[java-idp-plugin-vci] 01/08: Refactoring to get rid of temporary 'stolen' package
Codeberg
noreply at shibboleth.net
Fri Sep 4 08:37:30 UTC 2026
This is an automated email from the git hooks/post-receive script.
codeberg pushed a commit to branch dev/CHECKSTYLE
in repository java-idp-plugin-vci.
View the commit online:
https://codeberg.org/Shibboleth/java-idp-plugin-vci/commit/41699c52be371367b3076beaa820c2aee4f11a3d
commit 41699c52be371367b3076beaa820c2aee4f11a3d
Author: Janne Lauros <janne.lauros at csc.fi>
AuthorDate: Fri Sep 4 09:07:44 2026 +0300
Refactoring to get rid of temporary 'stolen' package
---
openid-vci-impl/pom.xml | 9 +
.../impl/AbstractOpenIDVCIConfiguration.java | 2 +-
...th2ClientAuthenticableProfileConfiguration.java | 800 ---------------------
...bstractOAuth2FlowAwareProfileConfiguration.java | 163 -----
.../impl/stolen/AbstractOIDCSSOConfiguration.java | 705 ------------------
.../AbstractOpenIDVCICredentialsRequestAction.java | 3 +-
.../impl/AbstractOpenIDVCITokenRequestAction.java | 3 +-
...ctInitializeOutboundResponseMessageContext.java | 26 +-
.../FormOutboundCredentialsResponseMessage.java | 2 +-
.../InitializeOutboundResponseMessageContext.java | 1 -
.../impl/{stolen => }/ParseAccessToken.java | 18 +-
.../openidvci/profile/impl/SignJWTCredential.java | 2 +-
.../impl/stolen/AbstractOIDCRequestAction.java | 82 ---
.../impl/stolen/AbstractOIDCResponseAction.java | 94 ---
.../openid/vci/credentials/credentials-beans.xml | 2 +-
pom.xml | 6 +
16 files changed, 51 insertions(+), 1867 deletions(-)
diff --git a/openid-vci-impl/pom.xml b/openid-vci-impl/pom.xml
index 1835c69..d51aca3 100644
--- a/openid-vci-impl/pom.xml
+++ b/openid-vci-impl/pom.xml
@@ -65,11 +65,20 @@
<groupId>net.shibboleth.idp.plugin.oidc</groupId>
<artifactId>idp-plugin-oidc-op-api</artifactId>
</dependency>
+ <dependency>
+ <groupId>net.shibboleth.idp.plugin.oidc</groupId>
+ <artifactId>idp-plugin-oidc-op-impl</artifactId>
+ </dependency>
<dependency>
<groupId>net.shibboleth.oidc</groupId>
<artifactId>oidc-common-profile-api</artifactId>
<scope>provided</scope>
</dependency>
+ <dependency>
+ <groupId>net.shibboleth.oidc</groupId>
+ <artifactId>oidc-common-profile-impl</artifactId>
+ <scope>provided</scope>
+ </dependency>
<dependency>
<groupId>net.shibboleth.oidc</groupId>
<artifactId>oidc-common-crypto-impl</artifactId>
diff --git a/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/config/impl/AbstractOpenIDVCIConfiguration.java b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/config/impl/AbstractOpenIDVCIConfiguration.java
index 85a0e4b..b5daee7 100644
--- a/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/config/impl/AbstractOpenIDVCIConfiguration.java
+++ b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/config/impl/AbstractOpenIDVCIConfiguration.java
@@ -23,10 +23,10 @@ import javax.annotation.Nonnull;
import javax.annotation.Nullable;
import org.geant.shibboleth.plugin.openidvci.config.OpenIDVCIConfiguration;
-import org.geant.shibboleth.plugin.openidvci.config.impl.stolen.AbstractOIDCSSOConfiguration;
import org.opensaml.profile.context.ProfileRequestContext;
import net.shibboleth.oidc.jwt.claims.ClaimsValidator;
+import net.shibboleth.oidc.profile.config.impl.AbstractOIDCSSOConfiguration;
import net.shibboleth.oidc.security.jose.SignatureSigningConfiguration;
import net.shibboleth.oidc.security.jose.SignatureValidationConfiguration;
import net.shibboleth.shared.annotation.constraint.NotEmpty;
diff --git a/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/config/impl/stolen/AbstractOAuth2ClientAuthenticableProfileConfiguration.java b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/config/impl/stolen/AbstractOAuth2ClientAuthenticableProfileConfiguration.java
deleted file mode 100644
index f5f884e..0000000
--- a/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/config/impl/stolen/AbstractOAuth2ClientAuthenticableProfileConfiguration.java
+++ /dev/null
@@ -1,800 +0,0 @@
-/*
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-// TODO: This abstract class is copied as is from shibboleth project. Refactoring needed.
-
-package org.geant.shibboleth.plugin.openidvci.config.impl.stolen;
-
-import java.security.Principal;
-import java.util.Collection;
-import java.util.List;
-import java.util.Map;
-import java.util.Set;
-import java.util.function.Function;
-import java.util.function.Predicate;
-
-import javax.annotation.Nonnull;
-import javax.annotation.Nullable;
-
-import org.opensaml.profile.context.ProfileRequestContext;
-
-import com.nimbusds.oauth2.sdk.auth.ClientAuthenticationMethod;
-
-import net.shibboleth.idp.profile.config.AbstractInterceptorAwareProfileConfiguration;
-import net.shibboleth.oidc.jwt.claims.ClaimsValidator;
-import net.shibboleth.oidc.metadata.policy.UnregisteredClientPolicy;
-import net.shibboleth.oidc.profile.oauth2.config.OAuth2ClientAuthenticableClientProfileConfiguration;
-import net.shibboleth.oidc.profile.oauth2.config.OAuth2ClientAuthenticableProfileConfiguration;
-import net.shibboleth.oidc.security.credential.ClientSecretCredential;
-import net.shibboleth.oidc.security.jose.SignatureValidationConfiguration;
-import net.shibboleth.shared.annotation.constraint.NonNegative;
-import net.shibboleth.shared.annotation.constraint.NonnullElements;
-import net.shibboleth.shared.annotation.constraint.NotEmpty;
-import net.shibboleth.shared.annotation.constraint.NotLive;
-import net.shibboleth.shared.annotation.constraint.Unmodifiable;
-import net.shibboleth.shared.collection.CollectionSupport;
-import net.shibboleth.shared.logic.Constraint;
-import net.shibboleth.shared.logic.FunctionSupport;
-import net.shibboleth.shared.logic.PredicateSupport;
-import net.shibboleth.shared.primitive.StringSupport;
-
-/**
- * Base class for OAuth profile configurations that support OAuth-defined client
- * authentication methods.
- */
-public abstract class AbstractOAuth2ClientAuthenticableProfileConfiguration
- extends AbstractInterceptorAwareProfileConfiguration
- implements OAuth2ClientAuthenticableProfileConfiguration, OAuth2ClientAuthenticableClientProfileConfiguration {
-
- /*** Enabled token endpoint authentication methods. */
- @Nonnull
- private Function<ProfileRequestContext, Set<String>> tokenEndpointAuthMethodsLookupStrategy;
-
- /**
- * The token endpoint authentication method to use with an upstream OpenID
- * Provider.
- */
- @Nonnull
- private Function<ProfileRequestContext, String> tokenEndpointAuthMethodLookupStrategy;
-
- /** Validation of JWT claims for subset of client auth methods. */
- @Nonnull
- private Function<ProfileRequestContext, ClaimsValidator> claimsValidatorLookupStrategy;
-
- /** Whether to mandate forced authentication for the request. */
- @Nonnull
- private Predicate<ProfileRequestContext> forceAuthnPredicate;
-
- /** Lookup function to supply proxyCount property. */
- @Nonnull
- private Function<ProfileRequestContext, Integer> proxyCountLookupStrategy;
-
- /** Lookup function to supply default authentication methods. */
- @Nonnull
- private Function<ProfileRequestContext, Collection<Principal>> defaultAuthenticationContextsLookupStrategy;
-
- /** Lookup function to supply authentication flows. */
- @Nonnull
- private Function<ProfileRequestContext, Set<String>> authenticationFlowsLookupStrategy;
-
- /** Lookup function to supply post authentication flows. */
- @Nonnull
- private Function<ProfileRequestContext, Collection<String>> postAuthenticationFlowsLookupStrategy;
-
- /**
- * Lookup function to retrieve a client credential from the given profile
- * request context.
- */
- @Nonnull
- private Function<ProfileRequestContext, ClientSecretCredential> clientCredentialLookupStrategy;
-
- /**
- * Lookup function to retrieve the client_id from the given profile request
- * context.
- */
- // TODO this is the same as the issuer in the proxy context?
- @Nonnull
- private Function<ProfileRequestContext, String> clientIdLookupStrategy;
-
- /**
- * Lookup function to retrieve the policy for validating claims of an
- * unregistered client.
- */
- @Nonnull
- private Function<ProfileRequestContext, Map<String, UnregisteredClientPolicy>> unregisteredClientPolicyLookupStrategy;
-
- /** Validation of JWT claims for DPoP proofs. */
- @Nonnull
- private Function<ProfileRequestContext, ClaimsValidator> dpopProofClaimsValidatorLookupStrategy;
-
- /** Validation of JWT signature of DPoP proofs. */
- @Nonnull
- private Function<ProfileRequestContext, SignatureValidationConfiguration> dpopSignatureValidationConfigurationLookupStrategy;
-
- /** Whether client is required to include DPoP Proof JWT in API request. */
- @Nonnull
- private Predicate<ProfileRequestContext> requireDpopProofPredicate;
-
- /** Lookup function to retrieve nonce generator for DPoP proofs. */
- @Nonnull
- private Function<ProfileRequestContext, Function<ProfileRequestContext, String>> dpopProofNonceGeneratorLookupStrategy;
-
- /**
- * Should the audience claim of a JWT be targeted to a specific endpoint on the
- * recipient? Defaults to true.
- */
- @Nonnull
- private Predicate<ProfileRequestContext> useTargetedEndpointAsJWTAudiencePredicate;
-
- /**
- * Lookup function to determine the 'typ' header parameter value for a client
- * authentication JWT.
- */
- @Nonnull
- private Function<ProfileRequestContext, String> clientAuthenticationJWTTypeLookupStrategy;
-
- /**
- * Whether single audience value is required in the JWT audience claim.
- */
- @Nonnull
- private Predicate<ProfileRequestContext> requireSingleJWTAudiencePredicate;
-
- /**
- * Constructor.
