[java-idp-plugin-vci] branch main updated: Refactoring packages, applying checkstyle
Codeberg
noreply at shibboleth.net
Fri Sep 4 08:39:23 UTC 2026
This is an automated email from the git hooks/post-receive script.
codeberg pushed a commit to branch main
in repository java-idp-plugin-vci.
View the commit online:
https://codeberg.org/Shibboleth/java-idp-plugin-vci/commit/d2299cbe96c39c0db8da174f379394ac5592bc91
The following commit(s) were added to refs/heads/main by this push:
new d2299cb Refactoring packages, applying checkstyle
d2299cb is described below
commit d2299cbe96c39c0db8da174f379394ac5592bc91
Author: Janne Lauros <janne.lauros at csc.fi>
AuthorDate: Fri Sep 4 11:39:13 2026 +0300
Refactoring packages, applying checkstyle
---
openid-vci-api/pom.xml | 22 +-
.../openidvci/credential/ClaimDescription.java | 8 +-
.../plugin/openidvci/credential/ClaimDisplay.java | 6 +-
.../credential/CredentialConfiguration.java | 36 +-
.../credential/CredentialConfigurations.java | 20 +-
.../openidvci/credential/CredentialDefinition.java | 24 +-
.../openidvci/credential/CredentialDisplay.java | 16 +-
.../openidvci/credential/CredentialMetadata.java | 6 +-
.../plugin/openidvci/credential/Image.java | 5 +-
.../credential/KeyAttestationsRequired.java | 6 +-
.../openidvci/credential/ProofTypeSupported.java | 8 +-
.../credential/package-info.java} | 18 +-
.../credential/resolver/package-info.java} | 18 +-
.../openidvci/messaging/error/OpenIDVCIError.java | 4 +
.../messaging/error/package-info.java} | 18 +-
.../metadata/CredentialIssuerMetadata.java | 2 +-
.../metadata/package-info.java} | 18 +-
.../openidvci/metadata/resolver/package-info.java | 15 +-
.../profile}/config/OpenIDVCIConfiguration.java | 5 +-
.../profile/config/package-info.java} | 18 +-
.../profile/package-info.java} | 18 +-
.../statuslist/MonthlyBucketStrategy.java | 2 +-
.../statuslist/StatusListBucket.java | 2 +-
.../statuslist/StatusListCodec.java | 2 +-
.../statuslist/StatusListParameters.java | 42 +-
.../statuslist/context/StatusListContext.java | 4 +-
.../statuslist/context/StatusListTokenContext.java | 2 +-
.../statuslist/context/package-info.java} | 18 +-
.../messaging/error/StatusListError.java | 2 +-
.../statuslist/messaging/error/package-info.java} | 18 +-
.../statuslist/package-info.java} | 18 +-
.../statuslist/profile/StatusListEventIds.java | 2 +-
.../statuslist/profile/package-info.java} | 18 +-
.../token/support/CredentialOfferClaimsSet.java | 13 +-
.../token/support/package-info.java} | 18 +-
openid-vci-dist/pom.xml | 2 +-
openid-vci-impl/pom.xml | 11 +-
.../authn/impl/WalletCredentialValidator.java | 19 +-
.../plugin/openidvci/authn/impl/package-info.java | 18 +-
...faultOpenIDVCICredentialOfferConfiguration.java | 11 -
.../DefaultOpenIDVCICredentialsConfiguration.java | 11 -
.../impl/DefaultOpenIDVCINonceConfiguration.java | 11 -
.../impl/DefaultOpenIDVCITokenConfiguration.java | 11 -
...th2ClientAuthenticableProfileConfiguration.java | 800 ---------------------
...bstractOAuth2FlowAwareProfileConfiguration.java | 163 -----
.../impl/stolen/AbstractOIDCSSOConfiguration.java | 705 ------------------
.../impl}/SelectiveDisclosureClaimSetUtil.java | 6 +-
.../impl}/SelectiveDisclosureClaimTree.java | 4 +-
.../openidvci/credential/impl/package-info.java | 18 +-
.../decoding/impl/BaseOpenIDVCIRequestDecoder.java | 2 +-
.../impl/CredentialOfferRequestDecoder.java | 9 +-
.../impl/OpenIDVCICredentialsRequestDecoder.java | 5 +-
.../impl/OpenIDVCITokenRequestDecoder.java | 7 +-
.../openidvci/decoding/impl/RequestUtil.java | 151 ----
.../openidvci/decoding/impl/package-info.java | 18 +-
.../messaging/context/CredentialOfferContext.java | 22 +-
.../messaging/context/CredentialsContext.java | 28 +-
.../openidvci/messaging/context/TokenContext.java | 39 +-
.../AuthorizationDetailsLookupFunction.java | 21 +-
.../RequestCodeVerifierLookupFunction.java | 3 +-
...estCredentialConfigurationIdLookupFunction.java | 3 +-
.../RequestCredentialIdentifierLookupFunction.java | 3 +-
.../messaging/context/navigate/package-info.java | 18 +-
.../openidvci/messaging/context/package-info.java | 18 +-
.../AbstractOpenIDVCICredentialsRequestAction.java | 13 +-
...AbstractOpenIDVCICredentialsResponseAction.java | 12 +-
...enIDVCICredentialsValidationResponseAction.java | 12 +-
.../impl/AbstractOpenIDVCITokenRequestAction.java | 13 +-
.../impl/AbstractOpenIDVCITokenResponseAction.java | 10 +-
.../messaging/impl/CredentialOfferRequest.java | 44 +-
.../impl/CredentialOfferRequestedClaim.java | 13 +-
.../impl/CredentialOfferRequestedCredential.java | 22 +-
.../impl/CredentialOfferSuccessResponse.java | 45 +-
.../messaging/impl/CredentialOfferTxCode.java | 29 +-
.../messaging/impl/CredentialSuccessResponse.java | 41 +-
.../messaging/impl/NonceSuccessResponse.java | 11 +-
.../impl/OpenIDVCIAuthorizationDetail.java | 26 +-
.../impl/OpenIDVCIAuthorizationDetailClaim.java | 11 +-
.../impl/OpenIDVCICredentialsRequest.java | 39 +-
.../messaging/impl/OpenIDVCITokenRequest.java | 69 +-
.../openidvci/messaging/impl/package-info.java | 18 +-
...FilesystemCredentialIssuerMetadataResolver.java | 8 +-
.../openidvci/metadata/impl/package-info.java | 18 +-
.../plugin/openidvci/oidfed/impl/package-info.java | 18 +-
.../shibboleth/plugin/openidvci/package-info.java | 18 +-
.../impl/AbstractOpenIDVCIConfiguration.java | 15 +-
...faultOpenIDVCICredentialOfferConfiguration.java | 23 +-
.../DefaultOpenIDVCICredentialsConfiguration.java | 23 +-
...efaultOpenIDVCIIssuerMetadataConfiguration.java | 2 +-
.../impl/DefaultOpenIDVCINonceConfiguration.java | 23 +-
.../impl/DefaultOpenIDVCITokenConfiguration.java | 23 +-
.../profile/config/impl/package-info.java | 18 +-
...ignatureSigningConfigurationLookupFunction.java | 6 +-
...ignatureSigningConfigurationLookupFunction.java | 4 +-
.../ProofNonceGeneratorLookupFunction.java | 4 +-
...atureValidationConfigurationLookupFunction.java | 4 +-
.../profile/config/navigate/package-info.java | 18 +-
.../navigate/APIRequestClientIDLookupFunction.java | 10 +-
.../profile/context/navigate/package-info.java | 18 +-
...ctInitializeOutboundResponseMessageContext.java | 22 +-
.../openidvci/profile/impl/AddCredentialShell.java | 18 +-
.../profile/impl/BuildCredentialOfferToken.java | 28 +-
...FormJsonLdSelectiveDisclosureJWTCredential.java | 9 +-
...FormOutboundCredentialOfferResponseMessage.java | 5 +-
.../FormOutboundCredentialsResponseMessage.java | 11 +-
.../impl/FormOutboundNonceResponseMessage.java | 6 +-
.../impl/FormOutboundTokenResponseMessage.java | 2 +
.../impl/FormSelectiveDisclosureJWTCredential.java | 6 +-
.../InitializeOutboundResponseMessageContext.java | 1 -
.../impl/{stolen => }/ParseAccessToken.java | 23 +-
.../plugin/openidvci/profile/impl/ParseProof.java | 43 +-
.../profile/impl/ResolveCredentialLifetime.java | 2 +-
.../SetAuthorizationDetailsToResponseContext.java | 40 +-
.../openidvci/profile/impl/SignJWTCredential.java | 8 +-
.../plugin/openidvci/profile/impl/UnwrapGrant.java | 49 +-
.../profile/impl/ValidateCredentialOffering.java | 12 +-
.../profile/impl/ValidateExpectedGrantType.java | 7 +-
.../openidvci/profile/impl/ValidateGrant.java | 16 +-
.../profile/impl/ValidateRequestedCredential.java | 32 +-
.../openidvci/profile/impl/ValidateTxCode.java | 5 +
...sponseMessageContext.java => package-info.java} | 15 +-
.../impl/stolen/AbstractOIDCRequestAction.java | 82 ---
.../impl/stolen/AbstractOIDCResponseAction.java | 94 ---
.../logic/CredentialIssuerLookupFunction.java | 2 +-
...faultChainRevocationLifetimeLookupStrategy.java | 75 --
.../logic/OpenIDVCITokenManipulationStrategy.java | 43 +-
.../openidvci/profile/logic/package-info.java | 18 +-
.../impl/ExtendedJOSEObjectCredentialResolver.java | 13 +-
.../security/credential/impl/package-info.java | 18 +-
.../security/impl}/DidJwkSupport.java | 2 +-
.../JWTMessageSignaturesSecurityHandler.java | 6 +-
.../security/{ => impl}/TokenKeyTrustEngine.java | 9 +-
.../openidvci/security/impl/package-info.java | 18 +-
...thmRestrictedSignatureSigningConfiguration.java | 2 +-
.../openidvci/security/jose/impl/package-info.java | 18 +-
.../impl/StatusListAssignmentsRequestDecoder.java | 6 +-
.../impl/StatusListRevokeRequestDecoder.java | 8 +-
.../statuslist/decoding/impl/package-info.java | 18 +-
.../impl/StatusListAssignmentsRequest.java | 4 +-
.../impl/StatusListAssignmentsSuccessResponse.java | 4 +-
.../messaging/impl/StatusListRevokeRequest.java | 6 +-
.../impl/StatusListRevokeSuccessResponse.java | 2 +-
.../messaging/impl/StatusListSuccessResponse.java | 2 +-
.../statuslist/messaging/impl/package-info.java | 18 +-
.../DefaultStatusListAssignmentsConfiguration.java | 4 +-
.../impl}/DefaultStatusListConfiguration.java | 5 +-
.../DefaultStatusListRevokeConfiguration.java | 4 +-
.../profile/config/impl/package-info.java | 18 +-
...ignatureSigningConfigurationLookupFunction.java | 4 +-
.../profile/config/navigate/package-info.java | 18 +-
.../statuslist/profile/impl/AllocateIndex.java | 24 +-
.../statuslist/profile/impl/AssignIndex.java | 10 +-
...tboundStatusListAssignmentsResponseMessage.java | 10 +-
.../FormOutboundStatusListResponseMessage.java | 6 +-
...ormOutboundStatusListRevokeResponseMessage.java | 4 +-
.../profile/impl/FormStatusListToken.java | 18 +-
.../profile/impl/RevokeStatusListIndex.java | 12 +-
.../profile/impl/SignStatusListToken.java | 6 +-
.../statuslist/profile/impl/package-info.java | 18 +-
.../storage/FeistelIndexPermutation.java | 2 +-
.../statuslist/storage/StatusListAssignment.java | 2 +-
.../storage/StatusListAssignmentStore.java | 10 +-
.../statuslist/storage/StatusListAssignments.java | 2 +-
.../storage/StatusListIndexAllocator.java | 14 +-
.../statuslist/storage/StatusListStore.java | 18 +-
.../openidvci/statuslist/storage/package-info.java | 18 +-
.../openidvci/storage/CredentialOfferCache.java | 36 +-
.../openidvci/storage/CredentialOfferObject.java | 24 +-
.../plugin/openidvci/storage/package-info.java | 18 +-
.../oauth/status-list/assign/assign-beans.xml | 8 +-
.../status-list/assignments/assignments-beans.xml | 6 +-
.../flows/oauth/status-list/list/list-beans.xml | 20 +-
.../oauth/status-list/revoke/revoke-beans.xml | 8 +-
.../openid/vci/credentials/credentials-beans.xml | 10 +-
.../vci/issuer-metadata/issuer-metadata-beans.xml | 2 +-
.../idp/service/relying-party/postconfig.xml | 20 +-
.../impl}/SelectiveDisclosureClaimSetUtilTest.java | 20 +-
.../impl}/SelectiveDisclosureClaimTreeTest.java | 2 +-
.../messaging/impl/OpenIDVCITokenRequestTest.java | 8 +-
.../impl/ValidateExpectedGrantTypeTest.java | 2 +-
.../logic/CredentialIssuerLookupFunctionTest.java | 2 +-
.../security/impl}/DidJwkSupportTest.java | 2 +-
.../statuslist/StatusListCodecTest.java | 2 +-
.../statuslist/profile/impl/AllocateIndexTest.java | 8 +-
.../storage/FeistelIndexPermutationTest.java | 4 +-
.../storage/StatusListAssignmentStoreTest.java | 2 +-
.../storage/StatusListIndexAllocatorTest.java | 4 +-
.../statuslist/storage/StatusListStoreTest.java | 8 +-
pom.xml | 33 +-
.../checkstyle/checkstyle.xml | 7 +-
190 files changed, 1124 insertions(+), 3457 deletions(-)
diff --git a/openid-vci-api/pom.xml b/openid-vci-api/pom.xml
index bb26ddc..fa8ea60 100644
--- a/openid-vci-api/pom.xml
+++ b/openid-vci-api/pom.xml
@@ -14,7 +14,7 @@
<artifactId>openid-vci-api</artifactId>
<packaging>jar</packaging>
<properties>
- <checkstyle.configLocation>${project.basedir}/../checkstyle.xml</checkstyle.configLocation>
+ <checkstyle.configLocation>${project.basedir}/../resources/checkstyle/checkstyle.xml</checkstyle.configLocation>
<automatic.module.name>org.geant.shibboleth.plugin.openidvci.api</automatic.module.name>
</properties>
<description>OpenID for Verifiable Credential Issuance plugin API.</description>
@@ -50,6 +50,26 @@
<artifactId>opensaml-profile-api</artifactId>
<scope>provided</scope>
</dependency>
+ <dependency>
+ <groupId>${opensaml.groupId}</groupId>
+ <artifactId>opensaml-messaging-api</artifactId>
+ <scope>provided</scope>
+ </dependency>
+ <dependency>
+ <groupId>${shib-profile.groupId}</groupId>
+ <artifactId>shib-profile-api</artifactId>
+ <scope>provided</scope>
+ </dependency>
+ <dependency>
+ <groupId>${shib-shared.groupId}</groupId>
+ <artifactId>shib-support</artifactId>
+ <scope>provided</scope>
+ </dependency>
+ <dependency>
+ <groupId>${oidc-common.groupId}</groupId>
+ <artifactId>oidc-common-crypto-api</artifactId>
+ <scope>provided</scope>
+ </dependency>
<!-- test dependencies -->
<dependency>
<groupId>org.testng</groupId>
diff --git a/openid-vci-api/src/main/java/org/geant/shibboleth/plugin/openidvci/credential/ClaimDescription.java b/openid-vci-api/src/main/java/org/geant/shibboleth/plugin/openidvci/credential/ClaimDescription.java
index fc0642d..403475b 100644
--- a/openid-vci-api/src/main/java/org/geant/shibboleth/plugin/openidvci/credential/ClaimDescription.java
+++ b/openid-vci-api/src/main/java/org/geant/shibboleth/plugin/openidvci/credential/ClaimDescription.java
@@ -33,7 +33,7 @@ import com.fasterxml.jackson.annotation.JsonProperty;
* {@link https://openid.net/specs/openid-4-verifiable-credential-issuance-1_0.html#claims-description-issuer-metadata}.
*/
@JsonIgnoreProperties(ignoreUnknown = true)
-public class ClaimDescription {
+public final class ClaimDescription {
/**
* JSON path locating the claim within the issued Credential. Each element is
@@ -65,9 +65,9 @@ public class ClaimDescription {
* the issued Credential
*/
@JsonCreator
- private ClaimDescription(@JsonProperty("path") @Nonnull List<Object> path,
- @JsonProperty("display") @Nullable List<ClaimDisplay> display,
- @JsonProperty("mandatory") @Nullable Boolean mandatory) {
+ private ClaimDescription(@JsonProperty("path") @Nonnull final List<Object> path,
+ @JsonProperty("display") @Nullable final List<ClaimDisplay> display,
+ @JsonProperty("mandatory") @Nullable final Boolean mandatory) {
assert path != null;
this.path = path;
this.display = display;
diff --git a/openid-vci-api/src/main/java/org/geant/shibboleth/plugin/openidvci/credential/ClaimDisplay.java b/openid-vci-api/src/main/java/org/geant/shibboleth/plugin/openidvci/credential/ClaimDisplay.java
index edf5459..cda218a 100644
--- a/openid-vci-api/src/main/java/org/geant/shibboleth/plugin/openidvci/credential/ClaimDisplay.java
+++ b/openid-vci-api/src/main/java/org/geant/shibboleth/plugin/openidvci/credential/ClaimDisplay.java
@@ -30,7 +30,7 @@ import com.fasterxml.jackson.annotation.JsonProperty;
* {@link https://openid.net/specs/openid-4-verifiable-credential-issuance-1_0.html#claims-description-issuer-metadata}.
*/
@JsonIgnoreProperties(ignoreUnknown = true)
-public class ClaimDisplay {
+public final class ClaimDisplay {
/** Display name of the claim. */
@Nullable
@@ -51,8 +51,8 @@ public class ClaimDisplay {
* @param locale Language tag identifying the language of this object
*/
@JsonCreator
- private ClaimDisplay(@JsonProperty("name") @Nullable String name,
- @JsonProperty("locale") @Nullable String locale) {
+ private ClaimDisplay(@JsonProperty("name") @Nullable final String name,
+ @JsonProperty("locale") @Nullable final String locale) {
this.name = name;
this.locale = locale;
}
diff --git a/openid-vci-api/src/main/java/org/geant/shibboleth/plugin/openidvci/credential/CredentialConfiguration.java b/openid-vci-api/src/main/java/org/geant/shibboleth/plugin/openidvci/credential/CredentialConfiguration.java
index 467f5db..cf2ba3e 100644
--- a/openid-vci-api/src/main/java/org/geant/shibboleth/plugin/openidvci/credential/CredentialConfiguration.java
+++ b/openid-vci-api/src/main/java/org/geant/shibboleth/plugin/openidvci/credential/CredentialConfiguration.java
@@ -38,7 +38,7 @@ import com.fasterxml.jackson.databind.ObjectMapper;
* as parameter credential_configurations_supported.
*/
@JsonIgnoreProperties(ignoreUnknown = true)
-public class CredentialConfiguration {
+public final class CredentialConfiguration {
/** Identifies the format of this Credential. */
@Nonnull
@@ -80,7 +80,7 @@ public class CredentialConfiguration {
private final CredentialDefinition credentialDefinition;
/**
- * Specifics of the key proof(s) that the Credential Issuer supports
+ * Specifics of the key proof(s) that the Credential Issuer supports.
*/
@Nullable
@JsonProperty("proof_types_supported")
@@ -102,6 +102,7 @@ public class CredentialConfiguration {
@JsonInclude(Include.NON_NULL)
private final String vct;
+// Checkstyle: ParameterNumber OFF
/**
* Constructor.
*
@@ -132,14 +133,16 @@ public class CredentialConfiguration {
* identifier (SD-JWT VC formats)
*/
@JsonCreator
- private CredentialConfiguration(@JsonProperty("format") @Nonnull String format,
- @JsonProperty("scope") @Nullable String scope,
- @JsonProperty("credential_signing_alg_values_supported") @Nullable List<String> credentialSigningAlgValuesSupported,
- @JsonProperty("cryptographic_binding_methods_supported") @Nullable List<String> cryptographicBindingMethodsSupported,
- @JsonProperty("credential_definition") @Nullable CredentialDefinition credentialDefinition,
- @JsonProperty("proof_types_supported") @Nullable Map<String, ProofTypeSupported> proofTypesSupported,
- @JsonProperty("credential_metadata") @Nullable CredentialMetadata credentialMetadata,
- @JsonProperty("vct") @Nullable String vct) {
+ private CredentialConfiguration(@JsonProperty("format") @Nonnull final String format,
+ @JsonProperty("scope") @Nullable final String scope,
+ @JsonProperty("credential_signing_alg_values_supported") @Nullable
+ final List<String> credentialSigningAlgValuesSupported,
+ @JsonProperty("cryptographic_binding_methods_supported") @Nullable
+ final List<String> cryptographicBindingMethodsSupported,
+ @JsonProperty("credential_definition") @Nullable final CredentialDefinition credentialDefinition,
+ @JsonProperty("proof_types_supported") @Nullable final Map<String, ProofTypeSupported> proofTypesSupported,
+ @JsonProperty("credential_metadata") @Nullable final CredentialMetadata credentialMetadata,
+ @JsonProperty("vct") @Nullable final String vct) {
assert format != null;
this.format = format;
this.scope = scope;
@@ -159,6 +162,7 @@ public class CredentialConfiguration {
throw new IllegalArgumentException("vct is missing");
}
}
+// Checkstyle: ParameterNumber ON
/**
* Get format of this Credential.
@@ -172,7 +176,7 @@ public class CredentialConfiguration {
/**
* Get scope value that this Credential Issuer supports for this particular
- * Credential
+ * Credential.
*
* @return Scope value that this Credential Issuer supports for this particular
* Credential
@@ -250,8 +254,8 @@ public class CredentialConfiguration {
/**
* Serialize object to json.
*
- * @return
- * @throws JsonProcessingException
+ * @return this Credential Configuration as a json string
+ * @throws JsonProcessingException if serialization fails
*/
public String serialize() throws JsonProcessingException {
return new ObjectMapper().writeValueAsString(this);
@@ -260,11 +264,11 @@ public class CredentialConfiguration {
/**
* Parse {@link CredentialConfiguration} from json string.
*
- * @param definition {@link CredentialConfiguration} as json string.
- * @return {@link CredentialDefinition}
+ * @param configuration {@link CredentialConfiguration} as json string.
+ * @return parsed {@link CredentialConfiguration}
* @throws JsonProcessingException if parsing fails.
*/
- public static CredentialConfiguration parse(@Nonnull String configuration) throws JsonProcessingException {
+ public static CredentialConfiguration parse(@Nonnull final String configuration) throws JsonProcessingException {
return new ObjectMapper().readValue(configuration, CredentialConfiguration.class);
}
diff --git a/openid-vci-api/src/main/java/org/geant/shibboleth/plugin/openidvci/credential/CredentialConfigurations.java b/openid-vci-api/src/main/java/org/geant/shibboleth/plugin/openidvci/credential/CredentialConfigurations.java
index bfc2316..e2ab738 100644
--- a/openid-vci-api/src/main/java/org/geant/shibboleth/plugin/openidvci/credential/CredentialConfigurations.java
+++ b/openid-vci-api/src/main/java/org/geant/shibboleth/plugin/openidvci/credential/CredentialConfigurations.java
@@ -44,7 +44,7 @@ import com.fasterxml.jackson.databind.ObjectMapper;
* how a credential is formed, the source one is what gets published, so that a
* member this plugin does not model still reaches the wallet.
*/
-public class CredentialConfigurations {
+public final class CredentialConfigurations {
/** Class logger. */
@Nonnull
@@ -52,7 +52,7 @@ public class CredentialConfigurations {
/** Parser of the source. */
@Nonnull
- private static final ObjectMapper mapper = new ObjectMapper();
+ private static final ObjectMapper MAPPER = new ObjectMapper();
/** Credential configuration content. */
@Nonnull
@@ -69,13 +69,18 @@ public class CredentialConfigurations {
* @param source Credential Configuration content as it was
* written
*/
- private CredentialConfigurations(@Nonnull Map<String, CredentialConfiguration> credentialConfigurations,
- @Nonnull Map<String, Object> source) {
+ private CredentialConfigurations(@Nonnull final Map<String, CredentialConfiguration> credentialConfigurations,
+ @Nonnull final Map<String, Object> source) {
assert credentialConfigurations != null;
this.credentialConfigurations = credentialConfigurations;
supported = source;
}
+ /**
+ * Get the Credential Configurations keyed by their identifier.
+ *
+ * @return Credential Configurations
+ */
public Map<String, CredentialConfiguration> getCredentialConfigurations() {
return credentialConfigurations;
}
@@ -105,8 +110,9 @@ public class CredentialConfigurations {
@Nonnull
public static CredentialConfigurations parse(@Nonnull final byte[] bytes) throws IOException {
- final Map<String, Object> document = mapper.readValue(bytes, new TypeReference<LinkedHashMap<String, Object>>() {
- });
+ final Map<String, Object> document =
+ MAPPER.readValue(bytes, new TypeReference<LinkedHashMap<String, Object>>() {
+ });
if (document == null) {
throw new IOException("Credential configuration is not a JSON object");
}
@@ -122,7 +128,7 @@ public class CredentialConfigurations {
final Map<String, CredentialConfiguration> parsed;
try {
- parsed = mapper.convertValue(configurations, new TypeReference<Map<String, CredentialConfiguration>>() {
+ parsed = MAPPER.convertValue(configurations, new TypeReference<Map<String, CredentialConfiguration>>() {
});
} catch (final IllegalArgumentException e) {
throw new IOException("Unable to parse a credential configuration: " + e.getMessage(), e);
diff --git a/openid-vci-api/src/main/java/org/geant/shibboleth/plugin/openidvci/credential/CredentialDefinition.java b/openid-vci-api/src/main/java/org/geant/shibboleth/plugin/openidvci/credential/CredentialDefinition.java
index f867050..3e4f9ec 100644
--- a/openid-vci-api/src/main/java/org/geant/shibboleth/plugin/openidvci/credential/CredentialDefinition.java
+++ b/openid-vci-api/src/main/java/org/geant/shibboleth/plugin/openidvci/credential/CredentialDefinition.java
@@ -37,7 +37,7 @@ import com.fasterxml.jackson.databind.ObjectMapper;
* string.
*/
@JsonIgnoreProperties(ignoreUnknown = true)
-public class CredentialDefinition {
+public final class CredentialDefinition {
/** Context of credential definition. */
@Nonnull
@@ -55,8 +55,8 @@ public class CredentialDefinition {
* @param context Context of credential definition
* @param type Type of credential definition
*/
- private CredentialDefinition(@JsonProperty("@context") @Nonnull List<String> context,
- @JsonProperty("type") @Nonnull List<String> type) {
+ private CredentialDefinition(@JsonProperty("@context") @Nonnull final List<String> context,
+ @JsonProperty("type") @Nonnull final List<String> type) {
assert context != null;
assert type != null;
this.context = context;
@@ -86,8 +86,8 @@ public class CredentialDefinition {
/**
* Serialize object to json.
*
- * @return
- * @throws JsonProcessingException
+ * @return this Credential Definition as a json string
+ * @throws JsonProcessingException if serialization fails
*/
public String serialize() throws JsonProcessingException {
return new ObjectMapper().writeValueAsString(this);
@@ -100,14 +100,22 @@ public class CredentialDefinition {
* @return {@link CredentialDefinition}
* @throws JsonProcessingException if parsing fails.
*/
- public static CredentialDefinition parse(@Nonnull String definition) throws JsonProcessingException {
+ public static CredentialDefinition parse(@Nonnull final String definition) throws JsonProcessingException {
return new ObjectMapper().readValue(definition, CredentialDefinition.class);
}
+ /**
+ * Create a Credential Definition, or null when the mandatory members are absent.
+ *
+ * @param context value of the @context member
+ * @param id value of the id member
+ * @param type value of the type member
+ * @return Credential Definition, or null
+ */
@JsonCreator
- public static CredentialDefinition of(@JsonProperty("@context") @Nullable List<String> context,
- @JsonProperty("id") @Nullable String id, @JsonProperty("type") @Nullable List<String> type) {
+ public static CredentialDefinition of(@JsonProperty("@context") @Nullable final List<String> context,
+ @JsonProperty("id") @Nullable final String id, @JsonProperty("type") @Nullable final List<String> type) {
if (context == null || type == null) {
return null;
}
diff --git a/openid-vci-api/src/main/java/org/geant/shibboleth/plugin/openidvci/credential/CredentialDisplay.java b/openid-vci-api/src/main/java/org/geant/shibboleth/plugin/openidvci/credential/CredentialDisplay.java
index 34dbdf5..7fcb242 100644
--- a/openid-vci-api/src/main/java/org/geant/shibboleth/plugin/openidvci/credential/CredentialDisplay.java
+++ b/openid-vci-api/src/main/java/org/geant/shibboleth/plugin/openidvci/credential/CredentialDisplay.java
@@ -30,7 +30,7 @@ import com.fasterxml.jackson.annotation.JsonProperty;
* {@link https://openid.net/specs/openid-4-verifiable-credential-issuance-1_0.html#name-credential-issuer-metadata-p}.
*/
@JsonIgnoreProperties(ignoreUnknown = true)
-public class CredentialDisplay {
+public final class CredentialDisplay {
/** Display name of the Credential. */
@Nullable
@@ -74,6 +74,7 @@ public class CredentialDisplay {
@JsonInclude(Include.NON_NULL)
private final String textColor;
+// Checkstyle: ParameterNumber OFF
/**
* Constructor.
*
@@ -86,12 +87,12 @@ public class CredentialDisplay {
* @param textColor Text color of the Credential
*/
@JsonCreator
- private CredentialDisplay(@JsonProperty("name") @Nullable String name,
- @JsonProperty("locale") @Nullable String locale, @JsonProperty("logo") @Nullable Image logo,
- @JsonProperty("description") @Nullable String description,
- @JsonProperty("background_color") @Nullable String backgroundColor,
- @JsonProperty("background_image") @Nullable Image backgroundImage,
- @JsonProperty("text_color") @Nullable String textColor) {
+ private CredentialDisplay(@JsonProperty("name") @Nullable final String name,
+ @JsonProperty("locale") @Nullable final String locale, @JsonProperty("logo") @Nullable final Image logo,
+ @JsonProperty("description") @Nullable final String description,
+ @JsonProperty("background_color") @Nullable final String backgroundColor,
+ @JsonProperty("background_image") @Nullable final Image backgroundImage,
+ @JsonProperty("text_color") @Nullable final String textColor) {
this.name = name;
this.locale = locale;
this.logo = logo;
@@ -100,6 +101,7 @@ public class CredentialDisplay {
this.backgroundImage = backgroundImage;
this.textColor = textColor;
}
+// Checkstyle: ParameterNumber ON
/**
* Get display name of the Credential.
diff --git a/openid-vci-api/src/main/java/org/geant/shibboleth/plugin/openidvci/credential/CredentialMetadata.java b/openid-vci-api/src/main/java/org/geant/shibboleth/plugin/openidvci/credential/CredentialMetadata.java
index b42cbc1..111f450 100644
--- a/openid-vci-api/src/main/java/org/geant/shibboleth/plugin/openidvci/credential/CredentialMetadata.java
+++ b/openid-vci-api/src/main/java/org/geant/shibboleth/plugin/openidvci/credential/CredentialMetadata.java
@@ -32,7 +32,7 @@ import com.fasterxml.jackson.annotation.JsonProperty;
* {@link https://openid.net/specs/openid-4-verifiable-credential-issuance-1_0.html#name-credential-issuer-metadata-p}.
*/
@JsonIgnoreProperties(ignoreUnknown = true)
-public class CredentialMetadata {
+public final class CredentialMetadata {
/** Display properties per language. */
@Nullable
@@ -53,8 +53,8 @@ public class CredentialMetadata {
* @param claims Description of the claims carried by this Credential
*/
@JsonCreator
- private CredentialMetadata(@JsonProperty("display") @Nullable List<CredentialDisplay> display,
- @JsonProperty("claims") @Nullable List<ClaimDescription> claims) {
+ private CredentialMetadata(@JsonProperty("display") @Nullable final List<CredentialDisplay> display,
+ @JsonProperty("claims") @Nullable final List<ClaimDescription> claims) {
this.display = display;
this.claims = claims;
}
diff --git a/openid-vci-api/src/main/java/org/geant/shibboleth/plugin/openidvci/credential/Image.java b/openid-vci-api/src/main/java/org/geant/shibboleth/plugin/openidvci/credential/Image.java
index eacb671..1dc8504 100644
--- a/openid-vci-api/src/main/java/org/geant/shibboleth/plugin/openidvci/credential/Image.java
+++ b/openid-vci-api/src/main/java/org/geant/shibboleth/plugin/openidvci/credential/Image.java
@@ -32,7 +32,7 @@ import com.fasterxml.jackson.annotation.JsonProperty;
* valid {@code background_image} object.
*/
@JsonIgnoreProperties(ignoreUnknown = true)
-public class Image {
+public final class Image {
/** URI where the Wallet can obtain the image from the Credential Issuer. */
@Nonnull
@@ -52,7 +52,8 @@ public class Image {
* @param altText Alternative text for the image
*/
@JsonCreator
- private Image(@JsonProperty("uri") @Nonnull String uri, @JsonProperty("alt_text") @Nullable String altText) {
+ private Image(@JsonProperty("uri") @Nonnull final String uri,
+ @JsonProperty("alt_text") @Nullable final String altText) {
assert uri != null;
this.uri = uri;
this.altText = altText;
diff --git a/openid-vci-api/src/main/java/org/geant/shibboleth/plugin/openidvci/credential/KeyAttestationsRequired.java b/openid-vci-api/src/main/java/org/geant/shibboleth/plugin/openidvci/credential/KeyAttestationsRequired.java
index 694c974..8f72982 100644
--- a/openid-vci-api/src/main/java/org/geant/shibboleth/plugin/openidvci/credential/KeyAttestationsRequired.java
+++ b/openid-vci-api/src/main/java/org/geant/shibboleth/plugin/openidvci/credential/KeyAttestationsRequired.java
@@ -31,7 +31,7 @@ import com.fasterxml.jackson.annotation.JsonProperty;
* {@link https://openid.net/specs/openid-4-verifiable-credential-issuance-1_0.html#name-key-attestations-in-jwt-pro}.
*/
@JsonIgnoreProperties(ignoreUnknown = true)
-public class KeyAttestationsRequired {
+public final class KeyAttestationsRequired {
/**
* Resistance level required for the key storage component of the attested key.
@@ -59,8 +59,8 @@ public class KeyAttestationsRequired {
* must satisfy
*/
@JsonCreator
- private KeyAttestationsRequired(@JsonProperty("key_storage") @Nullable List<String> keyStorage,
- @JsonProperty("user_authentication") @Nullable List<String> userAuthentication) {
+ private KeyAttestationsRequired(@JsonProperty("key_storage") @Nullable final List<String> keyStorage,
+ @JsonProperty("user_authentication") @Nullable final List<String> userAuthentication) {
this.keyStorage = keyStorage;
this.userAuthentication = userAuthentication;
}
diff --git a/openid-vci-api/src/main/java/org/geant/shibboleth/plugin/openidvci/credential/ProofTypeSupported.java b/openid-vci-api/src/main/java/org/geant/shibboleth/plugin/openidvci/credential/ProofTypeSupported.java
index ddef74a..90bab32 100644
--- a/openid-vci-api/src/main/java/org/geant/shibboleth/plugin/openidvci/credential/ProofTypeSupported.java
+++ b/openid-vci-api/src/main/java/org/geant/shibboleth/plugin/openidvci/credential/ProofTypeSupported.java
@@ -33,7 +33,7 @@ import com.fasterxml.jackson.annotation.JsonProperty;
* {@link https://openid.net/specs/openid-4-verifiable-credential-issuance-1_0.html#name-credential-issuer-metadata-p}.
*/
@JsonIgnoreProperties(ignoreUnknown = true)
-public class ProofTypeSupported {
+public final class ProofTypeSupported {
/**
* Algorithm identifiers the Issuer supports for this proof type.
@@ -60,8 +60,10 @@ public class ProofTypeSupported {
*/
@JsonCreator
private ProofTypeSupported(
- @JsonProperty("proof_signing_alg_values_supported") @Nonnull List<String> proofSigningAlgValuesSupported,
- @JsonProperty("key_attestations_required") @Nullable KeyAttestationsRequired keyAttestationsRequired) {
+ @JsonProperty("proof_signing_alg_values_supported") @Nonnull
+ final List<String> proofSigningAlgValuesSupported,
+ @JsonProperty("key_attestations_required") @Nullable
+ final KeyAttestationsRequired keyAttestationsRequired) {
assert proofSigningAlgValuesSupported != null;
this.proofSigningAlgValuesSupported = proofSigningAlgValuesSupported;
this.keyAttestationsRequired = keyAttestationsRequired;
diff --git a/openid-vci-api/src/main/java/org/geant/shibboleth/plugin/oauth/statuslist/StatusListBucket.java b/openid-vci-api/src/main/java/org/geant/shibboleth/plugin/openidvci/credential/package-info.java
similarity index 52%
copy from openid-vci-api/src/main/java/org/geant/shibboleth/plugin/oauth/statuslist/StatusListBucket.java
copy to openid-vci-api/src/main/java/org/geant/shibboleth/plugin/openidvci/credential/package-info.java
index 8a3d844..c0d4962 100644
--- a/openid-vci-api/src/main/java/org/geant/shibboleth/plugin/oauth/statuslist/StatusListBucket.java
+++ b/openid-vci-api/src/main/java/org/geant/shibboleth/plugin/openidvci/credential/package-info.java
@@ -14,21 +14,7 @@
* limitations under the License.
*/
-package org.geant.shibboleth.plugin.oauth.statuslist;
-
-import java.time.Instant;
-
-import javax.annotation.Nonnull;
-
/**
- * Immutable identity of one Status List as in
- * <a href="https://datatracker.ietf.org/doc/draft-ietf-oauth-status-list/">
- * draft-ietf-oauth-status-list</a>.
- *
- * A bucket holds credentials that all expire before the end of the bucket.
- *
- * @param id identifier, used as storage key
- * @param end upper bound for expiration of any credential in this bucket
+ * Credential Configuration model published in Credential Issuer metadata.
*/
-public record StatusListBucket(@Nonnull String id, @Nonnull Instant end) {
-}
+package org.geant.shibboleth.plugin.openidvci.credential;
diff --git a/openid-vci-api/src/main/java/org/geant/shibboleth/plugin/oauth/statuslist/StatusListBucket.java b/openid-vci-api/src/main/java/org/geant/shibboleth/plugin/openidvci/credential/resolver/package-info.java
similarity index 52%
copy from openid-vci-api/src/main/java/org/geant/shibboleth/plugin/oauth/statuslist/StatusListBucket.java
copy to openid-vci-api/src/main/java/org/geant/shibboleth/plugin/openidvci/credential/resolver/package-info.java
index 8a3d844..a01b2a0 100644
--- a/openid-vci-api/src/main/java/org/geant/shibboleth/plugin/oauth/statuslist/StatusListBucket.java
+++ b/openid-vci-api/src/main/java/org/geant/shibboleth/plugin/openidvci/credential/resolver/package-info.java
@@ -14,21 +14,7 @@
* limitations under the License.
*/
-package org.geant.shibboleth.plugin.oauth.statuslist;
-
-import java.time.Instant;
-
-import javax.annotation.Nonnull;
-
/**
- * Immutable identity of one Status List as in
- * <a href="https://datatracker.ietf.org/doc/draft-ietf-oauth-status-list/">
- * draft-ietf-oauth-status-list</a>.
- *
- * A bucket holds credentials that all expire before the end of the bucket.
- *
- * @param id identifier, used as storage key
- * @param end upper bound for expiration of any credential in this bucket
+ * Interfaces for resolving Credential Configurations.
*/
-public record StatusListBucket(@Nonnull String id, @Nonnull Instant end) {
-}
+package org.geant.shibboleth.plugin.openidvci.credential.resolver;
diff --git a/openid-vci-api/src/main/java/org/geant/shibboleth/plugin/openidvci/messaging/error/OpenIDVCIError.java b/openid-vci-api/src/main/java/org/geant/shibboleth/plugin/openidvci/messaging/error/OpenIDVCIError.java
index 809574e..cfac17d 100644
--- a/openid-vci-api/src/main/java/org/geant/shibboleth/plugin/openidvci/messaging/error/OpenIDVCIError.java
+++ b/openid-vci-api/src/main/java/org/geant/shibboleth/plugin/openidvci/messaging/error/OpenIDVCIError.java
@@ -36,4 +36,8 @@ public final class OpenIDVCIError {
public static final ErrorObject NO_CREDENTIAL_OFFER = new ErrorObject("no_credential_offer",
"No active credential offer per pre-authorized code", HTTPResponse.SC_BAD_REQUEST);
+ /** Constructor. */
+ private OpenIDVCIError() {
+ }
+
}
diff --git a/openid-vci-api/src/main/java/org/geant/shibboleth/plugin/oauth/statuslist/StatusListBucket.java b/openid-vci-api/src/main/java/org/geant/shibboleth/plugin/openidvci/messaging/error/package-info.java
similarity index 52%
copy from openid-vci-api/src/main/java/org/geant/shibboleth/plugin/oauth/statuslist/StatusListBucket.java
copy to openid-vci-api/src/main/java/org/geant/shibboleth/plugin/openidvci/messaging/error/package-info.java
index 8a3d844..5eb6f80 100644
--- a/openid-vci-api/src/main/java/org/geant/shibboleth/plugin/oauth/statuslist/StatusListBucket.java
+++ b/openid-vci-api/src/main/java/org/geant/shibboleth/plugin/openidvci/messaging/error/package-info.java
@@ -14,21 +14,7 @@
* limitations under the License.
*/
-package org.geant.shibboleth.plugin.oauth.statuslist;
-
-import java.time.Instant;
-
-import javax.annotation.Nonnull;
-
/**
- * Immutable identity of one Status List as in
- * <a href="https://datatracker.ietf.org/doc/draft-ietf-oauth-status-list/">
- * draft-ietf-oauth-status-list</a>.
- *
- * A bucket holds credentials that all expire before the end of the bucket.
- *
- * @param id identifier, used as storage key
- * @param end upper bound for expiration of any credential in this bucket
+ * Error objects for OpenID4VCI responses.
*/
-public record StatusListBucket(@Nonnull String id, @Nonnull Instant end) {
-}
+package org.geant.shibboleth.plugin.openidvci.messaging.error;
diff --git a/openid-vci-api/src/main/java/org/geant/shibboleth/plugin/openidvci/metadata/CredentialIssuerMetadata.java b/openid-vci-api/src/main/java/org/geant/shibboleth/plugin/openidvci/metadata/CredentialIssuerMetadata.java
index bc54c94..f760b60 100644
--- a/openid-vci-api/src/main/java/org/geant/shibboleth/plugin/openidvci/metadata/CredentialIssuerMetadata.java
+++ b/openid-vci-api/src/main/java/org/geant/shibboleth/plugin/openidvci/metadata/CredentialIssuerMetadata.java
@@ -35,7 +35,7 @@ import com.nimbusds.oauth2.sdk.id.Issuer;
* published. Only 'credential_issuer' is parsed, it names the document.