- *
- * @param profileId Unique profile identifier
- */
- protected AbstractOAuth2ClientAuthenticableProfileConfiguration(@Nonnull @NotEmpty final String profileId) {
- super(profileId);
-
- tokenEndpointAuthMethodsLookupStrategy = FunctionSupport
- .constant(CollectionSupport.setOf(ClientAuthenticationMethod.CLIENT_SECRET_BASIC.toString(),
- ClientAuthenticationMethod.CLIENT_SECRET_POST.toString(),
- ClientAuthenticationMethod.CLIENT_SECRET_JWT.toString(),
- ClientAuthenticationMethod.PRIVATE_KEY_JWT.toString()));
- tokenEndpointAuthMethodLookupStrategy = FunctionSupport
- .constant(ClientAuthenticationMethod.CLIENT_SECRET_BASIC.toString());
- claimsValidatorLookupStrategy = FunctionSupport.constant(null);
- forceAuthnPredicate = PredicateSupport.alwaysFalse();
- proxyCountLookupStrategy = FunctionSupport.constant(null);
- defaultAuthenticationContextsLookupStrategy = FunctionSupport.constant(null);
- authenticationFlowsLookupStrategy = FunctionSupport.constant(null);
- postAuthenticationFlowsLookupStrategy = FunctionSupport.constant(null);
- clientCredentialLookupStrategy = FunctionSupport.constant(null);
- clientIdLookupStrategy = FunctionSupport.constant(null);
- unregisteredClientPolicyLookupStrategy = FunctionSupport.constant(null);
- dpopProofClaimsValidatorLookupStrategy = FunctionSupport.constant(null);
- dpopSignatureValidationConfigurationLookupStrategy = FunctionSupport.constant(null);
- requireDpopProofPredicate = PredicateSupport.alwaysFalse();
- dpopProofNonceGeneratorLookupStrategy = FunctionSupport.constant(null);
- useTargetedEndpointAsJWTAudiencePredicate = PredicateSupport.alwaysTrue();
- clientAuthenticationJWTTypeLookupStrategy = FunctionSupport.constant(null);
- requireSingleJWTAudiencePredicate = PredicateSupport.alwaysFalse();
- }
-
- /** {@inheritDoc} */
- @Override
- @Nonnull
- @NonnullElements
- @NotLive
- @Unmodifiable
- public Set<String> getTokenEndpointAuthMethods(@Nullable final ProfileRequestContext profileRequestContext) {
-
- final Collection<String> methods = tokenEndpointAuthMethodsLookupStrategy.apply(profileRequestContext);
- if (methods != null) {
- return CollectionSupport.copyToSet(methods);
- }
- return CollectionSupport.emptySet();
- }
-
- /**
- * Set the enabled token endpoint authentication methods.
- *
- * @param methods What to set.
- */
- public void setTokenEndpointAuthMethods(@Nonnull @NonnullElements final Collection<String> methods) {
- Constraint.isNotNull(methods, "Collection of methods cannot be null");
-
- tokenEndpointAuthMethodsLookupStrategy = FunctionSupport
- .constant(Set.copyOf(StringSupport.normalizeStringCollection(methods)));
- }
-
- /**
- * Set a lookup strategy for the enabled token endpoint authentication methods.
- *
- * @param strategy lookup strategy
- */
- public void setTokenEndpointAuthMethodsLookupStrategy(
- @Nonnull final Function<ProfileRequestContext, Set<String>> strategy) {
- tokenEndpointAuthMethodsLookupStrategy = Constraint.isNotNull(strategy, "Lookup strategy cannot be null");
- }
-
- /** {@inheritDoc} */
- @Override
- @Nullable
- public String getTokenEndpointAuthMethod(@Nullable final ProfileRequestContext profileRequestContext) {
- return tokenEndpointAuthMethodLookupStrategy.apply(profileRequestContext);
- }
-
- /**
- * Set the enabled token endpoint authentication method to use with an upstream
- * OpenID Provider.
- *
- * @param method the token endpoint authentication method to set.
- *
- * @since 2.2.0
- */
- public void setTokenEndpointAuthMethod(@Nonnull @NonnullElements final String method) {
- tokenEndpointAuthMethodLookupStrategy = FunctionSupport
- .constant(Constraint.isNotNull(method, "Collection of methods cannot be null"));
- }
-
- /**
- * Set a lookup strategy to find the enabled token endpoint authentication
- * method to use with an upstream OpenID Provider.
- *
- * @param strategy lookup strategy
- *
- * @since 2.2.0
- */
- public void setTokenEndpointAuthMethodLookupStrategy(
- @Nonnull final Function<ProfileRequestContext, String> strategy) {
- tokenEndpointAuthMethodLookupStrategy = Constraint.isNotNull(strategy, "Lookup strategy cannot be null");
- }
-
- /**
- * Get the {@link ClaimsValidator} to apply to JWT-based client authentication.
- *
- * @param profileRequestContext current profile request context
- *
- * @return the validator to use
- *
- * @since 3.1.0
- */
- @Override
- @Nullable
- public ClaimsValidator getClaimsValidator(@Nullable final ProfileRequestContext profileRequestContext) {
- return claimsValidatorLookupStrategy.apply(profileRequestContext);
- }
-
- /**
- * Set the {@link ClaimsValidator} to apply to JWT-based client authentication.
- *
- * @param validator validator to use
- *
- * @since 3.1.0
- */
- public void setClaimsValidator(@Nullable final ClaimsValidator validator) {
- claimsValidatorLookupStrategy = FunctionSupport.constant(validator);
- }
-
- /**
- * Set a lookup strategy for the {@link ClaimsValidator} to apply to JWT-based
- * client authentication.
- *
- * @param strategy lookup strategy
- *
- * @since 3.1.0
- */
- public void setClaimsValidatorLookupStrategy(
- @Nonnull final Function<ProfileRequestContext, ClaimsValidator> strategy) {
- claimsValidatorLookupStrategy = Constraint.isNotNull(strategy, "Lookup strategy cannot be null");
- }
-
- /** {@inheritDoc} */
- @Override
- public boolean isForceAuthn(@Nullable final ProfileRequestContext profileRequestContext) {
- return forceAuthnPredicate.test(profileRequestContext);
- }
-
- /**
- * Set whether a fresh user presence proof should be required for this request.
- *
- * @param flag flag to set
- */
- public void setForceAuthn(final boolean flag) {
- forceAuthnPredicate = flag ? PredicateSupport.alwaysTrue() : PredicateSupport.alwaysFalse();
- }
-
- /**
- * Set a condition to determine whether a fresh user presence proof should be
- * required for this request.
- *
- * @param condition condition to set
- */
- public void setForceAuthnPredicate(@Nonnull final Predicate<ProfileRequestContext> condition) {
- forceAuthnPredicate = Constraint.isNotNull(condition, "Forced authentication predicate cannot be null");
- }
-
- /** {@inheritDoc} */
- @Override
- @Nullable
- public Integer getProxyCount(@Nullable final ProfileRequestContext profileRequestContext) {
- final Integer count = proxyCountLookupStrategy.apply(profileRequestContext);
- if (count != null) {
- Constraint.isGreaterThanOrEqual(0, count, "Proxy count must be greater than or equal to 0");
- }
- return count;
- }
-
- /**
- * Sets the maximum number of times an assertion may be proxied outbound and/or
- * the maximum number of hops between the relying party and a proxied
- * authentication authority inbound.
- *
- * @param count proxy count
- */
- public void setProxyCount(@Nullable @NonNegative final Integer count) {
- if (count != null) {
- Constraint.isGreaterThanOrEqual(0, count, "Proxy count must be greater than or equal to 0");
- }
- proxyCountLookupStrategy = FunctionSupport.constant(count);
- }
-
- /**
- * Set a lookup strategy for the maximum number of times an assertion may be
- * proxied outbound and/or the maximum number of hops between the relying party
- * and a proxied authentication authority inbound.
- *
- * @param strategy lookup strategy
- */
- public void setProxyCountLookupStrategy(@Nonnull final Function<ProfileRequestContext, Integer> strategy) {
- proxyCountLookupStrategy = Constraint.isNotNull(strategy, "Lookup strategy cannot be null");
- }
-
- /** {@inheritDoc} */
- @Override
- @Nonnull
- @NonnullElements
- @NotLive
- @Unmodifiable
- public Set<String> getAuthenticationFlows(@Nullable final ProfileRequestContext profileRequestContext) {
- final Set<String> flows = authenticationFlowsLookupStrategy.apply(profileRequestContext);
- if (flows != null) {
- return CollectionSupport.copyToSet(flows);
- }
- return CollectionSupport.emptySet();
- }
-
- /**
- * Set the authentication flows to use.
- *
- * @param flows flow identifiers to use
- */
- public void setAuthenticationFlows(@Nullable @NonnullElements final Collection<String> flows) {
- if (flows != null) {
- authenticationFlowsLookupStrategy = FunctionSupport
- .constant(Set.copyOf(StringSupport.normalizeStringCollection(flows)));
- } else {
- authenticationFlowsLookupStrategy = FunctionSupport.constant(null);
- }
- }
-
- /**
- * Set a lookup strategy for the authentication flows to use.
- *
- * @param strategy lookup strategy
- */
- public void setAuthenticationFlowsLookupStrategy(
- @Nonnull final Function<ProfileRequestContext, Set<String>> strategy) {
- authenticationFlowsLookupStrategy = Constraint.isNotNull(strategy, "Lookup strategy cannot be null");
- }
-
- /** {@inheritDoc} */
- @Override
- @Nonnull
- @NonnullElements
- @NotLive
- @Unmodifiable
- public List<String> getPostAuthenticationFlows(@Nullable final ProfileRequestContext profileRequestContext) {
- final Collection<String> flows = postAuthenticationFlowsLookupStrategy.apply(profileRequestContext);
- if (flows != null) {
- return CollectionSupport.copyToList(flows);
- }
- return CollectionSupport.emptyList();
- }
-
- /**
- * Set the ordered collection of post-authentication interceptor flows to
- * enable.
- *
- * @param flows flow identifiers to enable
- */
- public void setPostAuthenticationFlows(@Nullable @NonnullElements final Collection<String> flows) {
- if (flows != null) {
- postAuthenticationFlowsLookupStrategy = FunctionSupport
- .constant(List.copyOf(StringSupport.normalizeStringCollection(flows)));
- } else {
- postAuthenticationFlowsLookupStrategy = FunctionSupport.constant(null);
- }
- }
-
- /**
- * Set a lookup strategy for the post-authentication interceptor flows to
- * enable.