* Everything else is the deployer's to write.
*/
-public class CredentialIssuerMetadata {
+public final class CredentialIssuerMetadata {
/** Member naming the Credential Issuer. */
@Nonnull
diff --git a/openid-vci-api/src/main/java/org/geant/shibboleth/plugin/oauth/statuslist/StatusListBucket.java b/openid-vci-api/src/main/java/org/geant/shibboleth/plugin/openidvci/metadata/package-info.java
similarity index 52%
copy from openid-vci-api/src/main/java/org/geant/shibboleth/plugin/oauth/statuslist/StatusListBucket.java
copy to openid-vci-api/src/main/java/org/geant/shibboleth/plugin/openidvci/metadata/package-info.java
index 8a3d844..354f1ec 100644
--- a/openid-vci-api/src/main/java/org/geant/shibboleth/plugin/oauth/statuslist/StatusListBucket.java
+++ b/openid-vci-api/src/main/java/org/geant/shibboleth/plugin/openidvci/metadata/package-info.java
@@ -14,21 +14,7 @@
* limitations under the License.
*/
-package org.geant.shibboleth.plugin.oauth.statuslist;
-
-import java.time.Instant;
-
-import javax.annotation.Nonnull;
-
/**
- * Immutable identity of one Status List as in
- * <a href="https://datatracker.ietf.org/doc/draft-ietf-oauth-status-list/">
- * draft-ietf-oauth-status-list</a>.
- *
- * A bucket holds credentials that all expire before the end of the bucket.
- *
- * @param id identifier, used as storage key
- * @param end upper bound for expiration of any credential in this bucket
+ * Credential Issuer metadata model.
*/
-public record StatusListBucket(@Nonnull String id, @Nonnull Instant end) {
-}
+package org.geant.shibboleth.plugin.openidvci.metadata;
diff --git a/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/profile/impl/InitializeOutboundResponseMessageContext.java b/openid-vci-api/src/main/java/org/geant/shibboleth/plugin/openidvci/metadata/resolver/package-info.java
similarity index 53%
copy from openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/profile/impl/InitializeOutboundResponseMessageContext.java
copy to openid-vci-api/src/main/java/org/geant/shibboleth/plugin/openidvci/metadata/resolver/package-info.java
index 9f72d40..622e2ad 100644
--- a/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/profile/impl/InitializeOutboundResponseMessageContext.java
+++ b/openid-vci-api/src/main/java/org/geant/shibboleth/plugin/openidvci/metadata/resolver/package-info.java
@@ -14,18 +14,7 @@
* limitations under the License.
*/
-package org.geant.shibboleth.plugin.openidvci.profile.impl;
-
-import org.geant.shibboleth.plugin.openidvci.profile.impl.stolen.AbstractInitializeOutboundResponseMessageContext;
-import org.opensaml.messaging.context.MessageContext;
-import org.opensaml.profile.context.ProfileRequestContext;
-
/**
- * Action that adds an outbound {@link MessageContext} and related OIDC contexts
- * to the {@link ProfileRequestContext} not knowing the relying party yet.
- *
- * @event {@link org.opensaml.profile.action.EventIds#PROCEED_EVENT_ID}
+ * Interfaces for resolving Credential Issuer metadata.
*/
-public class InitializeOutboundResponseMessageContext extends AbstractInitializeOutboundResponseMessageContext {
-
-}
\ No newline at end of file
+package org.geant.shibboleth.plugin.openidvci.metadata.resolver;
diff --git a/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/config/OpenIDVCIConfiguration.java b/openid-vci-api/src/main/java/org/geant/shibboleth/plugin/openidvci/profile/config/OpenIDVCIConfiguration.java
similarity index 96%
rename from openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/config/OpenIDVCIConfiguration.java
rename to openid-vci-api/src/main/java/org/geant/shibboleth/plugin/openidvci/profile/config/OpenIDVCIConfiguration.java
index 4498346..8989056 100644
--- a/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/config/OpenIDVCIConfiguration.java
+++ b/openid-vci-api/src/main/java/org/geant/shibboleth/plugin/openidvci/profile/config/OpenIDVCIConfiguration.java
@@ -14,7 +14,7 @@
* limitations under the License.
*/
-package org.geant.shibboleth.plugin.openidvci.config;
+package org.geant.shibboleth.plugin.openidvci.profile.config;
import java.time.Duration;
import java.util.function.Function;
@@ -40,7 +40,8 @@ public interface OpenIDVCIConfiguration extends ConditionalProfileConfiguration
/** Open ID VCI URI. */
@Nonnull
@NotEmpty
- public static final String PROTOCOL_URI = "https://openid.net/specs/openid-4-verifiable-credential-issuance-1_0.html";
+ public static final String PROTOCOL_URI =
+ "https://openid.net/specs/openid-4-verifiable-credential-issuance-1_0.html";
/** Main id for this profile configuration. */
@Nonnull
diff --git a/openid-vci-api/src/main/java/org/geant/shibboleth/plugin/oauth/statuslist/StatusListBucket.java b/openid-vci-api/src/main/java/org/geant/shibboleth/plugin/openidvci/profile/config/package-info.java
similarity index 52%
copy from openid-vci-api/src/main/java/org/geant/shibboleth/plugin/oauth/statuslist/StatusListBucket.java
copy to openid-vci-api/src/main/java/org/geant/shibboleth/plugin/openidvci/profile/config/package-info.java
index 8a3d844..348c436 100644
--- a/openid-vci-api/src/main/java/org/geant/shibboleth/plugin/oauth/statuslist/StatusListBucket.java
+++ b/openid-vci-api/src/main/java/org/geant/shibboleth/plugin/openidvci/profile/config/package-info.java
@@ -14,21 +14,7 @@
* limitations under the License.
*/
-package org.geant.shibboleth.plugin.oauth.statuslist;
-
-import java.time.Instant;
-
-import javax.annotation.Nonnull;
-
/**
- * Immutable identity of one Status List as in
- * <a href="https://datatracker.ietf.org/doc/draft-ietf-oauth-status-list/">
- * draft-ietf-oauth-status-list</a>.
- *
- * A bucket holds credentials that all expire before the end of the bucket.
- *
- * @param id identifier, used as storage key
- * @param end upper bound for expiration of any credential in this bucket
+ * Profile configuration interfaces.
*/
-public record StatusListBucket(@Nonnull String id, @Nonnull Instant end) {
-}
+package org.geant.shibboleth.plugin.openidvci.profile.config;
diff --git a/openid-vci-api/src/main/java/org/geant/shibboleth/plugin/oauth/statuslist/StatusListBucket.java b/openid-vci-api/src/main/java/org/geant/shibboleth/plugin/openidvci/profile/package-info.java
similarity index 52%
copy from openid-vci-api/src/main/java/org/geant/shibboleth/plugin/oauth/statuslist/StatusListBucket.java
copy to openid-vci-api/src/main/java/org/geant/shibboleth/plugin/openidvci/profile/package-info.java
index 8a3d844..f422d2d 100644
--- a/openid-vci-api/src/main/java/org/geant/shibboleth/plugin/oauth/statuslist/StatusListBucket.java
+++ b/openid-vci-api/src/main/java/org/geant/shibboleth/plugin/openidvci/profile/package-info.java
@@ -14,21 +14,7 @@
* limitations under the License.
*/
-package org.geant.shibboleth.plugin.oauth.statuslist;
-
-import java.time.Instant;
-
-import javax.annotation.Nonnull;
-
/**
- * Immutable identity of one Status List as in
- * <a href="https://datatracker.ietf.org/doc/draft-ietf-oauth-status-list/">
- * draft-ietf-oauth-status-list</a>.
- *
- * A bucket holds credentials that all expire before the end of the bucket.
- *
- * @param id identifier, used as storage key
- * @param end upper bound for expiration of any credential in this bucket
+ * Event identifiers for OpenID4VCI profile actions.
*/
-public record StatusListBucket(@Nonnull String id, @Nonnull Instant end) {
-}
+package org.geant.shibboleth.plugin.openidvci.profile;
diff --git a/openid-vci-api/src/main/java/org/geant/shibboleth/plugin/oauth/statuslist/MonthlyBucketStrategy.java b/openid-vci-api/src/main/java/org/geant/shibboleth/plugin/openidvci/statuslist/MonthlyBucketStrategy.java
similarity index 97%
rename from openid-vci-api/src/main/java/org/geant/shibboleth/plugin/oauth/statuslist/MonthlyBucketStrategy.java
rename to openid-vci-api/src/main/java/org/geant/shibboleth/plugin/openidvci/statuslist/MonthlyBucketStrategy.java
index 5e5de32..0b1aa65 100644
--- a/openid-vci-api/src/main/java/org/geant/shibboleth/plugin/oauth/statuslist/MonthlyBucketStrategy.java
+++ b/openid-vci-api/src/main/java/org/geant/shibboleth/plugin/openidvci/statuslist/MonthlyBucketStrategy.java
@@ -14,7 +14,7 @@
* limitations under the License.
*/
-package org.geant.shibboleth.plugin.oauth.statuslist;
+package org.geant.shibboleth.plugin.openidvci.statuslist;
import java.time.Instant;
import java.time.YearMonth;
diff --git a/openid-vci-api/src/main/java/org/geant/shibboleth/plugin/oauth/statuslist/StatusListBucket.java b/openid-vci-api/src/main/java/org/geant/shibboleth/plugin/openidvci/statuslist/StatusListBucket.java
similarity index 95%
copy from openid-vci-api/src/main/java/org/geant/shibboleth/plugin/oauth/statuslist/StatusListBucket.java
copy to openid-vci-api/src/main/java/org/geant/shibboleth/plugin/openidvci/statuslist/StatusListBucket.java
index 8a3d844..e04d416 100644
--- a/openid-vci-api/src/main/java/org/geant/shibboleth/plugin/oauth/statuslist/StatusListBucket.java
+++ b/openid-vci-api/src/main/java/org/geant/shibboleth/plugin/openidvci/statuslist/StatusListBucket.java
@@ -14,7 +14,7 @@
* limitations under the License.
*/
-package org.geant.shibboleth.plugin.oauth.statuslist;
+package org.geant.shibboleth.plugin.openidvci.statuslist;
import java.time.Instant;
diff --git a/openid-vci-api/src/main/java/org/geant/shibboleth/plugin/oauth/statuslist/StatusListCodec.java b/openid-vci-api/src/main/java/org/geant/shibboleth/plugin/openidvci/statuslist/StatusListCodec.java
similarity index 98%
rename from openid-vci-api/src/main/java/org/geant/shibboleth/plugin/oauth/statuslist/StatusListCodec.java
rename to openid-vci-api/src/main/java/org/geant/shibboleth/plugin/openidvci/statuslist/StatusListCodec.java
index 2ca2bc9..b0c1cd0 100644
--- a/openid-vci-api/src/main/java/org/geant/shibboleth/plugin/oauth/statuslist/StatusListCodec.java
+++ b/openid-vci-api/src/main/java/org/geant/shibboleth/plugin/openidvci/statuslist/StatusListCodec.java
@@ -14,7 +14,7 @@
* limitations under the License.
*/
-package org.geant.shibboleth.plugin.oauth.statuslist;
+package org.geant.shibboleth.plugin.openidvci.statuslist;
import java.io.ByteArrayOutputStream;
import java.io.IOException;
diff --git a/openid-vci-api/src/main/java/org/geant/shibboleth/plugin/oauth/statuslist/StatusListParameters.java b/openid-vci-api/src/main/java/org/geant/shibboleth/plugin/openidvci/statuslist/StatusListParameters.java
similarity index 98%
rename from openid-vci-api/src/main/java/org/geant/shibboleth/plugin/oauth/statuslist/StatusListParameters.java
rename to openid-vci-api/src/main/java/org/geant/shibboleth/plugin/openidvci/statuslist/StatusListParameters.java
index 505d8f2..4acc57f 100644
--- a/openid-vci-api/src/main/java/org/geant/shibboleth/plugin/oauth/statuslist/StatusListParameters.java
+++ b/openid-vci-api/src/main/java/org/geant/shibboleth/plugin/openidvci/statuslist/StatusListParameters.java
@@ -14,7 +14,7 @@
* limitations under the License.
*/
-package org.geant.shibboleth.plugin.oauth.statuslist;
+package org.geant.shibboleth.plugin.openidvci.statuslist;
import java.time.Duration;
@@ -59,26 +59,6 @@ public final class StatusListParameters {
/** Number of slots described by one piece of list. */
public static final long CHUNK_CAPACITY = CAPACITY / CHUNKS;
- /**
- * Get piece of a list holding a slot.
- *
- * @param index slot to locate
- * @return piece holding the slot
- */
- public static int chunkOf(final long index) {
- return (int) (index / CHUNK_CAPACITY);
- }
-
- /**
- * Get the position of slot within the piece holding it.
- *
- * @param index slot to locate
- * @return position within the piece
- */
- public static long offsetInChunk(final long index) {
- return index % CHUNK_CAPACITY;
- }
-
/**
* Time a list is kept in storage after the bucket has ended. Only for clock
* skew at verifiers.
@@ -99,4 +79,24 @@ public final class StatusListParameters {
private StatusListParameters() {
}
+ /**
+ * Get piece of a list holding a slot.
+ *
+ * @param index slot to locate
+ * @return piece holding the slot
+ */
+ public static int chunkOf(final long index) {
+ return (int) (index / CHUNK_CAPACITY);
+ }
+
+ /**
+ * Get the position of slot within the piece holding it.
+ *
+ * @param index slot to locate
+ * @return position within the piece
+ */
+ public static long offsetInChunk(final long index) {
+ return index % CHUNK_CAPACITY;
+ }
+
}
diff --git a/openid-vci-api/src/main/java/org/geant/shibboleth/plugin/oauth/statuslist/context/StatusListContext.java b/openid-vci-api/src/main/java/org/geant/shibboleth/plugin/openidvci/statuslist/context/StatusListContext.java
similarity index 95%
rename from openid-vci-api/src/main/java/org/geant/shibboleth/plugin/oauth/statuslist/context/StatusListContext.java
rename to openid-vci-api/src/main/java/org/geant/shibboleth/plugin/openidvci/statuslist/context/StatusListContext.java
index 0030101..2b229dd 100644
--- a/openid-vci-api/src/main/java/org/geant/shibboleth/plugin/oauth/statuslist/context/StatusListContext.java
+++ b/openid-vci-api/src/main/java/org/geant/shibboleth/plugin/openidvci/statuslist/context/StatusListContext.java
@@ -14,7 +14,7 @@
* limitations under the License.
*/
-package org.geant.shibboleth.plugin.oauth.statuslist.context;
+package org.geant.shibboleth.plugin.openidvci.statuslist.context;
import java.util.List;
@@ -79,7 +79,7 @@ public class StatusListContext extends BaseContext {
/**
* Get allocated index of a credential.
*
- * @param position of the credential in this issuance
+ * @param ordinal position of the credential in this issuance
* @return allocated index, or null if there is no index for the position
*/
@Nullable
diff --git a/openid-vci-api/src/main/java/org/geant/shibboleth/plugin/oauth/statuslist/context/StatusListTokenContext.java b/openid-vci-api/src/main/java/org/geant/shibboleth/plugin/openidvci/statuslist/context/StatusListTokenContext.java
similarity index 96%
rename from openid-vci-api/src/main/java/org/geant/shibboleth/plugin/oauth/statuslist/context/StatusListTokenContext.java
rename to openid-vci-api/src/main/java/org/geant/shibboleth/plugin/openidvci/statuslist/context/StatusListTokenContext.java
index 1d0954d..bb165a5 100644
--- a/openid-vci-api/src/main/java/org/geant/shibboleth/plugin/oauth/statuslist/context/StatusListTokenContext.java
+++ b/openid-vci-api/src/main/java/org/geant/shibboleth/plugin/openidvci/statuslist/context/StatusListTokenContext.java
@@ -14,7 +14,7 @@
* limitations under the License.
*/
-package org.geant.shibboleth.plugin.oauth.statuslist.context;
+package org.geant.shibboleth.plugin.openidvci.statuslist.context;
import javax.annotation.Nullable;
diff --git a/openid-vci-api/src/main/java/org/geant/shibboleth/plugin/oauth/statuslist/StatusListBucket.java b/openid-vci-api/src/main/java/org/geant/shibboleth/plugin/openidvci/statuslist/context/package-info.java
similarity index 52%
copy from openid-vci-api/src/main/java/org/geant/shibboleth/plugin/oauth/statuslist/StatusListBucket.java
copy to openid-vci-api/src/main/java/org/geant/shibboleth/plugin/openidvci/statuslist/context/package-info.java
index 8a3d844..6f6850e 100644
--- a/openid-vci-api/src/main/java/org/geant/shibboleth/plugin/oauth/statuslist/StatusListBucket.java
+++ b/openid-vci-api/src/main/java/org/geant/shibboleth/plugin/openidvci/statuslist/context/package-info.java
@@ -14,21 +14,7 @@
* limitations under the License.
*/
-package org.geant.shibboleth.plugin.oauth.statuslist;
-
-import java.time.Instant;
-
-import javax.annotation.Nonnull;
-
/**
- * Immutable identity of one Status List as in
- * <a href="https://datatracker.ietf.org/doc/draft-ietf-oauth-status-list/">
- * draft-ietf-oauth-status-list</a>.
- *
- * A bucket holds credentials that all expire before the end of the bucket.
- *
- * @param id identifier, used as storage key
- * @param end upper bound for expiration of any credential in this bucket
+ * Contexts carrying Status List state.
*/
-public record StatusListBucket(@Nonnull String id, @Nonnull Instant end) {
-}
+package org.geant.shibboleth.plugin.openidvci.statuslist.context;
diff --git a/openid-vci-api/src/main/java/org/geant/shibboleth/plugin/oauth/statuslist/messaging/error/StatusListError.java b/openid-vci-api/src/main/java/org/geant/shibboleth/plugin/openidvci/statuslist/messaging/error/StatusListError.java
similarity index 95%
rename from openid-vci-api/src/main/java/org/geant/shibboleth/plugin/oauth/statuslist/messaging/error/StatusListError.java
rename to openid-vci-api/src/main/java/org/geant/shibboleth/plugin/openidvci/statuslist/messaging/error/StatusListError.java
index 61160e9..0994148 100644
--- a/openid-vci-api/src/main/java/org/geant/shibboleth/plugin/oauth/statuslist/messaging/error/StatusListError.java
+++ b/openid-vci-api/src/main/java/org/geant/shibboleth/plugin/openidvci/statuslist/messaging/error/StatusListError.java
@@ -14,7 +14,7 @@
* limitations under the License.
*/
-package org.geant.shibboleth.plugin.oauth.statuslist.messaging.error;
+package org.geant.shibboleth.plugin.openidvci.statuslist.messaging.error;
import javax.annotation.Nonnull;
diff --git a/openid-vci-api/src/main/java/org/geant/shibboleth/plugin/oauth/statuslist/StatusListBucket.java b/openid-vci-api/src/main/java/org/geant/shibboleth/plugin/openidvci/statuslist/messaging/error/package-info.java
similarity index 52%
copy from openid-vci-api/src/main/java/org/geant/shibboleth/plugin/oauth/statuslist/StatusListBucket.java
copy to openid-vci-api/src/main/java/org/geant/shibboleth/plugin/openidvci/statuslist/messaging/error/package-info.java
index 8a3d844..dde42aa 100644
--- a/openid-vci-api/src/main/java/org/geant/shibboleth/plugin/oauth/statuslist/StatusListBucket.java
+++ b/openid-vci-api/src/main/java/org/geant/shibboleth/plugin/openidvci/statuslist/messaging/error/package-info.java
@@ -14,21 +14,7 @@
* limitations under the License.
*/
-package org.geant.shibboleth.plugin.oauth.statuslist;
-
-import java.time.Instant;
-
-import javax.annotation.Nonnull;
-
/**
- * Immutable identity of one Status List as in
- * <a href="https://datatracker.ietf.org/doc/draft-ietf-oauth-status-list/">
- * draft-ietf-oauth-status-list</a>.
- *
- * A bucket holds credentials that all expire before the end of the bucket.
- *
- * @param id identifier, used as storage key
- * @param end upper bound for expiration of any credential in this bucket
+ * Error objects for Status List responses.
*/
-public record StatusListBucket(@Nonnull String id, @Nonnull Instant end) {
-}
+package org.geant.shibboleth.plugin.openidvci.statuslist.messaging.error;
diff --git a/openid-vci-api/src/main/java/org/geant/shibboleth/plugin/oauth/statuslist/StatusListBucket.java b/openid-vci-api/src/main/java/org/geant/shibboleth/plugin/openidvci/statuslist/package-info.java
similarity index 52%
copy from openid-vci-api/src/main/java/org/geant/shibboleth/plugin/oauth/statuslist/StatusListBucket.java
copy to openid-vci-api/src/main/java/org/geant/shibboleth/plugin/openidvci/statuslist/package-info.java
index 8a3d844..0dcca94 100644
--- a/openid-vci-api/src/main/java/org/geant/shibboleth/plugin/oauth/statuslist/StatusListBucket.java
+++ b/openid-vci-api/src/main/java/org/geant/shibboleth/plugin/openidvci/statuslist/package-info.java
@@ -14,21 +14,7 @@
* limitations under the License.
*/
-package org.geant.shibboleth.plugin.oauth.statuslist;
-
-import java.time.Instant;
-
-import javax.annotation.Nonnull;
-
/**
- * Immutable identity of one Status List as in
- * <a href="https://datatracker.ietf.org/doc/draft-ietf-oauth-status-list/">
- * draft-ietf-oauth-status-list</a>.
- *
- * A bucket holds credentials that all expire before the end of the bucket.
- *
- * @param id identifier, used as storage key
- * @param end upper bound for expiration of any credential in this bucket
+ * Token Status List model and encoding.
*/
-public record StatusListBucket(@Nonnull String id, @Nonnull Instant end) {
-}
+package org.geant.shibboleth.plugin.openidvci.statuslist;
diff --git a/openid-vci-api/src/main/java/org/geant/shibboleth/plugin/oauth/statuslist/profile/StatusListEventIds.java b/openid-vci-api/src/main/java/org/geant/shibboleth/plugin/openidvci/statuslist/profile/StatusListEventIds.java
similarity index 94%
rename from openid-vci-api/src/main/java/org/geant/shibboleth/plugin/oauth/statuslist/profile/StatusListEventIds.java
rename to openid-vci-api/src/main/java/org/geant/shibboleth/plugin/openidvci/statuslist/profile/StatusListEventIds.java
index e06e57d..f4d7170 100644
--- a/openid-vci-api/src/main/java/org/geant/shibboleth/plugin/oauth/statuslist/profile/StatusListEventIds.java
+++ b/openid-vci-api/src/main/java/org/geant/shibboleth/plugin/openidvci/statuslist/profile/StatusListEventIds.java
@@ -14,7 +14,7 @@
* limitations under the License.
*/
-package org.geant.shibboleth.plugin.oauth.statuslist.profile;
+package org.geant.shibboleth.plugin.openidvci.statuslist.profile;
import javax.annotation.Nonnull;
diff --git a/openid-vci-api/src/main/java/org/geant/shibboleth/plugin/oauth/statuslist/StatusListBucket.java b/openid-vci-api/src/main/java/org/geant/shibboleth/plugin/openidvci/statuslist/profile/package-info.java
similarity index 52%
copy from openid-vci-api/src/main/java/org/geant/shibboleth/plugin/oauth/statuslist/StatusListBucket.java
copy to openid-vci-api/src/main/java/org/geant/shibboleth/plugin/openidvci/statuslist/profile/package-info.java
index 8a3d844..bb7ccfb 100644
--- a/openid-vci-api/src/main/java/org/geant/shibboleth/plugin/oauth/statuslist/StatusListBucket.java
+++ b/openid-vci-api/src/main/java/org/geant/shibboleth/plugin/openidvci/statuslist/profile/package-info.java
@@ -14,21 +14,7 @@
* limitations under the License.
*/
-package org.geant.shibboleth.plugin.oauth.statuslist;
-
-import java.time.Instant;
-
-import javax.annotation.Nonnull;
-
/**
- * Immutable identity of one Status List as in
- * <a href="https://datatracker.ietf.org/doc/draft-ietf-oauth-status-list/">
- * draft-ietf-oauth-status-list</a>.
- *
- * A bucket holds credentials that all expire before the end of the bucket.
- *
- * @param id identifier, used as storage key
- * @param end upper bound for expiration of any credential in this bucket
+ * Event identifiers for Status List profile actions.
*/
-public record StatusListBucket(@Nonnull String id, @Nonnull Instant end) {
-}
+package org.geant.shibboleth.plugin.openidvci.statuslist.profile;
diff --git a/openid-vci-api/src/main/java/org/geant/shibboleth/plugin/openidvci/token/support/CredentialOfferClaimsSet.java b/openid-vci-api/src/main/java/org/geant/shibboleth/plugin/openidvci/token/support/CredentialOfferClaimsSet.java
index 6383445..2244e13 100644
--- a/openid-vci-api/src/main/java/org/geant/shibboleth/plugin/openidvci/token/support/CredentialOfferClaimsSet.java
+++ b/openid-vci-api/src/main/java/org/geant/shibboleth/plugin/openidvci/token/support/CredentialOfferClaimsSet.java
@@ -1,12 +1,14 @@
/*
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
+ * Copyright (c) 2025, GÉANT
+ *
+ * Licensed under the Apache License, Version 2.0 (the “License”); you may not
+ * use this file except in compliance with the License. You may obtain a copy
+ * of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
+ * distributed under the License is distributed on an “AS IS” BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
@@ -23,6 +25,9 @@ import net.shibboleth.shared.security.DataSealerException;
import java.text.ParseException;
+/**
+ * Claims set of a Credential Offer token.
+ */
public final class CredentialOfferClaimsSet extends TokenClaimsSet {
/** Value of credential offer claims set type. */
diff --git a/openid-vci-api/src/main/java/org/geant/shibboleth/plugin/oauth/statuslist/StatusListBucket.java b/openid-vci-api/src/main/java/org/geant/shibboleth/plugin/openidvci/token/support/package-info.java
similarity index 52%
copy from openid-vci-api/src/main/java/org/geant/shibboleth/plugin/oauth/statuslist/StatusListBucket.java
copy to openid-vci-api/src/main/java/org/geant/shibboleth/plugin/openidvci/token/support/package-info.java
index 8a3d844..0fa1c9f 100644
--- a/openid-vci-api/src/main/java/org/geant/shibboleth/plugin/oauth/statuslist/StatusListBucket.java
+++ b/openid-vci-api/src/main/java/org/geant/shibboleth/plugin/openidvci/token/support/package-info.java
@@ -14,21 +14,7 @@
* limitations under the License.
*/
-package org.geant.shibboleth.plugin.oauth.statuslist;
-
-import java.time.Instant;
-
-import javax.annotation.Nonnull;
-
/**
- * Immutable identity of one Status List as in
- * <a href="https://datatracker.ietf.org/doc/draft-ietf-oauth-status-list/">
- * draft-ietf-oauth-status-list</a>.
- *
- * A bucket holds credentials that all expire before the end of the bucket.
- *
- * @param id identifier, used as storage key
- * @param end upper bound for expiration of any credential in this bucket
+ * Claims sets for OpenID4VCI tokens.
*/
-public record StatusListBucket(@Nonnull String id, @Nonnull Instant end) {
-}
+package org.geant.shibboleth.plugin.openidvci.token.support;
diff --git a/openid-vci-dist/pom.xml b/openid-vci-dist/pom.xml
index 342c1b7..5329f7c 100644
--- a/openid-vci-dist/pom.xml
+++ b/openid-vci-dist/pom.xml
@@ -13,7 +13,7 @@
<artifactId>openid-vci-dist</artifactId>
<packaging>pom</packaging>
<properties>
- <checkstyle.configLocation>${project.basedir}/../checkstyle.xml</checkstyle.configLocation>
+ <checkstyle.configLocation>${project.basedir}/../resources/checkstyle/checkstyle.xml</checkstyle.configLocation>
<dist.finalName>shibboleth-idp-plugin-openid-vci-${project.version}</dist.finalName>
<dist.assemblyDirectory>${project.build.directory}/${dist.finalName}</dist.assemblyDirectory>
</properties>
diff --git a/openid-vci-impl/pom.xml b/openid-vci-impl/pom.xml
index 1835c69..2f74d9d 100644
--- a/openid-vci-impl/pom.xml
+++ b/openid-vci-impl/pom.xml
@@ -15,7 +15,7 @@
<artifactId>openid-vci-impl</artifactId>
<packaging>jar</packaging>
<properties>
- <checkstyle.configLocation>${project.basedir}/../checkstyle.xml</checkstyle.configLocation>
+ <checkstyle.configLocation>${project.basedir}/../resources/checkstyle/checkstyle.xml</checkstyle.configLocation>
<automatic.module.name>org.geant.shibboleth.plugin.openidvci.impl</automatic.module.name>
</properties>
<dependencies>
@@ -65,11 +65,20 @@
<groupId>net.shibboleth.idp.plugin.oidc</groupId>
<artifactId>idp-plugin-oidc-op-api</artifactId>
</dependency>
+ <dependency>
+ <groupId>net.shibboleth.idp.plugin.oidc</groupId>
+ <artifactId>idp-plugin-oidc-op-impl</artifactId>
+ </dependency>
<dependency>
<groupId>net.shibboleth.oidc</groupId>
<artifactId>oidc-common-profile-api</artifactId>
<scope>provided</scope>
</dependency>
+ <dependency>
+ <groupId>net.shibboleth.oidc</groupId>
+ <artifactId>oidc-common-profile-impl</artifactId>
+ <scope>provided</scope>
+ </dependency>
<dependency>
<groupId>net.shibboleth.oidc</groupId>
<artifactId>oidc-common-crypto-impl</artifactId>
diff --git a/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/authn/impl/WalletCredentialValidator.java b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/authn/impl/WalletCredentialValidator.java
index d5dac36..92c3f05 100644
--- a/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/authn/impl/WalletCredentialValidator.java
+++ b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/authn/impl/WalletCredentialValidator.java
@@ -1,12 +1,14 @@
/*
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
+ * Copyright (c) 2025, GÉANT
+ *
+ * Licensed under the Apache License, Version 2.0 (the “License”); you may not
+ * use this file except in compliance with the License. You may obtain a copy
+ * of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
+ * distributed under the License is distributed on an “AS IS” BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
@@ -46,12 +48,15 @@ public class WalletCredentialValidator extends AbstractCredentialValidator {
@Nonnull
private final Logger log = LoggerFactory.getLogger(WalletCredentialValidator.class);
+ /** {@inheritDoc} */
@Override
- protected Subject doValidate(ProfileRequestContext profileRequestContext,
- AuthenticationContext authenticationContext, WarningHandler warningHandler, ErrorHandler errorHandler)
+ protected Subject doValidate(final ProfileRequestContext profileRequestContext,
+ final AuthenticationContext authenticationContext, final WarningHandler warningHandler,
+ final ErrorHandler errorHandler)
throws Exception {
- APIRequestClientIDLookupFunction apiRequestClientIDLookupFunction = new APIRequestClientIDLookupFunction();
+ final APIRequestClientIDLookupFunction apiRequestClientIDLookupFunction =
+ new APIRequestClientIDLookupFunction();
// TODO Auto-generated method stub
final Subject subject = new Subject();
final ClientID clientId = apiRequestClientIDLookupFunction
diff --git a/openid-vci-api/src/main/java/org/geant/shibboleth/plugin/oauth/statuslist/StatusListBucket.java b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/authn/impl/package-info.java
similarity index 52%
copy from openid-vci-api/src/main/java/org/geant/shibboleth/plugin/oauth/statuslist/StatusListBucket.java
copy to openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/authn/impl/package-info.java
index 8a3d844..4cddeab 100644
--- a/openid-vci-api/src/main/java/org/geant/shibboleth/plugin/oauth/statuslist/StatusListBucket.java
+++ b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/authn/impl/package-info.java
@@ -14,21 +14,7 @@
* limitations under the License.
*/
-package org.geant.shibboleth.plugin.oauth.statuslist;
-
-import java.time.Instant;
-
-import javax.annotation.Nonnull;
-
/**
- * Immutable identity of one Status List as in
- * <a href="https://datatracker.ietf.org/doc/draft-ietf-oauth-status-list/">
- * draft-ietf-oauth-status-list</a>.
- *
- * A bucket holds credentials that all expire before the end of the bucket.
- *
- * @param id identifier, used as storage key
- * @param end upper bound for expiration of any credential in this bucket
+ * Authentication support for wallet clients.
*/
-public record StatusListBucket(@Nonnull String id, @Nonnull Instant end) {
-}
+package org.geant.shibboleth.plugin.openidvci.authn.impl;
diff --git a/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/config/impl/DefaultOpenIDVCICredentialOfferConfiguration.java b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/config/impl/DefaultOpenIDVCICredentialOfferConfiguration.java
deleted file mode 100644
index ce80a74..0000000
--- a/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/config/impl/DefaultOpenIDVCICredentialOfferConfiguration.java
+++ /dev/null
@@ -1,11 +0,0 @@
-package org.geant.shibboleth.plugin.openidvci.config.impl;
-
-import org.geant.shibboleth.plugin.openidvci.config.OpenIDVCIConfiguration;
-
-public class DefaultOpenIDVCICredentialOfferConfiguration extends AbstractOpenIDVCIConfiguration{
-
- public DefaultOpenIDVCICredentialOfferConfiguration() {
- super(OpenIDVCIConfiguration.PROFILE_ID_CREDENTIAL_OFFER);
- }
-
-}
diff --git a/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/config/impl/DefaultOpenIDVCICredentialsConfiguration.java b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/config/impl/DefaultOpenIDVCICredentialsConfiguration.java
deleted file mode 100644
index b379bc7..0000000
--- a/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/config/impl/DefaultOpenIDVCICredentialsConfiguration.java
+++ /dev/null
@@ -1,11 +0,0 @@
-package org.geant.shibboleth.plugin.openidvci.config.impl;
-
-import org.geant.shibboleth.plugin.openidvci.config.OpenIDVCIConfiguration;
-
-public class DefaultOpenIDVCICredentialsConfiguration extends AbstractOpenIDVCIConfiguration{
-
- public DefaultOpenIDVCICredentialsConfiguration() {
- super(OpenIDVCIConfiguration.PROFILE_ID_CREDENTIALS);
- }
-
-}
diff --git a/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/config/impl/DefaultOpenIDVCINonceConfiguration.java b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/config/impl/DefaultOpenIDVCINonceConfiguration.java
deleted file mode 100644
index 7df9b97..0000000
--- a/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/config/impl/DefaultOpenIDVCINonceConfiguration.java
+++ /dev/null
@@ -1,11 +0,0 @@
-package org.geant.shibboleth.plugin.openidvci.config.impl;
-
-import org.geant.shibboleth.plugin.openidvci.config.OpenIDVCIConfiguration;
-
-public class DefaultOpenIDVCINonceConfiguration extends AbstractOpenIDVCIConfiguration{
-
- public DefaultOpenIDVCINonceConfiguration() {
- super(OpenIDVCIConfiguration.PROFILE_ID_NONCE);
- }
-
-}
diff --git a/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/config/impl/DefaultOpenIDVCITokenConfiguration.java b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/config/impl/DefaultOpenIDVCITokenConfiguration.java
deleted file mode 100644
index 5e51cdf..0000000
--- a/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/config/impl/DefaultOpenIDVCITokenConfiguration.java
+++ /dev/null
@@ -1,11 +0,0 @@
-package org.geant.shibboleth.plugin.openidvci.config.impl;
-
-import org.geant.shibboleth.plugin.openidvci.config.OpenIDVCIConfiguration;
-
-public class DefaultOpenIDVCITokenConfiguration extends AbstractOpenIDVCIConfiguration{
-
- public DefaultOpenIDVCITokenConfiguration() {
- super(OpenIDVCIConfiguration.PROFILE_ID_TOKEN);
- }
-
-}
diff --git a/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/config/impl/stolen/AbstractOAuth2ClientAuthenticableProfileConfiguration.java b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/config/impl/stolen/AbstractOAuth2ClientAuthenticableProfileConfiguration.java
deleted file mode 100644
index f5f884e..0000000
--- a/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/config/impl/stolen/AbstractOAuth2ClientAuthenticableProfileConfiguration.java
+++ /dev/null
@@ -1,800 +0,0 @@
-/*
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-// TODO: This abstract class is copied as is from shibboleth project. Refactoring needed.
-
-package org.geant.shibboleth.plugin.openidvci.config.impl.stolen;
-
-import java.security.Principal;
-import java.util.Collection;
-import java.util.List;
-import java.util.Map;
-import java.util.Set;
-import java.util.function.Function;
-import java.util.function.Predicate;
-
-import javax.annotation.Nonnull;
-import javax.annotation.Nullable;
-
-import org.opensaml.profile.context.ProfileRequestContext;
-
-import com.nimbusds.oauth2.sdk.auth.ClientAuthenticationMethod;
-
-import net.shibboleth.idp.profile.config.AbstractInterceptorAwareProfileConfiguration;
-import net.shibboleth.oidc.jwt.claims.ClaimsValidator;
-import net.shibboleth.oidc.metadata.policy.UnregisteredClientPolicy;
-import net.shibboleth.oidc.profile.oauth2.config.OAuth2ClientAuthenticableClientProfileConfiguration;
-import net.shibboleth.oidc.profile.oauth2.config.OAuth2ClientAuthenticableProfileConfiguration;
-import net.shibboleth.oidc.security.credential.ClientSecretCredential;
-import net.shibboleth.oidc.security.jose.SignatureValidationConfiguration;
-import net.shibboleth.shared.annotation.constraint.NonNegative;
-import net.shibboleth.shared.annotation.constraint.NonnullElements;
-import net.shibboleth.shared.annotation.constraint.NotEmpty;
-import net.shibboleth.shared.annotation.constraint.NotLive;
-import net.shibboleth.shared.annotation.constraint.Unmodifiable;
-import net.shibboleth.shared.collection.CollectionSupport;
-import net.shibboleth.shared.logic.Constraint;
-import net.shibboleth.shared.logic.FunctionSupport;
-import net.shibboleth.shared.logic.PredicateSupport;
-import net.shibboleth.shared.primitive.StringSupport;
-
-/**
- * Base class for OAuth profile configurations that support OAuth-defined client
- * authentication methods.
- */
-public abstract class AbstractOAuth2ClientAuthenticableProfileConfiguration
- extends AbstractInterceptorAwareProfileConfiguration
- implements OAuth2ClientAuthenticableProfileConfiguration, OAuth2ClientAuthenticableClientProfileConfiguration {
-
- /*** Enabled token endpoint authentication methods. */
- @Nonnull
- private Function<ProfileRequestContext, Set<String>> tokenEndpointAuthMethodsLookupStrategy;
-
- /**
- * The token endpoint authentication method to use with an upstream OpenID
- * Provider.
- */
- @Nonnull
- private Function<ProfileRequestContext, String> tokenEndpointAuthMethodLookupStrategy;
-
- /** Validation of JWT claims for subset of client auth methods. */
- @Nonnull
- private Function<ProfileRequestContext, ClaimsValidator> claimsValidatorLookupStrategy;
-
- /** Whether to mandate forced authentication for the request. */
- @Nonnull
- private Predicate<ProfileRequestContext> forceAuthnPredicate;
-
- /** Lookup function to supply proxyCount property. */
- @Nonnull
- private Function<ProfileRequestContext, Integer> proxyCountLookupStrategy;
-
- /** Lookup function to supply default authentication methods. */
- @Nonnull
- private Function<ProfileRequestContext, Collection<Principal>> defaultAuthenticationContextsLookupStrategy;
-
- /** Lookup function to supply authentication flows. */
- @Nonnull
- private Function<ProfileRequestContext, Set<String>> authenticationFlowsLookupStrategy;
-
- /** Lookup function to supply post authentication flows. */
- @Nonnull
- private Function<ProfileRequestContext, Collection<String>> postAuthenticationFlowsLookupStrategy;
-
- /**
- * Lookup function to retrieve a client credential from the given profile
- * request context.
- */
- @Nonnull
- private Function<ProfileRequestContext, ClientSecretCredential> clientCredentialLookupStrategy;
-
- /**
- * Lookup function to retrieve the client_id from the given profile request
- * context.
- */
- // TODO this is the same as the issuer in the proxy context?
- @Nonnull
- private Function<ProfileRequestContext, String> clientIdLookupStrategy;
-
- /**
- * Lookup function to retrieve the policy for validating claims of an
- * unregistered client.
- */
- @Nonnull
- private Function<ProfileRequestContext, Map<String, UnregisteredClientPolicy>> unregisteredClientPolicyLookupStrategy;
-
- /** Validation of JWT claims for DPoP proofs. */
- @Nonnull
- private Function<ProfileRequestContext, ClaimsValidator> dpopProofClaimsValidatorLookupStrategy;
-
- /** Validation of JWT signature of DPoP proofs. */
- @Nonnull
- private Function<ProfileRequestContext, SignatureValidationConfiguration> dpopSignatureValidationConfigurationLookupStrategy;
-
- /** Whether client is required to include DPoP Proof JWT in API request. */
- @Nonnull
- private Predicate<ProfileRequestContext> requireDpopProofPredicate;
-
- /** Lookup function to retrieve nonce generator for DPoP proofs. */
- @Nonnull
- private Function<ProfileRequestContext, Function<ProfileRequestContext, String>> dpopProofNonceGeneratorLookupStrategy;
-
- /**
- * Should the audience claim of a JWT be targeted to a specific endpoint on the
- * recipient? Defaults to true.
- */
- @Nonnull
- private Predicate<ProfileRequestContext> useTargetedEndpointAsJWTAudiencePredicate;
-
- /**
- * Lookup function to determine the 'typ' header parameter value for a client
- * authentication JWT.
- */
- @Nonnull
- private Function<ProfileRequestContext, String> clientAuthenticationJWTTypeLookupStrategy;
-
- /**
- * Whether single audience value is required in the JWT audience claim.
- */
- @Nonnull
- private Predicate<ProfileRequestContext> requireSingleJWTAudiencePredicate;
-
- /**
- * Constructor.
- *
- * @param profileId Unique profile identifier
- */
- protected AbstractOAuth2ClientAuthenticableProfileConfiguration(@Nonnull @NotEmpty final String profileId) {
- super(profileId);
-
- tokenEndpointAuthMethodsLookupStrategy = FunctionSupport
- .constant(CollectionSupport.setOf(ClientAuthenticationMethod.CLIENT_SECRET_BASIC.toString(),
- ClientAuthenticationMethod.CLIENT_SECRET_POST.toString(),
- ClientAuthenticationMethod.CLIENT_SECRET_JWT.toString(),
- ClientAuthenticationMethod.PRIVATE_KEY_JWT.toString()));
- tokenEndpointAuthMethodLookupStrategy = FunctionSupport
- .constant(ClientAuthenticationMethod.CLIENT_SECRET_BASIC.toString());
- claimsValidatorLookupStrategy = FunctionSupport.constant(null);
- forceAuthnPredicate = PredicateSupport.alwaysFalse();
- proxyCountLookupStrategy = FunctionSupport.constant(null);
- defaultAuthenticationContextsLookupStrategy = FunctionSupport.constant(null);
- authenticationFlowsLookupStrategy = FunctionSupport.constant(null);
- postAuthenticationFlowsLookupStrategy = FunctionSupport.constant(null);
- clientCredentialLookupStrategy = FunctionSupport.constant(null);
- clientIdLookupStrategy = FunctionSupport.constant(null);
- unregisteredClientPolicyLookupStrategy = FunctionSupport.constant(null);
- dpopProofClaimsValidatorLookupStrategy = FunctionSupport.constant(null);
- dpopSignatureValidationConfigurationLookupStrategy = FunctionSupport.constant(null);
- requireDpopProofPredicate = PredicateSupport.alwaysFalse();
- dpopProofNonceGeneratorLookupStrategy = FunctionSupport.constant(null);
- useTargetedEndpointAsJWTAudiencePredicate = PredicateSupport.alwaysTrue();
- clientAuthenticationJWTTypeLookupStrategy = FunctionSupport.constant(null);
- requireSingleJWTAudiencePredicate = PredicateSupport.alwaysFalse();
- }
-
- /** {@inheritDoc} */
- @Override
- @Nonnull
- @NonnullElements
- @NotLive
- @Unmodifiable
- public Set<String> getTokenEndpointAuthMethods(@Nullable final ProfileRequestContext profileRequestContext) {
-
- final Collection<String> methods = tokenEndpointAuthMethodsLookupStrategy.apply(profileRequestContext);
- if (methods != null) {
- return CollectionSupport.copyToSet(methods);
- }
- return CollectionSupport.emptySet();
- }
-
- /**
- * Set the enabled token endpoint authentication methods.
- *
- * @param methods What to set.
- */
- public void setTokenEndpointAuthMethods(@Nonnull @NonnullElements final Collection<String> methods) {
- Constraint.isNotNull(methods, "Collection of methods cannot be null");
-
- tokenEndpointAuthMethodsLookupStrategy = FunctionSupport
- .constant(Set.copyOf(StringSupport.normalizeStringCollection(methods)));
- }
-
- /**
- * Set a lookup strategy for the enabled token endpoint authentication methods.
- *
- * @param strategy lookup strategy
- */
- public void setTokenEndpointAuthMethodsLookupStrategy(
- @Nonnull final Function<ProfileRequestContext, Set<String>> strategy) {
- tokenEndpointAuthMethodsLookupStrategy = Constraint.isNotNull(strategy, "Lookup strategy cannot be null");
- }
-
- /** {@inheritDoc} */
- @Override
- @Nullable
- public String getTokenEndpointAuthMethod(@Nullable final ProfileRequestContext profileRequestContext) {
- return tokenEndpointAuthMethodLookupStrategy.apply(profileRequestContext);
- }
-
- /**
- * Set the enabled token endpoint authentication method to use with an upstream
- * OpenID Provider.
- *
- * @param method the token endpoint authentication method to set.
- *
- * @since 2.2.0
- */
- public void setTokenEndpointAuthMethod(@Nonnull @NonnullElements final String method) {
- tokenEndpointAuthMethodLookupStrategy = FunctionSupport
- .constant(Constraint.isNotNull(method, "Collection of methods cannot be null"));
- }
-
- /**
- * Set a lookup strategy to find the enabled token endpoint authentication
- * method to use with an upstream OpenID Provider.
- *
- * @param strategy lookup strategy
- *
- * @since 2.2.0
- */
- public void setTokenEndpointAuthMethodLookupStrategy(
- @Nonnull final Function<ProfileRequestContext, String> strategy) {
- tokenEndpointAuthMethodLookupStrategy = Constraint.isNotNull(strategy, "Lookup strategy cannot be null");
- }
-
- /**
- * Get the {@link ClaimsValidator} to apply to JWT-based client authentication.
- *
- * @param profileRequestContext current profile request context
- *
- * @return the validator to use
- *
- * @since 3.1.0
- */
- @Override
- @Nullable
- public ClaimsValidator getClaimsValidator(@Nullable final ProfileRequestContext profileRequestContext) {
- return claimsValidatorLookupStrategy.apply(profileRequestContext);
- }
-
- /**
- * Set the {@link ClaimsValidator} to apply to JWT-based client authentication.
- *
- * @param validator validator to use
- *
- * @since 3.1.0
- */
- public void setClaimsValidator(@Nullable final ClaimsValidator validator) {
- claimsValidatorLookupStrategy = FunctionSupport.constant(validator);
- }
-
- /**
- * Set a lookup strategy for the {@link ClaimsValidator} to apply to JWT-based
- * client authentication.
- *
- * @param strategy lookup strategy
- *
- * @since 3.1.0
- */
- public void setClaimsValidatorLookupStrategy(
- @Nonnull final Function<ProfileRequestContext, ClaimsValidator> strategy) {
- claimsValidatorLookupStrategy = Constraint.isNotNull(strategy, "Lookup strategy cannot be null");
- }
-
- /** {@inheritDoc} */
- @Override
- public boolean isForceAuthn(@Nullable final ProfileRequestContext profileRequestContext) {
- return forceAuthnPredicate.test(profileRequestContext);
- }
-
- /**
- * Set whether a fresh user presence proof should be required for this request.
- *
- * @param flag flag to set
- */
- public void setForceAuthn(final boolean flag) {
- forceAuthnPredicate = flag ? PredicateSupport.alwaysTrue() : PredicateSupport.alwaysFalse();
- }
-
- /**
- * Set a condition to determine whether a fresh user presence proof should be
- * required for this request.
- *
- * @param condition condition to set
- */
- public void setForceAuthnPredicate(@Nonnull final Predicate<ProfileRequestContext> condition) {
- forceAuthnPredicate = Constraint.isNotNull(condition, "Forced authentication predicate cannot be null");
- }
-
- /** {@inheritDoc} */
- @Override
- @Nullable
- public Integer getProxyCount(@Nullable final ProfileRequestContext profileRequestContext) {
- final Integer count = proxyCountLookupStrategy.apply(profileRequestContext);
- if (count != null) {
- Constraint.isGreaterThanOrEqual(0, count, "Proxy count must be greater than or equal to 0");
- }
- return count;
- }
-
- /**
- * Sets the maximum number of times an assertion may be proxied outbound and/or
- * the maximum number of hops between the relying party and a proxied
- * authentication authority inbound.
- *
- * @param count proxy count
- */
- public void setProxyCount(@Nullable @NonNegative final Integer count) {
- if (count != null) {
- Constraint.isGreaterThanOrEqual(0, count, "Proxy count must be greater than or equal to 0");
- }
- proxyCountLookupStrategy = FunctionSupport.constant(count);
- }
-
- /**
- * Set a lookup strategy for the maximum number of times an assertion may be
- * proxied outbound and/or the maximum number of hops between the relying party
- * and a proxied authentication authority inbound.
- *
- * @param strategy lookup strategy
- */
- public void setProxyCountLookupStrategy(@Nonnull final Function<ProfileRequestContext, Integer> strategy) {
- proxyCountLookupStrategy = Constraint.isNotNull(strategy, "Lookup strategy cannot be null");
- }
-
- /** {@inheritDoc} */
- @Override
- @Nonnull
- @NonnullElements
- @NotLive
- @Unmodifiable
- public Set<String> getAuthenticationFlows(@Nullable final ProfileRequestContext profileRequestContext) {
- final Set<String> flows = authenticationFlowsLookupStrategy.apply(profileRequestContext);
- if (flows != null) {
- return CollectionSupport.copyToSet(flows);
- }
- return CollectionSupport.emptySet();
- }
-
- /**
- * Set the authentication flows to use.
- *
- * @param flows flow identifiers to use
- */
- public void setAuthenticationFlows(@Nullable @NonnullElements final Collection<String> flows) {
- if (flows != null) {
- authenticationFlowsLookupStrategy = FunctionSupport
- .constant(Set.copyOf(StringSupport.normalizeStringCollection(flows)));
- } else {
- authenticationFlowsLookupStrategy = FunctionSupport.constant(null);
- }
- }
-
- /**
- * Set a lookup strategy for the authentication flows to use.
- *
- * @param strategy lookup strategy
- */
- public void setAuthenticationFlowsLookupStrategy(
- @Nonnull final Function<ProfileRequestContext, Set<String>> strategy) {
- authenticationFlowsLookupStrategy = Constraint.isNotNull(strategy, "Lookup strategy cannot be null");
- }
-
- /** {@inheritDoc} */
- @Override
- @Nonnull
- @NonnullElements
- @NotLive
- @Unmodifiable
- public List<String> getPostAuthenticationFlows(@Nullable final ProfileRequestContext profileRequestContext) {
- final Collection<String> flows = postAuthenticationFlowsLookupStrategy.apply(profileRequestContext);
- if (flows != null) {
- return CollectionSupport.copyToList(flows);
- }
- return CollectionSupport.emptyList();
- }
-
- /**
- * Set the ordered collection of post-authentication interceptor flows to
- * enable.
- *
- * @param flows flow identifiers to enable
- */
- public void setPostAuthenticationFlows(@Nullable @NonnullElements final Collection<String> flows) {
- if (flows != null) {
- postAuthenticationFlowsLookupStrategy = FunctionSupport
- .constant(List.copyOf(StringSupport.normalizeStringCollection(flows)));
- } else {
- postAuthenticationFlowsLookupStrategy = FunctionSupport.constant(null);
- }
- }
-
- /**
- * Set a lookup strategy for the post-authentication interceptor flows to
- * enable.
- *
- * @param strategy lookup strategy
- */
- public void setPostAuthenticationFlowsLookupStrategy(
- @Nonnull final Function<ProfileRequestContext, Collection<String>> strategy) {
- postAuthenticationFlowsLookupStrategy = Constraint.isNotNull(strategy, "Lookup strategy cannot be null");
- }
-
- /** {@inheritDoc} */
- @Override
- @Nonnull
- @NonnullElements
- @NotLive
- @Unmodifiable
- public List<Principal> getDefaultAuthenticationMethods(
- @Nullable final ProfileRequestContext profileRequestContext) {
- final Collection<Principal> methods = defaultAuthenticationContextsLookupStrategy.apply(profileRequestContext);
- if (methods != null) {
- return CollectionSupport.copyToList(methods);
- }
- return CollectionSupport.emptyList();
- }
-
- /**
- * Set the default authentication contexts to use, expressed as custom
- * principals.
- *
- * @param contexts default authentication contexts to use
- */
- public void setDefaultAuthenticationMethods(@Nullable @NonnullElements final Collection<Principal> contexts) {
- if (contexts != null) {
- defaultAuthenticationContextsLookupStrategy = FunctionSupport
- .constant(CollectionSupport.copyToList(contexts));
- } else {
- defaultAuthenticationContextsLookupStrategy = FunctionSupport.constant(null);
- }
- }
-
- /**
- * Set a lookup strategy for the authentication contexts to use, expressed as
- * custom principals.
- *
- * @param strategy lookup strategy
- */
- public void setDefaultAuthenticationMethodsLookupStrategy(
- @Nonnull final Function<ProfileRequestContext, Collection<Principal>> strategy) {
- defaultAuthenticationContextsLookupStrategy = Constraint.isNotNull(strategy, "Lookup strategy cannot be null");
- }
-
- /**
- * Set the client credential lookup strategy.
- *
- * @param strategy the strategy to use
- *
- * @since 2.2.0
- */
- public void setClientCredentialLookupStrategy(
- @Nonnull final Function<ProfileRequestContext, ClientSecretCredential> strategy) {
- clientCredentialLookupStrategy = Constraint.isNotNull(strategy,
- "Client credential lookup strategy can not be null");
- }
-
- /**
- * Set a fixed client credential to use no matter what the context/request.
- *
- * @param clientCredential the static client credential to use
- *
- * @since 2.2.0
- */
- public void setClientCredential(@Nullable final ClientSecretCredential clientCredential) {
- clientCredentialLookupStrategy = FunctionSupport.constant(clientCredential);
- }
-
- /** {@inheritDoc} */
- @Override
- public ClientSecretCredential getClientCredential(@Nullable final ProfileRequestContext profileRequestContext) {
- return clientCredentialLookupStrategy.apply(profileRequestContext);
- }
-
- /**
- * Set the strategy to locate a client_id.
- *
- * @param strategy the strategy to use
- *
- * @since 2.2.0
- */
- public void setClientIdLookupStrategy(@Nonnull final Function<ProfileRequestContext, String> strategy) {
- clientIdLookupStrategy = Constraint.isNotNull(strategy, "Client ID lookup strategy can not be null");
- }
-
- /**
- * Set a fixed client_id to use no matter what the context/request.
- *
- * @param clientId the static clientId to use
- *
- * @since 2.2.0
- */
- public void setClientId(@Nullable final String clientId) {
- clientIdLookupStrategy = FunctionSupport.constant(StringSupport.trimOrNull(clientId));
- }
-
- /** {@inheritDoc} */
- @Override
- @Nullable
- public String getClientId(@Nullable final ProfileRequestContext profileRequestContext) {
- return clientIdLookupStrategy.apply(profileRequestContext);
- }
-
- /** {@inheritDoc} */
- @Override
- @Nonnull
- @Unmodifiable
- public Map<String, UnregisteredClientPolicy> getUnregisteredClientPolicy(
- @Nullable final ProfileRequestContext profileRequestContext) {
- final Map<String, UnregisteredClientPolicy> result = unregisteredClientPolicyLookupStrategy
- .apply(profileRequestContext);
- if (result == null) {
- return CollectionSupport.emptyMap();
- }
- return CollectionSupport.copyToMap(result);
- }
-
- /**
- * Sets the policy for validating unregistered clients.
- *
- * @param policy policy to set
- *
- * @since 3.0.0
- */
- public void setUnregisteredClientPolicy(@Nullable final Map<String, UnregisteredClientPolicy> policy) {
- unregisteredClientPolicyLookupStrategy = FunctionSupport.constant(policy);
- }
-
- /**
- * Set a lookup strategy for the policy for validating unregistered clients.
- *
- * @param strategy lookup strategy
- *
- * @since 3.0.0
- */
- public void setUnregisteredClientPolicyLookupStrategy(
- @Nonnull final Function<ProfileRequestContext, Map<String, UnregisteredClientPolicy>> strategy) {
- unregisteredClientPolicyLookupStrategy = Constraint.isNotNull(strategy, "Lookup strategy cannot be null");
- }
-
- /** {@inheritDoc} */
- @Override
- @Nullable
- public ClaimsValidator getDpopProofClaimsValidator(@Nullable final ProfileRequestContext profileRequestContext) {
- return dpopProofClaimsValidatorLookupStrategy.apply(profileRequestContext);
- }
-
- /**
- * Set the {@link ClaimsValidator} to apply to DPoP Proof JWT.
- *
- * @param validator validator to use
- *
- * @since 3.2.0
- */
- public void setDpopProofClaimsValidator(@Nullable final ClaimsValidator validator) {
- dpopProofClaimsValidatorLookupStrategy = FunctionSupport.constant(validator);
- }
-
- /**
- * Set a lookup strategy for the {@link ClaimsValidator} to apply to DPoP Proof
- * JWT.
- *
- * @param strategy lookup strategy
- *
- * @since 3.2.0
- */
- public void setDpopProofClaimsValidatorLookupStrategy(
- @Nonnull final Function<ProfileRequestContext, ClaimsValidator> strategy) {
- dpopProofClaimsValidatorLookupStrategy = Constraint.isNotNull(strategy, "Lookup strategy cannot be null");
- }
-
- /** {@inheritDoc} */
- @Override
- @Nullable
- public SignatureValidationConfiguration getDpopProofSignatureValidationConfiguration(
- @Nullable final ProfileRequestContext profileRequestContext) {
- return dpopSignatureValidationConfigurationLookupStrategy.apply(profileRequestContext);
- }
-
- /**
- * Set the {@link SignatureValidationConfiguration} to validate the DPoP Proof
- * JWT signatures.
- *
- * @param configuration configuration to use
- *
- * @since 3.2.0
- */
- public void setDpopProofSignatureValidationConfiguration(
- @Nullable final SignatureValidationConfiguration configuration) {
- dpopSignatureValidationConfigurationLookupStrategy = FunctionSupport.constant(configuration);
- }
-
- /**
- * Set a lookup strategy for the {@link SignatureValidationConfiguration} to
- * validate the DPoP Proof JWT signatures.
- *
- * @param strategy lookup strategy
- *
- * @since 3.2.0
- */
- public void setDpopProofSignatureValidationConfigurationLookupStrategy(
- @Nonnull final Function<ProfileRequestContext, SignatureValidationConfiguration> strategy) {
- dpopSignatureValidationConfigurationLookupStrategy = Constraint.isNotNull(strategy,
- "Lookup strategy cannot be null");
- }
-
- /** {@inheritDoc} */
- @Override
- public boolean isRequireDpopProof(@Nullable final ProfileRequestContext profileRequestContext) {
- return requireDpopProofPredicate.test(profileRequestContext);
- }
-
- /**
- * Set whether client is required to include DPoP proof in request.
- *
- * @param flag flag to set
- *
- * @since 3.2.0
- */
- public void setRequireDpopProof(final boolean flag) {
- requireDpopProofPredicate = flag ? PredicateSupport.alwaysTrue() : PredicateSupport.alwaysFalse();
- }
-
- /**
- * Set condition for whether client is required to include DPoP proof in
- * request.
- *
- * @param condition condition to set
- *
- * @since 3.2.0
- */
- public void setRequireDpopProofPredicate(@Nonnull final Predicate<ProfileRequestContext> condition) {
- requireDpopProofPredicate = Constraint.isNotNull(condition, "Condition cannot be null");
- }
-
- /** {@inheritDoc} */
- @Override
- @Nullable
- public Function<ProfileRequestContext, String> getDpopProofNonceGenerator(
- @Nullable final ProfileRequestContext profileRequestContext) {
- return dpopProofNonceGeneratorLookupStrategy.apply(profileRequestContext);
- }
-
- /**
- * Set the {@link Function} to create nonces to be used with DPoP Proof JWTs.
- *
- * @param function generator function to use
- *
- * @since 3.2.0
- */
- public void setDpopProofNonceGenerator(@Nullable final Function<ProfileRequestContext, String> function) {
- dpopProofNonceGeneratorLookupStrategy = FunctionSupport.constant(function);
- }
-
- /**
- * Set a lookup strategy for the {@link Function} to create nonces to be used
- * with DPoP Proof JWTs.
- *
- * @param strategy lookup strategy
- *
- * @since 3.2.0
- */
- public void setDpopProofNonceGeneratorLookupStrategy(
- @Nonnull final Function<ProfileRequestContext, Function<ProfileRequestContext, String>> strategy) {
- dpopProofNonceGeneratorLookupStrategy = Constraint.isNotNull(strategy, "Lookup strategy cannot be null");
- }
-
- /** {@inheritDoc} */
- @Override
- public boolean isUseTargetedEndpointAsJWTAudience(@Nullable final ProfileRequestContext profileRequestContext) {
- return useTargetedEndpointAsJWTAudiencePredicate.test(profileRequestContext);
- }
-
- /**
- * Set a condition to determine if the audience claim of a JWT should be
- * targeted to a specific endpoint of the recipient? The endpoint value used
- * will differ depending on the context in which the predicate is used. If the
- * condition returns false, the audience value must be fixed to the issuer
- * identifier of the recipient.
- *
- * @param condition condition to set.
- *
- * @since 3.3.0
- */
- public void setUseTargetedEndpointAsJWTAudiencePredicate(
- @Nonnull final Predicate<ProfileRequestContext> condition) {
- useTargetedEndpointAsJWTAudiencePredicate = Constraint.isNotNull(condition,
- "UseTargetedEndpointAsJWTAudience Condition cannot be null");
- }
-
- /**
- * Set a flag to determine if the audience claim of a JWT should be targeted to
- * a specific endpoint of the recipient? The endpoint value used will differ
- * depending on the context in which the predicate is used. If the condition
- * returns false, the audience value must be fixed to the issuer identifier of
- * the recipient.
- *
- * @param flag the flag to set
- *
- * @since 3.3.0
- */
- public void setUseTargetedEndpointAsJWTAudience(final boolean flag) {
- useTargetedEndpointAsJWTAudiencePredicate = flag ? PredicateSupport.alwaysTrue()
- : PredicateSupport.alwaysFalse();
- }
-
- /** {@inheritDoc} */
- @Override
- @Nullable
- public String getClientAuthenticationJWTType(@Nullable final ProfileRequestContext profileRequestContext) {
- return clientAuthenticationJWTTypeLookupStrategy.apply(profileRequestContext);
- }
-
- /**
- * Set a lookup strategy to determine the 'typ' header parameter value for a
- * client authentication JWT.
- *
- * @param strategy lookup strategy
- *
- * @since 3.3.0
- */
- public void setClientAuthenticationJWTTypeLookupStrategy(
- @Nonnull final Function<ProfileRequestContext, String> strategy) {
- clientAuthenticationJWTTypeLookupStrategy = Constraint.isNotNull(strategy,
- "ClientAuthenticationJWTTypeLookupStrategy can not be null");
- }
-
- /**
- * Set the 'typ' header parameter value for a client authentication JWT.
- *
- * @param type the 'typ' header value to set
- *
- * @since 3.3.0
- */
- public void setClientAuthenticationJWTType(@Nullable final String type) {
- clientAuthenticationJWTTypeLookupStrategy = FunctionSupport.constant(type);
- }
-
- /** {@inheritDoc} */
- @Override
- public boolean isRequireSingleJWTAudience(@Nullable final ProfileRequestContext profileRequestContext) {
- return requireSingleJWTAudiencePredicate.test(profileRequestContext);
- }
-
- /**
- * Set a condition whether single audience value is required in the JWT audience
- * claim. Otherwise the claim can be a list of values.
- *
- * @param condition condition to set.
- *
- * @since 3.3.0
- */
- public void setRequireSingleJWTAudiencePredicate(@Nonnull final Predicate<ProfileRequestContext> condition) {
- requireSingleJWTAudiencePredicate = Constraint.isNotNull(condition,
- "RequireSingleJWTAudiencePredicate Condition cannot be null");
- }
-
- /**
- * Set a flag whether single audience value is required in the JWT audience
- * claim. Otherwise the claim can be a list of values.
- *
- * @param flag the flag to set
- *
- * @since 3.3.0
- */
- public void setRequireSingleJWTAudience(final boolean flag) {
- requireSingleJWTAudiencePredicate = flag ? PredicateSupport.alwaysTrue() : PredicateSupport.alwaysFalse();
- }
-
-}
\ No newline at end of file
diff --git a/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/config/impl/stolen/AbstractOAuth2FlowAwareProfileConfiguration.java b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/config/impl/stolen/AbstractOAuth2FlowAwareProfileConfiguration.java
deleted file mode 100644
index 3e31f1b..0000000
--- a/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/config/impl/stolen/AbstractOAuth2FlowAwareProfileConfiguration.java
+++ /dev/null
@@ -1,163 +0,0 @@
-/*
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.geant.shibboleth.plugin.openidvci.config.impl.stolen;
-
-import java.util.function.Predicate;
-
-import javax.annotation.Nonnull;
-import javax.annotation.Nullable;
-
-import org.opensaml.profile.context.ProfileRequestContext;
-
-import net.shibboleth.oidc.profile.config.OIDCFlowAwareProfileConfiguration;
-import net.shibboleth.oidc.profile.oauth2.config.OAuth2FlowAwareProfileConfiguration;
-import net.shibboleth.shared.annotation.constraint.NotEmpty;
-import net.shibboleth.shared.logic.Constraint;
-import net.shibboleth.shared.logic.PredicateSupport;
-
-/**
- * Base class for OIDC protocol configuration, containing configuration bits shared by all flow aware OIDC protocol
- * configurations.
- */
-public abstract class AbstractOAuth2FlowAwareProfileConfiguration
- extends AbstractOAuth2ClientAuthenticableProfileConfiguration implements OIDCFlowAwareProfileConfiguration,
- OAuth2FlowAwareProfileConfiguration {
-
- /** Predicate used to indicate whether authorization code flow is supported by this profile. Default true. */
- @Nonnull private Predicate<ProfileRequestContext> authorizationCodeFlowPredicate;
-
- /** Predicate used to indicate whether implicit flow is supported by this profile. Default true. */
- @Nonnull private Predicate<ProfileRequestContext> implicitFlowPredicate;
-
- /** Predicate used to indicate whether hybrid flow is supported by this profile. Default true. */
- @Nonnull private Predicate<ProfileRequestContext> hybridFlowPredicate;
-
- /** Predicate used to indicate whether refresh tokens are supported by this profile. Default true. */
- @Nonnull private Predicate<ProfileRequestContext> refreshTokensPredicate;
-
- /**
- * Constructor.
- *
- * @param profileId Unique profile identifier.
- */
- protected AbstractOAuth2FlowAwareProfileConfiguration(@Nonnull @NotEmpty final String profileId) {
- super(profileId);
- authorizationCodeFlowPredicate = PredicateSupport.alwaysTrue();
- implicitFlowPredicate = PredicateSupport.alwaysTrue();
- hybridFlowPredicate = PredicateSupport.alwaysTrue();
- refreshTokensPredicate = PredicateSupport.alwaysTrue();
- }
-
- /** {@inheritDoc} */
- @Override
- public boolean isAuthorizationCodeFlowEnabled(@Nullable final ProfileRequestContext profileRequestContext) {
- return authorizationCodeFlowPredicate.test(profileRequestContext);
- }
-
- /**
- * Set whether authorization code flow is supported by this profile.
- *
- * @param flag flag to set
- */
- public void setAuthorizationCodeFlowEnabled(final boolean flag) {
- authorizationCodeFlowPredicate = flag ? PredicateSupport.alwaysTrue() : PredicateSupport.alwaysFalse();
- }
-
- /**
- * Set condition used to indicate whether authorization code flow is supported by this profile.
- *
- * @param condition condition to set
- */
- public void setAuthorizationCodeFlowEnabledPredicate(@Nonnull final Predicate<ProfileRequestContext> condition) {
- authorizationCodeFlowPredicate = Constraint.isNotNull(condition,
- "Condition used to indicate whether authorization code flow is supported cannot be null");
- }
-
- /** {@inheritDoc} */
- @Override
- public boolean isHybridFlowEnabled(@Nullable final ProfileRequestContext profileRequestContext) {
- return hybridFlowPredicate.test(profileRequestContext);
- }
-
- /**
- * Set whether implicit flow is supported by this profile.
- *
- * @param flag flag to set
- */
- public void setHybridFlowEnabled(final boolean flag) {
- hybridFlowPredicate = flag ? PredicateSupport.alwaysTrue() : PredicateSupport.alwaysFalse();
- }
-
- /**
- * Set condition used to indicate whether implicit flow is supported by this profile.
- *
- * @param condition condition to set
- */
- public void setHybridFlowEnabledPredicate(@Nonnull final Predicate<ProfileRequestContext> condition) {
- hybridFlowPredicate = Constraint.isNotNull(condition,
- "Condition used to indicate whether implicit flow is supported cannot be null");
- }
-
- /** {@inheritDoc} */
- @Override
- public boolean isImplicitFlowEnabled(@Nullable final ProfileRequestContext profileRequestContext) {
- return implicitFlowPredicate.test(profileRequestContext);
- }
-
- /**
- * Set whether hybrid flow is supported by this profile.
- *
- * @param flag flag to set
- */
- public void setImplicitFlowEnabled(final boolean flag) {
- implicitFlowPredicate = flag ? PredicateSupport.alwaysTrue() : PredicateSupport.alwaysFalse();
- }
-
- /**
- * Set condition used to indicate whether hybrid flow is supported by this profile.
- *
- * @param condition condition to set.
- */
- public void setImplicitFlowEnabledPredicate(@Nonnull final Predicate<ProfileRequestContext> condition) {
- implicitFlowPredicate = Constraint.isNotNull(condition,
- "Condition used to indicate whether hybrid flow is supported cannot be null");
- }
-
- /** {@inheritDoc} */
- @Override
- public boolean isRefreshTokensEnabled(@Nullable final ProfileRequestContext profileRequestContext) {
- return refreshTokensPredicate.test(profileRequestContext);
- }
-
- /**
- * Set whether refresh tokens are supported by this profile.
- *
- * @param flag flag to set
- */
- public void setRefreshTokensEnabled(final boolean flag) {
- refreshTokensPredicate = flag ? PredicateSupport.alwaysTrue() : PredicateSupport.alwaysFalse();
- }
-
- /**
- * Set condition used to indicate whether refresh tokens are supported by this profile.
- *
- * @param condition condition to set
- */
- public void setRefreshTokensEnabledPredicate(@Nonnull final Predicate<ProfileRequestContext> condition) {
- refreshTokensPredicate = Constraint.isNotNull(condition,
- "Condition used to indicate whether refresh tokens are supported cannot be null");
- }
-
-}
\ No newline at end of file
diff --git a/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/config/impl/stolen/AbstractOIDCSSOConfiguration.java b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/config/impl/stolen/AbstractOIDCSSOConfiguration.java
deleted file mode 100644
index 05a54ac..0000000
--- a/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/config/impl/stolen/AbstractOIDCSSOConfiguration.java
+++ /dev/null
@@ -1,705 +0,0 @@
-/*
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.geant.shibboleth.plugin.openidvci.config.impl.stolen;
-
-import java.net.URI;
-import java.time.Duration;
-import java.util.Collection;
-import java.util.Map;
-import java.util.Set;
-import java.util.function.BiFunction;
-import java.util.function.BiPredicate;
-import java.util.function.Function;
-import java.util.function.Predicate;
-
-import javax.annotation.Nonnull;
-import javax.annotation.Nullable;
-
-import org.opensaml.profile.context.ProfileRequestContext;
-
-import net.shibboleth.oidc.profile.config.OIDCSSOProviderConfiguration;
-import net.shibboleth.oidc.profile.config.OIDCSSORelyingPartyConfiguration;
-import net.shibboleth.shared.annotation.constraint.NonnullElements;
-import net.shibboleth.shared.annotation.constraint.NotEmpty;
-import net.shibboleth.shared.annotation.constraint.NotLive;
-import net.shibboleth.shared.annotation.constraint.Positive;
-import net.shibboleth.shared.collection.CollectionSupport;
-import net.shibboleth.shared.logic.Constraint;
-import net.shibboleth.shared.logic.FunctionSupport;
-import net.shibboleth.shared.logic.PredicateSupport;
-import net.shibboleth.shared.primitive.StringSupport;
-
-/**
- * Base class for profiles that support OIDC's concept of SSO, which spans multiple endpoints.
- */
-public abstract class AbstractOIDCSSOConfiguration extends AbstractOAuth2FlowAwareProfileConfiguration
- implements OIDCSSORelyingPartyConfiguration, OIDCSSOProviderConfiguration {
-
- /** Lookup function to override issuer value. */
- @Nonnull private Function<ProfileRequestContext,String> issuerLookupStrategy;
-
- /** Whether attributes should be resolved in the course of the profile. */
- @Nonnull private Predicate<ProfileRequestContext> resolveAttributesPredicate;
-
- /** Whether encryption is optional in the face of no key, etc. */
- @Nonnull private Predicate<ProfileRequestContext> encryptionOptionalPredicate;
-
- /** Whether client is required to use PKCE. */
- @Nonnull private Predicate<ProfileRequestContext> forcePKCEPredicate;
-
- /** Whether client is allowed to use PKCE code challenge method plain. */
- @Nonnull private Predicate<ProfileRequestContext> allowPKCEPlainPredicate;
-
- /** Lookup function to supply ID token lifetime. */
- @Nonnull private Function<ProfileRequestContext,Duration> idTokenLifetimeLookupStrategy;
-
- /** Lookup function to supply access token type. */
- @Nonnull private Function<ProfileRequestContext,String> accessTokenTypeLookupStrategy;
-
- /** Lookup function to supply refresh token type. */
- @Nonnull private Function<ProfileRequestContext,String> refreshTokenTypeLookupStrategy;
-
- /** Lookup function to supply access token lifetime. */
- @Nonnull private Function<ProfileRequestContext,Duration> accessTokenLifetimeLookupStrategy;
-
- /** Lookup function to supply refresh token timeout. */
- @Nonnull private Function<ProfileRequestContext,Duration> refreshTokenTimeoutLookupStrategy;
-
- /** Lookup function to supply refresh token chain lifetime. */
- @Nonnull private Function<ProfileRequestContext,Duration> refreshTokenChainLifetimeLookupStrategy;
-
- /** Lookup function to supply additional audiences for ID token. */
- @Nonnull private Function<ProfileRequestContext,Set<String>> assertionAudiencesLookupStrategy;
-
- /** Lookup function to supply attribute IDs to include in ID token regardless of response_type. */
- @Nonnull private Function<ProfileRequestContext,Set<String>> alwaysIncludedAttributesLookupStrategy;
-
- /** Lookup function to supply strategy bi-function for manipulating id_token claims. */
- @Nonnull
- private Function<ProfileRequestContext,BiFunction<ProfileRequestContext,Map<String,Object>,Map<String,Object>>>
- idTokenManipulationStrategyLookupStrategy;
-
- /** Lookup function to supply strategy bi-function for manipulating access token claims set. */
- @Nonnull
- private Function<ProfileRequestContext,BiFunction<ProfileRequestContext,Map<String,Object>,Map<String,Object>>>
- accessTokenClaimsSetManipulationStrategyLookupStrategy;
-
- /** Lookup function to supply strategy bi-predicate for custom valdation of redirect URI in the request. */
- @Nonnull
- private Function<ProfileRequestContext,BiPredicate<URI,ProfileRequestContext>>
- customRedirectUriValidationStrategyLookupStrategy;
-
- /** Whether the access token to be issued is always a bearer access token. */
- @Nonnull private Predicate<ProfileRequestContext> alwaysIssueBearerAccessTokenPredicate;
-
- /** Whether scope validation is strict, i.e. request for unallowed scopes is an error. */
- @Nonnull private Predicate<ProfileRequestContext> strictScopeValidationPredicate;
-
- /**
- * Creates a new configuration instance.
- *
- * @param profileId Unique profile identifier.
- */
- public AbstractOIDCSSOConfiguration(@Nonnull @NotEmpty final String profileId) {
- super(profileId);
- issuerLookupStrategy = FunctionSupport.constant(null);
- resolveAttributesPredicate = PredicateSupport.alwaysTrue();
- encryptionOptionalPredicate = PredicateSupport.alwaysTrue();
-
- forcePKCEPredicate = PredicateSupport.alwaysFalse();
- allowPKCEPlainPredicate = PredicateSupport.alwaysFalse();
-
- idTokenLifetimeLookupStrategy = FunctionSupport.constant(Duration.ofHours(1));
- accessTokenTypeLookupStrategy = FunctionSupport.constant(null);
- accessTokenLifetimeLookupStrategy = FunctionSupport.constant(Duration.ofMinutes(10));
- refreshTokenTimeoutLookupStrategy = FunctionSupport.constant(Duration.ofHours(2));
- refreshTokenChainLifetimeLookupStrategy = FunctionSupport.constant(Duration.ofHours(2));
- refreshTokenTypeLookupStrategy = FunctionSupport.constant(null);
-
- assertionAudiencesLookupStrategy = FunctionSupport.constant(null);
- alwaysIncludedAttributesLookupStrategy = FunctionSupport.constant(null);
-
- idTokenManipulationStrategyLookupStrategy = FunctionSupport.constant(null);
- accessTokenClaimsSetManipulationStrategyLookupStrategy = FunctionSupport.constant(null);
-
- customRedirectUriValidationStrategyLookupStrategy = FunctionSupport.constant(null);
-
- alwaysIssueBearerAccessTokenPredicate = PredicateSupport.alwaysFalse();
- strictScopeValidationPredicate = PredicateSupport.alwaysFalse();
- }
-
- /** {@inheritDoc} */
- @Override
- @Nullable @NotEmpty public String getIssuer(@Nullable final ProfileRequestContext profileRequestContext) {
- return issuerLookupStrategy.apply(profileRequestContext);
- }
-
- /**
- * Set overridden issuer value.
- *
- * @param issuer issuer value
- */
- public void setIssuer(@Nullable @NotEmpty final String issuer) {
- issuerLookupStrategy = FunctionSupport.constant(issuer);
- }
-
- /**
- * Sets lookup strategy for overridden issuer value.
- *
- * @param strategy lookup strategy
- */
- public void setIssuerLookupStrategy(@Nonnull final Function<ProfileRequestContext,String> strategy) {
- issuerLookupStrategy = Constraint.isNotNull(strategy, "Issuer lookup strategy cannot be null");
- }
-
- /** {@inheritDoc} */
- @Override
- public boolean isResolveAttributes(@Nullable final ProfileRequestContext profileRequestContext) {
- return resolveAttributesPredicate.test(profileRequestContext);
- }
-
- /**
- * Set whether attributes should be resolved during the profile.
- *
- * @param flag flag to set
- */
- public void setResolveAttributes(final boolean flag) {
- resolveAttributesPredicate = flag ? PredicateSupport.alwaysTrue() : PredicateSupport.alwaysFalse();
- }
-
- /**
- * Set a condition to determine whether attributes should be resolved during the profile.
- *
- * @param condition condition to set
- */
- public void setResolveAttributesPredicate(@Nonnull final Predicate<ProfileRequestContext> condition) {
- resolveAttributesPredicate = Constraint.isNotNull(condition, "Resolve attributes predicate cannot be null");
- }
-
- /** {@inheritDoc} */
- @Override
- public boolean isEncryptionOptional(@Nullable final ProfileRequestContext profileRequestContext) {
- return encryptionOptionalPredicate.test(profileRequestContext);
- }
-
- /**
- * Set whether encryption is optional in the face of a missing key, etc.
- *
- * @param flag flag to set
- */
- public void setEncryptionOptional(final boolean flag) {
- encryptionOptionalPredicate = flag ? PredicateSupport.alwaysTrue() : PredicateSupport.alwaysFalse();
- }
-
- /**
- * Set a condition to determine whether encryption is optional in the face of a missing key, etc.
- *
- * @param condition condition to set
- */
- public void setEncryptionOptionalPredicate(@Nonnull final Predicate<ProfileRequestContext> condition) {
- encryptionOptionalPredicate = Constraint.isNotNull(condition, "Encryption optional predicate cannot be null");
- }
-
- /** {@inheritDoc} */
- @Override
- public boolean isForcePKCE(@Nullable final ProfileRequestContext profileRequestContext) {
- return forcePKCEPredicate.test(profileRequestContext);
- }
-
- /**
- * Set whether client is required to use PKCE.
- *
- * @param flag flag to set
- */
- public void setForcePKCE(final boolean flag) {
- forcePKCEPredicate = flag ? PredicateSupport.alwaysTrue() : PredicateSupport.alwaysFalse();
- }
-
- /**
- * Set condition for whether client is required to use PKCE.
- *
- * @param condition condition to set
- */
- public void setForcePKCEPredicate(@Nonnull final Predicate<ProfileRequestContext> condition) {
- forcePKCEPredicate = Constraint.isNotNull(condition, "Condition cannot be null");
- }
-
- /** {@inheritDoc} */
- @Override
- public boolean isAllowPKCEPlain(@Nullable final ProfileRequestContext profileRequestContext) {
- return allowPKCEPlainPredicate.test(profileRequestContext);
- }
-
- /**
- * Set whether client is allowed to use PKCE code challenge method plain.
- *
- * @param flag flag to set
- */
- public void setAllowPKCEPlain(final boolean flag) {
- allowPKCEPlainPredicate = flag ? PredicateSupport.alwaysTrue() : PredicateSupport.alwaysFalse();
- }
-
- /**
- * Set condition for whether client is allowed to use PKCE code challenge method plain.
- *
- * @param condition condition to set
- */
- public void setAllowPKCEPlainPredicate(@Nonnull final Predicate<ProfileRequestContext> condition) {
- allowPKCEPlainPredicate = Constraint.isNotNull(condition, "Condition cannot be null");
- }
-
- /** {@inheritDoc} */
- @Override
- @Positive @Nonnull public Duration getIDTokenLifetime(@Nullable final ProfileRequestContext profileRequestContext) {
-
- final Duration lifetime = idTokenLifetimeLookupStrategy.apply(profileRequestContext);
-
- Constraint.isTrue(lifetime != null && !lifetime.isZero() && !lifetime.isNegative(),
- "ID token lifetime must be greater than 0");
- assert lifetime != null;
- return lifetime;
- }
-
- /**
- * Set the lifetime of an id token.
- *
- * @param lifetime lifetime of an id token in milliseconds
- */
- public void setIDTokenLifetime(@Positive @Nonnull final Duration lifetime) {
- final Duration idTokenLifetime = Constraint.isNotNull(lifetime, "ID token lifetime cannot be null");
- Constraint.isTrue(!idTokenLifetime.isZero() && !idTokenLifetime.isNegative(),
- "ID token lifetime must be greater than 0");
-
- idTokenLifetimeLookupStrategy = FunctionSupport.constant(idTokenLifetime);
- }
-
- /**
- * Set a lookup strategy for the ID token lifetime.
- *
- * @param strategy lookup strategy
- */
- public void setIDTokenLifetimeLookupStrategy(@Nonnull final Function<ProfileRequestContext,Duration> strategy) {
- idTokenLifetimeLookupStrategy = Constraint.isNotNull(strategy, "Lookup strategy cannot be null");
- }
-
- /** {@inheritDoc} */
- @Override
- @Nullable @NotEmpty public String getAccessTokenType(@Nullable final ProfileRequestContext profileRequestContext) {
- return accessTokenTypeLookupStrategy.apply(profileRequestContext);
- }
-
- /**
- * Set access token type.
- *
- * @param type token type, or null for unspecified/opaque
- *
- * @since 2.1.0
- */
- public void setAccessTokenType(@Nullable @NotEmpty final String type) {
- accessTokenTypeLookupStrategy = FunctionSupport.constant(StringSupport.trimOrNull(type));
- }
-
- /**
- * Set lookup strategy for access token type.
- *
- * @param strategy lookup strategy
- *
- * @since 2.1.0
- */
- public void setAccessTokenTypeLookupStrategy(@Nonnull final Function<ProfileRequestContext,String> strategy) {
- accessTokenTypeLookupStrategy = Constraint.isNotNull(strategy, "Lookup strategy cannot be null");
- }
-
- /** {@inheritDoc} */
- @Override
- @Positive @Nonnull
- public Duration getAccessTokenLifetime(@Nullable final ProfileRequestContext profileRequestContext) {
- final Duration lifetime = accessTokenLifetimeLookupStrategy.apply(profileRequestContext);
-
- Constraint.isTrue(lifetime != null && !lifetime.isZero() && !lifetime.isNegative(),
- "Access token lifetime must be greater than 0");
- assert lifetime != null;
- return lifetime;
- }
-
- /**
- * Set the lifetime of an access token.
- *
- * @param lifetime lifetime of an access token in milliseconds
- */
- public void setAccessTokenLifetime(@Positive @Nonnull final Duration lifetime) {
- final Duration tokenLifetime = Constraint.isNotNull(lifetime, "Access token lifetime cannot be null");
- Constraint.isTrue(!tokenLifetime.isZero() && !tokenLifetime.isNegative(),
- "Access token lifetime must be greater than 0");
-
- accessTokenLifetimeLookupStrategy = FunctionSupport.constant(tokenLifetime);
- }
-
- /**
- * Set a lookup strategy for the access token lifetime.