- *
- * @param strategy lookup strategy
- */
- public void setPostAuthenticationFlowsLookupStrategy(
- @Nonnull final Function<ProfileRequestContext, Collection<String>> strategy) {
- postAuthenticationFlowsLookupStrategy = Constraint.isNotNull(strategy, "Lookup strategy cannot be null");
- }
-
- /** {@inheritDoc} */
- @Override
- @Nonnull
- @NonnullElements
- @NotLive
- @Unmodifiable
- public List<Principal> getDefaultAuthenticationMethods(
- @Nullable final ProfileRequestContext profileRequestContext) {
- final Collection<Principal> methods = defaultAuthenticationContextsLookupStrategy.apply(profileRequestContext);
- if (methods != null) {
- return CollectionSupport.copyToList(methods);
- }
- return CollectionSupport.emptyList();
- }
-
- /**
- * Set the default authentication contexts to use, expressed as custom
- * principals.
- *
- * @param contexts default authentication contexts to use
- */
- public void setDefaultAuthenticationMethods(@Nullable @NonnullElements final Collection<Principal> contexts) {
- if (contexts != null) {
- defaultAuthenticationContextsLookupStrategy = FunctionSupport
- .constant(CollectionSupport.copyToList(contexts));
- } else {
- defaultAuthenticationContextsLookupStrategy = FunctionSupport.constant(null);
- }
- }
-
- /**
- * Set a lookup strategy for the authentication contexts to use, expressed as
- * custom principals.
- *
- * @param strategy lookup strategy
- */
- public void setDefaultAuthenticationMethodsLookupStrategy(
- @Nonnull final Function<ProfileRequestContext, Collection<Principal>> strategy) {
- defaultAuthenticationContextsLookupStrategy = Constraint.isNotNull(strategy, "Lookup strategy cannot be null");
- }
-
- /**
- * Set the client credential lookup strategy.
- *
- * @param strategy the strategy to use
- *
- * @since 2.2.0
- */
- public void setClientCredentialLookupStrategy(
- @Nonnull final Function<ProfileRequestContext, ClientSecretCredential> strategy) {
- clientCredentialLookupStrategy = Constraint.isNotNull(strategy,
- "Client credential lookup strategy can not be null");
- }
-
- /**
- * Set a fixed client credential to use no matter what the context/request.
- *
- * @param clientCredential the static client credential to use
- *
- * @since 2.2.0
- */
- public void setClientCredential(@Nullable final ClientSecretCredential clientCredential) {
- clientCredentialLookupStrategy = FunctionSupport.constant(clientCredential);
- }
-
- /** {@inheritDoc} */
- @Override
- public ClientSecretCredential getClientCredential(@Nullable final ProfileRequestContext profileRequestContext) {
- return clientCredentialLookupStrategy.apply(profileRequestContext);
- }
-
- /**
- * Set the strategy to locate a client_id.
- *
- * @param strategy the strategy to use
- *
- * @since 2.2.0
- */
- public void setClientIdLookupStrategy(@Nonnull final Function<ProfileRequestContext, String> strategy) {
- clientIdLookupStrategy = Constraint.isNotNull(strategy, "Client ID lookup strategy can not be null");
- }
-
- /**
- * Set a fixed client_id to use no matter what the context/request.
- *
- * @param clientId the static clientId to use
- *
- * @since 2.2.0
- */
- public void setClientId(@Nullable final String clientId) {
- clientIdLookupStrategy = FunctionSupport.constant(StringSupport.trimOrNull(clientId));
- }
-
- /** {@inheritDoc} */
- @Override
- @Nullable
- public String getClientId(@Nullable final ProfileRequestContext profileRequestContext) {
- return clientIdLookupStrategy.apply(profileRequestContext);
- }
-
- /** {@inheritDoc} */
- @Override
- @Nonnull
- @Unmodifiable
- public Map<String, UnregisteredClientPolicy> getUnregisteredClientPolicy(
- @Nullable final ProfileRequestContext profileRequestContext) {
- final Map<String, UnregisteredClientPolicy> result = unregisteredClientPolicyLookupStrategy
- .apply(profileRequestContext);
- if (result == null) {
- return CollectionSupport.emptyMap();
- }
- return CollectionSupport.copyToMap(result);
- }
-
- /**
- * Sets the policy for validating unregistered clients.
- *
- * @param policy policy to set
- *
- * @since 3.0.0
- */
- public void setUnregisteredClientPolicy(@Nullable final Map<String, UnregisteredClientPolicy> policy) {
- unregisteredClientPolicyLookupStrategy = FunctionSupport.constant(policy);
- }
-
- /**
- * Set a lookup strategy for the policy for validating unregistered clients.
- *
- * @param strategy lookup strategy
- *
- * @since 3.0.0
- */
- public void setUnregisteredClientPolicyLookupStrategy(
- @Nonnull final Function<ProfileRequestContext, Map<String, UnregisteredClientPolicy>> strategy) {
- unregisteredClientPolicyLookupStrategy = Constraint.isNotNull(strategy, "Lookup strategy cannot be null");
- }
-
- /** {@inheritDoc} */
- @Override
- @Nullable
- public ClaimsValidator getDpopProofClaimsValidator(@Nullable final ProfileRequestContext profileRequestContext) {
- return dpopProofClaimsValidatorLookupStrategy.apply(profileRequestContext);
- }
-
- /**
- * Set the {@link ClaimsValidator} to apply to DPoP Proof JWT.
- *
- * @param validator validator to use
- *
- * @since 3.2.0
- */
- public void setDpopProofClaimsValidator(@Nullable final ClaimsValidator validator) {
- dpopProofClaimsValidatorLookupStrategy = FunctionSupport.constant(validator);
- }
-
- /**
- * Set a lookup strategy for the {@link ClaimsValidator} to apply to DPoP Proof
- * JWT.
- *
- * @param strategy lookup strategy
- *
- * @since 3.2.0
- */
- public void setDpopProofClaimsValidatorLookupStrategy(
- @Nonnull final Function<ProfileRequestContext, ClaimsValidator> strategy) {
- dpopProofClaimsValidatorLookupStrategy = Constraint.isNotNull(strategy, "Lookup strategy cannot be null");
- }
-
- /** {@inheritDoc} */
- @Override
- @Nullable
- public SignatureValidationConfiguration getDpopProofSignatureValidationConfiguration(
- @Nullable final ProfileRequestContext profileRequestContext) {
- return dpopSignatureValidationConfigurationLookupStrategy.apply(profileRequestContext);
- }
-
- /**
- * Set the {@link SignatureValidationConfiguration} to validate the DPoP Proof
- * JWT signatures.
- *
- * @param configuration configuration to use
- *
- * @since 3.2.0
- */
- public void setDpopProofSignatureValidationConfiguration(
- @Nullable final SignatureValidationConfiguration configuration) {
- dpopSignatureValidationConfigurationLookupStrategy = FunctionSupport.constant(configuration);
- }
-
- /**
- * Set a lookup strategy for the {@link SignatureValidationConfiguration} to
- * validate the DPoP Proof JWT signatures.
- *
- * @param strategy lookup strategy
- *
- * @since 3.2.0
- */
- public void setDpopProofSignatureValidationConfigurationLookupStrategy(
- @Nonnull final Function<ProfileRequestContext, SignatureValidationConfiguration> strategy) {
- dpopSignatureValidationConfigurationLookupStrategy = Constraint.isNotNull(strategy,
- "Lookup strategy cannot be null");
- }
-
- /** {@inheritDoc} */
- @Override
- public boolean isRequireDpopProof(@Nullable final ProfileRequestContext profileRequestContext) {
- return requireDpopProofPredicate.test(profileRequestContext);
- }
-
- /**
- * Set whether client is required to include DPoP proof in request.
- *
- * @param flag flag to set
- *
- * @since 3.2.0
- */
- public void setRequireDpopProof(final boolean flag) {
- requireDpopProofPredicate = flag ? PredicateSupport.alwaysTrue() : PredicateSupport.alwaysFalse();
- }
-
- /**
- * Set condition for whether client is required to include DPoP proof in
- * request.
- *
- * @param condition condition to set
- *
- * @since 3.2.0
- */
- public void setRequireDpopProofPredicate(@Nonnull final Predicate<ProfileRequestContext> condition) {
- requireDpopProofPredicate = Constraint.isNotNull(condition, "Condition cannot be null");
- }
-
- /** {@inheritDoc} */
- @Override
- @Nullable
- public Function<ProfileRequestContext, String> getDpopProofNonceGenerator(
- @Nullable final ProfileRequestContext profileRequestContext) {
- return dpopProofNonceGeneratorLookupStrategy.apply(profileRequestContext);
- }
-
- /**
- * Set the {@link Function} to create nonces to be used with DPoP Proof JWTs.
- *
- * @param function generator function to use
- *
- * @since 3.2.0
- */
- public void setDpopProofNonceGenerator(@Nullable final Function<ProfileRequestContext, String> function) {
- dpopProofNonceGeneratorLookupStrategy = FunctionSupport.constant(function);
- }
-
- /**
- * Set a lookup strategy for the {@link Function} to create nonces to be used
- * with DPoP Proof JWTs.
- *
- * @param strategy lookup strategy
- *
- * @since 3.2.0
- */
- public void setDpopProofNonceGeneratorLookupStrategy(
- @Nonnull final Function<ProfileRequestContext, Function<ProfileRequestContext, String>> strategy) {
- dpopProofNonceGeneratorLookupStrategy = Constraint.isNotNull(strategy, "Lookup strategy cannot be null");
- }
-
- /** {@inheritDoc} */
- @Override
- public boolean isUseTargetedEndpointAsJWTAudience(@Nullable final ProfileRequestContext profileRequestContext) {
- return useTargetedEndpointAsJWTAudiencePredicate.test(profileRequestContext);
- }
-
- /**
- * Set a condition to determine if the audience claim of a JWT should be
- * targeted to a specific endpoint of the recipient? The endpoint value used
- * will differ depending on the context in which the predicate is used. If the
- * condition returns false, the audience value must be fixed to the issuer
- * identifier of the recipient.
- *
- * @param condition condition to set.
- *
- * @since 3.3.0
- */
- public void setUseTargetedEndpointAsJWTAudiencePredicate(
- @Nonnull final Predicate<ProfileRequestContext> condition) {
- useTargetedEndpointAsJWTAudiencePredicate = Constraint.isNotNull(condition,
- "UseTargetedEndpointAsJWTAudience Condition cannot be null");
- }
-
- /**
- * Set a flag to determine if the audience claim of a JWT should be targeted to
- * a specific endpoint of the recipient? The endpoint value used will differ
- * depending on the context in which the predicate is used. If the condition
- * returns false, the audience value must be fixed to the issuer identifier of
- * the recipient.
- *
- * @param flag the flag to set
- *
- * @since 3.3.0
- */
- public void setUseTargetedEndpointAsJWTAudience(final boolean flag) {
- useTargetedEndpointAsJWTAudiencePredicate = flag ? PredicateSupport.alwaysTrue()
- : PredicateSupport.alwaysFalse();
- }
-
- /** {@inheritDoc} */
- @Override
- @Nullable
- public String getClientAuthenticationJWTType(@Nullable final ProfileRequestContext profileRequestContext) {
- return clientAuthenticationJWTTypeLookupStrategy.apply(profileRequestContext);
- }
-
- /**
- * Set a lookup strategy to determine the 'typ' header parameter value for a
- * client authentication JWT.