- *
- * @param strategy lookup strategy
- */
- public void setAccessTokenLifetimeLookupStrategy(
- @Nullable final Function<ProfileRequestContext,Duration> strategy) {
- accessTokenLifetimeLookupStrategy = Constraint.isNotNull(strategy, "Lookup strategy cannot be null");
- }
-
- /** {@inheritDoc} */
- @Override
- @Nonnull @Positive
- public Duration getRefreshTokenTimeout(@Nullable final ProfileRequestContext profileRequestContext) {
- final Duration timeout = refreshTokenTimeoutLookupStrategy.apply(profileRequestContext);
-
- Constraint.isTrue(timeout != null && !timeout.isZero() && !timeout.isNegative(),
- "Refresh token timeout must be greater than 0");
- assert timeout != null;
- return timeout;
- }
-
- /**
- * Set the timeout of refresh token.
- *
- * @param timeout timeout of an refresh token
- *
- * @since 2.2.0
- */
- public void setRefreshTokenTimeout(@Nonnull @Positive final Duration timeout) {
- final Duration tokenTimeout = Constraint.isNotNull(timeout, "Refresh token timeout cannot be null");
- Constraint.isTrue(!tokenTimeout.isZero() && !timeout.isNegative(),
- "Refresh token timeout must be greater than 0");
-
- refreshTokenTimeoutLookupStrategy = FunctionSupport.constant(tokenTimeout);
- }
-
- /**
- * Set a lookup strategy for the refresh token timeout.
- *
- * @param strategy lookup strategy
- *
- * @since 2.2.0
- */
- public void setRefreshTokenTimeoutLookupStrategy(
- @Nullable final Function<ProfileRequestContext,Duration> strategy) {
- refreshTokenTimeoutLookupStrategy = Constraint.isNotNull(strategy, "Lookup strategy cannot be null");
- }
-
- /** {@inheritDoc} */
- @Override
- @Nonnull @Positive
- public Duration getRefreshTokenChainLifetime(@Nullable final ProfileRequestContext profileRequestContext) {
- final Duration lifetime = refreshTokenChainLifetimeLookupStrategy.apply(profileRequestContext);
-
- Constraint.isTrue(lifetime != null && !lifetime.isZero() && !lifetime.isNegative(),
- "Refresh token chain lifetime must be greater than 0");
- assert lifetime != null;
- return lifetime;
- }
-
- /**
- * Set the lifetime of refresh token chain.
- *
- * @param lifetime lifetime of a refresh token chain
- *
- * @since 2.2.0
- */
- public void setRefreshTokenChainLifetime(@Nonnull @Positive final Duration lifetime) {
- final Duration chainLifetime = Constraint.isNotNull(lifetime, "Refresh token chain lifetime cannot be null");
- Constraint.isTrue(!chainLifetime.isZero() && !chainLifetime.isNegative(),
- "Refresh token chain lifetime must be greater than 0");
-
- refreshTokenChainLifetimeLookupStrategy = FunctionSupport.constant(chainLifetime);
- }
-
- /**
- * Set a lookup strategy for the refresh token chain lifetime.
- *
- * @param strategy lookup strategy
- *
- * @since 2.2.0
- */
- public void setRefreshTokenChainLifetimeLookupStrategy(
- @Nullable final Function<ProfileRequestContext,Duration> strategy) {
- refreshTokenChainLifetimeLookupStrategy = Constraint.isNotNull(strategy, "Lookup strategy cannot be null");
- }
-
- /** {@inheritDoc} */
- @Override
- @Nullable @NotEmpty public String getRefreshTokenType(@Nullable final ProfileRequestContext profileRequestContext) {
- return refreshTokenTypeLookupStrategy.apply(profileRequestContext);
- }
-
- /**
- * Set refresh token type.
- *
- * @param type token type, or null for unspecified/opaque
- *
- * @since 3.1.0
- */
- public void setRefreshTokenType(@Nullable @NotEmpty final String type) {
- refreshTokenTypeLookupStrategy = FunctionSupport.constant(StringSupport.trimOrNull(type));
- }
-
- /**
- * Set lookup strategy for token token type.
- *
- * @param strategy lookup strategy
- *
- * @since 3.1.0
- */
- public void setRefreshTokenTypeLookupStrategy(@Nonnull final Function<ProfileRequestContext,String> strategy) {
- refreshTokenTypeLookupStrategy = Constraint.isNotNull(strategy, "Lookup strategy cannot be null");
- }
-
- /** {@inheritDoc} */
- @Override
- @Nonnull @NonnullElements @NotLive public Set<String> getAdditionalAudiencesForIdToken(
- @Nullable final ProfileRequestContext profileRequestContext) {
-
- final Set<String> audiences = assertionAudiencesLookupStrategy.apply(profileRequestContext);
- if (audiences != null) {
- return CollectionSupport.copyToSet(audiences);
- }
- return CollectionSupport.emptySet();
- }
-
- /**
- * Set the set of audiences, in addition to the relying party(ies) to which the IdP is issuing the ID Token, with
- * which the token may be shared.
- *
- * @param audiences the additional audiences
- */
- public void setAdditionalAudiencesForIdToken(@Nullable @NonnullElements final Collection<String> audiences) {
-
- if (audiences == null || audiences.isEmpty()) {
- assertionAudiencesLookupStrategy = FunctionSupport.constant(null);
- } else {
- assertionAudiencesLookupStrategy = FunctionSupport.constant(
- Set.copyOf(StringSupport.normalizeStringCollection(audiences)));
- }
- }
-
- /**
- * Set a lookup strategy for the set of audiences, in addition to the relying party(ies) to which the IdP
- * is issuing the ID Token, with which the token may be shared.
- *
- * @param strategy lookup strategy
- */
- public void setAdditionalAudiencesForIdTokenLookupStrategy(
- @Nonnull final Function<ProfileRequestContext,Set<String>> strategy) {
- assertionAudiencesLookupStrategy = Constraint.isNotNull(strategy, "Lookup strategy cannot be null");
- }
-
- /** {@inheritDoc} */
- @Override
- @Nonnull @NonnullElements @NotLive public Set<String> getAlwaysIncludedAttributes(
- @Nullable final ProfileRequestContext profileRequestContext) {
-
- final Set<String> attributes = alwaysIncludedAttributesLookupStrategy.apply(profileRequestContext);
- if (attributes != null) {
- return CollectionSupport.copyToSet(attributes);
- }
- return CollectionSupport.emptySet();
- }
-
- /**
- * Set the set of attribute IDs which should be included in the ID token regardless of response_type.
- *
- * <p>Default behavior is to include claims only with the implicit id_token type only, while any use
- * of a back-channel relies on the user_info endpoint to get the claims. This setting forces certain
- * attributes to be added to the ID token regardless of flow.</p>
- *
- * @param attributes the attribute IDs to include in all cases
- */
- public void setAlwaysIncludedAttributes(@Nullable @NonnullElements final Collection<String> attributes) {
-
- if (attributes == null || attributes.isEmpty()) {
- alwaysIncludedAttributesLookupStrategy = FunctionSupport.constant(null);
- } else {
- alwaysIncludedAttributesLookupStrategy = FunctionSupport.constant(
- Set.copyOf(StringSupport.normalizeStringCollection(attributes)));
- }
- }
-
- /**
- * Set a lookup strategy for the attribute IDs which should be included in the ID token regardless of
- * response_type.
- *
- * @param strategy lookup strategy
- */
- public void setAlwaysIncludedAttributesLookupStrategy(
- @Nonnull final Function<ProfileRequestContext,Set<String>> strategy) {
- alwaysIncludedAttributesLookupStrategy = Constraint.isNotNull(strategy, "Lookup strategy cannot be null");
- }
-
- /** {@inheritDoc} */
- @Override
- @Nullable
- public BiFunction<ProfileRequestContext,Map<String,Object>,Map<String,Object>> getIDTokenManipulationStrategy(
- @Nullable final ProfileRequestContext profileRequestContext) {
- return idTokenManipulationStrategyLookupStrategy.apply(profileRequestContext);
- }
-
- /**
- * Set the bi-function for manipulating id_token claims.
- *
- * @param strategy bi-function for manipulating id_token claims
- *
- * @since 2.1.0
- */
- public void setIDTokenManipulationStrategy(
- @Nullable final BiFunction<ProfileRequestContext,Map<String,Object>,Map<String,Object>> strategy) {
- idTokenManipulationStrategyLookupStrategy = FunctionSupport.constant(strategy);
- }
-
- /**
- * Set a lookup strategy for the bi-function for manipulating id_token claims.
- *
- * @param strategy lookup strategy
- *
- * @since 2.1.0
- */
- public void setIDTokenManipulationStrategyLookupStrategy(@Nonnull final
- Function<ProfileRequestContext,BiFunction<ProfileRequestContext,Map<String,Object>,Map<String,Object>>>
- strategy) {
- idTokenManipulationStrategyLookupStrategy = Constraint.isNotNull(strategy, "Lookup strategy cannot be null");
- }
-
- /** {@inheritDoc} */
- @Override
- @Nullable
- public BiFunction<ProfileRequestContext,Map<String,Object>,Map<String,Object>>
- getAccessTokenClaimsSetManipulationStrategy(
- @Nullable final ProfileRequestContext profileRequestContext) {
- return accessTokenClaimsSetManipulationStrategyLookupStrategy.apply(profileRequestContext);
- }
-
- /**
- * Set the bi-function for manipulating access token claims set.
- *
- * @param strategy bi-function for manipulating access token claims set
- *
- * @since 2.1.0
- */
- public void setAccessTokenClaimsSetManipulationStrategy(
- @Nullable final BiFunction<ProfileRequestContext,Map<String,Object>,Map<String,Object>> strategy) {
- accessTokenClaimsSetManipulationStrategyLookupStrategy = FunctionSupport.constant(strategy);
- }
-
- /**
- * Set a lookup strategy for the bi-function for manipulating access token claims set.
- *
- * @param strategy lookup strategy
- *
- * @since 2.1.0
- */
- public void setAccessTokenClaimsSetManipulationStrategyLookupStrategy(@Nonnull final
- Function<ProfileRequestContext,BiFunction<ProfileRequestContext,Map<String,Object>,Map<String,Object>>>
- strategy) {
- accessTokenClaimsSetManipulationStrategyLookupStrategy = Constraint.isNotNull(strategy,
- "Lookup strategy cannot be null");
- }
-
- /** {@inheritDoc} */
- @Override
- @Nullable public BiPredicate<URI,ProfileRequestContext> getCustomRedirectUriValidationStrategy(
- @Nullable final ProfileRequestContext profileRequestContext) {
- return customRedirectUriValidationStrategyLookupStrategy.apply(profileRequestContext);
- }
-
- /**
- * Set the bi-predicate for custom validation of redirect URI in the request.
- * .
- * @param strategy bi-predicate for custom validation of redirect URI in the request
- *
- * @since 3.2.0
- */
- public void setCustomRedirectUriValidationStrategy(
- @Nullable final BiPredicate<URI,ProfileRequestContext> strategy) {
- customRedirectUriValidationStrategyLookupStrategy = FunctionSupport.constant(strategy);
- }
-
- /**
- * Set a lookup strategy for the bi-predicate for custom validation of redirect URI in the request.
- *
- * @param strategy lookup strategy
- *
- * @since 3.2.0
- */
- public void setCustomRedirectUriValidationStrategyLookupStrategy(@Nonnull final
- Function<ProfileRequestContext,BiPredicate<URI,ProfileRequestContext>> strategy) {
- customRedirectUriValidationStrategyLookupStrategy = Constraint.isNotNull(strategy,
- "Lookup strategy cannot be null");
- }
-
- /** {@inheritDoc} */
- @Override
- public boolean isAlwaysIssueBearerAccessToken(@Nullable final ProfileRequestContext profileRequestContext) {
- return alwaysIssueBearerAccessTokenPredicate.test(profileRequestContext);
- }
-
- /**
- * Set whether the access token to be issued is always a bearer access token.
- *
- * @param flag flag to set
- *
- * @since 3.2.0
- */
- public void setAlwaysIssueBearerAccessToken(final boolean flag) {
- alwaysIssueBearerAccessTokenPredicate = flag ? PredicateSupport.alwaysTrue() : PredicateSupport.alwaysFalse();
- }
-
- /**
- * Set a condition to determine whether the access token to be issued is always a bearer access token.
- *
- * @param condition condition to set
- *
- * @since 3.2.0
- */
- public void setAlwaysIssueBearerAccessTokenPredicate(@Nonnull final Predicate<ProfileRequestContext> condition) {
- alwaysIssueBearerAccessTokenPredicate = Constraint.isNotNull(condition,
- "Always issue bearer access token predicate cannot be null");
- }
-
- /** {@inheritDoc} */
- @Override
- public boolean isStrictScopeValidation(@Nullable final ProfileRequestContext profileRequestContext) {
- return strictScopeValidationPredicate.test(profileRequestContext);
- }
-
- /**
- * Set whether scope validation is strict, i.e. request for unallowed scopes is an error.
- *
- * @param flag flag to set
- *
- * @since 3.2.0
- */
- public void setStrictScopeValidation(final boolean flag) {
- strictScopeValidationPredicate = flag ? PredicateSupport.alwaysTrue() : PredicateSupport.alwaysFalse();
- }
-
- /**
- * Set a condition to determine whether scope validation is strict, i.e. request for unallowed scopes is an error.
- *
- * @param condition condition to set
- *
- * @since 3.2.0
- */
- public void setStrictScopeValidationPredicate(@Nonnull final Predicate<ProfileRequestContext> condition) {
- strictScopeValidationPredicate = Constraint.isNotNull(condition,
- "Strict scope validation predicate cannot be null");
- }
-
-}
diff --git a/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/util/SelectiveDisclosureClaimSetUtil.java b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/credential/impl/SelectiveDisclosureClaimSetUtil.java
similarity index 97%
rename from openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/util/SelectiveDisclosureClaimSetUtil.java
rename to openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/credential/impl/SelectiveDisclosureClaimSetUtil.java
index 1c0d76a..b1dee54 100644
--- a/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/util/SelectiveDisclosureClaimSetUtil.java
+++ b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/credential/impl/SelectiveDisclosureClaimSetUtil.java
@@ -14,7 +14,7 @@
* limitations under the License.
*/
-package org.geant.shibboleth.plugin.openidvci.util;
+package org.geant.shibboleth.plugin.openidvci.credential.impl;
import java.nio.charset.StandardCharsets;
import java.security.MessageDigest;
@@ -92,7 +92,7 @@ public class SelectiveDisclosureClaimSetUtil {
*
* @return digests of the disclosures
*/
- public List<String> get_sd() {
+ public List<String> getSd() {
return encodedDisclosures;
}
@@ -110,7 +110,7 @@ public class SelectiveDisclosureClaimSetUtil {
*
* @return digest algorithm of disclosures
*/
- public String get_alg() {
+ public String getAlg() {
return algorithm.toLowerCase();
}
diff --git a/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/util/SelectiveDisclosureClaimTree.java b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/credential/impl/SelectiveDisclosureClaimTree.java
similarity index 97%
rename from openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/util/SelectiveDisclosureClaimTree.java
rename to openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/credential/impl/SelectiveDisclosureClaimTree.java
index 5f70872..1a4dc13 100644
--- a/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/util/SelectiveDisclosureClaimTree.java
+++ b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/credential/impl/SelectiveDisclosureClaimTree.java
@@ -14,7 +14,7 @@
* limitations under the License.
*/
-package org.geant.shibboleth.plugin.openidvci.util;
+package org.geant.shibboleth.plugin.openidvci.credential.impl;
import java.util.ArrayList;
import java.util.Collection;
@@ -90,7 +90,7 @@ public class SelectiveDisclosureClaimTree {
for (final Map.Entry<List<String>, Map<String, Object>> level : levels.entrySet()) {
final SelectiveDisclosureClaimSetUtil disclosed = new SelectiveDisclosureClaimSetUtil(level.getValue(),
algorithm);
- resolve(level.getKey()).put(SD_CLAIM, disclosed.get_sd());
+ resolve(level.getKey()).put(SD_CLAIM, disclosed.getSd());
parts.add(disclosed.getFormattedDisclosures());
}
disclosures = String.join("~", parts);
diff --git a/openid-vci-api/src/main/java/org/geant/shibboleth/plugin/oauth/statuslist/StatusListBucket.java b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/credential/impl/package-info.java
similarity index 52%
copy from openid-vci-api/src/main/java/org/geant/shibboleth/plugin/oauth/statuslist/StatusListBucket.java
copy to openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/credential/impl/package-info.java
index 8a3d844..213956d 100644
--- a/openid-vci-api/src/main/java/org/geant/shibboleth/plugin/oauth/statuslist/StatusListBucket.java
+++ b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/credential/impl/package-info.java
@@ -14,21 +14,7 @@
* limitations under the License.
*/
-package org.geant.shibboleth.plugin.oauth.statuslist;
-
-import java.time.Instant;
-
-import javax.annotation.Nonnull;
-
/**
- * Immutable identity of one Status List as in
- * <a href="https://datatracker.ietf.org/doc/draft-ietf-oauth-status-list/">
- * draft-ietf-oauth-status-list</a>.
- *
- * A bucket holds credentials that all expire before the end of the bucket.
- *
- * @param id identifier, used as storage key
- * @param end upper bound for expiration of any credential in this bucket
+ * Credential Configuration resolvers and selective disclosure support.
*/
-public record StatusListBucket(@Nonnull String id, @Nonnull Instant end) {
-}
+package org.geant.shibboleth.plugin.openidvci.credential.impl;
diff --git a/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/decoding/impl/BaseOpenIDVCIRequestDecoder.java b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/decoding/impl/BaseOpenIDVCIRequestDecoder.java
index b585ebf..c5860ac 100644
--- a/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/decoding/impl/BaseOpenIDVCIRequestDecoder.java
+++ b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/decoding/impl/BaseOpenIDVCIRequestDecoder.java
@@ -93,7 +93,7 @@ public abstract class BaseOpenIDVCIRequestDecoder<T extends Request> extends Abs
@Override
@Nullable
@SuppressWarnings("unchecked")
- protected String serializeMessageForLogging(@Nullable Object message) {
+ protected String serializeMessageForLogging(@Nullable final Object message) {
return getMessageToLog((T) message);
}
diff --git a/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/decoding/impl/CredentialOfferRequestDecoder.java b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/decoding/impl/CredentialOfferRequestDecoder.java
index 1ab8a54..ef28f28 100644
--- a/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/decoding/impl/CredentialOfferRequestDecoder.java
+++ b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/decoding/impl/CredentialOfferRequestDecoder.java
@@ -27,6 +27,8 @@ import org.opensaml.messaging.decoder.MessageDecodingException;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
+import net.shibboleth.idp.plugin.oidc.op.decoding.impl.RequestUtil;
+
import com.fasterxml.jackson.core.JsonProcessingException;
import com.fasterxml.jackson.databind.ObjectMapper;
import com.google.common.base.MoreObjects;
@@ -55,15 +57,16 @@ public class CredentialOfferRequestDecoder extends BaseOpenIDVCIRequestDecoder<C
}
}
+ /** {@inheritDoc} */
@Override
- protected String getMessageToLog(CredentialOfferRequest message) {
+ protected String getMessageToLog(final CredentialOfferRequest message) {
- Map<String, CredentialOfferRequestedCredential> request = message.getPreAuthorizedCredentials();
+ final Map<String, CredentialOfferRequestedCredential> request = message.getPreAuthorizedCredentials();
String requestAsString = null;
if (request != null) {
try {
requestAsString = new ObjectMapper().writeValueAsString(request);
- } catch (JsonProcessingException e) {
+ } catch (final JsonProcessingException e) {
// No action.
}
}
diff --git a/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/decoding/impl/OpenIDVCICredentialsRequestDecoder.java b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/decoding/impl/OpenIDVCICredentialsRequestDecoder.java
index 5992f5d..9154ca0 100644
--- a/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/decoding/impl/OpenIDVCICredentialsRequestDecoder.java
+++ b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/decoding/impl/OpenIDVCICredentialsRequestDecoder.java
@@ -25,6 +25,8 @@ import org.opensaml.messaging.decoder.MessageDecodingException;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
+import net.shibboleth.idp.plugin.oidc.op.decoding.impl.RequestUtil;
+
import com.google.common.base.MoreObjects;
import com.nimbusds.oauth2.sdk.http.HTTPRequest;
import com.nimbusds.oauth2.sdk.http.JakartaServletUtils;
@@ -51,8 +53,9 @@ public class OpenIDVCICredentialsRequestDecoder extends BaseOpenIDVCIRequestDeco
}
}
+ /** {@inheritDoc} */
@Override
- protected String getMessageToLog(OpenIDVCICredentialsRequest message) {
+ protected String getMessageToLog(final OpenIDVCICredentialsRequest message) {
return message == null ? null
: MoreObjects.toStringHelper(this).omitNullValues()
diff --git a/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/decoding/impl/OpenIDVCITokenRequestDecoder.java b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/decoding/impl/OpenIDVCITokenRequestDecoder.java
index 0c6644e..a5f7e75 100644
--- a/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/decoding/impl/OpenIDVCITokenRequestDecoder.java
+++ b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/decoding/impl/OpenIDVCITokenRequestDecoder.java
@@ -25,6 +25,8 @@ import org.opensaml.messaging.decoder.MessageDecodingException;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
+import net.shibboleth.idp.plugin.oidc.op.decoding.impl.RequestUtil;
+
import com.fasterxml.jackson.core.JsonProcessingException;
import com.fasterxml.jackson.databind.ObjectMapper;
import com.google.common.base.MoreObjects;
@@ -53,14 +55,15 @@ public class OpenIDVCITokenRequestDecoder extends BaseOpenIDVCIRequestDecoder<Op
}
}
+ /** {@inheritDoc} */
@Override
- protected String getMessageToLog(OpenIDVCITokenRequest message) {
+ protected String getMessageToLog(final OpenIDVCITokenRequest message) {
String details = null;
try {
details = message.getAuthorizationDetails() != null
? new ObjectMapper().writeValueAsString(message.getAuthorizationDetails())
: null;
- } catch (JsonProcessingException e) {
+ } catch (final JsonProcessingException e) {
log.warn("Failed serializing authorization_details", e);
// ignore
}
diff --git a/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/decoding/impl/RequestUtil.java b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/decoding/impl/RequestUtil.java
deleted file mode 100644
index 4cab159..0000000
--- a/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/decoding/impl/RequestUtil.java
+++ /dev/null
@@ -1,151 +0,0 @@
-/*
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-// TODO: This class is copied as is from shibboleth project. Refactoring needed.
-
-package org.geant.shibboleth.plugin.openidvci.decoding.impl;
-
-import java.util.List;
-import java.util.Map;
-import java.util.Map.Entry;
-
-import javax.annotation.Nullable;
-
-import com.google.common.base.MoreObjects;
-import com.nimbusds.oauth2.sdk.AuthorizationCodeGrant;
-import com.nimbusds.oauth2.sdk.AuthorizationGrant;
-import com.nimbusds.oauth2.sdk.ClientCredentialsGrant;
-import com.nimbusds.oauth2.sdk.RefreshTokenGrant;
-import com.nimbusds.oauth2.sdk.auth.ClientAuthentication;
-import com.nimbusds.oauth2.sdk.http.HTTPRequest;
-import com.nimbusds.oauth2.sdk.token.AccessToken;
-import com.nimbusds.oauth2.sdk.token.RefreshToken;
-
-/** Request logging helper class. */
-public final class RequestUtil {
-
- /** Private constructor. */
- private RequestUtil() {
-
- }
-
- /**
- * Helper method to print request to string for logging.
- *
- * @param httpReq request to be printed
- * @return request as formatted string.
- */
- @Nullable public static String toString(@Nullable final HTTPRequest httpReq) {
- if (httpReq == null) {
- return null;
- }
- final String nl = System.lineSeparator();
- String ret = httpReq.getMethod().toString() + nl;
- final Map<String, List<String>> headers = httpReq.getHeaderMap();
- if (headers != null) {
- ret += "Headers:" + nl;
- for (final Entry<String, List<String>> entry : headers.entrySet()) {
- ret += "\t" + entry.getKey() + ":" + entry.getValue() + nl;
- }
- }
- final Map<String, List<String>> parameters = httpReq.getQueryParameters();
- if (parameters != null) {
- ret += "Parameters:" + nl;
- for (final Entry<String, List<String>> entry : parameters.entrySet()) {
- ret += "\t" + entry.getKey() + ":" + entry.getValue().get(0) + nl;
- }
- }
- return ret;
- }
-
- /**
- * Helper method for getting protocol log message for client authentication object.
- *
- * @param authentication The client authentication object
- * @return The log message
- */
- @Nullable public static String getClientAuthenticationLog(@Nullable final ClientAuthentication authentication) {
- return authentication == null ? null : MoreObjects.toStringHelper("ClientAuthentication").omitNullValues()
- .add("clientId", authentication.getClientID())
- .add("method", authentication.getMethod())
- .toString();
- }
-
- /**
- * Helper method for getting protocol log message for access token object.
- *
- * @param accessToken The access token object
- * @return The log message
- */
- @Nullable public static String getAccessTokenLog(@Nullable final AccessToken accessToken) {
- return accessToken == null ? null : MoreObjects.toStringHelper("AccessToken").omitNullValues()
- .add("lifetime", accessToken.getLifetime())
- .add("issuedTokenType", accessToken.getIssuedTokenType())
- .add("parameterNames", accessToken.getParameterNames())
- .add("scope", accessToken.getScope())
- .add("value", accessToken.getValue())
- .add("type", accessToken.getType())
- .toString();
- }
-
- /**
- * Helper method for getting protocol log message for authorization grant object.
- *
- * @param grant The authorization grant object
- * @return The log message
- */
- @Nullable public static String getAuthorizationGrantLog(@Nullable final AuthorizationGrant grant) {
- if (grant == null) {
- return null;
- }
- if (grant instanceof AuthorizationCodeGrant) {
- final AuthorizationCodeGrant codeGrant = (AuthorizationCodeGrant) grant;
- return MoreObjects.toStringHelper(codeGrant).omitNullValues()
- .add("authorizationCode", codeGrant.getAuthorizationCode())
- .add("codeVerifier", codeGrant.getCodeVerifier())
- .add("redirectionURI", codeGrant.getRedirectionURI())
- .add("type", codeGrant.getType())
- .toString();
- } else if (grant instanceof RefreshTokenGrant) {
- final RefreshTokenGrant refreshGrant = (RefreshTokenGrant) grant;
- return MoreObjects.toStringHelper(refreshGrant).omitNullValues()
- .add("refreshToken", getRefreshTokenLog(refreshGrant.getRefreshToken()))
- .add("type", refreshGrant.getType())
- .toString();
- } else if (grant instanceof ClientCredentialsGrant) {
- final ClientCredentialsGrant credentialsGrant = (ClientCredentialsGrant) grant;
- return MoreObjects.toStringHelper(credentialsGrant).omitNullValues()
- .add("type", credentialsGrant.getType())
- .toString();
-
- }
- return MoreObjects.toStringHelper(grant).omitNullValues()
- .add("type", grant.getType())
- .toString();
- }
-
- /**
- * Helper method for getting protocol log message for refresh token object.
- *
- * @param refreshToken The refresh token object
- * @return The log message
- */
- @Nullable public static String getRefreshTokenLog(@Nullable final RefreshToken refreshToken) {
- return refreshToken == null ? null : MoreObjects.toStringHelper("RefreshToken").omitNullValues()
- .add("parameterNames", refreshToken.getParameterNames())
- .add("value", refreshToken.getValue())
- .toString();
- }
-
-}
diff --git a/openid-vci-api/src/main/java/org/geant/shibboleth/plugin/oauth/statuslist/StatusListBucket.java b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/decoding/impl/package-info.java
similarity index 52%
copy from openid-vci-api/src/main/java/org/geant/shibboleth/plugin/oauth/statuslist/StatusListBucket.java
copy to openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/decoding/impl/package-info.java
index 8a3d844..cd37f18 100644
--- a/openid-vci-api/src/main/java/org/geant/shibboleth/plugin/oauth/statuslist/StatusListBucket.java
+++ b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/decoding/impl/package-info.java
@@ -14,21 +14,7 @@
* limitations under the License.
*/
-package org.geant.shibboleth.plugin.oauth.statuslist;
-
-import java.time.Instant;
-
-import javax.annotation.Nonnull;
-
/**
- * Immutable identity of one Status List as in
- * <a href="https://datatracker.ietf.org/doc/draft-ietf-oauth-status-list/">
- * draft-ietf-oauth-status-list</a>.
- *
- * A bucket holds credentials that all expire before the end of the bucket.
- *
- * @param id identifier, used as storage key
- * @param end upper bound for expiration of any credential in this bucket
+ * Decoders for inbound OpenID4VCI requests.
*/
-public record StatusListBucket(@Nonnull String id, @Nonnull Instant end) {
-}
+package org.geant.shibboleth.plugin.openidvci.decoding.impl;
diff --git a/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/messaging/context/CredentialOfferContext.java b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/messaging/context/CredentialOfferContext.java
index 71cf57d..ada7e56 100644
--- a/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/messaging/context/CredentialOfferContext.java
+++ b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/messaging/context/CredentialOfferContext.java
@@ -22,7 +22,6 @@ import java.util.Map;
import javax.annotation.Nullable;
import org.geant.shibboleth.plugin.openidvci.credential.CredentialConfiguration;
-import org.geant.shibboleth.plugin.openidvci.credential.CredentialConfigurations;
import org.geant.shibboleth.plugin.openidvci.messaging.impl.CredentialOfferRequestedCredential;
import org.geant.shibboleth.plugin.openidvci.messaging.impl.CredentialOfferTxCode;
import org.opensaml.messaging.context.BaseContext;
@@ -61,7 +60,8 @@ public class CredentialOfferContext extends BaseContext {
* @param credentialConfigurations credential configuration supported
*/
@Nullable
- public void setCredentialConfigurations(@Nullable Map<String, CredentialConfiguration> credentialConfigurations) {
+ public void setCredentialConfigurations(
+ @Nullable final Map<String, CredentialConfiguration> credentialConfigurations) {
this.credentialConfigurations = credentialConfigurations;
}
@@ -78,12 +78,12 @@ public class CredentialOfferContext extends BaseContext {
/**
* Set credential offer request content in pre-auth flow.
*
- * @param Credential offer request content in pre-auth flow
+ * @param credentials offer request content in pre-auth flow
*/
@Nullable
public void setValidatedPreAuthorizedCredentials(
- @Nullable Map<String, CredentialOfferRequestedCredential> credentialOfferRequegetPreAuthorizedCredentials) {
- this.preAuthorizedCredentials = credentialOfferRequegetPreAuthorizedCredentials;
+ @Nullable final Map<String, CredentialOfferRequestedCredential> credentials) {
+ this.preAuthorizedCredentials = credentials;
}
/**
@@ -99,11 +99,11 @@ public class CredentialOfferContext extends BaseContext {
/**
* Set list of credentials for Credential offer in code flow.
*
- * @param codeCredentials List of credentials for Credential offer in code flow
+ * @param credentials List of credentials for Credential offer in code flow
*/
@Nullable
- public void setValidatedCodeCredentials(@Nullable List<String> codeCredentials) {
- this.codeCredentials = codeCredentials;
+ public void setValidatedCodeCredentials(@Nullable final List<String> credentials) {
+ this.codeCredentials = credentials;
}
@@ -128,11 +128,11 @@ public class CredentialOfferContext extends BaseContext {
}
/**
- * Get Transaction Code
+ * Get Transaction Code.
*
* @param credentialOfferTxCode Transaction Code
*/
- public void setCredentialOfferTxCode(CredentialOfferTxCode credentialOfferTxCode) {
+ public void setCredentialOfferTxCode(final CredentialOfferTxCode credentialOfferTxCode) {
this.credentialOfferTxCode = credentialOfferTxCode;
}
@@ -155,7 +155,7 @@ public class CredentialOfferContext extends BaseContext {
* @param credentialOfferToken Token that serves both as pre-authorized code and
* issuer_state in responses
*/
- public void setCredentialOfferToken(@Nullable String credentialOfferToken) {
+ public void setCredentialOfferToken(@Nullable final String credentialOfferToken) {
this.credentialOfferToken = credentialOfferToken;
}
diff --git a/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/messaging/context/CredentialsContext.java b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/messaging/context/CredentialsContext.java
index b1abd1a..904201b 100644
--- a/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/messaging/context/CredentialsContext.java
+++ b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/messaging/context/CredentialsContext.java
@@ -89,7 +89,7 @@ public class CredentialsContext extends BaseContext {
*
* @param proofs Validated proofs of wallet
*/
- public void setProofs(@Nullable List<SignedJWT> proofs) {
+ public void setProofs(@Nullable final List<SignedJWT> proofs) {
this.proofs = proofs;
}
@@ -109,7 +109,7 @@ public class CredentialsContext extends BaseContext {
* @param issuanceInstant Issuance instant shared by all credentials of this
* request
*/
- public void setIssuedAt(@Nullable Instant issuanceInstant) {
+ public void setIssuedAt(@Nullable final Instant issuanceInstant) {
this.issuedAt = issuanceInstant;
}
@@ -129,7 +129,7 @@ public class CredentialsContext extends BaseContext {
* @param expirationInstant Expiration instant shared by all credentials of this
* request
*/
- public void setExpiresAt(@Nullable Instant expirationInstant) {
+ public void setExpiresAt(@Nullable final Instant expirationInstant) {
this.expiresAt = expirationInstant;
}
@@ -148,7 +148,7 @@ public class CredentialsContext extends BaseContext {
*
* @param credentialContent Credential content to for the final credential
*/
- public void setCredentialContent(@Nullable CredentialOfferRequestedCredential credentialContent) {
+ public void setCredentialContent(@Nullable final CredentialOfferRequestedCredential credentialContent) {
this.credentialContent = credentialContent;
}
@@ -169,7 +169,7 @@ public class CredentialsContext extends BaseContext {
* @param credentialConfiguration Credential configuration for the credential to
* be returned in response
*/
- public void setCredentialConfiguration(@Nullable CredentialConfiguration credentialConfiguration) {
+ public void setCredentialConfiguration(@Nullable final CredentialConfiguration credentialConfiguration) {
this.credentialConfiguration = credentialConfiguration;
}
@@ -188,7 +188,7 @@ public class CredentialsContext extends BaseContext {
*
* @param credentialIdentifier Validated identifier for credential configuration
*/
- public void setCredentialIdentifier(@Nullable String credentialIdentifier) {
+ public void setCredentialIdentifier(@Nullable final String credentialIdentifier) {
this.credentialIdentifier = credentialIdentifier;
}
@@ -207,7 +207,7 @@ public class CredentialsContext extends BaseContext {
*
* @param credentialShells Credential shell(s) per proof
*/
- public void setCredentialShells(@Nullable List<ClaimsSet> credentialShells) {
+ public void setCredentialShells(@Nullable final List<ClaimsSet> credentialShells) {
this.credentialShells = credentialShells;
}
@@ -222,12 +222,12 @@ public class CredentialsContext extends BaseContext {
}
/**
- * Set JWT based credential per proof ready to be signed
+ * Set JWT based credential per proof ready to be signed.
*
- * @param jwtCredential JWT based credential per proof ready to be signed
+ * @param credentials JWT based credential per proof ready to be signed
*/
- public void setJWTCredentials(List<JWTClaimsSet> jwtCredential) {
- this.jwtCredential = jwtCredential;
+ public void setJWTCredentials(final List<JWTClaimsSet> credentials) {
+ this.jwtCredential = credentials;
}
/**
@@ -240,11 +240,11 @@ public class CredentialsContext extends BaseContext {
}
/**
- * Set Disclosures of JWT based credential
+ * Set Disclosures of JWT based credential.
*
* @param disclosures Disclosures of JWT based credential
*/
- public void setDisclosures(String disclosures) {
+ public void setDisclosures(final String disclosures) {
this.disclosures = disclosures;
}
@@ -264,7 +264,7 @@ public class CredentialsContext extends BaseContext {
* @param signedCredential Per proof signed credential
*/
@Nullable
- public void setSignedCredential(List<String> signedCredential) {
+ public void setSignedCredential(final List<String> signedCredential) {
this.signedJWTCredential = signedCredential;
}
diff --git a/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/messaging/context/TokenContext.java b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/messaging/context/TokenContext.java
index 5394cfe..361d11b 100644
--- a/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/messaging/context/TokenContext.java
+++ b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/messaging/context/TokenContext.java
@@ -33,37 +33,70 @@ import com.nimbusds.openid.connect.sdk.claims.ClaimsSet;
*/
public class TokenContext extends BaseContext {
+ /** Credential Offer being redeemed. */
@Nullable
private CredentialOfferObject credentialOfferObject;
+ /** Claims the issued token may carry. */
@Nullable
private ClaimsSet potentialCredentials;
+ /** Authorization details returned in the token response. */
@Nullable
private List<OpenIDVCIAuthorizationDetail> responseAuthorizationDetails;
+ /**
+ * Get the Credential Offer being redeemed.
+ *
+ * @return Credential Offer, or null
+ */
@Nullable
public CredentialOfferObject getCredentialOfferObject() {
return credentialOfferObject;
}
- public void setCredentialOfferObject(@Nullable CredentialOfferObject credentialOfferObject) {
+ /**
+ * Set the Credential Offer being redeemed.
+ *
+ * @param credentialOfferObject Credential Offer to set
+ */
+ public void setCredentialOfferObject(@Nullable final CredentialOfferObject credentialOfferObject) {
this.credentialOfferObject = credentialOfferObject;
}
+ /**
+ * Get the claims the issued token may carry.
+ *
+ * @return claims, or null
+ */
public ClaimsSet getPotentialCredentials() {
return potentialCredentials;
}
- public void setPotentialCredentials(ClaimsSet potentialCredentials) {
+ /**
+ * Set the claims the issued token may carry.
+ *
+ * @param potentialCredentials claims to set
+ */
+ public void setPotentialCredentials(final ClaimsSet potentialCredentials) {
this.potentialCredentials = potentialCredentials;
}
+ /**
+ * Get the authorization details returned in the token response.
+ *
+ * @return authorization details, or null
+ */
public List<OpenIDVCIAuthorizationDetail> getResponseAuthorizationDetails() {
return responseAuthorizationDetails;
}
- public void setResponseAuthorizationDetails(List<OpenIDVCIAuthorizationDetail> responseAuthorizationDetails) {
+ /**
+ * Set the authorization details returned in the token response.
+ *
+ * @param responseAuthorizationDetails authorization details to set
+ */
+ public void setResponseAuthorizationDetails(final List<OpenIDVCIAuthorizationDetail> responseAuthorizationDetails) {
this.responseAuthorizationDetails = responseAuthorizationDetails;
}
diff --git a/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/messaging/context/navigate/AuthorizationDetailsLookupFunction.java b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/messaging/context/navigate/AuthorizationDetailsLookupFunction.java
index cbff6fb..76a2a7b 100644
--- a/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/messaging/context/navigate/AuthorizationDetailsLookupFunction.java
+++ b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/messaging/context/navigate/AuthorizationDetailsLookupFunction.java
@@ -38,10 +38,8 @@ import net.shibboleth.idp.plugin.oidc.op.messaging.context.OIDCAuthenticationRes
* A function that returns list of {@link OpenIDVCIAuthorizationDetail} parsed
* from from 1. {@link AuthorizationRequest}, 2. {@link OpenIDVCITokenRequest}
* or from claim encoded to 3. authorization code grant.
- */
-
-/**
- * TODO Locate details also in PAR and or Request Object case.
+ *
+ * <p>TODO Locate details also in PAR and or Request Object case.</p>
*/
public class AuthorizationDetailsLookupFunction
implements ContextDataLookupFunction<ProfileRequestContext, List<OpenIDVCIAuthorizationDetail>> {
@@ -50,15 +48,17 @@ public class AuthorizationDetailsLookupFunction
@Nonnull
private final Logger log = LoggerFactory.getLogger(AuthorizationDetailsLookupFunction.class);
+// Checkstyle: CyclomaticComplexity|ReturnCount OFF
+ /** {@inheritDoc} */
@Override
- public List<OpenIDVCIAuthorizationDetail> apply(ProfileRequestContext input) {
+ public List<OpenIDVCIAuthorizationDetail> apply(final ProfileRequestContext input) {
if (input == null || input.getInboundMessageContext() == null) {
return null;
}
if (input.getInboundMessageContext().getMessage() instanceof AuthorizationRequest request) {
try {
return OpenIDVCIAuthorizationDetail.parse(request.toHTTPRequest());
- } catch (JsonProcessingException e) {
+ } catch (final JsonProcessingException e) {
log.warn("Failed parsing authorization_details", e);
return null;
}
@@ -67,21 +67,21 @@ public class AuthorizationDetailsLookupFunction
if (tokenRequest.getAuthorizationDetails() != null && !tokenRequest.getAuthorizationDetails().isEmpty()) {
return tokenRequest.getAuthorizationDetails();
}
- MessageContext msgCtx = input.getOutboundMessageContext();
+ final MessageContext msgCtx = input.getOutboundMessageContext();
if (msgCtx == null) {
return null;
}
- OIDCAuthenticationResponseContext oidcCtx = input.getOutboundMessageContext()
+ final OIDCAuthenticationResponseContext oidcCtx = input.getOutboundMessageContext()
.getSubcontext(OIDCAuthenticationResponseContext.class);
if (oidcCtx == null || oidcCtx.getAuthorizationGrantClaimsSet() == null
|| oidcCtx.getAuthorizationGrantClaimsSet().getClaimsSet() == null) {
return null;
}
if (oidcCtx.getAuthorizationGrantClaimsSet().getClaimsSet()
- .getClaim(OpenIDVCITokenManipulationStrategy.AuthDetails) instanceof String details) {
+ .getClaim(OpenIDVCITokenManipulationStrategy.AUTH_DETAILS) instanceof String details) {
try {
return OpenIDVCIAuthorizationDetail.parse(details);
- } catch (JsonProcessingException e) {
+ } catch (final JsonProcessingException e) {
log.warn("Failed parsing authorization_details", e);
return null;
}
@@ -89,4 +89,5 @@ public class AuthorizationDetailsLookupFunction
}
return null;
}
+// Checkstyle: CyclomaticComplexity|ReturnCount ON
}
diff --git a/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/messaging/context/navigate/RequestCodeVerifierLookupFunction.java b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/messaging/context/navigate/RequestCodeVerifierLookupFunction.java
index 223902e..989c09e 100644
--- a/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/messaging/context/navigate/RequestCodeVerifierLookupFunction.java
+++ b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/messaging/context/navigate/RequestCodeVerifierLookupFunction.java
@@ -29,8 +29,9 @@ import org.opensaml.profile.context.ProfileRequestContext;
*/
public class RequestCodeVerifierLookupFunction implements ContextDataLookupFunction<ProfileRequestContext, String> {
+ /** {@inheritDoc} */
@Override
- public String apply(ProfileRequestContext input) {
+ public String apply(final ProfileRequestContext input) {
if (input == null || input.getInboundMessageContext() == null) {
return null;
}
diff --git a/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/messaging/context/navigate/RequestCredentialConfigurationIdLookupFunction.java b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/messaging/context/navigate/RequestCredentialConfigurationIdLookupFunction.java
index bd052ec..91ce561 100644
--- a/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/messaging/context/navigate/RequestCredentialConfigurationIdLookupFunction.java
+++ b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/messaging/context/navigate/RequestCredentialConfigurationIdLookupFunction.java
@@ -31,8 +31,9 @@ import org.opensaml.profile.context.ProfileRequestContext;
public class RequestCredentialConfigurationIdLookupFunction
implements ContextDataLookupFunction<ProfileRequestContext, String> {
+ /** {@inheritDoc} */
@Override
- public String apply(ProfileRequestContext input) {
+ public String apply(final ProfileRequestContext input) {
if (input == null || input.getInboundMessageContext() == null) {
return null;
}
diff --git a/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/messaging/context/navigate/RequestCredentialIdentifierLookupFunction.java b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/messaging/context/navigate/RequestCredentialIdentifierLookupFunction.java
index b3a74a9..31300a8 100644
--- a/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/messaging/context/navigate/RequestCredentialIdentifierLookupFunction.java
+++ b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/messaging/context/navigate/RequestCredentialIdentifierLookupFunction.java
@@ -31,8 +31,9 @@ import org.opensaml.profile.context.ProfileRequestContext;
public class RequestCredentialIdentifierLookupFunction
implements ContextDataLookupFunction<ProfileRequestContext, String> {
+ /** {@inheritDoc} */
@Override
- public String apply(ProfileRequestContext input) {
+ public String apply(final ProfileRequestContext input) {
if (input == null || input.getInboundMessageContext() == null) {
return null;
}
diff --git a/openid-vci-api/src/main/java/org/geant/shibboleth/plugin/oauth/statuslist/StatusListBucket.java b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/messaging/context/navigate/package-info.java
similarity index 52%
copy from openid-vci-api/src/main/java/org/geant/shibboleth/plugin/oauth/statuslist/StatusListBucket.java
copy to openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/messaging/context/navigate/package-info.java
index 8a3d844..21abf9c 100644
--- a/openid-vci-api/src/main/java/org/geant/shibboleth/plugin/oauth/statuslist/StatusListBucket.java
+++ b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/messaging/context/navigate/package-info.java
@@ -14,21 +14,7 @@
* limitations under the License.