- *
- * @param strategy lookup strategy
- *
- * @since 3.3.0
- */
- public void setClientAuthenticationJWTTypeLookupStrategy(
- @Nonnull final Function<ProfileRequestContext, String> strategy) {
- clientAuthenticationJWTTypeLookupStrategy = Constraint.isNotNull(strategy,
- "ClientAuthenticationJWTTypeLookupStrategy can not be null");
- }
-
- /**
- * Set the 'typ' header parameter value for a client authentication JWT.
- *
- * @param type the 'typ' header value to set
- *
- * @since 3.3.0
- */
- public void setClientAuthenticationJWTType(@Nullable final String type) {
- clientAuthenticationJWTTypeLookupStrategy = FunctionSupport.constant(type);
- }
-
- /** {@inheritDoc} */
- @Override
- public boolean isRequireSingleJWTAudience(@Nullable final ProfileRequestContext profileRequestContext) {
- return requireSingleJWTAudiencePredicate.test(profileRequestContext);
- }
-
- /**
- * Set a condition whether single audience value is required in the JWT audience
- * claim. Otherwise the claim can be a list of values.
- *
- * @param condition condition to set.
- *
- * @since 3.3.0
- */
- public void setRequireSingleJWTAudiencePredicate(@Nonnull final Predicate<ProfileRequestContext> condition) {
- requireSingleJWTAudiencePredicate = Constraint.isNotNull(condition,
- "RequireSingleJWTAudiencePredicate Condition cannot be null");
- }
-
- /**
- * Set a flag whether single audience value is required in the JWT audience
- * claim. Otherwise the claim can be a list of values.
- *
- * @param flag the flag to set
- *
- * @since 3.3.0
- */
- public void setRequireSingleJWTAudience(final boolean flag) {
- requireSingleJWTAudiencePredicate = flag ? PredicateSupport.alwaysTrue() : PredicateSupport.alwaysFalse();
- }
-
-}
\ No newline at end of file
diff --git a/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/config/impl/stolen/AbstractOAuth2FlowAwareProfileConfiguration.java b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/config/impl/stolen/AbstractOAuth2FlowAwareProfileConfiguration.java
deleted file mode 100644
index 3e31f1b..0000000
--- a/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/config/impl/stolen/AbstractOAuth2FlowAwareProfileConfiguration.java
+++ /dev/null
@@ -1,163 +0,0 @@
-/*
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.geant.shibboleth.plugin.openidvci.config.impl.stolen;
-
-import java.util.function.Predicate;
-
-import javax.annotation.Nonnull;
-import javax.annotation.Nullable;
-
-import org.opensaml.profile.context.ProfileRequestContext;
-
-import net.shibboleth.oidc.profile.config.OIDCFlowAwareProfileConfiguration;
-import net.shibboleth.oidc.profile.oauth2.config.OAuth2FlowAwareProfileConfiguration;
-import net.shibboleth.shared.annotation.constraint.NotEmpty;
-import net.shibboleth.shared.logic.Constraint;
-import net.shibboleth.shared.logic.PredicateSupport;
-
-/**
- * Base class for OIDC protocol configuration, containing configuration bits shared by all flow aware OIDC protocol
- * configurations.
- */
-public abstract class AbstractOAuth2FlowAwareProfileConfiguration
- extends AbstractOAuth2ClientAuthenticableProfileConfiguration implements OIDCFlowAwareProfileConfiguration,
- OAuth2FlowAwareProfileConfiguration {
-
- /** Predicate used to indicate whether authorization code flow is supported by this profile. Default true. */
- @Nonnull private Predicate<ProfileRequestContext> authorizationCodeFlowPredicate;
-
- /** Predicate used to indicate whether implicit flow is supported by this profile. Default true. */
- @Nonnull private Predicate<ProfileRequestContext> implicitFlowPredicate;
-
- /** Predicate used to indicate whether hybrid flow is supported by this profile. Default true. */
- @Nonnull private Predicate<ProfileRequestContext> hybridFlowPredicate;
-
- /** Predicate used to indicate whether refresh tokens are supported by this profile. Default true. */
- @Nonnull private Predicate<ProfileRequestContext> refreshTokensPredicate;
-
- /**
- * Constructor.
- *
- * @param profileId Unique profile identifier.
- */
- protected AbstractOAuth2FlowAwareProfileConfiguration(@Nonnull @NotEmpty final String profileId) {
- super(profileId);
- authorizationCodeFlowPredicate = PredicateSupport.alwaysTrue();
- implicitFlowPredicate = PredicateSupport.alwaysTrue();
- hybridFlowPredicate = PredicateSupport.alwaysTrue();
- refreshTokensPredicate = PredicateSupport.alwaysTrue();
- }
-
- /** {@inheritDoc} */
- @Override
- public boolean isAuthorizationCodeFlowEnabled(@Nullable final ProfileRequestContext profileRequestContext) {
- return authorizationCodeFlowPredicate.test(profileRequestContext);
- }
-
- /**
- * Set whether authorization code flow is supported by this profile.
- *
- * @param flag flag to set
- */
- public void setAuthorizationCodeFlowEnabled(final boolean flag) {
- authorizationCodeFlowPredicate = flag ? PredicateSupport.alwaysTrue() : PredicateSupport.alwaysFalse();
- }
-
- /**
- * Set condition used to indicate whether authorization code flow is supported by this profile.
- *
- * @param condition condition to set
- */
- public void setAuthorizationCodeFlowEnabledPredicate(@Nonnull final Predicate<ProfileRequestContext> condition) {
- authorizationCodeFlowPredicate = Constraint.isNotNull(condition,
- "Condition used to indicate whether authorization code flow is supported cannot be null");
- }
-
- /** {@inheritDoc} */
- @Override
- public boolean isHybridFlowEnabled(@Nullable final ProfileRequestContext profileRequestContext) {
- return hybridFlowPredicate.test(profileRequestContext);
- }
-
- /**
- * Set whether implicit flow is supported by this profile.
- *
- * @param flag flag to set
- */
- public void setHybridFlowEnabled(final boolean flag) {
- hybridFlowPredicate = flag ? PredicateSupport.alwaysTrue() : PredicateSupport.alwaysFalse();
- }
-
- /**
- * Set condition used to indicate whether implicit flow is supported by this profile.
- *
- * @param condition condition to set
- */
- public void setHybridFlowEnabledPredicate(@Nonnull final Predicate<ProfileRequestContext> condition) {
- hybridFlowPredicate = Constraint.isNotNull(condition,
- "Condition used to indicate whether implicit flow is supported cannot be null");
- }
-
- /** {@inheritDoc} */
- @Override
- public boolean isImplicitFlowEnabled(@Nullable final ProfileRequestContext profileRequestContext) {
- return implicitFlowPredicate.test(profileRequestContext);
- }
-
- /**
- * Set whether hybrid flow is supported by this profile.
- *
- * @param flag flag to set
- */
- public void setImplicitFlowEnabled(final boolean flag) {
- implicitFlowPredicate = flag ? PredicateSupport.alwaysTrue() : PredicateSupport.alwaysFalse();
- }
-
- /**
- * Set condition used to indicate whether hybrid flow is supported by this profile.
- *
- * @param condition condition to set.
- */
- public void setImplicitFlowEnabledPredicate(@Nonnull final Predicate<ProfileRequestContext> condition) {
- implicitFlowPredicate = Constraint.isNotNull(condition,
- "Condition used to indicate whether hybrid flow is supported cannot be null");
- }
-
- /** {@inheritDoc} */
- @Override
- public boolean isRefreshTokensEnabled(@Nullable final ProfileRequestContext profileRequestContext) {
- return refreshTokensPredicate.test(profileRequestContext);
- }
-
- /**
- * Set whether refresh tokens are supported by this profile.
- *
- * @param flag flag to set
- */
- public void setRefreshTokensEnabled(final boolean flag) {
- refreshTokensPredicate = flag ? PredicateSupport.alwaysTrue() : PredicateSupport.alwaysFalse();
- }
-
- /**
- * Set condition used to indicate whether refresh tokens are supported by this profile.
- *
- * @param condition condition to set
- */
- public void setRefreshTokensEnabledPredicate(@Nonnull final Predicate<ProfileRequestContext> condition) {
- refreshTokensPredicate = Constraint.isNotNull(condition,
- "Condition used to indicate whether refresh tokens are supported cannot be null");
- }
-
-}
\ No newline at end of file
diff --git a/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/config/impl/stolen/AbstractOIDCSSOConfiguration.java b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/config/impl/stolen/AbstractOIDCSSOConfiguration.java
deleted file mode 100644
index 05a54ac..0000000
--- a/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/config/impl/stolen/AbstractOIDCSSOConfiguration.java
+++ /dev/null
@@ -1,705 +0,0 @@
-/*
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.geant.shibboleth.plugin.openidvci.config.impl.stolen;
-
-import java.net.URI;
-import java.time.Duration;
-import java.util.Collection;
-import java.util.Map;
-import java.util.Set;
-import java.util.function.BiFunction;
-import java.util.function.BiPredicate;
-import java.util.function.Function;
-import java.util.function.Predicate;
-
-import javax.annotation.Nonnull;
-import javax.annotation.Nullable;
-
-import org.opensaml.profile.context.ProfileRequestContext;
-
-import net.shibboleth.oidc.profile.config.OIDCSSOProviderConfiguration;
-import net.shibboleth.oidc.profile.config.OIDCSSORelyingPartyConfiguration;
-import net.shibboleth.shared.annotation.constraint.NonnullElements;
-import net.shibboleth.shared.annotation.constraint.NotEmpty;
-import net.shibboleth.shared.annotation.constraint.NotLive;
-import net.shibboleth.shared.annotation.constraint.Positive;
-import net.shibboleth.shared.collection.CollectionSupport;
-import net.shibboleth.shared.logic.Constraint;
-import net.shibboleth.shared.logic.FunctionSupport;
-import net.shibboleth.shared.logic.PredicateSupport;
-import net.shibboleth.shared.primitive.StringSupport;
-
-/**
- * Base class for profiles that support OIDC's concept of SSO, which spans multiple endpoints.