*/
-package org.geant.shibboleth.plugin.oauth.statuslist;
-
-import java.time.Instant;
-
-import javax.annotation.Nonnull;
-
/**
- * Immutable identity of one Status List as in
- * <a href="https://datatracker.ietf.org/doc/draft-ietf-oauth-status-list/">
- * draft-ietf-oauth-status-list</a>.
- *
- * A bucket holds credentials that all expire before the end of the bucket.
- *
- * @param id identifier, used as storage key
- * @param end upper bound for expiration of any credential in this bucket
+ * Lookup functions operating on OpenID4VCI message contexts.
*/
-public record StatusListBucket(@Nonnull String id, @Nonnull Instant end) {
-}
+package org.geant.shibboleth.plugin.openidvci.messaging.context.navigate;
diff --git a/openid-vci-api/src/main/java/org/geant/shibboleth/plugin/oauth/statuslist/StatusListBucket.java b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/messaging/context/package-info.java
similarity index 52%
copy from openid-vci-api/src/main/java/org/geant/shibboleth/plugin/oauth/statuslist/StatusListBucket.java
copy to openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/messaging/context/package-info.java
index 8a3d844..6bda431 100644
--- a/openid-vci-api/src/main/java/org/geant/shibboleth/plugin/oauth/statuslist/StatusListBucket.java
+++ b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/messaging/context/package-info.java
@@ -14,21 +14,7 @@
* limitations under the License.
*/
-package org.geant.shibboleth.plugin.oauth.statuslist;
-
-import java.time.Instant;
-
-import javax.annotation.Nonnull;
-
/**
- * Immutable identity of one Status List as in
- * <a href="https://datatracker.ietf.org/doc/draft-ietf-oauth-status-list/">
- * draft-ietf-oauth-status-list</a>.
- *
- * A bucket holds credentials that all expire before the end of the bucket.
- *
- * @param id identifier, used as storage key
- * @param end upper bound for expiration of any credential in this bucket
+ * Contexts carrying OpenID4VCI request and response state.
*/
-public record StatusListBucket(@Nonnull String id, @Nonnull Instant end) {
-}
+package org.geant.shibboleth.plugin.openidvci.messaging.context;
diff --git a/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/messaging/impl/AbstractOpenIDVCICredentialsRequestAction.java b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/messaging/impl/AbstractOpenIDVCICredentialsRequestAction.java
index 20006cc..b2d4999 100644
--- a/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/messaging/impl/AbstractOpenIDVCICredentialsRequestAction.java
+++ b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/messaging/impl/AbstractOpenIDVCICredentialsRequestAction.java
@@ -1,12 +1,14 @@
/*
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
+ * Copyright (c) 2025, GÉANT
+ *
+ * Licensed under the Apache License, Version 2.0 (the “License”); you may not
+ * use this file except in compliance with the License. You may obtain a copy
+ * of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
+ * distributed under the License is distributed on an “AS IS” BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
@@ -14,10 +16,11 @@
package org.geant.shibboleth.plugin.openidvci.messaging.impl;
-import org.geant.shibboleth.plugin.openidvci.profile.impl.stolen.AbstractOIDCRequestAction;
import org.opensaml.messaging.context.MessageContext;
import org.opensaml.profile.context.ProfileRequestContext;
+import net.shibboleth.idp.plugin.oidc.op.profile.impl.AbstractOIDCRequestAction;
+
import com.nimbusds.openid.connect.sdk.UserInfoRequest;
/**
diff --git a/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/messaging/impl/AbstractOpenIDVCICredentialsResponseAction.java b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/messaging/impl/AbstractOpenIDVCICredentialsResponseAction.java
index c554e26..09d0f3a 100644
--- a/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/messaging/impl/AbstractOpenIDVCICredentialsResponseAction.java
+++ b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/messaging/impl/AbstractOpenIDVCICredentialsResponseAction.java
@@ -1,12 +1,14 @@
/*
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
+ * Copyright (c) 2025, GÉANT
+ *
+ * Licensed under the Apache License, Version 2.0 (the “License”); you may not
+ * use this file except in compliance with the License. You may obtain a copy
+ * of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
+ * distributed under the License is distributed on an “AS IS” BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
@@ -40,7 +42,7 @@ import net.shibboleth.shared.primitive.LoggerFactory;
* {@link OIDCAuthenticationResponseContext} located under
* {@link ProfileRequestContext#getOutboundMessageContext()}.
*/
-abstract public class AbstractOpenIDVCICredentialsResponseAction
+public abstract class AbstractOpenIDVCICredentialsResponseAction
extends AbstractOpenIDVCICredentialsValidationResponseAction {
/** Class logger. */
diff --git a/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/messaging/impl/AbstractOpenIDVCICredentialsValidationResponseAction.java b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/messaging/impl/AbstractOpenIDVCICredentialsValidationResponseAction.java
index b7d371a..d21f0e8 100644
--- a/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/messaging/impl/AbstractOpenIDVCICredentialsValidationResponseAction.java
+++ b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/messaging/impl/AbstractOpenIDVCICredentialsValidationResponseAction.java
@@ -1,12 +1,14 @@
/*
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
+ * Copyright (c) 2025, GÉANT
+ *
+ * Licensed under the Apache License, Version 2.0 (the “License”); you may not
+ * use this file except in compliance with the License. You may obtain a copy
+ * of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
+ * distributed under the License is distributed on an “AS IS” BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
@@ -36,7 +38,7 @@ import net.shibboleth.shared.primitive.LoggerFactory;
* {@link ProfileRequestContext#getInboundMessageContext()} and
* {@link MessageContext#getMessage()}.
*/
-abstract public class AbstractOpenIDVCICredentialsValidationResponseAction
+public abstract class AbstractOpenIDVCICredentialsValidationResponseAction
extends AbstractOpenIDVCICredentialsRequestAction {
/** Class logger. */
diff --git a/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/messaging/impl/AbstractOpenIDVCITokenRequestAction.java b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/messaging/impl/AbstractOpenIDVCITokenRequestAction.java
index c45b84d..ed14396 100644
--- a/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/messaging/impl/AbstractOpenIDVCITokenRequestAction.java
+++ b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/messaging/impl/AbstractOpenIDVCITokenRequestAction.java
@@ -1,12 +1,14 @@
/*
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
+ * Copyright (c) 2025, GÉANT
+ *
+ * Licensed under the Apache License, Version 2.0 (the “License”); you may not
+ * use this file except in compliance with the License. You may obtain a copy
+ * of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
+ * distributed under the License is distributed on an “AS IS” BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
@@ -16,10 +18,11 @@ package org.geant.shibboleth.plugin.openidvci.messaging.impl;
import javax.annotation.Nullable;
-import org.geant.shibboleth.plugin.openidvci.profile.impl.stolen.AbstractOIDCRequestAction;
import org.opensaml.messaging.context.MessageContext;
import org.opensaml.profile.context.ProfileRequestContext;
+import net.shibboleth.idp.plugin.oidc.op.profile.impl.AbstractOIDCRequestAction;
+
import com.nimbusds.oauth2.sdk.TokenRequest;
/**
diff --git a/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/messaging/impl/AbstractOpenIDVCITokenResponseAction.java b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/messaging/impl/AbstractOpenIDVCITokenResponseAction.java
index 8d05dc7..4492de9 100644
--- a/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/messaging/impl/AbstractOpenIDVCITokenResponseAction.java
+++ b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/messaging/impl/AbstractOpenIDVCITokenResponseAction.java
@@ -1,12 +1,14 @@
/*
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
+ * Copyright (c) 2025, GÉANT
+ *
+ * Licensed under the Apache License, Version 2.0 (the “License”); you may not
+ * use this file except in compliance with the License. You may obtain a copy
+ * of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
+ * distributed under the License is distributed on an “AS IS” BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
diff --git a/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/messaging/impl/CredentialOfferRequest.java b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/messaging/impl/CredentialOfferRequest.java
index 6364b1e..675fe6b 100644
--- a/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/messaging/impl/CredentialOfferRequest.java
+++ b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/messaging/impl/CredentialOfferRequest.java
@@ -69,12 +69,13 @@ public class CredentialOfferRequest extends AbstractOptionallyIdentifiedRequest
* example, the {@link #toHTTPRequest()} method will not be
* used).
* @param clientAuth The client authentication, {@code null} if none.
- * @param request Credential Offer Request content.
- * @throws ParseException
+ * @param preAuthorizedCredentials Credentials offered in the pre-authorized code flow.
+ * @param codeCredentials Credentials offered in the authorization code flow.
+ * @param credentialOfferTxCode Transaction Code the wallet must present.
*/
- public CredentialOfferRequest(@Nullable final URI uri, @Nullable ClientAuthentication clientAuth,
+ public CredentialOfferRequest(@Nullable final URI uri, @Nullable final ClientAuthentication clientAuth,
@Nullable final Map<String, CredentialOfferRequestedCredential> preAuthorizedCredentials,
- @Nullable final List<String> codeCredentials, @Nullable CredentialOfferTxCode credentialOfferTxCode) {
+ @Nullable final List<String> codeCredentials, @Nullable final CredentialOfferTxCode credentialOfferTxCode) {
super(uri, clientAuth);
assert !(preAuthorizedCredentials == null && codeCredentials == null);
assert !(preAuthorizedCredentials != null && codeCredentials != null);
@@ -90,12 +91,13 @@ public class CredentialOfferRequest extends AbstractOptionallyIdentifiedRequest
* is intended, {@code null} if not specified (if, for example,
* the {@link #toHTTPRequest()} method will not be used).
* @param clientID The client identifier, {@code null} if not specified.
- * @param request Credential Offer Request content.
- * @throws ParseException
+ * @param preAuthorizedCredentials Credentials offered in the pre-authorized code flow.
+ * @param codeCredentials Credentials offered in the authorization code flow.
+ * @param credentialOfferTxCode Transaction Code the wallet must present.
*/
- public CredentialOfferRequest(@Nullable final URI uri, @Nullable ClientID clientID,
+ public CredentialOfferRequest(@Nullable final URI uri, @Nullable final ClientID clientID,
@Nullable final Map<String, CredentialOfferRequestedCredential> preAuthorizedCredentials,
- @Nullable final List<String> codeCredentials, @Nullable CredentialOfferTxCode credentialOfferTxCode) {
+ @Nullable final List<String> codeCredentials, @Nullable final CredentialOfferTxCode credentialOfferTxCode) {
super(uri, clientID);
assert !(preAuthorizedCredentials == null && codeCredentials == null);
assert !(preAuthorizedCredentials != null && codeCredentials != null);
@@ -132,6 +134,7 @@ public class CredentialOfferRequest extends AbstractOptionallyIdentifiedRequest
return credentialOfferTxCode;
}
+// Checkstyle: CyclomaticComplexity OFF
/**
* Parses request from http request.
*
@@ -143,37 +146,38 @@ public class CredentialOfferRequest extends AbstractOptionallyIdentifiedRequest
public static CredentialOfferRequest parse(final HTTPRequest httpRequest) throws ParseException {
httpRequest.ensureMethod(HTTPRequest.Method.POST);
httpRequest.ensureEntityContentType(ContentType.APPLICATION_JSON);
- ClientAuthentication clientAuth;
+ final ClientAuthentication clientAuth;
// TODO: Implement additional client authentication parsing from JSON content
try {
clientAuth = ClientAuthentication.parse(httpRequest);
- } catch (ParseException e) {
+ } catch (final ParseException e) {
throw new ParseException(e.getMessage(),
OAuth2Error.INVALID_REQUEST.appendDescription(": " + e.getMessage()));
}
- Map<String, Object> content;
+ final Map<String, Object> content;
try {
content = new ObjectMapper().readValue(httpRequest.getQuery(), new TypeReference<Map<String, Object>>() {
});
- } catch (IllegalArgumentException | JsonProcessingException e1) {
+ } catch (final IllegalArgumentException | JsonProcessingException e1) {
throw new ParseException(e1.getMessage());
}
- if ((content.containsKey("preAuthorizedCredentials") && content.containsKey("codeCredentials"))
- || (!content.containsKey("preAuthorizedCredentials") && !content.containsKey("codeCredentials"))) {
+ if (content.containsKey("preAuthorizedCredentials") && content.containsKey("codeCredentials")
+ || !content.containsKey("preAuthorizedCredentials") && !content.containsKey("codeCredentials")) {
throw new ParseException(
- "Invalid credential offer request: Exactly one of the parameters 'preAuthorizedCredentials' 'codeCredentials' must exist");
+ "Invalid credential offer request: Exactly one of the parameters "
+ + "'preAuthorizedCredentials' 'codeCredentials' must exist");
}
Map<String, CredentialOfferRequestedCredential> preAuthorizedCredentials = null;
if (content.containsKey("preAuthorizedCredentials")) {
- Map<String, Object> preAuthorizedCredentialsInRequest = (Map<String, Object>) content
+ final Map<String, Object> preAuthorizedCredentialsInRequest = (Map<String, Object>) content
.get("preAuthorizedCredentials");
preAuthorizedCredentials = new HashMap<>();
- for (String key : preAuthorizedCredentialsInRequest.keySet()) {
+ for (final String key : preAuthorizedCredentialsInRequest.keySet()) {
preAuthorizedCredentials.put(key,
CredentialOfferRequestedCredential.parse(preAuthorizedCredentialsInRequest.get(key)));
}
@@ -189,10 +193,10 @@ public class CredentialOfferRequest extends AbstractOptionallyIdentifiedRequest
codeCredentials = (List<String>) credentials;
}
- URI uri;
+ final URI uri;
try {
uri = httpRequest.getURL().toURI();
- } catch (URISyntaxException e) {
+ } catch (final URISyntaxException e) {
throw new ParseException(e.getMessage(), e);
}
if (clientAuth != null) {
@@ -209,7 +213,9 @@ public class CredentialOfferRequest extends AbstractOptionallyIdentifiedRequest
return new CredentialOfferRequest(uri, new ClientID(clientIDString), preAuthorizedCredentials, codeCredentials,
credentialOfferTxCode);
}
+// Checkstyle: CyclomaticComplexity ON
+ /** {@inheritDoc} */
@Override
public HTTPRequest toHTTPRequest() {
// Not implemented
diff --git a/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/messaging/impl/CredentialOfferRequestedClaim.java b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/messaging/impl/CredentialOfferRequestedClaim.java
index f378620..683e13d 100644
--- a/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/messaging/impl/CredentialOfferRequestedClaim.java
+++ b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/messaging/impl/CredentialOfferRequestedClaim.java
@@ -16,9 +16,6 @@
package org.geant.shibboleth.plugin.openidvci.messaging.impl;
-/**
- * Requested claim in {@link CredentialOfferRequestedCredential}.
- */
import java.util.List;
import java.util.Map;
import java.util.stream.Collectors;
@@ -30,7 +27,10 @@ import com.nimbusds.oauth2.sdk.ParseException;
import net.shibboleth.shared.annotation.constraint.NotEmpty;
-public class CredentialOfferRequestedClaim {
+/**
+ * Requested claim in {@link CredentialOfferRequestedCredential}.
+ */
+public final class CredentialOfferRequestedClaim {
/** Path of the claim. */
@Nonnull
@@ -49,7 +49,8 @@ public class CredentialOfferRequestedClaim {
* @param path Path of the claim
* @param value Value of the claim
*/
- private CredentialOfferRequestedClaim(@JsonProperty("path") @Nonnull @NotEmpty List<String> path, @JsonProperty("value") @Nonnull Object value) {
+ private CredentialOfferRequestedClaim(@JsonProperty("path") @Nonnull @NotEmpty final List<String> path,
+ @JsonProperty("value") @Nonnull final Object value) {
if (path == null || path.isEmpty()) {
throw new IllegalArgumentException("Requested claim must have path component");
}
@@ -88,7 +89,7 @@ public class CredentialOfferRequestedClaim {
* @return CredentialOfferRequestedClaim instance
* @throws ParseException if something unexpected occurs
*/
- public static CredentialOfferRequestedClaim parse(@Nonnull Object object) throws ParseException {
+ public static CredentialOfferRequestedClaim parse(@Nonnull final Object object) throws ParseException {
List<String> parsedPath = null;
if (object instanceof Map<?, ?> requestedClaim) {
if (requestedClaim.get("path") instanceof List<?> path2) {
diff --git a/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/messaging/impl/CredentialOfferRequestedCredential.java b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/messaging/impl/CredentialOfferRequestedCredential.java
index b9daf11..76999e6 100644
--- a/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/messaging/impl/CredentialOfferRequestedCredential.java
+++ b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/messaging/impl/CredentialOfferRequestedCredential.java
@@ -42,13 +42,14 @@ public class CredentialOfferRequestedCredential {
* @param requestedCredential Requested credentials
*/
@JsonCreator
- public CredentialOfferRequestedCredential(List<CredentialOfferRequestedClaim> requestedCredential) {
+ public CredentialOfferRequestedCredential(final List<CredentialOfferRequestedClaim> requestedCredential) {
if (requestedCredential == null || requestedCredential.isEmpty()) {
throw new IllegalArgumentException("Requested credential must have requested claims");
}
this.requestedCredential = requestedCredential;
}
+ /** Constructor. */
@JsonCreator
private CredentialOfferRequestedCredential() {
requestedCredential = new ArrayList<>();
@@ -66,14 +67,21 @@ public class CredentialOfferRequestedCredential {
/**
* Serialize object to json.
*
- * @return
- * @throws JsonProcessingException
+ * @return this requested credential as a json string
+ * @throws JsonProcessingException if serialization fails
*/
public String serialize() throws JsonProcessingException {
return new ObjectMapper().writeValueAsString(this);
}
- public static CredentialOfferRequestedCredential parse(@Nonnull String request)
+ /**
+ * Parse a requested credential from its JSON representation.
+ *
+ * @param request JSON to parse
+ * @return parsed requested credential
+ * @throws ParseException if the JSON cannot be parsed
+ */
+ public static CredentialOfferRequestedCredential parse(@Nonnull final String request)
throws ParseException, JsonMappingException, JsonProcessingException {
return new ObjectMapper().readValue(request, CredentialOfferRequestedCredential.class);
@@ -86,10 +94,10 @@ public class CredentialOfferRequestedCredential {
* @return CredentialOfferRequestedCredential instance
* @throws ParseException if something unexpected occurs
*/
- public static CredentialOfferRequestedCredential parse(Object object) throws ParseException {
- List<CredentialOfferRequestedClaim> requestedCredential = new ArrayList<>();
+ public static CredentialOfferRequestedCredential parse(final Object object) throws ParseException {
+ final List<CredentialOfferRequestedClaim> requestedCredential = new ArrayList<>();
if (object instanceof List<?> objects) {
- ListIterator<?> it = objects.listIterator();
+ final ListIterator<?> it = objects.listIterator();
while (it.hasNext()) {
requestedCredential.add(CredentialOfferRequestedClaim.parse(it.next()));
}
diff --git a/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/messaging/impl/CredentialOfferSuccessResponse.java b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/messaging/impl/CredentialOfferSuccessResponse.java
index 7a7e89a..6e11489 100644
--- a/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/messaging/impl/CredentialOfferSuccessResponse.java
+++ b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/messaging/impl/CredentialOfferSuccessResponse.java
@@ -58,16 +58,17 @@ public class CredentialOfferSuccessResponse implements SuccessResponse {
private final Object grants;
/**
- *
- * @param issuer
- * @param codeOrState
- * @param preAuthCredentials
- * @param codeCredentials
- * @param credentialOfferTxCode
+ * Constructor.
+ *
+ * @param issuer Credential Issuer identifier.
+ * @param codeOrState Pre-authorized code, or issuer_state in the authorization code flow.
+ * @param preAuthCredentials Credentials offered in the pre-authorized code flow.
+ * @param codeCredentials Credentials offered in the authorization code flow.
+ * @param credentialOfferTxCode Transaction Code the wallet must present.
*/
- public CredentialOfferSuccessResponse(@Nonnull String issuer, @Nonnull String codeOrState,
- @Nullable Map<String, CredentialOfferRequestedCredential> preAuthCredentials,
- @Nullable List<String> codeCredentials, @Nullable CredentialOfferTxCode credentialOfferTxCode) {
+ public CredentialOfferSuccessResponse(@Nonnull final String issuer, @Nonnull final String codeOrState,
+ @Nullable final Map<String, CredentialOfferRequestedCredential> preAuthCredentials,
+ @Nullable final List<String> codeCredentials, @Nullable final CredentialOfferTxCode credentialOfferTxCode) {
credentialIssuer = issuer;
if (preAuthCredentials != null) {
@@ -114,7 +115,7 @@ public class CredentialOfferSuccessResponse implements SuccessResponse {
* @throws JsonProcessingException
*/
private String toOffer() throws JsonProcessingException {
- ObjectMapper objectMapper = new ObjectMapper();
+ final ObjectMapper objectMapper = new ObjectMapper();
return "openid-credential-offer://?credential_offer=" + objectMapper.writeValueAsString(this);
}
@@ -127,24 +128,31 @@ public class CredentialOfferSuccessResponse implements SuccessResponse {
/** {@inheritDoc} */
@Override
public HTTPResponse toHTTPResponse() {
- HTTPResponse httpResponse = new HTTPResponse(HTTPResponse.SC_OK);
+ final HTTPResponse httpResponse = new HTTPResponse(HTTPResponse.SC_OK);
httpResponse.setEntityContentType(ContentType.APPLICATION_JSON);
httpResponse.setCacheControl("no-store");
httpResponse.setPragma("no-cache");
try {
httpResponse.setContent(toOffer());
- } catch (JsonProcessingException e) {
+ } catch (final JsonProcessingException e) {
log.error("Internal message processing error", e);
return null;
}
return httpResponse;
}
+ /**
+ * Build the authorization code grant of a Credential Offer.
+ *
+ * @param issuerState issuer_state carried to the authorization request
+ * @param authorizationServer authorization server the wallet must use, or null
+ * @return grant as a map
+ */
@SuppressWarnings("unchecked")
public static Map<String, Object> buildCodeGrant(@Nonnull final String issuerState,
@Nullable final String authorizationServer) {
assert issuerState != null;
- Map<String, Object> grant = new HashMap<>();
+ final Map<String, Object> grant = new HashMap<>();
grant.put("authorization_code", new HashMap<>());
((Map<String, Object>) grant.get("authorization_code")).put("issuer_state", issuerState);
if (authorizationServer != null) {
@@ -153,11 +161,18 @@ public class CredentialOfferSuccessResponse implements SuccessResponse {
return grant;
}
+ /**
+ * Build the pre-authorized code grant of a Credential Offer.
+ *
+ * @param preauthCode pre-authorized code
+ * @param txCode Transaction Code the wallet must present, or null
+ * @return grant as a map
+ */
@SuppressWarnings("unchecked")
public static Map<String, Object> buildPreAuthGrant(@Nonnull final String preauthCode,
- CredentialOfferTxCode txCode) {
+ final CredentialOfferTxCode txCode) {
assert preauthCode != null;
- Map<String, Object> grant = new HashMap<>();
+ final Map<String, Object> grant = new HashMap<>();
grant.put("urn:ietf:params:oauth:grant-type:pre-authorized_code", new HashMap<>());
((Map<String, Object>) grant.get("urn:ietf:params:oauth:grant-type:pre-authorized_code"))
.put("pre-authorized_code", preauthCode);
diff --git a/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/messaging/impl/CredentialOfferTxCode.java b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/messaging/impl/CredentialOfferTxCode.java
index 843794d..bd4f117 100644
--- a/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/messaging/impl/CredentialOfferTxCode.java
+++ b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/messaging/impl/CredentialOfferTxCode.java
@@ -65,7 +65,7 @@ public class CredentialOfferTxCode {
private final String value;
/**
- * Constructor
+ * Constructor.
*
* @param inputMode String specifying the input character set. Possible values
* are numeric (only digits) and text (any characters). The
@@ -78,10 +78,10 @@ public class CredentialOfferTxCode {
* @param value Value of tx code
*/
@JsonCreator
- public CredentialOfferTxCode(@JsonProperty("input_mode") @Nullable String inputMode,
- @JsonProperty("length") @Nullable Integer length,
+ public CredentialOfferTxCode(@JsonProperty("input_mode") @Nullable final String inputMode,
+ @JsonProperty("length") @Nullable final Integer length,
@JsonProperty("description") @Nullable final String description,
- @JsonProperty("value") @Nonnull String value) {
+ @JsonProperty("value") @Nonnull final String value) {
assert value != null;
this.inputMode = inputMode;
this.length = length;
@@ -136,8 +136,8 @@ public class CredentialOfferTxCode {
/**
* Serialize object to json.
*
- * @return
- * @throws JsonProcessingException
+ * @return this Transaction Code as a json string
+ * @throws JsonProcessingException if serialization fails
*/
public String serialize() throws JsonProcessingException {
return new ObjectMapper().writeValueAsString(this);
@@ -149,8 +149,9 @@ public class CredentialOfferTxCode {
* @return Object as map without value field
*/
public Map<String, Object> toResponseMap() {
- Map<String, Object> object = new ObjectMapper().convertValue(this, new TypeReference<Map<String, Object>>() {
- });
+ final Map<String, Object> object =
+ new ObjectMapper().convertValue(this, new TypeReference<Map<String, Object>>() {
+ });
object.remove("value");
return object;
}
@@ -162,7 +163,7 @@ public class CredentialOfferTxCode {
* @return CredentialOfferTxCode object
* @throws JsonProcessingException if something unexpected occurs.
*/
- public static CredentialOfferTxCode parse(@Nonnull String txCode) throws JsonProcessingException {
+ public static CredentialOfferTxCode parse(@Nonnull final String txCode) throws JsonProcessingException {
return new ObjectMapper().readValue(txCode, CredentialOfferTxCode.class);
}
@@ -174,12 +175,12 @@ public class CredentialOfferTxCode {
* @return CredentialOfferTxCode instance
* @throws ParseException if something unexpected occurs
*/
- public static CredentialOfferTxCode parse(@Nonnull Object object) throws ParseException {
+ public static CredentialOfferTxCode parse(@Nonnull final Object object) throws ParseException {
if (object instanceof Map<?, ?> txCode) {
- String txInputMode = txCode.get("input_mode") instanceof String mode ? mode : null;
- Integer txLength = txCode.get("length") instanceof Integer length ? length : null;
- String txDescription = txCode.get("description") instanceof String description ? description : null;
- String txValue = txCode.get("value") instanceof String value ? value : null;
+ final String txInputMode = txCode.get("input_mode") instanceof String mode ? mode : null;
+ final Integer txLength = txCode.get("length") instanceof Integer len ? len : null;
+ final String txDescription = txCode.get("description") instanceof String desc ? desc : null;
+ final String txValue = txCode.get("value") instanceof String val ? val : null;
return new CredentialOfferTxCode(txInputMode, txLength, txDescription, txValue);
}
throw new ParseException("Invalid credential offer tx code: Parsing failed");
diff --git a/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/messaging/impl/CredentialSuccessResponse.java b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/messaging/impl/CredentialSuccessResponse.java
index 4544a7c..8775a31 100644
--- a/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/messaging/impl/CredentialSuccessResponse.java
+++ b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/messaging/impl/CredentialSuccessResponse.java
@@ -16,21 +16,11 @@
package org.geant.shibboleth.plugin.openidvci.messaging.impl;
-import java.text.DateFormat;
-import java.text.SimpleDateFormat;
-import java.time.Instant;
-import java.time.LocalDateTime;
-import java.time.ZoneId;
-import java.time.ZoneOffset;
import java.time.ZonedDateTime;
import java.time.format.DateTimeFormatter;
-import java.time.temporal.TemporalAccessor;
import java.util.ArrayList;
-import java.util.Calendar;
-import java.util.Date;
import java.util.HashMap;
import java.util.List;
-import java.util.Locale;
import java.util.Map;
import javax.annotation.Nullable;
@@ -55,34 +45,33 @@ public class CredentialSuccessResponse implements SuccessResponse {
private final List<Map<String, String>> credentials = new ArrayList<Map<String, String>>();
/**
- * Get v15 credentials parameter.
+ * Constructor. TODO: No safeguards in place. Add when finalized.
*
- * @return v15 credentials parameter
+ * @param credentialv15 v15 credentials parameter
*/
- public List<Map<String, String>> getCredentials() {
- return credentials;
+ public CredentialSuccessResponse(@Nullable final List<String> credentialv15) {
+ final Map<String, String> cred = new HashMap<String, String>();
+ credentialv15.forEach(credential -> cred.put("credential", credential));
+ credentials.add(cred);
}
/**
- * Constructor. TODO: No safeguards in place. Add when finalized.
+ * Get v15 credentials parameter.
*
- * @param credentialv15 v15 credentials parameter
- * @param credentialv14 v14 credential parameter
+ * @return v15 credentials parameter
*/
- public CredentialSuccessResponse(@Nullable List<String> credentialv15) {
- Map<String, String> cred = new HashMap<String, String>();
- credentialv15.forEach(credential -> cred.put("credential", credential));
- credentials.add(cred);
+ public List<Map<String, String>> getCredentials() {
+ return credentials;
}
/**
* Response content as JSON.
*
- * @return
- * @throws JsonProcessingException
+ * @return this response as a json string
+ * @throws JsonProcessingException if serialization fails
*/
public String toOffer() throws JsonProcessingException {
- ObjectMapper objectMapper = new ObjectMapper();
+ final ObjectMapper objectMapper = new ObjectMapper();
return objectMapper.writeValueAsString(this);
}
@@ -95,7 +84,7 @@ public class CredentialSuccessResponse implements SuccessResponse {
/** {@inheritDoc} */
@Override
public HTTPResponse toHTTPResponse() {
- HTTPResponse httpResponse = new HTTPResponse(HTTPResponse.SC_OK);
+ final HTTPResponse httpResponse = new HTTPResponse(HTTPResponse.SC_OK);
httpResponse.setEntityContentType(ContentType.APPLICATION_JSON);
httpResponse.setCacheControl("no-store");
httpResponse.setPragma("no-cache");
@@ -103,7 +92,7 @@ public class CredentialSuccessResponse implements SuccessResponse {
httpResponse.setHeader("Date", DateTimeFormatter.RFC_1123_DATE_TIME.format(ZonedDateTime.now()));
try {
httpResponse.setContent(toOffer());
- } catch (JsonProcessingException e) {
+ } catch (final JsonProcessingException e) {
// TODO Auto-generated catch block
e.printStackTrace();
return null;
diff --git a/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/messaging/impl/NonceSuccessResponse.java b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/messaging/impl/NonceSuccessResponse.java
index 87328f4..cc25b5c 100644
--- a/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/messaging/impl/NonceSuccessResponse.java
+++ b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/messaging/impl/NonceSuccessResponse.java
@@ -48,7 +48,12 @@ public class NonceSuccessResponse implements SuccessResponse {
@JsonProperty("c_nonce")
private final String cNonce;
- public NonceSuccessResponse(@Nonnull @NotEmpty String cNonce) {
+ /**
+ * Constructor.
+ *
+ * @param cNonce nonce to return to the wallet
+ */
+ public NonceSuccessResponse(@Nonnull @NotEmpty final String cNonce) {
assert cNonce != null;
assert !cNonce.isEmpty();
this.cNonce = cNonce;
@@ -63,13 +68,13 @@ public class NonceSuccessResponse implements SuccessResponse {
/** {@inheritDoc} */
@Override
public HTTPResponse toHTTPResponse() {
- HTTPResponse httpResponse = new HTTPResponse(HTTPResponse.SC_OK);
+ final HTTPResponse httpResponse = new HTTPResponse(HTTPResponse.SC_OK);
httpResponse.setEntityContentType(ContentType.APPLICATION_JSON);
//httpResponse.setCacheControl("no-store");
httpResponse.setPragma("no-cache");
try {
httpResponse.setContent(new ObjectMapper().writeValueAsString(this));
- } catch (JsonProcessingException e) {
+ } catch (final JsonProcessingException e) {
// TODO Auto-generated catch block
e.printStackTrace();
return null;
diff --git a/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/messaging/impl/OpenIDVCIAuthorizationDetail.java b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/messaging/impl/OpenIDVCIAuthorizationDetail.java
index 9f19973..c9c97fa 100644
--- a/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/messaging/impl/OpenIDVCIAuthorizationDetail.java
+++ b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/messaging/impl/OpenIDVCIAuthorizationDetail.java
@@ -17,9 +17,6 @@
package org.geant.shibboleth.plugin.openidvci.messaging.impl;
import java.util.List;
-/**
- * OpenID VCI authorization detail in {@link }.
- */
import java.util.Map;
import javax.annotation.Nonnull;
@@ -39,9 +36,9 @@ import com.nimbusds.oauth2.sdk.util.MultivaluedMapUtils;
import net.shibboleth.shared.annotation.constraint.NotEmpty;
/**
- * Class parsing authorization_details parameter for OpenID VCI as described in
- * https://openid.net/specs/openid-4-verifiable-credential-issuance-1_0.html#name-using-authorization-details
+ * Class parsing the authorization_details parameter for OpenID4VCI.
*
+ * <p>See https://openid.net/specs/openid-4-verifiable-credential-issuance-1_0.html#name-using-authorization-details</p>
*/
@JsonIgnoreProperties(ignoreUnknown = true)
public class OpenIDVCIAuthorizationDetail {
@@ -71,17 +68,18 @@ public class OpenIDVCIAuthorizationDetail {
private final List<String> credentialIdentifiers;
/**
- * Constructor
+ * Constructor.
*
* @param type Authorization details type
* @param credentialConfigurationId Credential configuration id
* @param claims Authorization details claims
+ * @param credentialIdentifiers Identifiers of the credentials the detail covers
*/
@JsonCreator
- public OpenIDVCIAuthorizationDetail(@JsonProperty("type") @Nonnull @NotEmpty String type,
- @JsonProperty("credential_configuration_id") @Nonnull @NotEmpty String credentialConfigurationId,
- @JsonProperty("claims") List<OpenIDVCIAuthorizationDetailClaim> claims,
- @JsonProperty("credential_identifiers") List<String> credentialIdentifiers) {
+ public OpenIDVCIAuthorizationDetail(@JsonProperty("type") @Nonnull @NotEmpty final String type,
+ @JsonProperty("credential_configuration_id") @Nonnull @NotEmpty final String credentialConfigurationId,
+ @JsonProperty("claims") final List<OpenIDVCIAuthorizationDetailClaim> claims,
+ @JsonProperty("credential_identifiers") final List<String> credentialIdentifiers) {
if (!"openid_credential".equals(type)) {
throw new IllegalArgumentException("Type must have value 'openid_credential'");
}
@@ -122,8 +120,8 @@ public class OpenIDVCIAuthorizationDetail {
/**
* Serialize object to json.
*
- * @return
- * @throws JsonProcessingException
+ * @return this authorization detail as a json string
+ * @throws JsonProcessingException if serialization fails
*/
public String serialize() throws JsonProcessingException {
return new ObjectMapper().writeValueAsString(this);
@@ -141,8 +139,8 @@ public class OpenIDVCIAuthorizationDetail {
public static final List<OpenIDVCIAuthorizationDetail> parse(@Nonnull final HTTPRequest httpRequest)
throws JsonProcessingException {
assert httpRequest != null;
- Map<String, List<String>> params = httpRequest.getQueryParameters();
- String authorizationDetails = MultivaluedMapUtils.getFirstValue(params, "authorization_details");
+ final Map<String, List<String>> params = httpRequest.getQueryParameters();
+ final String authorizationDetails = MultivaluedMapUtils.getFirstValue(params, "authorization_details");
if (authorizationDetails != null && !authorizationDetails.isEmpty()) {
return parse(authorizationDetails);
}
diff --git a/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/messaging/impl/OpenIDVCIAuthorizationDetailClaim.java b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/messaging/impl/OpenIDVCIAuthorizationDetailClaim.java
index a021b43..7e8691a 100644
--- a/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/messaging/impl/OpenIDVCIAuthorizationDetailClaim.java
+++ b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/messaging/impl/OpenIDVCIAuthorizationDetailClaim.java
@@ -26,11 +26,12 @@ import com.fasterxml.jackson.annotation.JsonProperty;
import net.shibboleth.shared.annotation.constraint.NotEmpty;
/**
- * claim in {@link OpenIDVCIAuthorizationDetail} as described in
- * https://openid.net/specs/openid-4-verifiable-credential-issuance-1_0.html#name-using-authorization-details
+ * Claim in {@link OpenIDVCIAuthorizationDetail}.
+ *
+ * <p>See https://openid.net/specs/openid-4-verifiable-credential-issuance-1_0.html#name-using-authorization-details</p>
*/
@JsonIgnoreProperties(ignoreUnknown = true)
-public class OpenIDVCIAuthorizationDetailClaim {
+public final class OpenIDVCIAuthorizationDetailClaim {
/** Path of the claim. */
@Nonnull
@@ -49,8 +50,8 @@ public class OpenIDVCIAuthorizationDetailClaim {
* @param mandatory Whether wallet will only accept a credential that includes
* this claim
*/
- private OpenIDVCIAuthorizationDetailClaim(@JsonProperty("path") @Nonnull @NotEmpty List<String> path,
- @JsonProperty("mandatory") @Nullable Boolean mandatory) {
+ private OpenIDVCIAuthorizationDetailClaim(@JsonProperty("path") @Nonnull @NotEmpty final List<String> path,
+ @JsonProperty("mandatory") @Nullable final Boolean mandatory) {
if (path == null || path.isEmpty()) {
throw new IllegalArgumentException("Requested claim must have path component");
}
diff --git a/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/messaging/impl/OpenIDVCICredentialsRequest.java b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/messaging/impl/OpenIDVCICredentialsRequest.java
index 979c8dd..229975c 100644
--- a/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/messaging/impl/OpenIDVCICredentialsRequest.java
+++ b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/messaging/impl/OpenIDVCICredentialsRequest.java
@@ -43,16 +43,16 @@ import com.nimbusds.oauth2.sdk.token.AccessToken;
public class OpenIDVCICredentialsRequest extends ProtectedResourceRequest {
/** Key to locate credential_identifier - field of request. */
- private final static String credentialIdentifierKey = "credential_identifier";
+ private static final String CREDENTIAL_IDENTIFIER_KEY = "credential_identifier";
/** Key to locate credential_configuration_id - field of request. */
- private final static String credentialConfigurationIdKey = "credential_configuration_id";
+ private static final String CREDENTIAL_CONFIGURATION_ID_KEY = "credential_configuration_id";
/** Key to locate proofs - field of request. */
- private final static String proofsKey = "proofs";
+ private static final String PROOFS_KEY = "proofs";
/** Key to locate credential_response_encryption - field of request. */
- private final static String credentialResponseEncryptionKey = "credential_response_encryption";
+ private static final String CREDENTIAL_RESPONSE_ENCRYPTION_KEY = "credential_response_encryption";
/** Request parameter credential_identifier. */
private String credentialIdentifier;
@@ -75,7 +75,7 @@ public class OpenIDVCICredentialsRequest extends ProtectedResourceRequest {
* be used).
* @param accessToken OAuth2 access token.
*/
- protected OpenIDVCICredentialsRequest(@Nullable URI uri, @Nonnull AccessToken accessToken) {
+ protected OpenIDVCICredentialsRequest(@Nullable final URI uri, @Nonnull final AccessToken accessToken) {
super(uri, accessToken);
if (accessToken == null) {
@@ -98,7 +98,7 @@ public class OpenIDVCICredentialsRequest extends ProtectedResourceRequest {
*
* @param id Request parameter credential_identifier
*/
- protected void setCredentialIdentifier(String id) {
+ protected void setCredentialIdentifier(final String id) {
credentialIdentifier = id;
}
@@ -117,7 +117,7 @@ public class OpenIDVCICredentialsRequest extends ProtectedResourceRequest {
*
* @param id request parameter credential_configuration_id
*/
- private void setCredentialConfigurationId(String id) {
+ private void setCredentialConfigurationId(final String id) {
credentialConfigurationId = id;
}
@@ -136,7 +136,7 @@ public class OpenIDVCICredentialsRequest extends ProtectedResourceRequest {
*
* @param proofs Request parameter proofs
*/
- private void setProofs(Map<String, Object> proofs) {
+ private void setProofs(final Map<String, Object> proofs) {
this.proofs = proofs;
}
@@ -155,7 +155,7 @@ public class OpenIDVCICredentialsRequest extends ProtectedResourceRequest {
*
* @param responseEncryption Request parameter credential_response_encryption
*/
- private void setCredentialResponseEncryption(Map<String, Object> responseEncryption) {
+ private void setCredentialResponseEncryption(final Map<String, Object> responseEncryption) {
credentialResponseEncryption = responseEncryption;
}
@@ -189,27 +189,28 @@ public class OpenIDVCICredentialsRequest extends ProtectedResourceRequest {
public static OpenIDVCICredentialsRequest parse(final HTTPRequest httpRequest) throws ParseException {
httpRequest.ensureMethod(HTTPRequest.Method.POST);
httpRequest.ensureEntityContentType(ContentType.APPLICATION_JSON);
- AccessToken accessToken = AccessToken.parse(httpRequest);
- Map<String, Object> payload;
+ final AccessToken accessToken = AccessToken.parse(httpRequest);
+ final Map<String, Object> payload;
try {
payload = new ObjectMapper().readValue(httpRequest.getQuery(), new TypeReference<Map<String, Object>>() {
});
- } catch (JsonProcessingException e1) {
+ } catch (final JsonProcessingException e1) {
throw new ParseException(e1.getMessage(),
OAuth2Error.INVALID_REQUEST.appendDescription(": " + e1.getMessage()));
}
- URI uri;
+ final URI uri;
try {
uri = httpRequest.getURL().toURI();
- } catch (URISyntaxException e) {
+ } catch (final URISyntaxException e) {
throw new ParseException(e.getMessage(), e);
}
- OpenIDVCICredentialsRequest request = new OpenIDVCICredentialsRequest(uri, accessToken);
- request.setCredentialIdentifier((payload.get(credentialIdentifierKey) instanceof String value) ? value : null);
+ final OpenIDVCICredentialsRequest request = new OpenIDVCICredentialsRequest(uri, accessToken);
+ request.setCredentialIdentifier(
+ (payload.get(CREDENTIAL_IDENTIFIER_KEY) instanceof String value) ? value : null);
request.setCredentialConfigurationId(
- (payload.get(credentialConfigurationIdKey) instanceof String value) ? value : null);
- request.setProofs((Map<String, Object>) payload.get(proofsKey));
- request.setCredentialResponseEncryption((Map<String, Object>) payload.get(credentialResponseEncryptionKey));
+ (payload.get(CREDENTIAL_CONFIGURATION_ID_KEY) instanceof String value) ? value : null);
+ request.setProofs((Map<String, Object>) payload.get(PROOFS_KEY));
+ request.setCredentialResponseEncryption((Map<String, Object>) payload.get(CREDENTIAL_RESPONSE_ENCRYPTION_KEY));
request.validate();
return request;
}
diff --git a/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/messaging/impl/OpenIDVCITokenRequest.java b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/messaging/impl/OpenIDVCITokenRequest.java
index 69a34d5..ba81849 100644
--- a/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/messaging/impl/OpenIDVCITokenRequest.java
+++ b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/messaging/impl/OpenIDVCITokenRequest.java
@@ -45,10 +45,10 @@ import com.nimbusds.oauth2.sdk.util.StringUtils;
public class OpenIDVCITokenRequest extends AbstractOptionallyIdentifiedRequest {
/** Grant Type value for pre-auth flow. */
- public final static String grantTypeValuePreAuth = "urn:ietf:params:oauth:grant-type:pre-authorized_code";
+ public static final String GRANT_TYPE_VALUE_PRE_AUTH = "urn:ietf:params:oauth:grant-type:pre-authorized_code";
/** Grant Type value for code flow. */
- public final static String grantTypeValueCode = "authorization_code";
+ public static final String GRANT_TYPE_VALUE_CODE = "authorization_code";
/**
* Grant type.