- */
-public abstract class AbstractOIDCSSOConfiguration extends AbstractOAuth2FlowAwareProfileConfiguration
- implements OIDCSSORelyingPartyConfiguration, OIDCSSOProviderConfiguration {
-
- /** Lookup function to override issuer value. */
- @Nonnull private Function<ProfileRequestContext,String> issuerLookupStrategy;
-
- /** Whether attributes should be resolved in the course of the profile. */
- @Nonnull private Predicate<ProfileRequestContext> resolveAttributesPredicate;
-
- /** Whether encryption is optional in the face of no key, etc. */
- @Nonnull private Predicate<ProfileRequestContext> encryptionOptionalPredicate;
-
- /** Whether client is required to use PKCE. */
- @Nonnull private Predicate<ProfileRequestContext> forcePKCEPredicate;
-
- /** Whether client is allowed to use PKCE code challenge method plain. */
- @Nonnull private Predicate<ProfileRequestContext> allowPKCEPlainPredicate;
-
- /** Lookup function to supply ID token lifetime. */
- @Nonnull private Function<ProfileRequestContext,Duration> idTokenLifetimeLookupStrategy;
-
- /** Lookup function to supply access token type. */
- @Nonnull private Function<ProfileRequestContext,String> accessTokenTypeLookupStrategy;
-
- /** Lookup function to supply refresh token type. */
- @Nonnull private Function<ProfileRequestContext,String> refreshTokenTypeLookupStrategy;
-
- /** Lookup function to supply access token lifetime. */
- @Nonnull private Function<ProfileRequestContext,Duration> accessTokenLifetimeLookupStrategy;
-
- /** Lookup function to supply refresh token timeout. */
- @Nonnull private Function<ProfileRequestContext,Duration> refreshTokenTimeoutLookupStrategy;
-
- /** Lookup function to supply refresh token chain lifetime. */
- @Nonnull private Function<ProfileRequestContext,Duration> refreshTokenChainLifetimeLookupStrategy;
-
- /** Lookup function to supply additional audiences for ID token. */
- @Nonnull private Function<ProfileRequestContext,Set<String>> assertionAudiencesLookupStrategy;
-
- /** Lookup function to supply attribute IDs to include in ID token regardless of response_type. */
- @Nonnull private Function<ProfileRequestContext,Set<String>> alwaysIncludedAttributesLookupStrategy;
-
- /** Lookup function to supply strategy bi-function for manipulating id_token claims. */
- @Nonnull
- private Function<ProfileRequestContext,BiFunction<ProfileRequestContext,Map<String,Object>,Map<String,Object>>>
- idTokenManipulationStrategyLookupStrategy;
-
- /** Lookup function to supply strategy bi-function for manipulating access token claims set. */
- @Nonnull
- private Function<ProfileRequestContext,BiFunction<ProfileRequestContext,Map<String,Object>,Map<String,Object>>>
- accessTokenClaimsSetManipulationStrategyLookupStrategy;
-
- /** Lookup function to supply strategy bi-predicate for custom valdation of redirect URI in the request. */
- @Nonnull
- private Function<ProfileRequestContext,BiPredicate<URI,ProfileRequestContext>>
- customRedirectUriValidationStrategyLookupStrategy;
-
- /** Whether the access token to be issued is always a bearer access token. */
- @Nonnull private Predicate<ProfileRequestContext> alwaysIssueBearerAccessTokenPredicate;
-
- /** Whether scope validation is strict, i.e. request for unallowed scopes is an error. */
- @Nonnull private Predicate<ProfileRequestContext> strictScopeValidationPredicate;
-
- /**
- * Creates a new configuration instance.
- *
- * @param profileId Unique profile identifier.
- */
- public AbstractOIDCSSOConfiguration(@Nonnull @NotEmpty final String profileId) {
- super(profileId);
- issuerLookupStrategy = FunctionSupport.constant(null);
- resolveAttributesPredicate = PredicateSupport.alwaysTrue();
- encryptionOptionalPredicate = PredicateSupport.alwaysTrue();
-
- forcePKCEPredicate = PredicateSupport.alwaysFalse();
- allowPKCEPlainPredicate = PredicateSupport.alwaysFalse();
-
- idTokenLifetimeLookupStrategy = FunctionSupport.constant(Duration.ofHours(1));
- accessTokenTypeLookupStrategy = FunctionSupport.constant(null);
- accessTokenLifetimeLookupStrategy = FunctionSupport.constant(Duration.ofMinutes(10));
- refreshTokenTimeoutLookupStrategy = FunctionSupport.constant(Duration.ofHours(2));
- refreshTokenChainLifetimeLookupStrategy = FunctionSupport.constant(Duration.ofHours(2));
- refreshTokenTypeLookupStrategy = FunctionSupport.constant(null);
-
- assertionAudiencesLookupStrategy = FunctionSupport.constant(null);
- alwaysIncludedAttributesLookupStrategy = FunctionSupport.constant(null);
-
- idTokenManipulationStrategyLookupStrategy = FunctionSupport.constant(null);
- accessTokenClaimsSetManipulationStrategyLookupStrategy = FunctionSupport.constant(null);
-
- customRedirectUriValidationStrategyLookupStrategy = FunctionSupport.constant(null);
-
- alwaysIssueBearerAccessTokenPredicate = PredicateSupport.alwaysFalse();
- strictScopeValidationPredicate = PredicateSupport.alwaysFalse();
- }
-
- /** {@inheritDoc} */
- @Override
- @Nullable @NotEmpty public String getIssuer(@Nullable final ProfileRequestContext profileRequestContext) {
- return issuerLookupStrategy.apply(profileRequestContext);
- }
-
- /**
- * Set overridden issuer value.
- *
- * @param issuer issuer value
- */
- public void setIssuer(@Nullable @NotEmpty final String issuer) {
- issuerLookupStrategy = FunctionSupport.constant(issuer);
- }
-
- /**
- * Sets lookup strategy for overridden issuer value.
- *
- * @param strategy lookup strategy
- */
- public void setIssuerLookupStrategy(@Nonnull final Function<ProfileRequestContext,String> strategy) {
- issuerLookupStrategy = Constraint.isNotNull(strategy, "Issuer lookup strategy cannot be null");
- }
-
- /** {@inheritDoc} */
- @Override
- public boolean isResolveAttributes(@Nullable final ProfileRequestContext profileRequestContext) {
- return resolveAttributesPredicate.test(profileRequestContext);
- }
-
- /**
- * Set whether attributes should be resolved during the profile.
- *
- * @param flag flag to set
- */
- public void setResolveAttributes(final boolean flag) {
- resolveAttributesPredicate = flag ? PredicateSupport.alwaysTrue() : PredicateSupport.alwaysFalse();
- }
-
- /**
- * Set a condition to determine whether attributes should be resolved during the profile.
- *
- * @param condition condition to set
- */
- public void setResolveAttributesPredicate(@Nonnull final Predicate<ProfileRequestContext> condition) {
- resolveAttributesPredicate = Constraint.isNotNull(condition, "Resolve attributes predicate cannot be null");
- }
-
- /** {@inheritDoc} */
- @Override
- public boolean isEncryptionOptional(@Nullable final ProfileRequestContext profileRequestContext) {
- return encryptionOptionalPredicate.test(profileRequestContext);
- }
-
- /**
- * Set whether encryption is optional in the face of a missing key, etc.
- *
- * @param flag flag to set
- */
- public void setEncryptionOptional(final boolean flag) {
- encryptionOptionalPredicate = flag ? PredicateSupport.alwaysTrue() : PredicateSupport.alwaysFalse();
- }
-
- /**
- * Set a condition to determine whether encryption is optional in the face of a missing key, etc.
- *
- * @param condition condition to set
- */
- public void setEncryptionOptionalPredicate(@Nonnull final Predicate<ProfileRequestContext> condition) {
- encryptionOptionalPredicate = Constraint.isNotNull(condition, "Encryption optional predicate cannot be null");
- }
-
- /** {@inheritDoc} */
- @Override
- public boolean isForcePKCE(@Nullable final ProfileRequestContext profileRequestContext) {
- return forcePKCEPredicate.test(profileRequestContext);
- }
-
- /**
- * Set whether client is required to use PKCE.
- *
- * @param flag flag to set
- */
- public void setForcePKCE(final boolean flag) {
- forcePKCEPredicate = flag ? PredicateSupport.alwaysTrue() : PredicateSupport.alwaysFalse();
- }
-
- /**
- * Set condition for whether client is required to use PKCE.
- *
- * @param condition condition to set
- */
- public void setForcePKCEPredicate(@Nonnull final Predicate<ProfileRequestContext> condition) {
- forcePKCEPredicate = Constraint.isNotNull(condition, "Condition cannot be null");
- }
-
- /** {@inheritDoc} */
- @Override
- public boolean isAllowPKCEPlain(@Nullable final ProfileRequestContext profileRequestContext) {
- return allowPKCEPlainPredicate.test(profileRequestContext);
- }
-
- /**
- * Set whether client is allowed to use PKCE code challenge method plain.
- *
- * @param flag flag to set
- */
- public void setAllowPKCEPlain(final boolean flag) {
- allowPKCEPlainPredicate = flag ? PredicateSupport.alwaysTrue() : PredicateSupport.alwaysFalse();
- }
-
- /**
- * Set condition for whether client is allowed to use PKCE code challenge method plain.
- *
- * @param condition condition to set
- */
- public void setAllowPKCEPlainPredicate(@Nonnull final Predicate<ProfileRequestContext> condition) {
- allowPKCEPlainPredicate = Constraint.isNotNull(condition, "Condition cannot be null");
- }
-
- /** {@inheritDoc} */
- @Override
- @Positive @Nonnull public Duration getIDTokenLifetime(@Nullable final ProfileRequestContext profileRequestContext) {
-
- final Duration lifetime = idTokenLifetimeLookupStrategy.apply(profileRequestContext);
-
- Constraint.isTrue(lifetime != null && !lifetime.isZero() && !lifetime.isNegative(),
- "ID token lifetime must be greater than 0");
- assert lifetime != null;
- return lifetime;
- }
-
- /**
- * Set the lifetime of an id token.
- *
- * @param lifetime lifetime of an id token in milliseconds
- */
- public void setIDTokenLifetime(@Positive @Nonnull final Duration lifetime) {
- final Duration idTokenLifetime = Constraint.isNotNull(lifetime, "ID token lifetime cannot be null");
- Constraint.isTrue(!idTokenLifetime.isZero() && !idTokenLifetime.isNegative(),
- "ID token lifetime must be greater than 0");
-
- idTokenLifetimeLookupStrategy = FunctionSupport.constant(idTokenLifetime);
- }
-
- /**
- * Set a lookup strategy for the ID token lifetime.
- *
- * @param strategy lookup strategy
- */
- public void setIDTokenLifetimeLookupStrategy(@Nonnull final Function<ProfileRequestContext,Duration> strategy) {
- idTokenLifetimeLookupStrategy = Constraint.isNotNull(strategy, "Lookup strategy cannot be null");
- }
-
- /** {@inheritDoc} */
- @Override
- @Nullable @NotEmpty public String getAccessTokenType(@Nullable final ProfileRequestContext profileRequestContext) {
- return accessTokenTypeLookupStrategy.apply(profileRequestContext);
- }
-
- /**
- * Set access token type.