@@ -88,6 +88,7 @@ public class OpenIDVCITokenRequest extends AbstractOptionallyIdentifiedRequest {
@Nullable
private final TokenRequest opTokenRequest;
+// Checkstyle: ParameterNumber OFF
/**
* Constructor.
*
@@ -101,24 +102,28 @@ public class OpenIDVCITokenRequest extends AbstractOptionallyIdentifiedRequest {
* @param code Authorization code
* @param txCode The tx-code in pre-authorized flow
* @param codeVerifier The PKCE code verifier
+ * @param authorizationDetails Authorization details of the request
+ * @param opTokenRequest Underlying OP token request
*/
- public OpenIDVCITokenRequest(@Nullable final URI uri, @Nullable ClientAuthentication clientAuth,
- @Nonnull String grantType, @Nullable String preAuthorizedCode, @Nullable String code,
- @Nullable String txCode, @Nullable String codeVerifier,
- @Nullable List<OpenIDVCIAuthorizationDetail> authorizationDetails, @Nullable TokenRequest opTokenRequest) {
+ public OpenIDVCITokenRequest(@Nullable final URI uri, @Nullable final ClientAuthentication clientAuth,
+ @Nonnull final String grantType, @Nullable final String preAuthorizedCode, @Nullable final String code,
+ @Nullable final String txCode, @Nullable final String codeVerifier,
+ @Nullable final List<OpenIDVCIAuthorizationDetail> authorizationDetails,
+ @Nullable final TokenRequest opTokenRequest) {
super(uri, clientAuth);
- if (grantTypeValuePreAuth.equals(grantType)) {
+ if (GRANT_TYPE_VALUE_PRE_AUTH.equals(grantType)) {
if (preAuthorizedCode == null || preAuthorizedCode.isEmpty()) {
throw new IllegalArgumentException(
"pre-auth code must not be null or empty for pre-authorized_code grant");
}
- } else if (grantTypeValueCode.equals(grantType)) {
+ } else if (GRANT_TYPE_VALUE_CODE.equals(grantType)) {
if (code == null || code.isEmpty()) {
throw new IllegalArgumentException("code must not be null or empty for authorization_code grant");
}
} else {
throw new IllegalArgumentException(
- "Grant type must be either 'authorization_code' or 'urn:ietf:params:oauth:grant-type:pre-authorized_code'");
+ "Grant type must be either 'authorization_code' or "
+ + "'urn:ietf:params:oauth:grant-type:pre-authorized_code'");
}
if (codeVerifier != null && codeVerifier.length() < 43) {
throw new IllegalArgumentException("The code verifier must be at least 43 characters");
@@ -146,24 +151,29 @@ public class OpenIDVCITokenRequest extends AbstractOptionallyIdentifiedRequest {
* @param code Authorization code
* @param txCode The tx-code in pre-authorized flow
* @param codeVerifier The PKCE code verifier
+ * @param authorizationDetails Authorization details of the request
+ * @param opTokenRequest Underlying OP token request
*/
- public OpenIDVCITokenRequest(@Nullable final URI uri, @Nullable ClientID clientID, @Nonnull String grantType,
- @Nullable String preAuthorizedCode, @Nullable String code, @Nullable String txCode,
- @Nullable String codeVerifier, @Nullable List<OpenIDVCIAuthorizationDetail> authorizationDetails,
- @Nullable TokenRequest opTokenRequest) {
+ public OpenIDVCITokenRequest(@Nullable final URI uri, @Nullable final ClientID clientID,
+ @Nonnull final String grantType,
+ @Nullable final String preAuthorizedCode, @Nullable final String code, @Nullable final String txCode,
+ @Nullable final String codeVerifier,
+ @Nullable final List<OpenIDVCIAuthorizationDetail> authorizationDetails,
+ @Nullable final TokenRequest opTokenRequest) {
super(uri, (ClientID) clientID);
- if (grantTypeValuePreAuth.equals(grantType)) {
+ if (GRANT_TYPE_VALUE_PRE_AUTH.equals(grantType)) {
if (preAuthorizedCode == null || preAuthorizedCode.isEmpty()) {
throw new IllegalArgumentException(
"pre-auth code must not be null or empty for pre-authorized_code grant");
}
- } else if (grantTypeValueCode.equals(grantType)) {
+ } else if (GRANT_TYPE_VALUE_CODE.equals(grantType)) {
if (code == null || code.isEmpty()) {
throw new IllegalArgumentException("code must not be null or empty for authorization_code grant");
}
} else {
throw new IllegalArgumentException(
- "Grant type must be either 'authorization_code' or 'urn:ietf:params:oauth:grant-type:pre-authorized_code'");
+ "Grant type must be either 'authorization_code' or "
+ + "'urn:ietf:params:oauth:grant-type:pre-authorized_code'");
}
if (codeVerifier != null && codeVerifier.length() < 43) {
throw new IllegalArgumentException("The code verifier must be at least 43 characters");
@@ -176,6 +186,7 @@ public class OpenIDVCITokenRequest extends AbstractOptionallyIdentifiedRequest {
this.authorizationDetails = authorizationDetails;
this.opTokenRequest = opTokenRequest;
}
+// Checkstyle: ParameterNumber ON
/**
* Get grant type.
@@ -267,37 +278,37 @@ public class OpenIDVCITokenRequest extends AbstractOptionallyIdentifiedRequest {
throws ParseException, JsonProcessingException {
httpRequest.ensureMethod(HTTPRequest.Method.POST);
httpRequest.ensureEntityContentType(ContentType.APPLICATION_URLENCODED);
- ClientAuthentication clientAuth;
+ final ClientAuthentication clientAuth;
try {
clientAuth = ClientAuthentication.parse(httpRequest);
- } catch (ParseException e) {
+ } catch (final ParseException e) {
throw new ParseException(e.getMessage(),
OAuth2Error.INVALID_REQUEST.appendDescription(": " + e.getMessage()));
}
- Map<String, List<String>> params = httpRequest.getQueryParameters();
+ final Map<String, List<String>> params = httpRequest.getQueryParameters();
if (clientAuth instanceof ClientSecretBasic) {
if (StringUtils.isNotBlank(MultivaluedMapUtils.getFirstValue(params, "client_assertion"))
|| StringUtils.isNotBlank(MultivaluedMapUtils.getFirstValue(params, "client_assertion_type"))) {
- String msg = "Multiple conflicting client authentication methods found: Basic and JWT assertion";
+ final String msg = "Multiple conflicting client authentication methods found: Basic and JWT assertion";
throw new ParseException(msg, OAuth2Error.INVALID_REQUEST.appendDescription(": " + msg));
}
}
- String grantType = MultivaluedMapUtils.getFirstValue(params, "grant_type");
- String preAuthorizedCode = MultivaluedMapUtils.getFirstValue(params, "pre-authorized_code");
- String code = MultivaluedMapUtils.getFirstValue(params, "code");
- String txCode = MultivaluedMapUtils.getFirstValue(params, "tx_code");
- String codeVerifier = MultivaluedMapUtils.getFirstValue(params, "code_verifier");
- List<OpenIDVCIAuthorizationDetail> authorizationDetails = OpenIDVCIAuthorizationDetail.parse(httpRequest);
+ final String grantType = MultivaluedMapUtils.getFirstValue(params, "grant_type");
+ final String preAuthorizedCode = MultivaluedMapUtils.getFirstValue(params, "pre-authorized_code");
+ final String code = MultivaluedMapUtils.getFirstValue(params, "code");
+ final String txCode = MultivaluedMapUtils.getFirstValue(params, "tx_code");
+ final String codeVerifier = MultivaluedMapUtils.getFirstValue(params, "code_verifier");
+ final List<OpenIDVCIAuthorizationDetail> authorizationDetails = OpenIDVCIAuthorizationDetail.parse(httpRequest);
TokenRequest opTokenRequest = null;
try {
opTokenRequest = TokenRequest.parse(httpRequest);
- } catch (ParseException e) {
+ } catch (final ParseException e) {
// no-op. pre-authorize grant is not parsable.
}
- URI uri;
+ final URI uri;
try {
uri = httpRequest.getURL().toURI();
- } catch (URISyntaxException e) {
+ } catch (final URISyntaxException e) {
throw new ParseException(e.getMessage(), e);
}
if (clientAuth != null) {
diff --git a/openid-vci-api/src/main/java/org/geant/shibboleth/plugin/oauth/statuslist/StatusListBucket.java b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/messaging/impl/package-info.java
similarity index 52%
copy from openid-vci-api/src/main/java/org/geant/shibboleth/plugin/oauth/statuslist/StatusListBucket.java
copy to openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/messaging/impl/package-info.java
index 8a3d844..ddf4767 100644
--- a/openid-vci-api/src/main/java/org/geant/shibboleth/plugin/oauth/statuslist/StatusListBucket.java
+++ b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/messaging/impl/package-info.java
@@ -14,21 +14,7 @@
* limitations under the License.
*/
-package org.geant.shibboleth.plugin.oauth.statuslist;
-
-import java.time.Instant;
-
-import javax.annotation.Nonnull;
-
/**
- * Immutable identity of one Status List as in
- * <a href="https://datatracker.ietf.org/doc/draft-ietf-oauth-status-list/">
- * draft-ietf-oauth-status-list</a>.
- *
- * A bucket holds credentials that all expire before the end of the bucket.
- *
- * @param id identifier, used as storage key
- * @param end upper bound for expiration of any credential in this bucket
+ * OpenID4VCI request and response message objects.
*/
-public record StatusListBucket(@Nonnull String id, @Nonnull Instant end) {
-}
+package org.geant.shibboleth.plugin.openidvci.messaging.impl;
diff --git a/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/metadata/impl/FilesystemCredentialIssuerMetadataResolver.java b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/metadata/impl/FilesystemCredentialIssuerMetadataResolver.java
index 0fa2b57..a25cbf0 100644
--- a/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/metadata/impl/FilesystemCredentialIssuerMetadataResolver.java
+++ b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/metadata/impl/FilesystemCredentialIssuerMetadataResolver.java
@@ -58,10 +58,6 @@ import net.shibboleth.shared.velocity.Template;
public class FilesystemCredentialIssuerMetadataResolver extends
AbstractFileOIDCEntityResolver<Issuer, CredentialIssuerMetadata> implements CredentialIssuerMetadataResolver {
- /** Class logger. */
- @Nonnull
- private final Logger log = LoggerFactory.getLogger(FilesystemCredentialIssuerMetadataResolver.class);
-
/** Variable carrying the issuer as configured. */
@Nonnull
private static final String ISSUER_VARIABLE = "issuer";
@@ -78,6 +74,10 @@ public class FilesystemCredentialIssuerMetadataResolver extends
@Nonnull
private static final Pattern UNRESOLVED = Pattern.compile("\\$\\{?[A-Za-z_]");
+ /** Class logger. */
+ @Nonnull
+ private final Logger log = LoggerFactory.getLogger(FilesystemCredentialIssuerMetadataResolver.class);
+
/** Parser of the metadata file. */
@Nonnull
private final ObjectMapper objectMapper = new ObjectMapper();
diff --git a/openid-vci-api/src/main/java/org/geant/shibboleth/plugin/oauth/statuslist/StatusListBucket.java b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/metadata/impl/package-info.java
similarity index 52%
copy from openid-vci-api/src/main/java/org/geant/shibboleth/plugin/oauth/statuslist/StatusListBucket.java
copy to openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/metadata/impl/package-info.java
index 8a3d844..2873ced 100644
--- a/openid-vci-api/src/main/java/org/geant/shibboleth/plugin/oauth/statuslist/StatusListBucket.java
+++ b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/metadata/impl/package-info.java
@@ -14,21 +14,7 @@
* limitations under the License.
*/
-package org.geant.shibboleth.plugin.oauth.statuslist;
-
-import java.time.Instant;
-
-import javax.annotation.Nonnull;
-
/**
- * Immutable identity of one Status List as in
- * <a href="https://datatracker.ietf.org/doc/draft-ietf-oauth-status-list/">
- * draft-ietf-oauth-status-list</a>.
- *
- * A bucket holds credentials that all expire before the end of the bucket.
- *
- * @param id identifier, used as storage key
- * @param end upper bound for expiration of any credential in this bucket
+ * Resolvers producing Credential Issuer metadata.
*/
-public record StatusListBucket(@Nonnull String id, @Nonnull Instant end) {
-}
+package org.geant.shibboleth.plugin.openidvci.metadata.impl;
diff --git a/openid-vci-api/src/main/java/org/geant/shibboleth/plugin/oauth/statuslist/StatusListBucket.java b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/oidfed/impl/package-info.java
similarity index 52%
copy from openid-vci-api/src/main/java/org/geant/shibboleth/plugin/oauth/statuslist/StatusListBucket.java
copy to openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/oidfed/impl/package-info.java
index 8a3d844..38563b3 100644
--- a/openid-vci-api/src/main/java/org/geant/shibboleth/plugin/oauth/statuslist/StatusListBucket.java
+++ b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/oidfed/impl/package-info.java
@@ -14,21 +14,7 @@
* limitations under the License.
*/
-package org.geant.shibboleth.plugin.oauth.statuslist;
-
-import java.time.Instant;
-
-import javax.annotation.Nonnull;
-
/**
- * Immutable identity of one Status List as in
- * <a href="https://datatracker.ietf.org/doc/draft-ietf-oauth-status-list/">
- * draft-ietf-oauth-status-list</a>.
- *
- * A bucket holds credentials that all expire before the end of the bucket.
- *
- * @param id identifier, used as storage key
- * @param end upper bound for expiration of any credential in this bucket
+ * OpenID Federation entity configuration support.
*/
-public record StatusListBucket(@Nonnull String id, @Nonnull Instant end) {
-}
+package org.geant.shibboleth.plugin.openidvci.oidfed.impl;
diff --git a/openid-vci-api/src/main/java/org/geant/shibboleth/plugin/oauth/statuslist/StatusListBucket.java b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/package-info.java
similarity index 52%
copy from openid-vci-api/src/main/java/org/geant/shibboleth/plugin/oauth/statuslist/StatusListBucket.java
copy to openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/package-info.java
index 8a3d844..1b0e483 100644
--- a/openid-vci-api/src/main/java/org/geant/shibboleth/plugin/oauth/statuslist/StatusListBucket.java
+++ b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/package-info.java
@@ -14,21 +14,7 @@
* limitations under the License.
*/
-package org.geant.shibboleth.plugin.oauth.statuslist;
-
-import java.time.Instant;
-
-import javax.annotation.Nonnull;
-
/**
- * Immutable identity of one Status List as in
- * <a href="https://datatracker.ietf.org/doc/draft-ietf-oauth-status-list/">
- * draft-ietf-oauth-status-list</a>.
- *
- * A bucket holds credentials that all expire before the end of the bucket.
- *
- * @param id identifier, used as storage key
- * @param end upper bound for expiration of any credential in this bucket
+ * Plugin and module information about the OpenID for Verifiable Credential Issuance plugin.
*/
-public record StatusListBucket(@Nonnull String id, @Nonnull Instant end) {
-}
+package org.geant.shibboleth.plugin.openidvci;
diff --git a/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/config/impl/AbstractOpenIDVCIConfiguration.java b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/profile/config/impl/AbstractOpenIDVCIConfiguration.java
similarity index 95%
rename from openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/config/impl/AbstractOpenIDVCIConfiguration.java
rename to openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/profile/config/impl/AbstractOpenIDVCIConfiguration.java
index 85a0e4b..97281dd 100644
--- a/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/config/impl/AbstractOpenIDVCIConfiguration.java
+++ b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/profile/config/impl/AbstractOpenIDVCIConfiguration.java
@@ -14,7 +14,7 @@
* limitations under the License.
*/
-package org.geant.shibboleth.plugin.openidvci.config.impl;
+package org.geant.shibboleth.plugin.openidvci.profile.config.impl;
import java.time.Duration;
import java.util.function.Function;
@@ -22,11 +22,11 @@ import java.util.function.Function;
import javax.annotation.Nonnull;
import javax.annotation.Nullable;
-import org.geant.shibboleth.plugin.openidvci.config.OpenIDVCIConfiguration;
-import org.geant.shibboleth.plugin.openidvci.config.impl.stolen.AbstractOIDCSSOConfiguration;
+import org.geant.shibboleth.plugin.openidvci.profile.config.OpenIDVCIConfiguration;
import org.opensaml.profile.context.ProfileRequestContext;
import net.shibboleth.oidc.jwt.claims.ClaimsValidator;
+import net.shibboleth.oidc.profile.config.impl.AbstractOIDCSSOConfiguration;
import net.shibboleth.oidc.security.jose.SignatureSigningConfiguration;
import net.shibboleth.oidc.security.jose.SignatureValidationConfiguration;
import net.shibboleth.shared.annotation.constraint.NotEmpty;
@@ -34,6 +34,7 @@ import net.shibboleth.shared.annotation.constraint.Positive;
import net.shibboleth.shared.logic.Constraint;
import net.shibboleth.shared.logic.FunctionSupport;
+/** Base class for the OpenID4VCI profile configurations. */
public abstract class AbstractOpenIDVCIConfiguration extends AbstractOIDCSSOConfiguration
implements OpenIDVCIConfiguration {
@@ -51,11 +52,13 @@ public abstract class AbstractOpenIDVCIConfiguration extends AbstractOIDCSSOConf
/** Validation of JWT signature of proofs. */
@Nonnull
- private Function<ProfileRequestContext, SignatureValidationConfiguration> proofSignatureValidationConfigurationLookupStrategy;
+ private Function<ProfileRequestContext, SignatureValidationConfiguration>
+ proofSignatureValidationConfigurationLookupStrategy;
/** Signing of issued credentials. */
@Nonnull
- private Function<ProfileRequestContext, SignatureSigningConfiguration> credentialSignatureSigningConfigurationLookupStrategy;
+ private Function<ProfileRequestContext, SignatureSigningConfiguration>
+ credentialSignatureSigningConfigurationLookupStrategy;
/** Validation of JWT claims for proofs. */
@Nonnull
@@ -67,6 +70,8 @@ public abstract class AbstractOpenIDVCIConfiguration extends AbstractOIDCSSOConf
/**
* Constructor.
+ *
+ * @param profileId identifier of the profile
*/
protected AbstractOpenIDVCIConfiguration(@Nonnull @NotEmpty final String profileId) {
super(profileId);
diff --git a/openid-vci-api/src/main/java/org/geant/shibboleth/plugin/oauth/statuslist/StatusListBucket.java b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/profile/config/impl/DefaultOpenIDVCICredentialOfferConfiguration.java
similarity index 52%
copy from openid-vci-api/src/main/java/org/geant/shibboleth/plugin/oauth/statuslist/StatusListBucket.java
copy to openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/profile/config/impl/DefaultOpenIDVCICredentialOfferConfiguration.java
index 8a3d844..db791b8 100644
--- a/openid-vci-api/src/main/java/org/geant/shibboleth/plugin/oauth/statuslist/StatusListBucket.java
+++ b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/profile/config/impl/DefaultOpenIDVCICredentialOfferConfiguration.java
@@ -14,21 +14,16 @@
* limitations under the License.
*/
-package org.geant.shibboleth.plugin.oauth.statuslist;
+package org.geant.shibboleth.plugin.openidvci.profile.config.impl;
-import java.time.Instant;
+import org.geant.shibboleth.plugin.openidvci.profile.config.OpenIDVCIConfiguration;
-import javax.annotation.Nonnull;
+/** Profile configuration for the Credential Offer endpoint. */
+public class DefaultOpenIDVCICredentialOfferConfiguration extends AbstractOpenIDVCIConfiguration{
+
+ /** Constructor. */
+ public DefaultOpenIDVCICredentialOfferConfiguration() {
+ super(OpenIDVCIConfiguration.PROFILE_ID_CREDENTIAL_OFFER);
+ }
-/**
- * Immutable identity of one Status List as in
- * <a href="https://datatracker.ietf.org/doc/draft-ietf-oauth-status-list/">
- * draft-ietf-oauth-status-list</a>.
- *
- * A bucket holds credentials that all expire before the end of the bucket.
- *
- * @param id identifier, used as storage key
- * @param end upper bound for expiration of any credential in this bucket
- */
-public record StatusListBucket(@Nonnull String id, @Nonnull Instant end) {
}
diff --git a/openid-vci-api/src/main/java/org/geant/shibboleth/plugin/oauth/statuslist/StatusListBucket.java b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/profile/config/impl/DefaultOpenIDVCICredentialsConfiguration.java
similarity index 52%
copy from openid-vci-api/src/main/java/org/geant/shibboleth/plugin/oauth/statuslist/StatusListBucket.java
copy to openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/profile/config/impl/DefaultOpenIDVCICredentialsConfiguration.java
index 8a3d844..1910aa7 100644
--- a/openid-vci-api/src/main/java/org/geant/shibboleth/plugin/oauth/statuslist/StatusListBucket.java
+++ b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/profile/config/impl/DefaultOpenIDVCICredentialsConfiguration.java
@@ -14,21 +14,16 @@
* limitations under the License.
*/
-package org.geant.shibboleth.plugin.oauth.statuslist;
+package org.geant.shibboleth.plugin.openidvci.profile.config.impl;
-import java.time.Instant;
+import org.geant.shibboleth.plugin.openidvci.profile.config.OpenIDVCIConfiguration;
-import javax.annotation.Nonnull;
+/** Profile configuration for the Credential endpoint. */
+public class DefaultOpenIDVCICredentialsConfiguration extends AbstractOpenIDVCIConfiguration{
+
+ /** Constructor. */
+ public DefaultOpenIDVCICredentialsConfiguration() {
+ super(OpenIDVCIConfiguration.PROFILE_ID_CREDENTIALS);
+ }
-/**
- * Immutable identity of one Status List as in
- * <a href="https://datatracker.ietf.org/doc/draft-ietf-oauth-status-list/">
- * draft-ietf-oauth-status-list</a>.
- *
- * A bucket holds credentials that all expire before the end of the bucket.
- *
- * @param id identifier, used as storage key
- * @param end upper bound for expiration of any credential in this bucket
- */
-public record StatusListBucket(@Nonnull String id, @Nonnull Instant end) {
}
diff --git a/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/config/impl/DefaultOpenIDVCIIssuerMetadataConfiguration.java b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/profile/config/impl/DefaultOpenIDVCIIssuerMetadataConfiguration.java
similarity index 98%
rename from openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/config/impl/DefaultOpenIDVCIIssuerMetadataConfiguration.java
rename to openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/profile/config/impl/DefaultOpenIDVCIIssuerMetadataConfiguration.java
index 7026d7f..3034ffe 100644
--- a/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/config/impl/DefaultOpenIDVCIIssuerMetadataConfiguration.java
+++ b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/profile/config/impl/DefaultOpenIDVCIIssuerMetadataConfiguration.java
@@ -14,7 +14,7 @@
* limitations under the License.
*/
-package org.geant.shibboleth.plugin.openidvci.config.impl;
+package org.geant.shibboleth.plugin.openidvci.profile.config.impl;
import java.util.function.Function;
diff --git a/openid-vci-api/src/main/java/org/geant/shibboleth/plugin/oauth/statuslist/StatusListBucket.java b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/profile/config/impl/DefaultOpenIDVCINonceConfiguration.java
similarity index 52%
copy from openid-vci-api/src/main/java/org/geant/shibboleth/plugin/oauth/statuslist/StatusListBucket.java
copy to openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/profile/config/impl/DefaultOpenIDVCINonceConfiguration.java
index 8a3d844..47f3ceb 100644
--- a/openid-vci-api/src/main/java/org/geant/shibboleth/plugin/oauth/statuslist/StatusListBucket.java
+++ b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/profile/config/impl/DefaultOpenIDVCINonceConfiguration.java
@@ -14,21 +14,16 @@
* limitations under the License.
*/
-package org.geant.shibboleth.plugin.oauth.statuslist;
+package org.geant.shibboleth.plugin.openidvci.profile.config.impl;
-import java.time.Instant;
+import org.geant.shibboleth.plugin.openidvci.profile.config.OpenIDVCIConfiguration;
-import javax.annotation.Nonnull;
+/** Profile configuration for the Nonce endpoint. */
+public class DefaultOpenIDVCINonceConfiguration extends AbstractOpenIDVCIConfiguration{
+
+ /** Constructor. */
+ public DefaultOpenIDVCINonceConfiguration() {
+ super(OpenIDVCIConfiguration.PROFILE_ID_NONCE);
+ }
-/**
- * Immutable identity of one Status List as in
- * <a href="https://datatracker.ietf.org/doc/draft-ietf-oauth-status-list/">
- * draft-ietf-oauth-status-list</a>.
- *
- * A bucket holds credentials that all expire before the end of the bucket.
- *
- * @param id identifier, used as storage key
- * @param end upper bound for expiration of any credential in this bucket
- */
-public record StatusListBucket(@Nonnull String id, @Nonnull Instant end) {
}
diff --git a/openid-vci-api/src/main/java/org/geant/shibboleth/plugin/oauth/statuslist/StatusListBucket.java b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/profile/config/impl/DefaultOpenIDVCITokenConfiguration.java
similarity index 52%
copy from openid-vci-api/src/main/java/org/geant/shibboleth/plugin/oauth/statuslist/StatusListBucket.java
copy to openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/profile/config/impl/DefaultOpenIDVCITokenConfiguration.java
index 8a3d844..e237e4b 100644
--- a/openid-vci-api/src/main/java/org/geant/shibboleth/plugin/oauth/statuslist/StatusListBucket.java
+++ b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/profile/config/impl/DefaultOpenIDVCITokenConfiguration.java
@@ -14,21 +14,16 @@
* limitations under the License.
*/
-package org.geant.shibboleth.plugin.oauth.statuslist;
+package org.geant.shibboleth.plugin.openidvci.profile.config.impl;
-import java.time.Instant;
+import org.geant.shibboleth.plugin.openidvci.profile.config.OpenIDVCIConfiguration;
-import javax.annotation.Nonnull;
+/** Profile configuration for the Token endpoint. */
+public class DefaultOpenIDVCITokenConfiguration extends AbstractOpenIDVCIConfiguration{
+
+ /** Constructor. */
+ public DefaultOpenIDVCITokenConfiguration() {
+ super(OpenIDVCIConfiguration.PROFILE_ID_TOKEN);
+ }
-/**
- * Immutable identity of one Status List as in
- * <a href="https://datatracker.ietf.org/doc/draft-ietf-oauth-status-list/">
- * draft-ietf-oauth-status-list</a>.
- *
- * A bucket holds credentials that all expire before the end of the bucket.
- *
- * @param id identifier, used as storage key
- * @param end upper bound for expiration of any credential in this bucket
- */
-public record StatusListBucket(@Nonnull String id, @Nonnull Instant end) {
}
diff --git a/openid-vci-api/src/main/java/org/geant/shibboleth/plugin/oauth/statuslist/StatusListBucket.java b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/profile/config/impl/package-info.java
similarity index 52%
copy from openid-vci-api/src/main/java/org/geant/shibboleth/plugin/oauth/statuslist/StatusListBucket.java
copy to openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/profile/config/impl/package-info.java
index 8a3d844..06681f9 100644
--- a/openid-vci-api/src/main/java/org/geant/shibboleth/plugin/oauth/statuslist/StatusListBucket.java
+++ b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/profile/config/impl/package-info.java
@@ -14,21 +14,7 @@
* limitations under the License.
*/
-package org.geant.shibboleth.plugin.oauth.statuslist;
-
-import java.time.Instant;
-
-import javax.annotation.Nonnull;
-
/**
- * Immutable identity of one Status List as in
- * <a href="https://datatracker.ietf.org/doc/draft-ietf-oauth-status-list/">
- * draft-ietf-oauth-status-list</a>.
- *
- * A bucket holds credentials that all expire before the end of the bucket.
- *
- * @param id identifier, used as storage key
- * @param end upper bound for expiration of any credential in this bucket
+ * Profile configuration implementations.
*/
-public record StatusListBucket(@Nonnull String id, @Nonnull Instant end) {
-}
+package org.geant.shibboleth.plugin.openidvci.profile.config.impl;
diff --git a/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/config/navigate/CredentialSignatureSigningConfigurationLookupFunction.java b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/profile/config/navigate/CredentialSignatureSigningConfigurationLookupFunction.java
similarity index 95%
rename from openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/config/navigate/CredentialSignatureSigningConfigurationLookupFunction.java
rename to openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/profile/config/navigate/CredentialSignatureSigningConfigurationLookupFunction.java
index 89c637e..ef13df1 100644
--- a/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/config/navigate/CredentialSignatureSigningConfigurationLookupFunction.java
+++ b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/profile/config/navigate/CredentialSignatureSigningConfigurationLookupFunction.java
@@ -13,7 +13,7 @@
* See the License for the specific language governing permissions and
* limitations under the License.
*/
-package org.geant.shibboleth.plugin.openidvci.config.navigate;
+package org.geant.shibboleth.plugin.openidvci.profile.config.navigate;
import java.util.List;
import java.util.function.Function;
@@ -21,10 +21,10 @@ import java.util.function.Function;
import javax.annotation.Nonnull;
import javax.annotation.Nullable;
-import org.geant.shibboleth.plugin.openidvci.config.OpenIDVCIConfiguration;
+import org.geant.shibboleth.plugin.openidvci.profile.config.OpenIDVCIConfiguration;
import org.geant.shibboleth.plugin.openidvci.credential.CredentialConfiguration;
import org.geant.shibboleth.plugin.openidvci.messaging.context.CredentialsContext;
-import org.geant.shibboleth.plugin.openidvci.security.jose.AlgorithmRestrictedSignatureSigningConfiguration;
+import org.geant.shibboleth.plugin.openidvci.security.jose.impl.AlgorithmRestrictedSignatureSigningConfiguration;
import org.opensaml.messaging.context.navigate.ChildContextLookup;
import org.opensaml.profile.context.ProfileRequestContext;
import org.opensaml.profile.context.navigate.InboundMessageContextLookup;
diff --git a/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/config/navigate/IssuerMetadataSignatureSigningConfigurationLookupFunction.java b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/profile/config/navigate/IssuerMetadataSignatureSigningConfigurationLookupFunction.java
similarity index 92%
rename from openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/config/navigate/IssuerMetadataSignatureSigningConfigurationLookupFunction.java
rename to openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/profile/config/navigate/IssuerMetadataSignatureSigningConfigurationLookupFunction.java
index 6502feb..836d97f 100644
--- a/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/config/navigate/IssuerMetadataSignatureSigningConfigurationLookupFunction.java
+++ b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/profile/config/navigate/IssuerMetadataSignatureSigningConfigurationLookupFunction.java
@@ -13,14 +13,14 @@
* See the License for the specific language governing permissions and
* limitations under the License.
*/
-package org.geant.shibboleth.plugin.openidvci.config.navigate;
+package org.geant.shibboleth.plugin.openidvci.profile.config.navigate;
import java.util.List;
import javax.annotation.Nonnull;
import javax.annotation.Nullable;
-import org.geant.shibboleth.plugin.openidvci.config.impl.DefaultOpenIDVCIIssuerMetadataConfiguration;
+import org.geant.shibboleth.plugin.openidvci.profile.config.impl.DefaultOpenIDVCIIssuerMetadataConfiguration;
import org.opensaml.profile.context.ProfileRequestContext;
import net.shibboleth.oidc.security.jose.SignatureSigningConfiguration;
diff --git a/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/config/navigate/ProofNonceGeneratorLookupFunction.java b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/profile/config/navigate/ProofNonceGeneratorLookupFunction.java
similarity index 92%
rename from openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/config/navigate/ProofNonceGeneratorLookupFunction.java
rename to openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/profile/config/navigate/ProofNonceGeneratorLookupFunction.java
index 7512244..e46ff8f 100644
--- a/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/config/navigate/ProofNonceGeneratorLookupFunction.java
+++ b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/profile/config/navigate/ProofNonceGeneratorLookupFunction.java
@@ -14,13 +14,13 @@
* limitations under the License.
*/
-package org.geant.shibboleth.plugin.openidvci.config.navigate;
+package org.geant.shibboleth.plugin.openidvci.profile.config.navigate;
import java.util.function.Function;
import javax.annotation.Nullable;
-import org.geant.shibboleth.plugin.openidvci.config.OpenIDVCIConfiguration;
+import org.geant.shibboleth.plugin.openidvci.profile.config.OpenIDVCIConfiguration;
import org.opensaml.profile.context.ProfileRequestContext;
import net.shibboleth.profile.config.ProfileConfiguration;
diff --git a/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/config/navigate/ProofSignatureValidationConfigurationLookupFunction.java b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/profile/config/navigate/ProofSignatureValidationConfigurationLookupFunction.java
similarity index 93%
rename from openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/config/navigate/ProofSignatureValidationConfigurationLookupFunction.java
rename to openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/profile/config/navigate/ProofSignatureValidationConfigurationLookupFunction.java
index 9f6b25a..352d28a 100644
--- a/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/config/navigate/ProofSignatureValidationConfigurationLookupFunction.java
+++ b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/profile/config/navigate/ProofSignatureValidationConfigurationLookupFunction.java
@@ -13,14 +13,14 @@
* See the License for the specific language governing permissions and
* limitations under the License.
*/
-package org.geant.shibboleth.plugin.openidvci.config.navigate;
+package org.geant.shibboleth.plugin.openidvci.profile.config.navigate;
import java.util.List;
import javax.annotation.Nonnull;
import javax.annotation.Nullable;
-import org.geant.shibboleth.plugin.openidvci.config.OpenIDVCIConfiguration;
+import org.geant.shibboleth.plugin.openidvci.profile.config.OpenIDVCIConfiguration;
import org.opensaml.profile.context.ProfileRequestContext;
import net.shibboleth.profile.config.ProfileConfiguration;
diff --git a/openid-vci-api/src/main/java/org/geant/shibboleth/plugin/oauth/statuslist/StatusListBucket.java b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/profile/config/navigate/package-info.java
similarity index 52%
copy from openid-vci-api/src/main/java/org/geant/shibboleth/plugin/oauth/statuslist/StatusListBucket.java
copy to openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/profile/config/navigate/package-info.java
index 8a3d844..f8f1fb2 100644
--- a/openid-vci-api/src/main/java/org/geant/shibboleth/plugin/oauth/statuslist/StatusListBucket.java
+++ b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/profile/config/navigate/package-info.java
@@ -14,21 +14,7 @@
* limitations under the License.
*/
-package org.geant.shibboleth.plugin.oauth.statuslist;
-
-import java.time.Instant;
-
-import javax.annotation.Nonnull;
-
/**
- * Immutable identity of one Status List as in
- * <a href="https://datatracker.ietf.org/doc/draft-ietf-oauth-status-list/">
- * draft-ietf-oauth-status-list</a>.
- *
- * A bucket holds credentials that all expire before the end of the bucket.
- *
- * @param id identifier, used as storage key
- * @param end upper bound for expiration of any credential in this bucket
+ * Lookup functions resolving profile configuration settings.
*/
-public record StatusListBucket(@Nonnull String id, @Nonnull Instant end) {
-}
+package org.geant.shibboleth.plugin.openidvci.profile.config.navigate;
diff --git a/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/profile/context/navigate/APIRequestClientIDLookupFunction.java b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/profile/context/navigate/APIRequestClientIDLookupFunction.java
index 49985b7..f70ca7d 100644
--- a/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/profile/context/navigate/APIRequestClientIDLookupFunction.java
+++ b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/profile/context/navigate/APIRequestClientIDLookupFunction.java
@@ -78,6 +78,7 @@ public class APIRequestClientIDLookupFunction implements ContextDataLookupFuncti
credentialOfferCache = Constraint.isNotNull(cache, "CredentialOfferCache cannot be null");
}
+// Checkstyle: CyclomaticComplexity OFF
/** {@inheritDoc} */
@Nullable
public ClientID apply(@Nullable final MessageContext input) {
@@ -95,21 +96,21 @@ public class APIRequestClientIDLookupFunction implements ContextDataLookupFuncti
if (message instanceof OpenIDVCITokenRequest msg && msg.getPreAuthorizedCode() != null
&& credentialOfferCache != null) {
try {
- CredentialOfferObject offer = credentialOfferCache.getCredentialOffer(msg.getPreAuthorizedCode());
+ final CredentialOfferObject offer = credentialOfferCache.getCredentialOffer(msg.getPreAuthorizedCode());
if (offer != null) {
return new ClientID(offer.getClientID().getValue() + "/wallet");
}
- } catch (IOException | ParseException e) {
+ } catch (final IOException | ParseException e) {
log.error("Unexpected error", e);
}
}
if (message instanceof OpenIDVCITokenRequest msg && msg.getPreAuthorizedCode() != null && dataSealer != null) {
- CredentialOfferClaimsSet credentialOffer;
+ final CredentialOfferClaimsSet credentialOffer;
try {
credentialOffer = CredentialOfferClaimsSet.parse(msg.getPreAuthorizedCode(), dataSealer);
return new ClientID(
CredentialOfferObject.parse(credentialOffer.getSubject()).getClientID().getValue() + "/wallet");
- } catch (java.text.ParseException | DataSealerException | JsonProcessingException
+ } catch (final java.text.ParseException | DataSealerException | JsonProcessingException
| com.nimbusds.oauth2.sdk.ParseException e) {
log.error("Unexpected error", e);
}
@@ -120,5 +121,6 @@ public class APIRequestClientIDLookupFunction implements ContextDataLookupFuncti
return null;
}
+// Checkstyle: CyclomaticComplexity ON
}
diff --git a/openid-vci-api/src/main/java/org/geant/shibboleth/plugin/oauth/statuslist/StatusListBucket.java b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/profile/context/navigate/package-info.java
similarity index 52%
copy from openid-vci-api/src/main/java/org/geant/shibboleth/plugin/oauth/statuslist/StatusListBucket.java
copy to openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/profile/context/navigate/package-info.java
index 8a3d844..68a978c 100644
--- a/openid-vci-api/src/main/java/org/geant/shibboleth/plugin/oauth/statuslist/StatusListBucket.java
+++ b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/profile/context/navigate/package-info.java
@@ -14,21 +14,7 @@
* limitations under the License.
*/
-package org.geant.shibboleth.plugin.oauth.statuslist;
-
-import java.time.Instant;
-
-import javax.annotation.Nonnull;
-
/**
- * Immutable identity of one Status List as in
- * <a href="https://datatracker.ietf.org/doc/draft-ietf-oauth-status-list/">
- * draft-ietf-oauth-status-list</a>.
- *
- * A bucket holds credentials that all expire before the end of the bucket.
- *
- * @param id identifier, used as storage key
- * @param end upper bound for expiration of any credential in this bucket
+ * Lookup functions operating on the profile request context.
*/
-public record StatusListBucket(@Nonnull String id, @Nonnull Instant end) {
-}
+package org.geant.shibboleth.plugin.openidvci.profile.context.navigate;
diff --git a/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/profile/impl/stolen/AbstractInitializeOutboundResponseMessageContext.java b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/profile/impl/AbstractInitializeOutboundResponseMessageContext.java
similarity index 77%
rename from openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/profile/impl/stolen/AbstractInitializeOutboundResponseMessageContext.java
rename to openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/profile/impl/AbstractInitializeOutboundResponseMessageContext.java
index 44862c5..b419be6 100644
--- a/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/profile/impl/stolen/AbstractInitializeOutboundResponseMessageContext.java
+++ b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/profile/impl/AbstractInitializeOutboundResponseMessageContext.java
@@ -1,22 +1,20 @@
/*
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
+ * Copyright (c) 2025, GÉANT
+ *
+ * Licensed under the Apache License, Version 2.0 (the “License”); you may not
+ * use this file except in compliance with the License. You may obtain a copy
+ * of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
+ * distributed under the License is distributed on an “AS IS” BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
-
-// TODO: This abstract class is copied as is from shibboleth project. Refactoring needed.
-
-
-package org.geant.shibboleth.plugin.openidvci.profile.impl.stolen;
+package org.geant.shibboleth.plugin.openidvci.profile.impl;
import javax.annotation.Nonnull;
@@ -32,7 +30,11 @@ import org.slf4j.LoggerFactory;
/**
* Action that adds an outbound {@link MessageContext} and related OIDC contexts to the {@link ProfileRequestContext}.