- *
- * @param type token type, or null for unspecified/opaque
- *
- * @since 2.1.0
- */
- public void setAccessTokenType(@Nullable @NotEmpty final String type) {
- accessTokenTypeLookupStrategy = FunctionSupport.constant(StringSupport.trimOrNull(type));
- }
-
- /**
- * Set lookup strategy for access token type.
- *
- * @param strategy lookup strategy
- *
- * @since 2.1.0
- */
- public void setAccessTokenTypeLookupStrategy(@Nonnull final Function<ProfileRequestContext,String> strategy) {
- accessTokenTypeLookupStrategy = Constraint.isNotNull(strategy, "Lookup strategy cannot be null");
- }
-
- /** {@inheritDoc} */
- @Override
- @Positive @Nonnull
- public Duration getAccessTokenLifetime(@Nullable final ProfileRequestContext profileRequestContext) {
- final Duration lifetime = accessTokenLifetimeLookupStrategy.apply(profileRequestContext);
-
- Constraint.isTrue(lifetime != null && !lifetime.isZero() && !lifetime.isNegative(),
- "Access token lifetime must be greater than 0");
- assert lifetime != null;
- return lifetime;
- }
-
- /**
- * Set the lifetime of an access token.
- *
- * @param lifetime lifetime of an access token in milliseconds
- */
- public void setAccessTokenLifetime(@Positive @Nonnull final Duration lifetime) {
- final Duration tokenLifetime = Constraint.isNotNull(lifetime, "Access token lifetime cannot be null");
- Constraint.isTrue(!tokenLifetime.isZero() && !tokenLifetime.isNegative(),
- "Access token lifetime must be greater than 0");
-
- accessTokenLifetimeLookupStrategy = FunctionSupport.constant(tokenLifetime);
- }
-
- /**
- * Set a lookup strategy for the access token lifetime.
- *
- * @param strategy lookup strategy
- */
- public void setAccessTokenLifetimeLookupStrategy(
- @Nullable final Function<ProfileRequestContext,Duration> strategy) {
- accessTokenLifetimeLookupStrategy = Constraint.isNotNull(strategy, "Lookup strategy cannot be null");
- }
-
- /** {@inheritDoc} */
- @Override
- @Nonnull @Positive
- public Duration getRefreshTokenTimeout(@Nullable final ProfileRequestContext profileRequestContext) {
- final Duration timeout = refreshTokenTimeoutLookupStrategy.apply(profileRequestContext);
-
- Constraint.isTrue(timeout != null && !timeout.isZero() && !timeout.isNegative(),
- "Refresh token timeout must be greater than 0");
- assert timeout != null;
- return timeout;
- }
-
- /**
- * Set the timeout of refresh token.
- *
- * @param timeout timeout of an refresh token
- *
- * @since 2.2.0
- */
- public void setRefreshTokenTimeout(@Nonnull @Positive final Duration timeout) {
- final Duration tokenTimeout = Constraint.isNotNull(timeout, "Refresh token timeout cannot be null");
- Constraint.isTrue(!tokenTimeout.isZero() && !timeout.isNegative(),
- "Refresh token timeout must be greater than 0");
-
- refreshTokenTimeoutLookupStrategy = FunctionSupport.constant(tokenTimeout);
- }
-
- /**
- * Set a lookup strategy for the refresh token timeout.
- *
- * @param strategy lookup strategy
- *
- * @since 2.2.0
- */
- public void setRefreshTokenTimeoutLookupStrategy(
- @Nullable final Function<ProfileRequestContext,Duration> strategy) {
- refreshTokenTimeoutLookupStrategy = Constraint.isNotNull(strategy, "Lookup strategy cannot be null");
- }
-
- /** {@inheritDoc} */
- @Override
- @Nonnull @Positive
- public Duration getRefreshTokenChainLifetime(@Nullable final ProfileRequestContext profileRequestContext) {
- final Duration lifetime = refreshTokenChainLifetimeLookupStrategy.apply(profileRequestContext);
-
- Constraint.isTrue(lifetime != null && !lifetime.isZero() && !lifetime.isNegative(),
- "Refresh token chain lifetime must be greater than 0");
- assert lifetime != null;
- return lifetime;
- }
-
- /**
- * Set the lifetime of refresh token chain.
- *
- * @param lifetime lifetime of a refresh token chain
- *
- * @since 2.2.0
- */
- public void setRefreshTokenChainLifetime(@Nonnull @Positive final Duration lifetime) {
- final Duration chainLifetime = Constraint.isNotNull(lifetime, "Refresh token chain lifetime cannot be null");
- Constraint.isTrue(!chainLifetime.isZero() && !chainLifetime.isNegative(),
- "Refresh token chain lifetime must be greater than 0");
-
- refreshTokenChainLifetimeLookupStrategy = FunctionSupport.constant(chainLifetime);
- }
-
- /**
- * Set a lookup strategy for the refresh token chain lifetime.
- *
- * @param strategy lookup strategy
- *
- * @since 2.2.0
- */
- public void setRefreshTokenChainLifetimeLookupStrategy(
- @Nullable final Function<ProfileRequestContext,Duration> strategy) {
- refreshTokenChainLifetimeLookupStrategy = Constraint.isNotNull(strategy, "Lookup strategy cannot be null");
- }
-
- /** {@inheritDoc} */
- @Override
- @Nullable @NotEmpty public String getRefreshTokenType(@Nullable final ProfileRequestContext profileRequestContext) {
- return refreshTokenTypeLookupStrategy.apply(profileRequestContext);
- }
-
- /**
- * Set refresh token type.
- *
- * @param type token type, or null for unspecified/opaque
- *
- * @since 3.1.0
- */
- public void setRefreshTokenType(@Nullable @NotEmpty final String type) {
- refreshTokenTypeLookupStrategy = FunctionSupport.constant(StringSupport.trimOrNull(type));
- }
-
- /**
- * Set lookup strategy for token token type.
- *
- * @param strategy lookup strategy
- *
- * @since 3.1.0
- */
- public void setRefreshTokenTypeLookupStrategy(@Nonnull final Function<ProfileRequestContext,String> strategy) {
- refreshTokenTypeLookupStrategy = Constraint.isNotNull(strategy, "Lookup strategy cannot be null");
- }
-
- /** {@inheritDoc} */
- @Override
- @Nonnull @NonnullElements @NotLive public Set<String> getAdditionalAudiencesForIdToken(
- @Nullable final ProfileRequestContext profileRequestContext) {
-
- final Set<String> audiences = assertionAudiencesLookupStrategy.apply(profileRequestContext);
- if (audiences != null) {
- return CollectionSupport.copyToSet(audiences);
- }
- return CollectionSupport.emptySet();
- }
-
- /**
- * Set the set of audiences, in addition to the relying party(ies) to which the IdP is issuing the ID Token, with
- * which the token may be shared.
- *
- * @param audiences the additional audiences
- */
- public void setAdditionalAudiencesForIdToken(@Nullable @NonnullElements final Collection<String> audiences) {
-
- if (audiences == null || audiences.isEmpty()) {
- assertionAudiencesLookupStrategy = FunctionSupport.constant(null);
- } else {
- assertionAudiencesLookupStrategy = FunctionSupport.constant(
- Set.copyOf(StringSupport.normalizeStringCollection(audiences)));
- }
- }
-
- /**
- * Set a lookup strategy for the set of audiences, in addition to the relying party(ies) to which the IdP
- * is issuing the ID Token, with which the token may be shared.
- *
- * @param strategy lookup strategy
- */
- public void setAdditionalAudiencesForIdTokenLookupStrategy(
- @Nonnull final Function<ProfileRequestContext,Set<String>> strategy) {
- assertionAudiencesLookupStrategy = Constraint.isNotNull(strategy, "Lookup strategy cannot be null");
- }
-
- /** {@inheritDoc} */
- @Override
- @Nonnull @NonnullElements @NotLive public Set<String> getAlwaysIncludedAttributes(
- @Nullable final ProfileRequestContext profileRequestContext) {
-
- final Set<String> attributes = alwaysIncludedAttributesLookupStrategy.apply(profileRequestContext);
- if (attributes != null) {
- return CollectionSupport.copyToSet(attributes);
- }
- return CollectionSupport.emptySet();
- }
-
- /**
- * Set the set of attribute IDs which should be included in the ID token regardless of response_type.
- *
- * <p>Default behavior is to include claims only with the implicit id_token type only, while any use
- * of a back-channel relies on the user_info endpoint to get the claims. This setting forces certain
- * attributes to be added to the ID token regardless of flow.</p>
- *
- * @param attributes the attribute IDs to include in all cases
- */
- public void setAlwaysIncludedAttributes(@Nullable @NonnullElements final Collection<String> attributes) {
-
- if (attributes == null || attributes.isEmpty()) {
- alwaysIncludedAttributesLookupStrategy = FunctionSupport.constant(null);
- } else {
- alwaysIncludedAttributesLookupStrategy = FunctionSupport.constant(
- Set.copyOf(StringSupport.normalizeStringCollection(attributes)));
- }
- }
-
- /**
- * Set a lookup strategy for the attribute IDs which should be included in the ID token regardless of
- * response_type.
- *
- * @param strategy lookup strategy
- */
- public void setAlwaysIncludedAttributesLookupStrategy(
- @Nonnull final Function<ProfileRequestContext,Set<String>> strategy) {
- alwaysIncludedAttributesLookupStrategy = Constraint.isNotNull(strategy, "Lookup strategy cannot be null");
- }
-
- /** {@inheritDoc} */
- @Override
- @Nullable
- public BiFunction<ProfileRequestContext,Map<String,Object>,Map<String,Object>> getIDTokenManipulationStrategy(
- @Nullable final ProfileRequestContext profileRequestContext) {
- return idTokenManipulationStrategyLookupStrategy.apply(profileRequestContext);
- }
-
- /**
- * Set the bi-function for manipulating id_token claims.
- *
- * @param strategy bi-function for manipulating id_token claims
- *
- * @since 2.1.0
- */
- public void setIDTokenManipulationStrategy(
- @Nullable final BiFunction<ProfileRequestContext,Map<String,Object>,Map<String,Object>> strategy) {
- idTokenManipulationStrategyLookupStrategy = FunctionSupport.constant(strategy);
- }
-
- /**
- * Set a lookup strategy for the bi-function for manipulating id_token claims.