- *
+ *
+ * <p>Derived from {@code AbstractInitializeOutboundResponseMessageContext} of the OpenID Connect Provider plugin,
+ * in package {@code net.shibboleth.idp.plugin.oidc.op.profile.impl}. That class is marked for removal, so this
+ * plugin carries its own rather than extending one that is going away.</p>
+ *
* @event {@link org.opensaml.profile.action.EventIds#PROCEED_EVENT_ID}
*/
public abstract class AbstractInitializeOutboundResponseMessageContext extends AbstractProfileAction {
diff --git a/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/profile/impl/AddCredentialShell.java b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/profile/impl/AddCredentialShell.java
index 8e962c8..0cc33a2 100644
--- a/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/profile/impl/AddCredentialShell.java
+++ b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/profile/impl/AddCredentialShell.java
@@ -35,9 +35,9 @@ import net.shibboleth.shared.component.ComponentInitializationException;
import net.shibboleth.shared.logic.Constraint;
import net.shibboleth.shared.primitive.LoggerFactory;
-import org.geant.shibboleth.plugin.oauth.profile.logic.CredentialIssuerLookupFunction;
-import org.geant.shibboleth.plugin.oauth.statuslist.context.StatusListContext;
-import org.geant.shibboleth.plugin.openidvci.config.OpenIDVCIConfiguration;
+import org.geant.shibboleth.plugin.openidvci.profile.logic.CredentialIssuerLookupFunction;
+import org.geant.shibboleth.plugin.openidvci.statuslist.context.StatusListContext;
+import org.geant.shibboleth.plugin.openidvci.profile.config.OpenIDVCIConfiguration;
import org.geant.shibboleth.plugin.openidvci.messaging.context.CredentialsContext;
import org.opensaml.messaging.context.navigate.ChildContextLookup;
import org.opensaml.profile.action.ActionSupport;
@@ -202,17 +202,17 @@ public class AddCredentialShell extends AbstractProfileAction {
@Override
protected void doExecute(@Nonnull final ProfileRequestContext profileRequestContext) {
- List<ClaimsSet> shells = new ArrayList<>();
+ final List<ClaimsSet> shells = new ArrayList<>();
if (ctx.getProofs() != null && !ctx.getProofs().isEmpty()) {
final List<SignedJWT> proofs = ctx.getProofs();
for (int ordinal = 0; ordinal < proofs.size(); ordinal++) {
- ClaimsSet shell = createShell(ordinal);
+ final ClaimsSet shell = createShell(ordinal);
try {
- Map<String, Object> cnf = buildCnf(proofs.get(ordinal));
+ final Map<String, Object> cnf = buildCnf(proofs.get(ordinal));
if (cnf != null) {
shell.setClaim("cnf", cnf);
}
- } catch (Exception e) {
+ } catch (final Exception e) {
log.error("{} Failed to build cnf", getLogPrefix(), e);
ActionSupport.buildEvent(profileRequestContext, IdPEventIds.INVALID_PROFILE_CONFIG);
return;
@@ -234,7 +234,7 @@ public class AddCredentialShell extends AbstractProfileAction {
* @throws JsonProcessingException if something unexpected occurs.
* @throws ParseException if something unexpected occurs.
*/
- private Map<String, Object> buildCnf(SignedJWT proof) throws JsonProcessingException, ParseException {
+ private Map<String, Object> buildCnf(final SignedJWT proof) throws JsonProcessingException, ParseException {
final String kid = proof.getHeader().getKeyID();
if (kid != null && kid.startsWith("did:jwk:") && kid.endsWith("#0")) {
@@ -254,7 +254,7 @@ public class AddCredentialShell extends AbstractProfileAction {
* @return credential shell.
*/
private ClaimsSet createShell(final int ordinal) {
- ClaimsSet shell = new ClaimsSet();
+ final ClaimsSet shell = new ClaimsSet();
shell.setIssuer(new Issuer(issuerId));
shell.setClaim("iat", issuedAt.getEpochSecond());
diff --git a/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/profile/impl/BuildCredentialOfferToken.java b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/profile/impl/BuildCredentialOfferToken.java
index 95eac6c..7a86678 100644
--- a/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/profile/impl/BuildCredentialOfferToken.java
+++ b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/profile/impl/BuildCredentialOfferToken.java
@@ -22,7 +22,7 @@ import java.time.Instant;
import java.util.function.Function;
import javax.annotation.Nonnull;
-import org.geant.shibboleth.plugin.openidvci.config.OpenIDVCIConfiguration;
+import org.geant.shibboleth.plugin.openidvci.profile.config.OpenIDVCIConfiguration;
import org.geant.shibboleth.plugin.openidvci.messaging.impl.CredentialOfferRequest;
import org.geant.shibboleth.plugin.openidvci.messaging.context.CredentialOfferContext;
import org.geant.shibboleth.plugin.openidvci.storage.CredentialOfferObject;
@@ -91,6 +91,7 @@ public class BuildCredentialOfferToken extends AbstractProfileAction {
/** Relying party context. */
private RelyingPartyContext rpCtx;
+ /** Inbound Credential Offer request. */
@NonnullAfterInit
private CredentialOfferRequest request;
@@ -108,10 +109,21 @@ public class BuildCredentialOfferToken extends AbstractProfileAction {
@Nonnull
private Function<ProfileRequestContext, String> issuerLookupStrategy;
+ /**
+ * Constructor.
+ *
+ * @param sealer sealer used to wrap the pre-authorized code
+ */
public BuildCredentialOfferToken(@Nonnull @ParameterName(name = "sealer") final DataSealer sealer) {
dataSealer = Constraint.isNotNull(sealer, "DataSealer cannot be null");
idGeneratorLookupStrategy = new Function<ProfileRequestContext, IdentifierGenerationStrategy>() {
- public IdentifierGenerationStrategy apply(ProfileRequestContext input) {
+ /**
+ * Get the identifier generation strategy for the offered credential.
+ *
+ * @param input profile request context
+ * @return generation strategy, or null
+ */
+ public IdentifierGenerationStrategy apply(final ProfileRequestContext input) {
return new SecureRandomIdentifierGenerationStrategy();
}
};
@@ -216,8 +228,8 @@ public class BuildCredentialOfferToken extends AbstractProfileAction {
/** {@inheritDoc} */
@Override
protected void doExecute(@Nonnull final ProfileRequestContext profileRequestContext) {
- String rpId = rpCtx.getRelyingPartyId();
- CredentialOfferObject credentialRequest = new CredentialOfferObject(new ClientID(rpId),
+ final String rpId = rpCtx.getRelyingPartyId();
+ final CredentialOfferObject credentialRequest = new CredentialOfferObject(new ClientID(rpId),
ctx.getValidatedPreAuthorizedCredentials(), ctx.getValidatedCodeCredentials(),
ctx.getCredentialOfferTxCode());
@@ -240,13 +252,13 @@ public class BuildCredentialOfferToken extends AbstractProfileAction {
ActionSupport.buildEvent(profileRequestContext, EventIds.IO_ERROR);
return;
}
- } catch (IOException e) {
+ } catch (final IOException e) {
log.error("{} Failed to set credential offer object to cache {}", getLogPrefix(), e);
ActionSupport.buildEvent(profileRequestContext, EventIds.IO_ERROR);
return;
}
} else {
- CredentialOfferClaimsSet claimsSet;
+ final CredentialOfferClaimsSet claimsSet;
try {
claimsSet = new CredentialOfferClaimsSet.Builder()
.setIssuer(issuerLookupStrategy.apply(profileRequestContext)).setClientID(new ClientID(rpId))
@@ -254,14 +266,14 @@ public class BuildCredentialOfferToken extends AbstractProfileAction {
.setAuthenticationTime(Instant.now()).setPrincipal("dummy")
.setSubject(credentialRequest.serialize()).setScope(new Scope("openid"))
.setExpiresAt(Instant.now().plus(expiration)).build();
- } catch (JsonProcessingException e) {
+ } catch (final JsonProcessingException e) {
log.error("{} Failed to serialize credential offer object to claim set {}", getLogPrefix(), e);
ActionSupport.buildEvent(profileRequestContext, EventIds.IO_ERROR);
return;
}
try {
credentialOfferToken = claimsSet.serialize(dataSealer);
- } catch (DataSealerException e) {
+ } catch (final DataSealerException e) {
log.error("{} Failed to serialize credentil offer claim set {}", getLogPrefix(), e);
ActionSupport.buildEvent(profileRequestContext, EventIds.IO_ERROR);
return;
diff --git a/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/profile/impl/FormJsonLdSelectiveDisclosureJWTCredential.java b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/profile/impl/FormJsonLdSelectiveDisclosureJWTCredential.java
index ba7bc5e..b7dd03e 100644
--- a/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/profile/impl/FormJsonLdSelectiveDisclosureJWTCredential.java
+++ b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/profile/impl/FormJsonLdSelectiveDisclosureJWTCredential.java
@@ -23,11 +23,11 @@ import java.util.function.Function;
import javax.annotation.Nonnull;
-import org.geant.shibboleth.plugin.oauth.profile.logic.CredentialIssuerLookupFunction;
+import org.geant.shibboleth.plugin.openidvci.profile.logic.CredentialIssuerLookupFunction;
import org.geant.shibboleth.plugin.openidvci.messaging.context.CredentialsContext;
import org.geant.shibboleth.plugin.openidvci.messaging.impl.CredentialOfferRequestedCredential;
import org.geant.shibboleth.plugin.openidvci.profile.OpenIDVCIEventIds;
-import org.geant.shibboleth.plugin.openidvci.util.SelectiveDisclosureClaimTree;
+import org.geant.shibboleth.plugin.openidvci.credential.impl.SelectiveDisclosureClaimTree;
import org.opensaml.profile.action.ActionSupport;
import org.opensaml.profile.action.EventIds;
import org.opensaml.profile.context.ProfileRequestContext;
@@ -61,12 +61,15 @@ import com.nimbusds.openid.connect.sdk.claims.ClaimsSet;
*/
public class FormJsonLdSelectiveDisclosureJWTCredential extends AbstractProfileAction {
+ /** Class logger. */
@Nonnull
private final Logger log = LoggerFactory.getLogger(FormJsonLdSelectiveDisclosureJWTCredential.class);
+ /** Credentials context. */
@NonnullBeforeExec
private CredentialsContext ctx;
+ /** Requested credential. */
@NonnullBeforeExec
private CredentialOfferRequestedCredential credential;
@@ -91,6 +94,7 @@ public class FormJsonLdSelectiveDisclosureJWTCredential extends AbstractProfileA
issuerLookupStrategy = Constraint.isNotNull(strategy, "IssuerLookupStrategy lookup strategy cannot be null");
}
+ /** {@inheritDoc} */
@Override
protected boolean doPreExecute(@Nonnull final ProfileRequestContext profileRequestContext) {
@@ -121,6 +125,7 @@ public class FormJsonLdSelectiveDisclosureJWTCredential extends AbstractProfileA
return true;
}
+ /** {@inheritDoc} */
@Override
protected void doExecute(@Nonnull final ProfileRequestContext profileRequestContext) {
diff --git a/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/profile/impl/FormOutboundCredentialOfferResponseMessage.java b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/profile/impl/FormOutboundCredentialOfferResponseMessage.java
index 62ebb1a..1ce80ec 100644
--- a/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/profile/impl/FormOutboundCredentialOfferResponseMessage.java
+++ b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/profile/impl/FormOutboundCredentialOfferResponseMessage.java
@@ -34,7 +34,7 @@ import net.shibboleth.shared.annotation.constraint.NonnullAfterInit;
import net.shibboleth.shared.logic.Constraint;
/**
- * Action forming {@link CredentialOfferSuccessResponse}
+ * Action forming {@link CredentialOfferSuccessResponse}.
*/
public class FormOutboundCredentialOfferResponseMessage extends AbstractProfileAction {
@@ -52,6 +52,7 @@ public class FormOutboundCredentialOfferResponseMessage extends AbstractProfileA
@Nonnull
private Function<ProfileRequestContext, String> issuerLookupStrategy;
+ /** Constructor. */
public FormOutboundCredentialOfferResponseMessage() {
issuerLookupStrategy = (Function<ProfileRequestContext, String>) new IssuerLookupFunction();
}
@@ -94,7 +95,7 @@ public class FormOutboundCredentialOfferResponseMessage extends AbstractProfileA
protected void doExecute(@Nonnull final ProfileRequestContext profileRequestContext) {
// TODO: code flow ignores 'issuer_state'. Authentication endpoint should check
// it. See Specification for guidance.
- CredentialOfferSuccessResponse offer = new CredentialOfferSuccessResponse(
+ final CredentialOfferSuccessResponse offer = new CredentialOfferSuccessResponse(
issuerLookupStrategy.apply(profileRequestContext), ctx.getCredentialOfferToken(),
ctx.getValidatedPreAuthorizedCredentials(), ctx.getValidatedCodeCredentials(),
ctx.getCredentialOfferTxCode());
diff --git a/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/profile/impl/FormOutboundCredentialsResponseMessage.java b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/profile/impl/FormOutboundCredentialsResponseMessage.java
index fdbc175..9d043f9 100644
--- a/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/profile/impl/FormOutboundCredentialsResponseMessage.java
+++ b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/profile/impl/FormOutboundCredentialsResponseMessage.java
@@ -24,19 +24,19 @@ import javax.annotation.Nonnull;
import org.geant.shibboleth.plugin.openidvci.messaging.context.CredentialsContext;
import org.geant.shibboleth.plugin.openidvci.messaging.impl.CredentialSuccessResponse;
import org.geant.shibboleth.plugin.openidvci.messaging.impl.OpenIDVCICredentialsRequest;
-import org.geant.shibboleth.plugin.openidvci.profile.impl.stolen.AbstractOIDCResponseAction;
import org.opensaml.profile.action.ActionSupport;
import org.opensaml.profile.action.EventIds;
import org.opensaml.profile.context.ProfileRequestContext;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
+import net.shibboleth.idp.plugin.oidc.op.profile.impl.AbstractOIDCResponseAction;
import net.shibboleth.shared.annotation.constraint.NonnullBeforeExec;
import com.fasterxml.jackson.core.JsonProcessingException;
/**
- * Action forming {@link CredentialSuccessResponse}
+ * Action forming {@link CredentialSuccessResponse}.
*/
public class FormOutboundCredentialsResponseMessage extends AbstractOIDCResponseAction {
@@ -44,6 +44,7 @@ public class FormOutboundCredentialsResponseMessage extends AbstractOIDCResponse
@Nonnull
private Logger log = LoggerFactory.getLogger(FormOutboundCredentialsResponseMessage.class);
+ /** Credentials context. */
@NonnullBeforeExec
private CredentialsContext ctx;
@@ -75,14 +76,14 @@ public class FormOutboundCredentialsResponseMessage extends AbstractOIDCResponse
return;
}
try {
- List<String> credentials = new ArrayList<>();
+ final List<String> credentials = new ArrayList<>();
ctx.getSignedCredential().forEach(cred -> {
credentials.add(cred + (ctx.getDisclosures() != null ? "~" + ctx.getDisclosures() + "~" : ""));
});
- CredentialSuccessResponse response = new CredentialSuccessResponse(credentials);
+ final CredentialSuccessResponse response = new CredentialSuccessResponse(credentials);
log.info("Setting response as {}", response.toOffer());
profileRequestContext.ensureOutboundMessageContext().setMessage(response);
- } catch (JsonProcessingException e) {
+ } catch (final JsonProcessingException e) {
log.error("{} Error occurred while parsing objects {}", getLogPrefix(), e);
ActionSupport.buildEvent(profileRequestContext, EventIds.IO_ERROR);
}
diff --git a/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/profile/impl/FormOutboundNonceResponseMessage.java b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/profile/impl/FormOutboundNonceResponseMessage.java
index 059e33a..2134472 100644
--- a/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/profile/impl/FormOutboundNonceResponseMessage.java
+++ b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/profile/impl/FormOutboundNonceResponseMessage.java
@@ -20,7 +20,7 @@ import java.util.function.Function;
import javax.annotation.Nonnull;
-import org.geant.shibboleth.plugin.openidvci.config.OpenIDVCIConfiguration;
+import org.geant.shibboleth.plugin.openidvci.profile.config.OpenIDVCIConfiguration;
import org.geant.shibboleth.plugin.openidvci.messaging.impl.NonceSuccessResponse;
import org.opensaml.messaging.context.navigate.ChildContextLookup;
import org.opensaml.profile.action.ActionSupport;
@@ -35,7 +35,7 @@ import net.shibboleth.shared.annotation.constraint.NonnullAfterInit;
import net.shibboleth.shared.logic.Constraint;
/**
- * Action forming {@link NonceSuccessResponse}
+ * Action forming {@link NonceSuccessResponse}.
*/
public class FormOutboundNonceResponseMessage extends AbstractProfileAction {
@@ -43,6 +43,7 @@ public class FormOutboundNonceResponseMessage extends AbstractProfileAction {
@Nonnull
private Logger log = LoggerFactory.getLogger(FormOutboundNonceResponseMessage.class);
+ /** Nonce generator. */
@NonnullAfterInit
private Function<ProfileRequestContext, String> generator;
@@ -56,6 +57,7 @@ public class FormOutboundNonceResponseMessage extends AbstractProfileAction {
/** Relying party context. */
private RelyingPartyContext rpCtx;
+ /** Constructor. */
public FormOutboundNonceResponseMessage() {
relyingPartyContextLookupStrategy = new ChildContextLookup<>(RelyingPartyContext.class);
}
diff --git a/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/profile/impl/FormOutboundTokenResponseMessage.java b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/profile/impl/FormOutboundTokenResponseMessage.java
index bf59088..b7a1d18 100644
--- a/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/profile/impl/FormOutboundTokenResponseMessage.java
+++ b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/profile/impl/FormOutboundTokenResponseMessage.java
@@ -38,12 +38,14 @@ import com.nimbusds.oauth2.sdk.token.Tokens;
import net.shibboleth.shared.annotation.constraint.NonnullBeforeExec;
+/** Action forming the outbound token response message. */
public class FormOutboundTokenResponseMessage extends AbstractOpenIDVCITokenResponseAction {
/** Class logger. */
@Nonnull
private Logger log = LoggerFactory.getLogger(FormOutboundTokenResponseMessage.class);
+ /** Token context. */
@NonnullBeforeExec
private TokenContext tokenContext;
diff --git a/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/profile/impl/FormSelectiveDisclosureJWTCredential.java b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/profile/impl/FormSelectiveDisclosureJWTCredential.java
index 490df3b..c4c44a9 100644
--- a/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/profile/impl/FormSelectiveDisclosureJWTCredential.java
+++ b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/profile/impl/FormSelectiveDisclosureJWTCredential.java
@@ -24,7 +24,7 @@ import javax.annotation.Nonnull;
import org.geant.shibboleth.plugin.openidvci.messaging.context.CredentialsContext;
import org.geant.shibboleth.plugin.openidvci.messaging.impl.CredentialOfferRequestedCredential;
import org.geant.shibboleth.plugin.openidvci.profile.OpenIDVCIEventIds;
-import org.geant.shibboleth.plugin.openidvci.util.SelectiveDisclosureClaimTree;
+import org.geant.shibboleth.plugin.openidvci.credential.impl.SelectiveDisclosureClaimTree;
import org.opensaml.profile.action.ActionSupport;
import org.opensaml.profile.action.EventIds;
import org.opensaml.profile.context.ProfileRequestContext;
@@ -58,11 +58,13 @@ public class FormSelectiveDisclosureJWTCredential extends AbstractProfileAction
@Nonnull
private Logger log = LoggerFactory.getLogger(FormSelectiveDisclosureJWTCredential.class);
+ /** Credentials context. */
@NonnullBeforeExec
private CredentialsContext ctx;
+ /** Requested credential. */
@NonnullBeforeExec
- CredentialOfferRequestedCredential credential;
+ private CredentialOfferRequestedCredential credential;
/** {@inheritDoc} */
@Override
diff --git a/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/profile/impl/InitializeOutboundResponseMessageContext.java b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/profile/impl/InitializeOutboundResponseMessageContext.java
index 9f72d40..ac304d8 100644
--- a/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/profile/impl/InitializeOutboundResponseMessageContext.java
+++ b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/profile/impl/InitializeOutboundResponseMessageContext.java
@@ -16,7 +16,6 @@
package org.geant.shibboleth.plugin.openidvci.profile.impl;
-import org.geant.shibboleth.plugin.openidvci.profile.impl.stolen.AbstractInitializeOutboundResponseMessageContext;
import org.opensaml.messaging.context.MessageContext;
import org.opensaml.profile.context.ProfileRequestContext;
diff --git a/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/profile/impl/stolen/ParseAccessToken.java b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/profile/impl/ParseAccessToken.java
similarity index 91%
rename from openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/profile/impl/stolen/ParseAccessToken.java
rename to openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/profile/impl/ParseAccessToken.java
index 5ddc2f4..501015e 100644
--- a/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/profile/impl/stolen/ParseAccessToken.java
+++ b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/profile/impl/ParseAccessToken.java
@@ -1,18 +1,20 @@
/*
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
+ * Copyright (c) 2025, GÉANT
+ *
+ * Licensed under the Apache License, Version 2.0 (the “License”); you may not
+ * use this file except in compliance with the License. You may obtain a copy
+ * of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
+ * distributed under the License is distributed on an “AS IS” BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
-package org.geant.shibboleth.plugin.openidvci.profile.impl.stolen;
+package org.geant.shibboleth.plugin.openidvci.profile.impl;
import java.text.ParseException;
import java.util.ArrayList;
@@ -54,8 +56,11 @@ import net.shibboleth.shared.security.DataSealerException;
* Action that parses an access token and initially populates the claims for later
* validation.
*
- * <p>Signed JWTs are also signature-checked here.</p>
- *
+ * <p>Signed JWTs are also signature-checked here. Derived from
+ * {@code net.shibboleth.idp.plugin.oidc.op.userinfo.profile.impl.ParseAccessToken} of the OpenID Connect Provider
+ * plugin, re-parented onto {@link AbstractOpenIDVCICredentialsValidationResponseAction} so that it reads the
+ * credentials request rather than a UserInfo request.</p>
+ *
* <p>The parsed token is stored to the response context retrievable as claims via
* {@link OIDCAuthenticationResponseContext#getAuthorizationGrantClaimsSet()}. Claims validation takes
* place later in order to allow for metadata and relying-party/profile config
@@ -64,8 +69,6 @@ import net.shibboleth.shared.security.DataSealerException;
* @event {@link EventIds#PROCEED_EVENT_ID}
* @event {@link OidcEventIds#INVALID_ACCESS_TOKEN}
* @event {@link OidcEventIds#INVALID_DPOP_ACCESS_TOKEN}
- *
- * @since 3.2.0
*/
public class ParseAccessToken extends AbstractOpenIDVCICredentialsValidationResponseAction {
@@ -136,7 +139,7 @@ public class ParseAccessToken extends AbstractOpenIDVCICredentialsValidationResp
protected void doExecute(@Nonnull final ProfileRequestContext profileRequestContext) {
final String invalidTokenId = dpopAccessTokenCondition.test(profileRequestContext) ?
- OidcEventIds.INVALID_ACCESS_TOKEN : OidcEventIds.INVALID_ACCESS_TOKEN;
+ OidcEventIds.INVALID_DPOP_ACCESS_TOKEN : OidcEventIds.INVALID_ACCESS_TOKEN;
final AccessToken token = getCredentialsRequest().getAccessToken();
if (token == null) {
diff --git a/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/profile/impl/ParseProof.java b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/profile/impl/ParseProof.java
index d86ac67..d028961 100644
--- a/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/profile/impl/ParseProof.java
+++ b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/profile/impl/ParseProof.java
@@ -25,7 +25,7 @@ import java.util.function.Function;
import javax.annotation.Nonnull;
import javax.annotation.Nullable;
-import org.geant.shibboleth.plugin.openidvci.config.OpenIDVCIConfiguration;
+import org.geant.shibboleth.plugin.openidvci.profile.config.OpenIDVCIConfiguration;
import org.geant.shibboleth.plugin.openidvci.messaging.context.CredentialsContext;
import org.geant.shibboleth.plugin.openidvci.messaging.impl.OpenIDVCICredentialsRequest;
import org.geant.shibboleth.plugin.openidvci.profile.OpenIDVCIEventIds;
@@ -48,12 +48,14 @@ import net.shibboleth.profile.context.RelyingPartyContext;
import net.shibboleth.shared.annotation.constraint.NonnullBeforeExec;
import net.shibboleth.shared.logic.Constraint;
+/** Action that parses the key proofs of a Credential request. */
public class ParseProof extends AbstractProfileAction {
/** Class logger. */
@Nonnull
private Logger log = LoggerFactory.getLogger(ParseProof.class);
+ /** Proofs of the request keyed by proof type. */
@NonnullBeforeExec
private Map<String, Object> proof;
@@ -124,23 +126,23 @@ public class ParseProof extends AbstractProfileAction {
/** {@inheritDoc} */
@Override
protected void doExecute(@Nonnull final ProfileRequestContext profileRequestContext) {
- Object proofToken = proof.get("jwt");
+ final Object proofToken = proof.get("jwt");
if (proofToken == null) {
log.error("{} Only proofs of type 'jwt' are supported {}", getLogPrefix(), proof);
ActionSupport.buildEvent(profileRequestContext, OpenIDVCIEventIds.PROOF_TYPE_UNSUPPORTED);
return;
}
- List<SignedJWT> proofs = new ArrayList<SignedJWT>();
+ final List<SignedJWT> proofs = new ArrayList<SignedJWT>();
// TODO: Enforce a maximum number of proofs per request, aligned with the
// batch_credential_issuance.batch_size value advertised in issuer metadata.
if (proofToken instanceof List<?> tokens) {
tokens.forEach(token -> {
if (token instanceof String strToken) {
try {
- SignedJWT singleProof = SignedJWT.parse(strToken);
+ final SignedJWT singleProof = SignedJWT.parse(strToken);
validateJWTProof(singleProof, profileRequestContext);
proofs.add(singleProof);
- } catch (Exception e) {
+ } catch (final Exception e) {
log.error("{} proof {} parsing failed.", getLogPrefix(), proof, e);
ActionSupport.buildEvent(profileRequestContext, OpenIDVCIEventIds.INVALID_PROOF);
return;
@@ -148,33 +150,36 @@ public class ParseProof extends AbstractProfileAction {
}
});
}
- CredentialsContext ctx = profileRequestContext.getInboundMessageContext()
+ final CredentialsContext ctx = profileRequestContext.getInboundMessageContext()
.ensureSubcontext(CredentialsContext.class);
ctx.setProofs(proofs);
}
/**
- * Validate jwt proof per
- * https://openid.net/specs/openid-4-verifiable-credential-issuance-1_0.html#name-jwt-proof-type
+ * Validate a jwt proof per the OpenID4VCI specification.
+ *
+ * <p>See https://openid.net/specs/openid-4-verifiable-credential-issuance-1_0.html#name-jwt-proof-type</p>
*
- * @param proof proof to validate
+ * @param jwtProof proof to validate
+ * @param profileRequestContext profile request context
* @throws ParseException
* @throws JWTValidationException
* @throws Exception thrown if validation fails
*/
- private void validateJWTProof(@Nonnull JWSObject proof, @Nonnull final ProfileRequestContext profileRequestContext)
+ private void validateJWTProof(@Nonnull final JWSObject jwtProof,
+ @Nonnull final ProfileRequestContext profileRequestContext)
throws IllegalArgumentException, JWTValidationException, ParseException {
- assert proof != null;
- if (JWSAlgorithm.Family.HMAC_SHA.contains(proof.getHeader().getAlgorithm())) {
- throw new IllegalArgumentException("HMAC algorithm used: " + proof.getHeader().getAlgorithm().getName());
+ assert jwtProof != null;
+ if (JWSAlgorithm.Family.HMAC_SHA.contains(jwtProof.getHeader().getAlgorithm())) {
+ throw new IllegalArgumentException("HMAC algorithm used: " + jwtProof.getHeader().getAlgorithm().getName());
}
- if (!proof.getHeader().getType().equals(new JOSEObjectType("openid4vci-proof+jwt"))) {
- throw new IllegalArgumentException("typ should be openid4vci-proof+jwt: " + proof.getHeader().getType());
+ if (!jwtProof.getHeader().getType().equals(new JOSEObjectType("openid4vci-proof+jwt"))) {
+ throw new IllegalArgumentException("typ should be openid4vci-proof+jwt: " + jwtProof.getHeader().getType());
}
- int fields = (proof.getHeader().getJWK() != null ? 1 : 0)
- + (proof.getHeader().getX509CertChain() != null ? 1 : 0)
- + (proof.getHeader().getKeyID() != null ? 1 : 0);
+ final int fields = (jwtProof.getHeader().getJWK() != null ? 1 : 0)
+ + (jwtProof.getHeader().getX509CertChain() != null ? 1 : 0)
+ + (jwtProof.getHeader().getKeyID() != null ? 1 : 0);
if (fields != 1) {
throw new IllegalArgumentException("Exactly one of jwk, x5c, or kid must be present");
@@ -182,7 +187,7 @@ public class ParseProof extends AbstractProfileAction {
// Validate nonce, audience and iat.
// TODO: iat is not verified per spec.
if (validator != null) {
- validator.validate(JWTClaimsSet.parse(proof.getPayload().toJSONObject()), profileRequestContext);
+ validator.validate(JWTClaimsSet.parse(jwtProof.getPayload().toJSONObject()), profileRequestContext);
}
}
}
\ No newline at end of file
diff --git a/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/profile/impl/ResolveCredentialLifetime.java b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/profile/impl/ResolveCredentialLifetime.java
index 0ff21bb..b6cf2fa 100644
--- a/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/profile/impl/ResolveCredentialLifetime.java
+++ b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/profile/impl/ResolveCredentialLifetime.java
@@ -30,7 +30,7 @@ import net.shibboleth.profile.context.RelyingPartyContext;
import net.shibboleth.shared.logic.Constraint;
import net.shibboleth.shared.primitive.LoggerFactory;
-import org.geant.shibboleth.plugin.openidvci.config.OpenIDVCIConfiguration;
+import org.geant.shibboleth.plugin.openidvci.profile.config.OpenIDVCIConfiguration;
import org.geant.shibboleth.plugin.openidvci.messaging.context.CredentialsContext;
import org.opensaml.messaging.context.navigate.ChildContextLookup;
import org.opensaml.profile.action.ActionSupport;
diff --git a/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/profile/impl/SetAuthorizationDetailsToResponseContext.java b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/profile/impl/SetAuthorizationDetailsToResponseContext.java
index 236afc8..957b2ea 100644
--- a/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/profile/impl/SetAuthorizationDetailsToResponseContext.java
+++ b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/profile/impl/SetAuthorizationDetailsToResponseContext.java
@@ -59,11 +59,20 @@ public class SetAuthorizationDetailsToResponseContext extends AbstractProfileAct
@Nonnull
private Function<ProfileRequestContext, List<OpenIDVCIAuthorizationDetail>> authorizationDetailsStrategy;
+ /** Authorization details of the request. */
@NonnullBeforeExec
private List<OpenIDVCIAuthorizationDetail> authorizationDetails;
+ /** Token context. */
@NonnullBeforeExec
- private TokenContext tokenContext = null;
+ private TokenContext tokenContext;
+
+ /**
+ * Constructor.
+ */
+ public SetAuthorizationDetailsToResponseContext() {
+ authorizationDetailsStrategy = new AuthorizationDetailsLookupFunction();
+ }
/**
* Set the strategy used to locate the {@link OpenIDVCIAuthorizationDetail} to
@@ -77,13 +86,6 @@ public class SetAuthorizationDetailsToResponseContext extends AbstractProfileAct
"AuthorizationDetailsLookupStrategy lookup strategy cannot be null");
}
- /**
- * Constructor.
- */
- public SetAuthorizationDetailsToResponseContext() {
- authorizationDetailsStrategy = new AuthorizationDetailsLookupFunction();
- }
-
/** {@inheritDoc} */
@Override
protected boolean doPreExecute(@Nonnull final ProfileRequestContext profileRequestContext) {
@@ -124,7 +126,7 @@ public class SetAuthorizationDetailsToResponseContext extends AbstractProfileAct
|| tokenContext.getCredentialOfferObject().getPreAuthorizedCredentials() == null) {
return;
}
- List<OpenIDVCIAuthorizationDetail> details = new ArrayList<>();
+ final List<OpenIDVCIAuthorizationDetail> details = new ArrayList<>();
tokenContext.getCredentialOfferObject().getPreAuthorizedCredentials().keySet()
.forEach(key -> details.add(new OpenIDVCIAuthorizationDetail("openid_credential", key, null, null)));
@@ -133,22 +135,23 @@ public class SetAuthorizationDetailsToResponseContext extends AbstractProfileAct
}
}
+ /** {@inheritDoc} */
@Override
protected void doExecute(@Nonnull final ProfileRequestContext profileRequestContext) {
// tokenContext.getCredentialOfferObject().
- List<OpenIDVCIAuthorizationDetail> matchedDetails = new ArrayList<>();
- for (OpenIDVCIAuthorizationDetail detail : authorizationDetails) {
- List<String> configurationsIds = new ArrayList<>();
- String configurationId = detail.getCredentialConfigurationId();
+ final List<OpenIDVCIAuthorizationDetail> matchedDetails = new ArrayList<>();
+ for (final OpenIDVCIAuthorizationDetail detail : authorizationDetails) {
+ final List<String> configurationsIds = new ArrayList<>();
+ final String configurationId = detail.getCredentialConfigurationId();
try {
- for (String credentialName : tokenContext.getPotentialCredentials().toJWTClaimsSet().toJSONObject()
- .keySet()) {
+ for (final String credentialName : tokenContext.getPotentialCredentials().toJWTClaimsSet()
+ .toJSONObject().keySet()) {
if (!credentialName.startsWith(configurationId)) {
continue;
}
- String potentialIdPart = credentialName.replaceFirst(configurationId, "");
+ final String potentialIdPart = credentialName.replaceFirst(configurationId, "");
if (potentialIdPart.isEmpty()
- || (potentialIdPart.startsWith("_") && potentialIdPart.lastIndexOf("_") == 0)) {
+ || potentialIdPart.startsWith("_") && potentialIdPart.lastIndexOf("_") == 0) {
configurationsIds.add(credentialName);
}
}
@@ -156,7 +159,7 @@ public class SetAuthorizationDetailsToResponseContext extends AbstractProfileAct
matchedDetails.add(new OpenIDVCIAuthorizationDetail(detail.getType(),
detail.getCredentialConfigurationId(), null, configurationsIds));
}
- } catch (ParseException e) {
+ } catch (final ParseException e) {
log.error("{} Parsing exception. Not able to match request to offering", getLogPrefix(), e);
ActionSupport.buildEvent(profileRequestContext, OpenIDVCIEventIds.NO_CREDENTIALS_FOR_REQUEST);
return;
@@ -169,4 +172,5 @@ public class SetAuthorizationDetailsToResponseContext extends AbstractProfileAct
}
tokenContext.setResponseAuthorizationDetails(matchedDetails);
}
+
}
diff --git a/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/profile/impl/SignJWTCredential.java b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/profile/impl/SignJWTCredential.java
index 76107a6..de257ed 100644
--- a/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/profile/impl/SignJWTCredential.java
+++ b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/profile/impl/SignJWTCredential.java
@@ -23,11 +23,10 @@ import java.util.function.Function;
import javax.annotation.Nonnull;
import javax.annotation.Nullable;
-import org.geant.shibboleth.plugin.oauth.security.DidJwkSupport;
+import org.geant.shibboleth.plugin.openidvci.security.impl.DidJwkSupport;
import org.geant.shibboleth.plugin.openidvci.messaging.context.CredentialsContext;
import org.geant.shibboleth.plugin.openidvci.messaging.impl.OpenIDVCICredentialsRequest;
import org.geant.shibboleth.plugin.openidvci.profile.OpenIDVCIEventIds;
-import org.geant.shibboleth.plugin.openidvci.profile.impl.stolen.AbstractOIDCResponseAction;
import org.opensaml.messaging.context.navigate.ChildContextLookup;
import org.opensaml.profile.action.ActionSupport;
import org.opensaml.profile.action.EventIds;
@@ -36,6 +35,7 @@ import org.opensaml.profile.context.navigate.OutboundMessageContextLookup;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
+import net.shibboleth.idp.plugin.oidc.op.profile.impl.AbstractOIDCResponseAction;
import net.shibboleth.oidc.security.impl.JWSTokenSigner;
import net.shibboleth.oidc.security.jose.SignatureException;
import net.shibboleth.oidc.security.jose.SignatureSigningParameters;
@@ -50,7 +50,7 @@ import com.nimbusds.jwt.JWTClaimsSet;
/**
* Action that signs all jwt verifiable credentials
* {@link CredentialsContext#getJWTCredentials} storing the result to
- * {@link CredentialsContext#setSignedCredential}
+ * {@link CredentialsContext#setSignedCredential}.
*/
public class SignJWTCredential extends AbstractOIDCResponseAction {
@@ -58,6 +58,7 @@ public class SignJWTCredential extends AbstractOIDCResponseAction {
@Nonnull
private Logger log = LoggerFactory.getLogger(SignJWTCredential.class);
+ /** Credentials context. */
@NonnullBeforeExec
private CredentialsContext ctx;
@@ -76,6 +77,7 @@ public class SignJWTCredential extends AbstractOIDCResponseAction {
@NonnullAfterInit
private SignatureSigningParameters signatureSigningParameters;
+ /** Constructor. */
public SignJWTCredential() {
final Function<ProfileRequestContext, SecurityParametersContext> splcs = new ChildContextLookup<>(
SecurityParametersContext.class).compose(new OutboundMessageContextLookup());
diff --git a/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/profile/impl/UnwrapGrant.java b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/profile/impl/UnwrapGrant.java
index 8e388d0..ea0b210 100644
--- a/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/profile/impl/UnwrapGrant.java
+++ b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/profile/impl/UnwrapGrant.java
@@ -1,12 +1,14 @@
/*
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
+ * Copyright (c) 2025, GÉANT
+ *
+ * Licensed under the Apache License, Version 2.0 (the “License”); you may not
+ * use this file except in compliance with the License. You may obtain a copy
+ * of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
+ * distributed under the License is distributed on an “AS IS” BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
@@ -93,6 +95,7 @@ public class UnwrapGrant extends AbstractOpenIDVCITokenResponseAction {
@Nonnull
private Function<ProfileRequestContext, ClientID> clientIDLookupStrategy;
+ /** Cache of Credential Offers. */
@NonnullAfterInit
private CredentialOfferCache credentialOfferCache;
@@ -103,7 +106,7 @@ public class UnwrapGrant extends AbstractOpenIDVCITokenResponseAction {
*/
public UnwrapGrant(@Nonnull @ParameterName(name = "sealer") final DataSealer sealer) {
dataSealer = Constraint.isNotNull(sealer, "DataSealer cannot be null");
- APIRequestClientIDLookupFunction lookup = new APIRequestClientIDLookupFunction();
+ final APIRequestClientIDLookupFunction lookup = new APIRequestClientIDLookupFunction();
lookup.setDataSealer(sealer);
clientIDLookupStrategy = FunctionSupport.compose(lookup, new InboundMessageContextLookup());
}
@@ -138,6 +141,7 @@ public class UnwrapGrant extends AbstractOpenIDVCITokenResponseAction {
}
}
+// Checkstyle: CyclomaticComplexity|MethodLength OFF
/** {@inheritDoc} */
@Override
protected void doExecute(@Nonnull final ProfileRequestContext profileRequestContext) {
@@ -174,17 +178,17 @@ public class UnwrapGrant extends AbstractOpenIDVCITokenResponseAction {
final OIDCAuthenticationResponseContext oidcResponseContext = getOidcResponseContext();
assert oidcResponseContext != null;
oidcResponseContext.setAuthorizationGrantClaimsSet(tokenClaimsSet);
- TokenContext tokenContext = profileRequestContext.getInboundMessageContext()
+ final TokenContext tokenContext = profileRequestContext.getInboundMessageContext()
.ensureSubcontext(TokenContext.class);
tokenContext.setPotentialCredentials(tokenClaimsSet.getUserinfoDeliveryClaims());
return;
} else if (getOpenIDVCITokenRequest().getPreAuthorizedCode() instanceof String) {
// This is pre-authorized grant
- String code = getOpenIDVCITokenRequest().getPreAuthorizedCode();
+ final String code = getOpenIDVCITokenRequest().getPreAuthorizedCode();
log.info("{} Unwrapping pre-authorization code: {}", getLogPrefix(), code);
- Exception e;
+ final Exception e;
try {
- CredentialOfferClaimsSet credentialOffer = CredentialOfferClaimsSet.parse(code, dataSealer);
+ final CredentialOfferClaimsSet credentialOffer = CredentialOfferClaimsSet.parse(code, dataSealer);
assert credentialOffer != null;
final String jti = credentialOffer.getID();
if (jti == null) {
@@ -194,7 +198,7 @@ public class UnwrapGrant extends AbstractOpenIDVCITokenResponseAction {
}
log.debug("{} pre-authorized grant unwrapped {}", getLogPrefix(), credentialOffer.serialize());
validateTokenClaimsSet(profileRequestContext, credentialOffer, false);
- TokenContext tokenContext = profileRequestContext.getInboundMessageContext()
+ final TokenContext tokenContext = profileRequestContext.getInboundMessageContext()
.ensureSubcontext(TokenContext.class);
tokenContext.setCredentialOfferObject(CredentialOfferObject.parse(credentialOffer.getSubject()));
getOidcResponseContext().setAuthTime(Instant.now());
@@ -211,7 +215,7 @@ public class UnwrapGrant extends AbstractOpenIDVCITokenResponseAction {
}
try {
- TokenContext tokenContext = profileRequestContext.getInboundMessageContext()
+ final TokenContext tokenContext = profileRequestContext.getInboundMessageContext()
.ensureSubcontext(TokenContext.class);
tokenContext.setCredentialOfferObject(credentialOfferCache.getCredentialOffer(code));
setPotentialCredentials(tokenContext);
@@ -221,7 +225,7 @@ public class UnwrapGrant extends AbstractOpenIDVCITokenResponseAction {
getOidcResponseContext().setSubject(clientIDLookupStrategy.apply(profileRequestContext).getValue());
getOidcResponseContext().setAuthTime(Instant.now());
return;
- } catch (IOException | net.minidev.json.parser.ParseException e1) {
+ } catch (final IOException | net.minidev.json.parser.ParseException e1) {
e = e1;
}
log.error("{} Validating pre-authorized code {} failed", getLogPrefix(), code, e);
@@ -230,9 +234,17 @@ public class UnwrapGrant extends AbstractOpenIDVCITokenResponseAction {
ActionSupport.buildEvent(profileRequestContext, OidcEventIds.INVALID_GRANT);
}
+// Checkstyle: CyclomaticComplexity|MethodLength ON
+ /**
+ * Validate the claims of an unwrapped grant.
+ *
+ * @param profileRequestContext profile request context
+ * @param tokenClaimsSet claims of the unwrapped grant
+ * @param clientMatch whether the grant was issued to this client
+ */
private void validateTokenClaimsSet(@Nonnull final ProfileRequestContext profileRequestContext,
- TokenClaimsSet tokenClaimsSet, boolean clientMatch) {
+ final TokenClaimsSet tokenClaimsSet, final boolean clientMatch) {
if (tokenClaimsSet == null) {
log.warn("{} Grant type not supported", getLogPrefix());
ActionSupport.buildEvent(profileRequestContext, OidcEventIds.INVALID_GRANT);
@@ -258,12 +270,17 @@ public class UnwrapGrant extends AbstractOpenIDVCITokenResponseAction {
}
}
- private void setPotentialCredentials(@Nonnull TokenContext ctx) {
- ClaimsSet credentialOfferClaims = new ClaimsSet();
+ /**
+ * Set the credentials the grant may be redeemed for.
+ *
+ * @param ctx token context to populate
+ */
+ private void setPotentialCredentials(@Nonnull final TokenContext ctx) {
+ final ClaimsSet credentialOfferClaims = new ClaimsSet();
ctx.getCredentialOfferObject().getPreAuthorizedCredentials().forEach((key, value) -> {
try {
credentialOfferClaims.setClaim(key, value.serialize());
- } catch (JsonProcessingException e) {
+ } catch (final JsonProcessingException e) {
log.warn("{} Error occurred while handling CredentialOfferObject {}", getLogPrefix(), e);
}
diff --git a/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/profile/impl/ValidateCredentialOffering.java b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/profile/impl/ValidateCredentialOffering.java
index 5e071d7..0b644d3 100644
--- a/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/profile/impl/ValidateCredentialOffering.java
+++ b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/profile/impl/ValidateCredentialOffering.java
@@ -55,8 +55,6 @@ public class ValidateCredentialOffering extends AbstractCredentialValidationActi
@NonnullBeforeExec
private Set<String> credentialConfIds;
- /** The supported credentials file. */
-
/**
* Inbound {@link CredentialOfferRequest}.