- *
- * @param strategy lookup strategy
- *
- * @since 2.1.0
- */
- public void setIDTokenManipulationStrategyLookupStrategy(@Nonnull final
- Function<ProfileRequestContext,BiFunction<ProfileRequestContext,Map<String,Object>,Map<String,Object>>>
- strategy) {
- idTokenManipulationStrategyLookupStrategy = Constraint.isNotNull(strategy, "Lookup strategy cannot be null");
- }
-
- /** {@inheritDoc} */
- @Override
- @Nullable
- public BiFunction<ProfileRequestContext,Map<String,Object>,Map<String,Object>>
- getAccessTokenClaimsSetManipulationStrategy(
- @Nullable final ProfileRequestContext profileRequestContext) {
- return accessTokenClaimsSetManipulationStrategyLookupStrategy.apply(profileRequestContext);
- }
-
- /**
- * Set the bi-function for manipulating access token claims set.
- *
- * @param strategy bi-function for manipulating access token claims set
- *
- * @since 2.1.0
- */
- public void setAccessTokenClaimsSetManipulationStrategy(
- @Nullable final BiFunction<ProfileRequestContext,Map<String,Object>,Map<String,Object>> strategy) {
- accessTokenClaimsSetManipulationStrategyLookupStrategy = FunctionSupport.constant(strategy);
- }
-
- /**
- * Set a lookup strategy for the bi-function for manipulating access token claims set.
- *
- * @param strategy lookup strategy
- *
- * @since 2.1.0
- */
- public void setAccessTokenClaimsSetManipulationStrategyLookupStrategy(@Nonnull final
- Function<ProfileRequestContext,BiFunction<ProfileRequestContext,Map<String,Object>,Map<String,Object>>>
- strategy) {
- accessTokenClaimsSetManipulationStrategyLookupStrategy = Constraint.isNotNull(strategy,
- "Lookup strategy cannot be null");
- }
-
- /** {@inheritDoc} */
- @Override
- @Nullable public BiPredicate<URI,ProfileRequestContext> getCustomRedirectUriValidationStrategy(
- @Nullable final ProfileRequestContext profileRequestContext) {
- return customRedirectUriValidationStrategyLookupStrategy.apply(profileRequestContext);
- }
-
- /**
- * Set the bi-predicate for custom validation of redirect URI in the request.
- * .
- * @param strategy bi-predicate for custom validation of redirect URI in the request
- *
- * @since 3.2.0
- */
- public void setCustomRedirectUriValidationStrategy(
- @Nullable final BiPredicate<URI,ProfileRequestContext> strategy) {
- customRedirectUriValidationStrategyLookupStrategy = FunctionSupport.constant(strategy);
- }
-
- /**
- * Set a lookup strategy for the bi-predicate for custom validation of redirect URI in the request.
- *
- * @param strategy lookup strategy
- *
- * @since 3.2.0
- */
- public void setCustomRedirectUriValidationStrategyLookupStrategy(@Nonnull final
- Function<ProfileRequestContext,BiPredicate<URI,ProfileRequestContext>> strategy) {
- customRedirectUriValidationStrategyLookupStrategy = Constraint.isNotNull(strategy,
- "Lookup strategy cannot be null");
- }
-
- /** {@inheritDoc} */
- @Override
- public boolean isAlwaysIssueBearerAccessToken(@Nullable final ProfileRequestContext profileRequestContext) {
- return alwaysIssueBearerAccessTokenPredicate.test(profileRequestContext);
- }
-
- /**
- * Set whether the access token to be issued is always a bearer access token.
- *
- * @param flag flag to set
- *
- * @since 3.2.0
- */
- public void setAlwaysIssueBearerAccessToken(final boolean flag) {
- alwaysIssueBearerAccessTokenPredicate = flag ? PredicateSupport.alwaysTrue() : PredicateSupport.alwaysFalse();
- }
-
- /**
- * Set a condition to determine whether the access token to be issued is always a bearer access token.
- *
- * @param condition condition to set
- *
- * @since 3.2.0
- */
- public void setAlwaysIssueBearerAccessTokenPredicate(@Nonnull final Predicate<ProfileRequestContext> condition) {
- alwaysIssueBearerAccessTokenPredicate = Constraint.isNotNull(condition,
- "Always issue bearer access token predicate cannot be null");
- }
-
- /** {@inheritDoc} */
- @Override
- public boolean isStrictScopeValidation(@Nullable final ProfileRequestContext profileRequestContext) {
- return strictScopeValidationPredicate.test(profileRequestContext);
- }
-
- /**
- * Set whether scope validation is strict, i.e. request for unallowed scopes is an error.
- *
- * @param flag flag to set
- *
- * @since 3.2.0
- */
- public void setStrictScopeValidation(final boolean flag) {
- strictScopeValidationPredicate = flag ? PredicateSupport.alwaysTrue() : PredicateSupport.alwaysFalse();
- }
-
- /**
- * Set a condition to determine whether scope validation is strict, i.e. request for unallowed scopes is an error.
- *
- * @param condition condition to set
- *
- * @since 3.2.0
- */
- public void setStrictScopeValidationPredicate(@Nonnull final Predicate<ProfileRequestContext> condition) {
- strictScopeValidationPredicate = Constraint.isNotNull(condition,
- "Strict scope validation predicate cannot be null");
- }
-
-}
diff --git a/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/messaging/impl/AbstractOpenIDVCICredentialsRequestAction.java b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/messaging/impl/AbstractOpenIDVCICredentialsRequestAction.java
index 20006cc..17be38f 100644
--- a/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/messaging/impl/AbstractOpenIDVCICredentialsRequestAction.java
+++ b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/messaging/impl/AbstractOpenIDVCICredentialsRequestAction.java
@@ -14,10 +14,11 @@
package org.geant.shibboleth.plugin.openidvci.messaging.impl;
-import org.geant.shibboleth.plugin.openidvci.profile.impl.stolen.AbstractOIDCRequestAction;
import org.opensaml.messaging.context.MessageContext;
import org.opensaml.profile.context.ProfileRequestContext;
+import net.shibboleth.idp.plugin.oidc.op.profile.impl.AbstractOIDCRequestAction;
+
import com.nimbusds.openid.connect.sdk.UserInfoRequest;
/**
diff --git a/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/messaging/impl/AbstractOpenIDVCITokenRequestAction.java b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/messaging/impl/AbstractOpenIDVCITokenRequestAction.java
index c45b84d..806d7d6 100644
--- a/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/messaging/impl/AbstractOpenIDVCITokenRequestAction.java
+++ b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/messaging/impl/AbstractOpenIDVCITokenRequestAction.java
@@ -16,10 +16,11 @@ package org.geant.shibboleth.plugin.openidvci.messaging.impl;
import javax.annotation.Nullable;
-import org.geant.shibboleth.plugin.openidvci.profile.impl.stolen.AbstractOIDCRequestAction;
import org.opensaml.messaging.context.MessageContext;
import org.opensaml.profile.context.ProfileRequestContext;
+import net.shibboleth.idp.plugin.oidc.op.profile.impl.AbstractOIDCRequestAction;
+
import com.nimbusds.oauth2.sdk.TokenRequest;
/**
diff --git a/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/profile/impl/stolen/AbstractInitializeOutboundResponseMessageContext.java b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/profile/impl/AbstractInitializeOutboundResponseMessageContext.java
similarity index 74%
rename from openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/profile/impl/stolen/AbstractInitializeOutboundResponseMessageContext.java
rename to openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/profile/impl/AbstractInitializeOutboundResponseMessageContext.java
index 44862c5..d2eda93 100644
--- a/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/profile/impl/stolen/AbstractInitializeOutboundResponseMessageContext.java
+++ b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/profile/impl/AbstractInitializeOutboundResponseMessageContext.java
@@ -1,22 +1,25 @@
/*
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
+ * Copyright (c) 2025, GÉANT
+ *
+ * Derived from
+ * net.shibboleth.idp.plugin.oidc.op.profile.impl.AbstractInitializeOutboundResponseMessageContext
+ * of the Shibboleth OpenID Connect Provider plugin, licensed under the Apache
+ * License, Version 2.0. Modified by GÉANT.
+ *
+ * Licensed under the Apache License, Version 2.0 (the “License”); you may not
+ * use this file except in compliance with the License. You may obtain a copy
+ * of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
+ * distributed under the License is distributed on an “AS IS” BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
-
-// TODO: This abstract class is copied as is from shibboleth project. Refactoring needed.
-
-
-package org.geant.shibboleth.plugin.openidvci.profile.impl.stolen;
+package org.geant.shibboleth.plugin.openidvci.profile.impl;
import javax.annotation.Nonnull;
@@ -32,7 +35,10 @@ import org.slf4j.LoggerFactory;
/**
* Action that adds an outbound {@link MessageContext} and related OIDC contexts to the {@link ProfileRequestContext}.
- *
+ *
+ * <p>The equivalent class of the OpenID Connect Provider plugin is marked for removal, so this plugin carries its
+ * own rather than extending one that is going away.</p>
+ *
* @event {@link org.opensaml.profile.action.EventIds#PROCEED_EVENT_ID}
*/
public abstract class AbstractInitializeOutboundResponseMessageContext extends AbstractProfileAction {
diff --git a/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/profile/impl/FormOutboundCredentialsResponseMessage.java b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/profile/impl/FormOutboundCredentialsResponseMessage.java
index fdbc175..a34a6b9 100644
--- a/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/profile/impl/FormOutboundCredentialsResponseMessage.java
+++ b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/profile/impl/FormOutboundCredentialsResponseMessage.java
@@ -24,13 +24,13 @@ import javax.annotation.Nonnull;
import org.geant.shibboleth.plugin.openidvci.messaging.context.CredentialsContext;
import org.geant.shibboleth.plugin.openidvci.messaging.impl.CredentialSuccessResponse;
import org.geant.shibboleth.plugin.openidvci.messaging.impl.OpenIDVCICredentialsRequest;
-import org.geant.shibboleth.plugin.openidvci.profile.impl.stolen.AbstractOIDCResponseAction;
import org.opensaml.profile.action.ActionSupport;
import org.opensaml.profile.action.EventIds;
import org.opensaml.profile.context.ProfileRequestContext;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
+import net.shibboleth.idp.plugin.oidc.op.profile.impl.AbstractOIDCResponseAction;
import net.shibboleth.shared.annotation.constraint.NonnullBeforeExec;
import com.fasterxml.jackson.core.JsonProcessingException;
diff --git a/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/profile/impl/InitializeOutboundResponseMessageContext.java b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/profile/impl/InitializeOutboundResponseMessageContext.java
index 9f72d40..ac304d8 100644
--- a/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/profile/impl/InitializeOutboundResponseMessageContext.java
+++ b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/profile/impl/InitializeOutboundResponseMessageContext.java
@@ -16,7 +16,6 @@
package org.geant.shibboleth.plugin.openidvci.profile.impl;
-import org.geant.shibboleth.plugin.openidvci.profile.impl.stolen.AbstractInitializeOutboundResponseMessageContext;
import org.opensaml.messaging.context.MessageContext;
import org.opensaml.profile.context.ProfileRequestContext;
diff --git a/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/profile/impl/stolen/ParseAccessToken.java b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/profile/impl/ParseAccessToken.java
similarity index 93%
rename from openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/profile/impl/stolen/ParseAccessToken.java
rename to openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/profile/impl/ParseAccessToken.java
index 5ddc2f4..04cf571 100644
--- a/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/profile/impl/stolen/ParseAccessToken.java
+++ b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/profile/impl/ParseAccessToken.java
@@ -1,18 +1,24 @@
/*
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
+ * Copyright (c) 2025, GÉANT
+ *
+ * Derived from net.shibboleth.idp.plugin.oidc.op.userinfo.profile.impl.ParseAccessToken
+ * of the Shibboleth OpenID Connect Provider plugin, licensed under the Apache
+ * License, Version 2.0. Modified by GÉANT.
+ *
+ * Licensed under the Apache License, Version 2.0 (the “License”); you may not
+ * use this file except in compliance with the License. You may obtain a copy
+ * of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
+ * distributed under the License is distributed on an “AS IS” BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
-package org.geant.shibboleth.plugin.openidvci.profile.impl.stolen;
+package org.geant.shibboleth.plugin.openidvci.profile.impl;
import java.text.ParseException;
import java.util.ArrayList;
@@ -136,7 +142,7 @@ public class ParseAccessToken extends AbstractOpenIDVCICredentialsValidationResp
protected void doExecute(@Nonnull final ProfileRequestContext profileRequestContext) {
final String invalidTokenId = dpopAccessTokenCondition.test(profileRequestContext) ?
- OidcEventIds.INVALID_ACCESS_TOKEN : OidcEventIds.INVALID_ACCESS_TOKEN;
+ OidcEventIds.INVALID_DPOP_ACCESS_TOKEN : OidcEventIds.INVALID_ACCESS_TOKEN;
final AccessToken token = getCredentialsRequest().getAccessToken();
if (token == null) {
diff --git a/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/profile/impl/SignJWTCredential.java b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/profile/impl/SignJWTCredential.java
index 76107a6..8b0bbb8 100644
--- a/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/profile/impl/SignJWTCredential.java
+++ b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/profile/impl/SignJWTCredential.java
@@ -27,7 +27,6 @@ import org.geant.shibboleth.plugin.oauth.security.DidJwkSupport;
import org.geant.shibboleth.plugin.openidvci.messaging.context.CredentialsContext;
import org.geant.shibboleth.plugin.openidvci.messaging.impl.OpenIDVCICredentialsRequest;
import org.geant.shibboleth.plugin.openidvci.profile.OpenIDVCIEventIds;
-import org.geant.shibboleth.plugin.openidvci.profile.impl.stolen.AbstractOIDCResponseAction;
import org.opensaml.messaging.context.navigate.ChildContextLookup;
import org.opensaml.profile.action.ActionSupport;
import org.opensaml.profile.action.EventIds;
@@ -36,6 +35,7 @@ import org.opensaml.profile.context.navigate.OutboundMessageContextLookup;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
+import net.shibboleth.idp.plugin.oidc.op.profile.impl.AbstractOIDCResponseAction;
import net.shibboleth.oidc.security.impl.JWSTokenSigner;
import net.shibboleth.oidc.security.jose.SignatureException;
import net.shibboleth.oidc.security.jose.SignatureSigningParameters;
diff --git a/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/profile/impl/stolen/AbstractOIDCRequestAction.java b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/profile/impl/stolen/AbstractOIDCRequestAction.java
deleted file mode 100644
index 5ebaae3..0000000
--- a/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/profile/impl/stolen/AbstractOIDCRequestAction.java
+++ /dev/null
@@ -1,82 +0,0 @@
-/*
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-
-// TODO: This abstract class is copied as is from shibboleth project. Refactoring needed.
-
-package org.geant.shibboleth.plugin.openidvci.profile.impl.stolen;
-
-import javax.annotation.Nonnull;
-
-import net.shibboleth.idp.profile.AbstractProfileAction;
-import net.shibboleth.shared.primitive.LoggerFactory;
-
-import org.opensaml.messaging.context.MessageContext;
-import org.opensaml.profile.action.ActionSupport;
-import org.opensaml.profile.action.EventIds;
-import org.opensaml.profile.context.ProfileRequestContext;
-import org.slf4j.Logger;
-
-/**
- *
- * Abstract class for actions performing actions on a oidc request found via
- * {@link ProfileRequestContext#getInboundMessageContext()} and {@link MessageContext#getMessage()}.
- *
- * @param <T> request message implementation class.
- *
- * TODO: Add explicit class parameter to test message type and cast with controlled calls.
- */
-
-public abstract class AbstractOIDCRequestAction<T> extends AbstractProfileAction {
-
- /** Class logger. */
- @Nonnull
- private Logger log = LoggerFactory.getLogger(AbstractOIDCRequestAction.class);
-
- /** OIDC request. */
- private T request;
-
- /**
- * Returns request.
- *
- * @return request
- */
- public T getRequest() {
- return request;
- }
-
- /** {@inheritDoc} */
- @SuppressWarnings("unchecked")
- @Override
- protected boolean doPreExecute(@Nonnull final ProfileRequestContext profileRequestContext) {
-
- if (!super.doPreExecute(profileRequestContext)) {
- return false;
- }
- if (profileRequestContext.getInboundMessageContext() == null) {
- log.error("{} Unable to locate inbound message context", getLogPrefix());
- ActionSupport.buildEvent(profileRequestContext, EventIds.INVALID_MSG_CTX);
- return false;
- }
- final Object message = profileRequestContext.ensureInboundMessageContext().getMessage();
- if (message == null) {
- log.error("{} Unable to locate inbound message", getLogPrefix());
- ActionSupport.buildEvent(profileRequestContext, EventIds.INVALID_MSG_CTX);
- return false;
- }
- request = (T) message;
- return true;
- }
-
-}
\ No newline at end of file
diff --git a/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/profile/impl/stolen/AbstractOIDCResponseAction.java b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/profile/impl/stolen/AbstractOIDCResponseAction.java
deleted file mode 100644
index 80450b1..0000000
--- a/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/profile/impl/stolen/AbstractOIDCResponseAction.java
+++ /dev/null
@@ -1,94 +0,0 @@
-/*
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-
-// TODO: This abstract class is copied as is from shibboleth project. Refactoring needed.
-
-package org.geant.shibboleth.plugin.openidvci.profile.impl.stolen;
-
-import javax.annotation.Nonnull;
-
-import org.opensaml.messaging.context.MessageContext;
-import org.opensaml.profile.action.ActionSupport;
-import org.opensaml.profile.action.EventIds;
-import org.opensaml.profile.context.ProfileRequestContext;
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
-
-import net.shibboleth.idp.plugin.oidc.op.messaging.context.OIDCAuthenticationResponseContext;
-import net.shibboleth.idp.profile.AbstractProfileAction;
-import net.shibboleth.oidc.metadata.context.OIDCMetadataContext;
-
-/**
- * Abstract class for actions performing actions on {@link OIDCAuthenticationResponseContext} located under
- * {@link ProfileRequestContext#getOutboundMessageContext()}.
- */
-public abstract class AbstractOIDCResponseAction extends AbstractProfileAction {
-
- /** Class logger. */
- @Nonnull
- private Logger log = LoggerFactory.getLogger(AbstractOIDCResponseAction.class);
-
- /** oidc response context. */
- @Nonnull
- private OIDCAuthenticationResponseContext oidcResponseContext;
-
- /** OIDC Metadata context. */
- @Nonnull
- private OIDCMetadataContext oidcMetadataContext;
-
- /**
- * Returns oidc response context.
- *
- * @return ctx.
- */
- @Nonnull
- public OIDCAuthenticationResponseContext getOidcResponseContext() {
- return oidcResponseContext;
- }
-
- /**
- * Returns the OIDC Metadata context.
- *
- * @return The OIDC Metadata context.
- */
- public OIDCMetadataContext getMetadataContext() {
- return oidcMetadataContext;
- }
-
- /** {@inheritDoc} */
- @Override
- protected boolean doPreExecute(@Nonnull final ProfileRequestContext profileRequestContext) {
-
- if (!super.doPreExecute(profileRequestContext)) {
- return false;
- }
- final MessageContext outboundMessageCtx = profileRequestContext.getOutboundMessageContext();
- if (outboundMessageCtx == null) {
- log.error("{} No outbound message context", getLogPrefix());
- ActionSupport.buildEvent(profileRequestContext, EventIds.INVALID_MSG_CTX);
- return false;
- }
- oidcResponseContext = outboundMessageCtx.getSubcontext(OIDCAuthenticationResponseContext.class);
- if (oidcResponseContext == null) {
- log.error("{} No oidc response context", getLogPrefix());
- ActionSupport.buildEvent(profileRequestContext, EventIds.INVALID_MSG_CTX);
- return false;
- }
- oidcMetadataContext = profileRequestContext.getInboundMessageContext().getSubcontext(OIDCMetadataContext.class);
-
- return true;
- }
-
-}
\ No newline at end of file
diff --git a/openid-vci-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/openid/vci/credentials/credentials-beans.xml b/openid-vci-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/openid/vci/credentials/credentials-beans.xml
index d4cb317..26fe0be 100644
--- a/openid-vci-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/openid/vci/credentials/credentials-beans.xml
+++ b/openid-vci-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/openid/vci/credentials/credentials-beans.xml
@@ -21,7 +21,7 @@
</bean>
<bean id="ParseAccessToken"
- class="org.geant.shibboleth.plugin.openidvci.profile.impl.stolen.ParseAccessToken" scope="prototype"
+ class="org.geant.shibboleth.plugin.openidvci.profile.impl.ParseAccessToken" scope="prototype"
p:dataSealer-ref="#{'%{idp.oidc.tokenSealer:shibboleth.oidc.TokenSealer}'.trim()}"
p:credentialResolver-ref="RelyingPartyCredentialResolver">
<property name="dpopAccessTokenCondition">
diff --git a/pom.xml b/pom.xml
index 7a42b0d..f5b8dae 100644
--- a/pom.xml
+++ b/pom.xml
@@ -105,6 +105,12 @@
<version>${oidc.op.version}</version>
<scope>provided</scope>
</dependency>
+ <dependency>
+ <groupId>net.shibboleth.idp.plugin.oidc</groupId>
+ <artifactId>idp-plugin-oidc-op-impl</artifactId>
+ <version>${oidc.op.version}</version>
+ <scope>provided</scope>
+ </dependency>
<!-- IdP BOM when importing IdP dependencies -->
<dependency>
<groupId>${idp.groupId}</groupId>
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list