*/
@@ -92,8 +90,8 @@ public class ValidateCredentialOffering extends AbstractCredentialValidationActi
});
if (request.getPreAuthorizedCredentials() != null) {
- for (Map.Entry<String, CredentialOfferRequestedCredential> entry : request.getPreAuthorizedCredentials()
- .entrySet()) {
+ for (final Map.Entry<String, CredentialOfferRequestedCredential> entry
+ : request.getPreAuthorizedCredentials().entrySet()) {
final CredentialConfiguration configuration = getCredentialConfigurations().get(entry.getKey());
if (configuration == null) {
continue;
@@ -107,7 +105,7 @@ public class ValidateCredentialOffering extends AbstractCredentialValidationActi
}
}
- CredentialOfferContext ctx = new CredentialOfferContext();
+ final CredentialOfferContext ctx = new CredentialOfferContext();
ctx.setCredentialConfigurations(getCredentialConfigurations());
ctx.setValidatedPreAuthorizedCredentials(request.getPreAuthorizedCredentials());
ctx.setValidatedCodeCredentials(request.getCodeCredentials());
@@ -130,7 +128,7 @@ public class ValidateCredentialOffering extends AbstractCredentialValidationActi
if (metadata == null || metadata.getClaims() == null) {
return true;
}
- for (ClaimDescription claim : metadata.getClaims()) {
+ for (final ClaimDescription claim : metadata.getClaims()) {
if (!Boolean.TRUE.equals(claim.getMandatory())) {
continue;
}
@@ -153,7 +151,7 @@ public class ValidateCredentialOffering extends AbstractCredentialValidationActi
*/
private boolean requestContainsPath(@Nonnull final CredentialOfferRequestedCredential requestedCredential,
@Nonnull final List<Object> configPath) {
- for (CredentialOfferRequestedClaim requestedClaim : requestedCredential.getRequestedCredential()) {
+ for (final CredentialOfferRequestedClaim requestedClaim : requestedCredential.getRequestedCredential()) {
final List<String> requestPath = requestedClaim.getPath();
if (configPath.size() != requestPath.size()) {
continue;
diff --git a/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/profile/impl/ValidateExpectedGrantType.java b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/profile/impl/ValidateExpectedGrantType.java
index 97fa9a5..0945a37 100644
--- a/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/profile/impl/ValidateExpectedGrantType.java
+++ b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/profile/impl/ValidateExpectedGrantType.java
@@ -46,8 +46,9 @@ public class ValidateExpectedGrantType extends AbstractProfileAction {
@Nonnull
private Logger log = LoggerFactory.getLogger(ValidateExpectedGrantType.class);
+ /** Grant type the flow expects. */
@Nonnull
- private String expectedGrantType = OpenIDVCITokenRequest.grantTypeValuePreAuth;
+ private String expectedGrantType = OpenIDVCITokenRequest.GRANT_TYPE_VALUE_PRE_AUTH;
/** OIDC Metadata context. */
private OIDCMetadataContext oidcMetadataContext;
@@ -57,7 +58,7 @@ public class ValidateExpectedGrantType extends AbstractProfileAction {
*
* @param type expected grant type
*/
- public void setExpectedGrantType(@Nonnull String type) {
+ public void setExpectedGrantType(@Nonnull final String type) {
Constraint.isNotEmpty(type, "Expected grant type must not be null or empty");
expectedGrantType = type;
}
@@ -92,7 +93,7 @@ public class ValidateExpectedGrantType extends AbstractProfileAction {
log.error("{} The grant type {} is not registered for this RP", getLogPrefix(), expectedGrantType);
ActionSupport.buildEvent(profileRequestContext, OidcEventIds.INVALID_GRANT_TYPE);
}
- } catch (ParseException e) {
+ } catch (final ParseException e) {
log.error("{} Unable to parse grant type from {}", getLogPrefix(), expectedGrantType);
ActionSupport.buildEvent(profileRequestContext, OidcEventIds.INVALID_GRANT_TYPE);
}
diff --git a/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/profile/impl/ValidateGrant.java b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/profile/impl/ValidateGrant.java
index 399341b..f5f68af 100644
--- a/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/profile/impl/ValidateGrant.java
+++ b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/profile/impl/ValidateGrant.java
@@ -1,12 +1,14 @@
/*
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
+ * Copyright (c) 2025, GÉANT
+ *
+ * Licensed under the Apache License, Version 2.0 (the “License”); you may not
+ * use this file except in compliance with the License. You may obtain a copy
+ * of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
+ * distributed under the License is distributed on an “AS IS” BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
@@ -22,7 +24,7 @@ import javax.annotation.Nonnull;
import javax.annotation.Nullable;
import org.geant.shibboleth.plugin.openidvci.messaging.impl.AbstractOpenIDVCITokenResponseAction;
-import org.geant.shibboleth.plugin.openidvci.profile.logic.DefaultChainRevocationLifetimeLookupStrategy;
+import net.shibboleth.idp.plugin.oidc.op.profile.logic.DefaultChainRevocationLifetimeLookupStrategy;
import org.opensaml.messaging.context.navigate.ChildContextLookup;
import org.opensaml.profile.action.ActionSupport;
import org.opensaml.profile.context.ProfileRequestContext;
@@ -58,7 +60,9 @@ import net.shibboleth.shared.primitive.LoggerFactory;
*
* <p> The validated claims from the grant are stored to response context via
* {@link OIDCAuthenticationResponseContext#getAuthorizationGrantClaimsSet()}.</p>
- *
+ *
+ * <p>Derived from {@code ValidateGrant} of the OpenID Connect Provider plugin, in package
+ * {@code net.shibboleth.idp.plugin.oidc.op.profile.impl}, reduced to the grant types this plugin issues.</p>
*/
public class ValidateGrant extends AbstractOpenIDVCITokenResponseAction {
diff --git a/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/profile/impl/ValidateRequestedCredential.java b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/profile/impl/ValidateRequestedCredential.java
index be81f57..934c648 100644
--- a/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/profile/impl/ValidateRequestedCredential.java
+++ b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/profile/impl/ValidateRequestedCredential.java
@@ -67,8 +67,17 @@ public class ValidateRequestedCredential extends AbstractCredentialValidationAct
@Nonnull
private Function<ProfileRequestContext, String> requestCredentialIdentifierLookupStrategy;
+ /** OIDC response context. */
private OIDCAuthenticationResponseContext oidcResponseContext;
+ /**
+ * Constructor.
+ */
+ public ValidateRequestedCredential() {
+ requestCredentialConfigurationIdLookupStrategy = new RequestCredentialConfigurationIdLookupFunction();
+ requestCredentialIdentifierLookupStrategy = new RequestCredentialIdentifierLookupFunction();
+ }
+
/**
* Set the strategy used to obtain the credential configuration id value from
* credentials request.
@@ -95,14 +104,6 @@ public class ValidateRequestedCredential extends AbstractCredentialValidationAct
"RequestCredentialIdentifierLookupStrategy lookup strategy cannot be null");
}
- /**
- * Constructor.
- */
- public ValidateRequestedCredential() {
- requestCredentialConfigurationIdLookupStrategy = new RequestCredentialConfigurationIdLookupFunction();
- requestCredentialIdentifierLookupStrategy = new RequestCredentialIdentifierLookupFunction();
- }
-
/** {@inheritDoc} */
@Override
protected boolean doPreExecute(@Nonnull final ProfileRequestContext profileRequestContext) {
@@ -124,6 +125,7 @@ public class ValidateRequestedCredential extends AbstractCredentialValidationAct
return true;
}
+// Checkstyle: CyclomaticComplexity OFF
/** {@inheritDoc} */
@Override
protected void doExecute(@Nonnull final ProfileRequestContext profileRequestContext) {
@@ -141,7 +143,8 @@ public class ValidateRequestedCredential extends AbstractCredentialValidationAct
if (idInRequest != null) {
final String newId = idInRequest;
// Look for configurations that start as "id_"
- Set<String> set = getCredentialConfigurations().keySet().stream().map(s -> newId.replaceFirst(s, ""))
+ final Set<String> set = getCredentialConfigurations().keySet().stream()
+ .map(s -> newId.replaceFirst(s, ""))
.filter(s -> s.startsWith("_") && s.lastIndexOf("_") == 0).collect(Collectors.toSet());
if (set.size() == 1) {
configuration = getCredentialConfigurations().get(set.iterator().next());
@@ -156,12 +159,13 @@ public class ValidateRequestedCredential extends AbstractCredentialValidationAct
// look for claim that would match id and store it.
CredentialOfferRequestedCredential credential = null;
try {
- Map<String, Object> potentialClaims = oidcResponseContext.getAuthorizationGrantClaimsSet().getClaimsSet()
- .getJSONObjectClaim(OpenIDVCITokenManipulationStrategy.PotentialClaims);
+ final Map<String, Object> potentialClaims =
+ oidcResponseContext.getAuthorizationGrantClaimsSet().getClaimsSet()
+ .getJSONObjectClaim(OpenIDVCITokenManipulationStrategy.POTENTIAL_CLAIMS);
if (potentialClaims != null && potentialClaims.containsKey(idInRequest)) {
credential = CredentialOfferRequestedCredential.parse((String)potentialClaims.get(idInRequest));
}
- } catch (ParseException | com.nimbusds.oauth2.sdk.ParseException | JsonProcessingException e) {
+ } catch (final ParseException | com.nimbusds.oauth2.sdk.ParseException | JsonProcessingException e) {
log.error("{} parsing failed", getLogPrefix(), e);
ActionSupport.buildEvent(profileRequestContext, EventIds.INVALID_PROFILE_CTX);
return;
@@ -173,11 +177,13 @@ public class ValidateRequestedCredential extends AbstractCredentialValidationAct
return;
}
// TODO: Move context creation to initialization phase
- CredentialsContext ctx = profileRequestContext.getInboundMessageContext()
+ final CredentialsContext ctx = profileRequestContext.getInboundMessageContext()
.ensureSubcontext(CredentialsContext.class);
ctx.setCredentialContent(credential);
ctx.setCredentialConfiguration(configuration);
// TODO: This should be value in configuration. Fix.
ctx.setCredentialIdentifier(idInRequest);
}
+
+// Checkstyle: CyclomaticComplexity ON
}
\ No newline at end of file
diff --git a/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/profile/impl/ValidateTxCode.java b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/profile/impl/ValidateTxCode.java
index ed03048..b4db195 100644
--- a/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/profile/impl/ValidateTxCode.java
+++ b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/profile/impl/ValidateTxCode.java
@@ -31,18 +31,22 @@ import net.shibboleth.idp.profile.AbstractProfileAction;
import net.shibboleth.shared.annotation.constraint.NonnullBeforeExec;
import net.shibboleth.shared.primitive.LoggerFactory;
+/** Action that validates the Transaction Code presented for a Credential Offer. */
public class ValidateTxCode extends AbstractProfileAction {
/** Class logger. */
@Nonnull
private Logger log = LoggerFactory.getLogger(ValidateTxCode.class);
+ /** Token context. */
@NonnullBeforeExec
private TokenContext tokenContext;
+ /** Transaction Code the offer requires. */
@NonnullBeforeExec
private CredentialOfferTxCode requiredTxCode;
+ /** Transaction Code presented in the request. */
@Nullable
private String providedTxCode;
@@ -80,6 +84,7 @@ public class ValidateTxCode extends AbstractProfileAction {
return true;
}
+ /** {@inheritDoc} */
@Override
protected void doExecute(@Nonnull final ProfileRequestContext profileRequestContext) {
log.info("{} Validating tx-code", getLogPrefix());
diff --git a/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/profile/impl/InitializeOutboundResponseMessageContext.java b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/profile/impl/package-info.java
similarity index 53%
copy from openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/profile/impl/InitializeOutboundResponseMessageContext.java
copy to openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/profile/impl/package-info.java
index 9f72d40..431896f 100644
--- a/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/profile/impl/InitializeOutboundResponseMessageContext.java
+++ b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/profile/impl/package-info.java
@@ -14,18 +14,7 @@
* limitations under the License.
*/
-package org.geant.shibboleth.plugin.openidvci.profile.impl;
-
-import org.geant.shibboleth.plugin.openidvci.profile.impl.stolen.AbstractInitializeOutboundResponseMessageContext;
-import org.opensaml.messaging.context.MessageContext;
-import org.opensaml.profile.context.ProfileRequestContext;
-
/**
- * Action that adds an outbound {@link MessageContext} and related OIDC contexts
- * to the {@link ProfileRequestContext} not knowing the relying party yet.
- *
- * @event {@link org.opensaml.profile.action.EventIds#PROCEED_EVENT_ID}
+ * Profile actions implementing credential issuance.
*/
-public class InitializeOutboundResponseMessageContext extends AbstractInitializeOutboundResponseMessageContext {
-
-}
\ No newline at end of file
+package org.geant.shibboleth.plugin.openidvci.profile.impl;
diff --git a/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/profile/impl/stolen/AbstractOIDCRequestAction.java b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/profile/impl/stolen/AbstractOIDCRequestAction.java
deleted file mode 100644
index 5ebaae3..0000000
--- a/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/profile/impl/stolen/AbstractOIDCRequestAction.java
+++ /dev/null
@@ -1,82 +0,0 @@
-/*
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-
-// TODO: This abstract class is copied as is from shibboleth project. Refactoring needed.
-
-package org.geant.shibboleth.plugin.openidvci.profile.impl.stolen;
-
-import javax.annotation.Nonnull;
-
-import net.shibboleth.idp.profile.AbstractProfileAction;
-import net.shibboleth.shared.primitive.LoggerFactory;
-
-import org.opensaml.messaging.context.MessageContext;
-import org.opensaml.profile.action.ActionSupport;
-import org.opensaml.profile.action.EventIds;
-import org.opensaml.profile.context.ProfileRequestContext;
-import org.slf4j.Logger;
-
-/**
- *
- * Abstract class for actions performing actions on a oidc request found via
- * {@link ProfileRequestContext#getInboundMessageContext()} and {@link MessageContext#getMessage()}.
- *
- * @param <T> request message implementation class.
- *
- * TODO: Add explicit class parameter to test message type and cast with controlled calls.
- */
-
-public abstract class AbstractOIDCRequestAction<T> extends AbstractProfileAction {
-
- /** Class logger. */
- @Nonnull
- private Logger log = LoggerFactory.getLogger(AbstractOIDCRequestAction.class);
-
- /** OIDC request. */
- private T request;
-
- /**
- * Returns request.
- *
- * @return request
- */
- public T getRequest() {
- return request;
- }
-
- /** {@inheritDoc} */
- @SuppressWarnings("unchecked")
- @Override
- protected boolean doPreExecute(@Nonnull final ProfileRequestContext profileRequestContext) {
-
- if (!super.doPreExecute(profileRequestContext)) {
- return false;
- }
- if (profileRequestContext.getInboundMessageContext() == null) {
- log.error("{} Unable to locate inbound message context", getLogPrefix());
- ActionSupport.buildEvent(profileRequestContext, EventIds.INVALID_MSG_CTX);
- return false;
- }
- final Object message = profileRequestContext.ensureInboundMessageContext().getMessage();
- if (message == null) {
- log.error("{} Unable to locate inbound message", getLogPrefix());
- ActionSupport.buildEvent(profileRequestContext, EventIds.INVALID_MSG_CTX);
- return false;
- }
- request = (T) message;
- return true;
- }
-
-}
\ No newline at end of file
diff --git a/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/profile/impl/stolen/AbstractOIDCResponseAction.java b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/profile/impl/stolen/AbstractOIDCResponseAction.java
deleted file mode 100644
index 80450b1..0000000
--- a/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/profile/impl/stolen/AbstractOIDCResponseAction.java
+++ /dev/null
@@ -1,94 +0,0 @@
-/*
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-
-// TODO: This abstract class is copied as is from shibboleth project. Refactoring needed.
-
-package org.geant.shibboleth.plugin.openidvci.profile.impl.stolen;
-
-import javax.annotation.Nonnull;
-
-import org.opensaml.messaging.context.MessageContext;
-import org.opensaml.profile.action.ActionSupport;
-import org.opensaml.profile.action.EventIds;
-import org.opensaml.profile.context.ProfileRequestContext;
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
-
-import net.shibboleth.idp.plugin.oidc.op.messaging.context.OIDCAuthenticationResponseContext;
-import net.shibboleth.idp.profile.AbstractProfileAction;
-import net.shibboleth.oidc.metadata.context.OIDCMetadataContext;
-
-/**
- * Abstract class for actions performing actions on {@link OIDCAuthenticationResponseContext} located under
- * {@link ProfileRequestContext#getOutboundMessageContext()}.
- */
-public abstract class AbstractOIDCResponseAction extends AbstractProfileAction {
-
- /** Class logger. */
- @Nonnull
- private Logger log = LoggerFactory.getLogger(AbstractOIDCResponseAction.class);
-
- /** oidc response context. */
- @Nonnull
- private OIDCAuthenticationResponseContext oidcResponseContext;
-
- /** OIDC Metadata context. */
- @Nonnull
- private OIDCMetadataContext oidcMetadataContext;
-
- /**
- * Returns oidc response context.
- *
- * @return ctx.
- */
- @Nonnull
- public OIDCAuthenticationResponseContext getOidcResponseContext() {
- return oidcResponseContext;
- }
-
- /**
- * Returns the OIDC Metadata context.
- *
- * @return The OIDC Metadata context.
- */
- public OIDCMetadataContext getMetadataContext() {
- return oidcMetadataContext;
- }
-
- /** {@inheritDoc} */
- @Override
- protected boolean doPreExecute(@Nonnull final ProfileRequestContext profileRequestContext) {
-
- if (!super.doPreExecute(profileRequestContext)) {
- return false;
- }
- final MessageContext outboundMessageCtx = profileRequestContext.getOutboundMessageContext();
- if (outboundMessageCtx == null) {
- log.error("{} No outbound message context", getLogPrefix());
- ActionSupport.buildEvent(profileRequestContext, EventIds.INVALID_MSG_CTX);
- return false;
- }
- oidcResponseContext = outboundMessageCtx.getSubcontext(OIDCAuthenticationResponseContext.class);
- if (oidcResponseContext == null) {
- log.error("{} No oidc response context", getLogPrefix());
- ActionSupport.buildEvent(profileRequestContext, EventIds.INVALID_MSG_CTX);
- return false;
- }
- oidcMetadataContext = profileRequestContext.getInboundMessageContext().getSubcontext(OIDCMetadataContext.class);
-
- return true;
- }
-
-}
\ No newline at end of file
diff --git a/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/oauth/profile/logic/CredentialIssuerLookupFunction.java b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/profile/logic/CredentialIssuerLookupFunction.java
similarity index 98%
rename from openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/oauth/profile/logic/CredentialIssuerLookupFunction.java
rename to openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/profile/logic/CredentialIssuerLookupFunction.java
index 3481ce4..3ebb165 100644
--- a/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/oauth/profile/logic/CredentialIssuerLookupFunction.java
+++ b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/profile/logic/CredentialIssuerLookupFunction.java
@@ -14,7 +14,7 @@
* limitations under the License.
*/
-package org.geant.shibboleth.plugin.oauth.profile.logic;
+package org.geant.shibboleth.plugin.openidvci.profile.logic;
import java.security.PublicKey;
import java.security.interfaces.ECPublicKey;
diff --git a/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/profile/logic/DefaultChainRevocationLifetimeLookupStrategy.java b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/profile/logic/DefaultChainRevocationLifetimeLookupStrategy.java
deleted file mode 100644
index 3d0f4bd..0000000
--- a/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/profile/logic/DefaultChainRevocationLifetimeLookupStrategy.java
+++ /dev/null
@@ -1,75 +0,0 @@
-/*
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.geant.shibboleth.plugin.openidvci.profile.logic;
-
-import java.time.Duration;
-
-import javax.annotation.Nonnull;
-import javax.annotation.Nullable;
-
-import org.opensaml.profile.context.ProfileRequestContext;
-import org.slf4j.Logger;
-
-import net.shibboleth.oidc.profile.config.navigate.RevocationLifetimeLookupFunction;
-import net.shibboleth.shared.logic.Constraint;
-import net.shibboleth.shared.primitive.LoggerFactory;
-
-/**
- * Default lookup function for fetching the chain revocation lifetime. This inherits the functionality of
- * {@link RevocationLifetimeLookupFunction} but also adds the configurable clock skew value and additional 5 minutes
- * to the returned value.
- */
-public class DefaultChainRevocationLifetimeLookupStrategy extends RevocationLifetimeLookupFunction {
-
- /** Class logger. */
- @Nonnull
- private final Logger log = LoggerFactory.getLogger(DefaultChainRevocationLifetimeLookupStrategy.class);
-
- /** Positive clock skew adjustment to consider when calculating revocation lifetime. */
- @Nonnull private Duration clockSkew;
-
- /**
- * Constructor.
- */
- public DefaultChainRevocationLifetimeLookupStrategy() {
- final Duration skew = Duration.ofMinutes(5);
- assert skew != null;
- clockSkew = skew;
- }
-
- /**
- * Set the clock skew.
- *
- * @param skew clock skew to set
- */
- public void setClockSkew(@Nonnull final Duration skew) {
- final Duration newValue = Constraint.isNotNull(skew, "Clock skew cannot be null").abs();
- assert newValue != null;
- clockSkew = newValue;
- }
-
- /** {@inheritDoc} */
- @Override
- @Nullable
- public Duration apply(@Nullable final ProfileRequestContext input) {
- final Duration profileDuration = super.apply(input);
- if (profileDuration == null || profileDuration.isZero()) {
- log.debug("No chain expiration time could be resolved, returning null");
- return null;
- }
- return profileDuration.plus(Duration.ofMinutes(5)).plus(clockSkew);
- }
-
-}
\ No newline at end of file
diff --git a/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/profile/logic/OpenIDVCITokenManipulationStrategy.java b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/profile/logic/OpenIDVCITokenManipulationStrategy.java
index 7eb6679..b0dab50 100644
--- a/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/profile/logic/OpenIDVCITokenManipulationStrategy.java
+++ b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/profile/logic/OpenIDVCITokenManipulationStrategy.java
@@ -48,18 +48,27 @@ import net.shibboleth.shared.primitive.LoggerFactory;
public class OpenIDVCITokenManipulationStrategy
implements BiFunction<ProfileRequestContext, Map<String, Object>, Map<String, Object>> {
+ /** Claim name carrying the authorization details. */
+ public static final String AUTH_DETAILS = "vci.int.authorizationDetails";
+
+ /** Claim name carrying the potential claims. */
+ public static final String POTENTIAL_CLAIMS = "vci.int.potentialClaims";
+
/** Class logger. */
@Nonnull
private Logger log = LoggerFactory.getLogger(OpenIDVCITokenManipulationStrategy.class);
- public final static String AuthDetails = "vci.int.authorizationDetails";
-
- public final static String PotentialClaims = "vci.int.potentialClaims";
-
/** Strategy used to locate the {@link OpenIDVCIAuthorizationDetail} to use. */
@Nonnull
private Function<ProfileRequestContext, List<OpenIDVCIAuthorizationDetail>> authorizationDetailsStrategy;
+ /**
+ * Constructor.
+ */
+ public OpenIDVCITokenManipulationStrategy() {
+ authorizationDetailsStrategy = new AuthorizationDetailsLookupFunction();
+ }
+
/**
* Set the strategy used to locate the {@link OpenIDVCIAuthorizationDetail} to
* use.
@@ -72,30 +81,28 @@ public class OpenIDVCITokenManipulationStrategy
"AuthorizationDetailsLookupStrategy lookup strategy cannot be null");
}
- /**
- * Constructor.
- */
- public OpenIDVCITokenManipulationStrategy() {
- authorizationDetailsStrategy = new AuthorizationDetailsLookupFunction();
- }
-
+ /** {@inheritDoc} */
@Override
- public Map<String, Object> apply(ProfileRequestContext profileRequestContext, Map<String, Object> claims) {
- Object message = profileRequestContext.getInboundMessageContext().getMessage();
+ public Map<String, Object> apply(final ProfileRequestContext profileRequestContext,
+ final Map<String, Object> claims) {
+ final Object message = profileRequestContext.getInboundMessageContext().getMessage();
if (message instanceof AuthorizationRequest || message instanceof OpenIDVCITokenRequest) {
try {
- List<OpenIDVCIAuthorizationDetail> details = authorizationDetailsStrategy.apply(profileRequestContext);
+ final List<OpenIDVCIAuthorizationDetail> details =
+ authorizationDetailsStrategy.apply(profileRequestContext);
if (details != null) {
- claims.put(AuthDetails, new ObjectMapper().writeValueAsString(details));
+ claims.put(AUTH_DETAILS, new ObjectMapper().writeValueAsString(details));
}
- } catch (JsonProcessingException e) {
+ } catch (final JsonProcessingException e) {
log.warn("{} Failed parsing", e);
}
}
- TokenContext tokenContext = profileRequestContext.getInboundMessageContext().getSubcontext(TokenContext.class);
+ final TokenContext tokenContext =
+ profileRequestContext.getInboundMessageContext().getSubcontext(TokenContext.class);
if (tokenContext != null) {
- claims.put(PotentialClaims, tokenContext.getPotentialCredentials().toJSONObject());
+ claims.put(POTENTIAL_CLAIMS, tokenContext.getPotentialCredentials().toJSONObject());
}
return claims;
}
+
}
diff --git a/openid-vci-api/src/main/java/org/geant/shibboleth/plugin/oauth/statuslist/StatusListBucket.java b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/profile/logic/package-info.java
similarity index 52%
copy from openid-vci-api/src/main/java/org/geant/shibboleth/plugin/oauth/statuslist/StatusListBucket.java
copy to openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/profile/logic/package-info.java
index 8a3d844..3c57ee8 100644
--- a/openid-vci-api/src/main/java/org/geant/shibboleth/plugin/oauth/statuslist/StatusListBucket.java
+++ b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/profile/logic/package-info.java
@@ -14,21 +14,7 @@
* limitations under the License.
*/
-package org.geant.shibboleth.plugin.oauth.statuslist;
-
-import java.time.Instant;
-
-import javax.annotation.Nonnull;
-
/**
- * Immutable identity of one Status List as in
- * <a href="https://datatracker.ietf.org/doc/draft-ietf-oauth-status-list/">
- * draft-ietf-oauth-status-list</a>.
- *
- * A bucket holds credentials that all expire before the end of the bucket.
- *
- * @param id identifier, used as storage key
- * @param end upper bound for expiration of any credential in this bucket
+ * Predicates and strategy functions for OpenID4VCI profiles.
*/
-public record StatusListBucket(@Nonnull String id, @Nonnull Instant end) {
-}
+package org.geant.shibboleth.plugin.openidvci.profile.logic;
diff --git a/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/security/credential/impl/ExtendedJOSEObjectCredentialResolver.java b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/security/credential/impl/ExtendedJOSEObjectCredentialResolver.java
index 64e7e62..ca3c090 100644
--- a/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/security/credential/impl/ExtendedJOSEObjectCredentialResolver.java
+++ b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/security/credential/impl/ExtendedJOSEObjectCredentialResolver.java
@@ -34,6 +34,7 @@ import net.shibboleth.shared.annotation.constraint.NonnullElements;
import net.shibboleth.shared.primitive.LoggerFactory;
import net.shibboleth.oidc.security.credential.impl.BasicJOSEObjectCredentialResolver;
+/** Credential resolver that also resolves did:jwk keys. */
public class ExtendedJOSEObjectCredentialResolver extends BasicJOSEObjectCredentialResolver {
/** Logger. */
@@ -72,16 +73,18 @@ public class ExtendedJOSEObjectCredentialResolver extends BasicJOSEObjectCredent
}
/**
- * Add did:jwk credential of format
- * https://github.com/quartzjer/did-jwk/blob/main/spec.md#did-url-1
+ * Add did:jwk credential of the format described in the did:jwk specification.
+ *
+ * <p>See https://github.com/quartzjer/did-jwk/blob/main/spec.md#did-url-1</p>
*
* @param credentials list of credentials.
* @param kid did:jwk url of format
* https://github.com/quartzjer/did-jwk/blob/main/spec.md#did-url-1
*/
- protected void addDidJwkCredentialIfPresent(@Nonnull List<Credential> credentials, @Nullable String kid) {
+ protected void addDidJwkCredentialIfPresent(@Nonnull final List<Credential> credentials,
+ @Nullable final String kid) {
if (kid != null && kid.startsWith("did:jwk:") && kid.endsWith("#0")) {
- String encoded = kid.substring("did:jwk:".length(), kid.indexOf('#'));
+ final String encoded = kid.substring("did:jwk:".length(), kid.indexOf('#'));
try {
final JWK didJwk = JWK
.parse(new String(Base64.getUrlDecoder().decode(encoded), StandardCharsets.UTF_8));
@@ -89,7 +92,7 @@ public class ExtendedJOSEObjectCredentialResolver extends BasicJOSEObjectCredent
if (cred != null) {
credentials.add(cred);
}
- } catch (ParseException e) {
+ } catch (final ParseException e) {
log.warn("Failed parsing kid {} as did:jwk", kid, e);
}
diff --git a/openid-vci-api/src/main/java/org/geant/shibboleth/plugin/oauth/statuslist/StatusListBucket.java b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/security/credential/impl/package-info.java
similarity index 52%
copy from openid-vci-api/src/main/java/org/geant/shibboleth/plugin/oauth/statuslist/StatusListBucket.java
copy to openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/security/credential/impl/package-info.java
index 8a3d844..5ee5d08 100644
--- a/openid-vci-api/src/main/java/org/geant/shibboleth/plugin/oauth/statuslist/StatusListBucket.java
+++ b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/security/credential/impl/package-info.java
@@ -14,21 +14,7 @@
* limitations under the License.
*/
-package org.geant.shibboleth.plugin.oauth.statuslist;
-
-import java.time.Instant;
-
-import javax.annotation.Nonnull;
-
/**
- * Immutable identity of one Status List as in
- * <a href="https://datatracker.ietf.org/doc/draft-ietf-oauth-status-list/">
- * draft-ietf-oauth-status-list</a>.
- *
- * A bucket holds credentials that all expire before the end of the bucket.
- *
- * @param id identifier, used as storage key
- * @param end upper bound for expiration of any credential in this bucket
+ * Credential resolvers for JOSE objects.
*/
-public record StatusListBucket(@Nonnull String id, @Nonnull Instant end) {
-}
+package org.geant.shibboleth.plugin.openidvci.security.credential.impl;
diff --git a/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/oauth/security/DidJwkSupport.java b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/security/impl/DidJwkSupport.java
similarity index 98%
rename from openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/oauth/security/DidJwkSupport.java
rename to openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/security/impl/DidJwkSupport.java
index 29de09e..7509889 100644
--- a/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/oauth/security/DidJwkSupport.java
+++ b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/security/impl/DidJwkSupport.java
@@ -14,7 +14,7 @@
* limitations under the License.
*/
-package org.geant.shibboleth.plugin.oauth.security;
+package org.geant.shibboleth.plugin.openidvci.security.impl;
import java.security.PrivateKey;
import java.security.PublicKey;
diff --git a/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/security/JWTMessageSignaturesSecurityHandler.java b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/security/impl/JWTMessageSignaturesSecurityHandler.java
similarity index 97%
rename from openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/security/JWTMessageSignaturesSecurityHandler.java
rename to openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/security/impl/JWTMessageSignaturesSecurityHandler.java
index 5223444..a34e4d4 100644
--- a/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/security/JWTMessageSignaturesSecurityHandler.java
+++ b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/security/impl/JWTMessageSignaturesSecurityHandler.java
@@ -13,7 +13,7 @@
* See the License for the specific language governing permissions and
* limitations under the License.
*/
-package org.geant.shibboleth.plugin.openidvci.security;
+package org.geant.shibboleth.plugin.openidvci.security.impl;
import java.text.ParseException;
import java.util.List;
@@ -106,7 +106,7 @@ public class JWTMessageSignaturesSecurityHandler extends BaseJWTSignatureSecurit
try {
// Test parse of claims.
- for (SignedJWT signedJwt : signedJwts) {
+ for (final SignedJWT signedJwt : signedJwts) {
signedJwt.getJWTClaimsSet();
}
} catch (final ParseException e) {
@@ -121,7 +121,7 @@ public class JWTMessageSignaturesSecurityHandler extends BaseJWTSignatureSecurit
@Override
protected void doInvoke(@Nonnull final MessageContext messageContext) throws MessageHandlerException {
- for (SignedJWT signedJwt : signedJwts) {
+ for (final SignedJWT signedJwt : signedJwts) {
if (signedJwt.getState() != State.SIGNED && signedJwt.getState() != State.VERIFIED) {
log.debug("{} The JWS object must be in a signed or verified state, cannot process signature",
diff --git a/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/security/TokenKeyTrustEngine.java b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/security/impl/TokenKeyTrustEngine.java
similarity index 95%
rename from openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/security/TokenKeyTrustEngine.java
rename to openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/security/impl/TokenKeyTrustEngine.java
index 771e256..e1ca4e3 100644
--- a/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/security/TokenKeyTrustEngine.java
+++ b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/security/impl/TokenKeyTrustEngine.java
@@ -13,7 +13,7 @@
* See the License for the specific language governing permissions and
* limitations under the License.
*/
-package org.geant.shibboleth.plugin.openidvci.security;
+package org.geant.shibboleth.plugin.openidvci.security.impl;
import java.security.PublicKey;
@@ -53,19 +53,20 @@ public class TokenKeyTrustEngine extends BaseSignedJWTTrustEngine<Credential> {
* @param joseObjectResolver resolver of credentials from JOSEObject headers.
*/
protected TokenKeyTrustEngine(
- @Nonnull final @ParameterName(name = "JOSEObjectResolver") JOSEObjectCredentialResolver joseObjectResolver) {
+ @Nonnull final @ParameterName(name = "JOSEObjectResolver")
+ JOSEObjectCredentialResolver joseObjectResolver) {
super(joseObjectResolver);
}
- @Override
/** {@inheritDoc} */
+ @Override
protected boolean doValidate(@Nonnull final SignedJWT signedJWT, @Nonnull final CriteriaSet trustBasisCriteria)
throws SecurityException {
return true;
}
- @Override
/** {@inheritDoc} */
+ @Override
protected boolean evaluateTrust(@Nonnull final Credential untrustedCredential,
@Nullable final Credential trustBasis) throws SecurityException {
final PublicKey publicKey = untrustedCredential.getPublicKey();
diff --git a/openid-vci-api/src/main/java/org/geant/shibboleth/plugin/oauth/statuslist/StatusListBucket.java b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/security/impl/package-info.java
similarity index 52%
copy from openid-vci-api/src/main/java/org/geant/shibboleth/plugin/oauth/statuslist/StatusListBucket.java
copy to openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/security/impl/package-info.java
index 8a3d844..0180306 100644
--- a/openid-vci-api/src/main/java/org/geant/shibboleth/plugin/oauth/statuslist/StatusListBucket.java
+++ b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/security/impl/package-info.java
@@ -14,21 +14,7 @@
* limitations under the License.
*/
-package org.geant.shibboleth.plugin.oauth.statuslist;
-
-import java.time.Instant;
-
-import javax.annotation.Nonnull;
-
/**
- * Immutable identity of one Status List as in
- * <a href="https://datatracker.ietf.org/doc/draft-ietf-oauth-status-list/">
- * draft-ietf-oauth-status-list</a>.
- *
- * A bucket holds credentials that all expire before the end of the bucket.
- *
- * @param id identifier, used as storage key
- * @param end upper bound for expiration of any credential in this bucket
+ * Trust engines and signature handling for OpenID4VCI.
*/
-public record StatusListBucket(@Nonnull String id, @Nonnull Instant end) {
-}
+package org.geant.shibboleth.plugin.openidvci.security.impl;
diff --git a/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/security/jose/AlgorithmRestrictedSignatureSigningConfiguration.java b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/security/jose/impl/AlgorithmRestrictedSignatureSigningConfiguration.java
similarity index 98%
rename from openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/security/jose/AlgorithmRestrictedSignatureSigningConfiguration.java
rename to openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/security/jose/impl/AlgorithmRestrictedSignatureSigningConfiguration.java
index c684504..15fab32 100644
--- a/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/security/jose/AlgorithmRestrictedSignatureSigningConfiguration.java
+++ b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/security/jose/impl/AlgorithmRestrictedSignatureSigningConfiguration.java
@@ -14,7 +14,7 @@
* limitations under the License.
*/
-package org.geant.shibboleth.plugin.openidvci.security.jose;
+package org.geant.shibboleth.plugin.openidvci.security.jose.impl;
import java.util.Collection;
import java.util.List;
diff --git a/openid-vci-api/src/main/java/org/geant/shibboleth/plugin/oauth/statuslist/StatusListBucket.java b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/security/jose/impl/package-info.java
similarity index 52%
copy from openid-vci-api/src/main/java/org/geant/shibboleth/plugin/oauth/statuslist/StatusListBucket.java
copy to openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/security/jose/impl/package-info.java
index 8a3d844..9b48fc2 100644
--- a/openid-vci-api/src/main/java/org/geant/shibboleth/plugin/oauth/statuslist/StatusListBucket.java
+++ b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/security/jose/impl/package-info.java
@@ -14,21 +14,7 @@
* limitations under the License.
*/
-package org.geant.shibboleth.plugin.oauth.statuslist;
-
-import java.time.Instant;
-
-import javax.annotation.Nonnull;
-
/**
- * Immutable identity of one Status List as in
- * <a href="https://datatracker.ietf.org/doc/draft-ietf-oauth-status-list/">
- * draft-ietf-oauth-status-list</a>.
- *
- * A bucket holds credentials that all expire before the end of the bucket.
- *
- * @param id identifier, used as storage key
- * @param end upper bound for expiration of any credential in this bucket
+ * JOSE signature configuration implementations.
*/
-public record StatusListBucket(@Nonnull String id, @Nonnull Instant end) {
-}
+package org.geant.shibboleth.plugin.openidvci.security.jose.impl;
diff --git a/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/oauth/statuslist/decoding/impl/StatusListAssignmentsRequestDecoder.java b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/statuslist/decoding/impl/StatusListAssignmentsRequestDecoder.java
similarity index 89%
rename from openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/oauth/statuslist/decoding/impl/StatusListAssignmentsRequestDecoder.java
rename to openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/statuslist/decoding/impl/StatusListAssignmentsRequestDecoder.java
index 17156ef..1e2a2f4 100644
--- a/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/oauth/statuslist/decoding/impl/StatusListAssignmentsRequestDecoder.java
+++ b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/statuslist/decoding/impl/StatusListAssignmentsRequestDecoder.java
@@ -14,15 +14,15 @@
* limitations under the License.
*/
-package org.geant.shibboleth.plugin.oauth.statuslist.decoding.impl;
+package org.geant.shibboleth.plugin.openidvci.statuslist.decoding.impl;
import java.io.IOException;
import javax.annotation.Nonnull;
-import org.geant.shibboleth.plugin.oauth.statuslist.messaging.impl.StatusListAssignmentsRequest;
+import org.geant.shibboleth.plugin.openidvci.statuslist.messaging.impl.StatusListAssignmentsRequest;
import org.geant.shibboleth.plugin.openidvci.decoding.impl.BaseOpenIDVCIRequestDecoder;
-import org.geant.shibboleth.plugin.openidvci.decoding.impl.RequestUtil;
+import net.shibboleth.idp.plugin.oidc.op.decoding.impl.RequestUtil;
import org.opensaml.messaging.decoder.MessageDecodingException;
import com.google.common.base.MoreObjects;
diff --git a/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/oauth/statuslist/decoding/impl/StatusListRevokeRequestDecoder.java b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/statuslist/decoding/impl/StatusListRevokeRequestDecoder.java
similarity index 86%
rename from openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/oauth/statuslist/decoding/impl/StatusListRevokeRequestDecoder.java
rename to openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/statuslist/decoding/impl/StatusListRevokeRequestDecoder.java
index 5bacc74..76c25bd 100644
--- a/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/oauth/statuslist/decoding/impl/StatusListRevokeRequestDecoder.java
+++ b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/statuslist/decoding/impl/StatusListRevokeRequestDecoder.java
@@ -14,16 +14,16 @@
* limitations under the License.
*/
-package org.geant.shibboleth.plugin.oauth.statuslist.decoding.impl;
+package org.geant.shibboleth.plugin.openidvci.statuslist.decoding.impl;
import java.io.IOException;
import javax.annotation.Nonnull;
-import org.geant.shibboleth.plugin.oauth.statuslist.StatusListParameters;
-import org.geant.shibboleth.plugin.oauth.statuslist.messaging.impl.StatusListRevokeRequest;
+import org.geant.shibboleth.plugin.openidvci.statuslist.StatusListParameters;
+import org.geant.shibboleth.plugin.openidvci.statuslist.messaging.impl.StatusListRevokeRequest;
import org.geant.shibboleth.plugin.openidvci.decoding.impl.BaseOpenIDVCIRequestDecoder;
-import org.geant.shibboleth.plugin.openidvci.decoding.impl.RequestUtil;
+import net.shibboleth.idp.plugin.oidc.op.decoding.impl.RequestUtil;
import org.opensaml.messaging.decoder.MessageDecodingException;
import com.google.common.base.MoreObjects;
diff --git a/openid-vci-api/src/main/java/org/geant/shibboleth/plugin/oauth/statuslist/StatusListBucket.java b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/statuslist/decoding/impl/package-info.java
similarity index 52%
copy from openid-vci-api/src/main/java/org/geant/shibboleth/plugin/oauth/statuslist/StatusListBucket.java
copy to openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/statuslist/decoding/impl/package-info.java
index 8a3d844..1992398 100644
--- a/openid-vci-api/src/main/java/org/geant/shibboleth/plugin/oauth/statuslist/StatusListBucket.java
+++ b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/statuslist/decoding/impl/package-info.java
@@ -14,21 +14,7 @@
* limitations under the License.
*/
-package org.geant.shibboleth.plugin.oauth.statuslist;
-
-import java.time.Instant;
-
-import javax.annotation.Nonnull;
-
/**
- * Immutable identity of one Status List as in
- * <a href="https://datatracker.ietf.org/doc/draft-ietf-oauth-status-list/">
- * draft-ietf-oauth-status-list</a>.
- *
- * A bucket holds credentials that all expire before the end of the bucket.
- *
- * @param id identifier, used as storage key
- * @param end upper bound for expiration of any credential in this bucket
+ * Decoders for inbound Status List requests.
*/
-public record StatusListBucket(@Nonnull String id, @Nonnull Instant end) {
-}
+package org.geant.shibboleth.plugin.openidvci.statuslist.decoding.impl;
diff --git a/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/oauth/statuslist/messaging/impl/StatusListAssignmentsRequest.java b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/statuslist/messaging/impl/StatusListAssignmentsRequest.java
similarity index 97%
rename from openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/oauth/statuslist/messaging/impl/StatusListAssignmentsRequest.java
rename to openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/statuslist/messaging/impl/StatusListAssignmentsRequest.java
index 48e8397..fb42df4 100644
--- a/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/oauth/statuslist/messaging/impl/StatusListAssignmentsRequest.java
+++ b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/statuslist/messaging/impl/StatusListAssignmentsRequest.java
@@ -14,7 +14,7 @@
* limitations under the License.
*/
-package org.geant.shibboleth.plugin.oauth.statuslist.messaging.impl;
+package org.geant.shibboleth.plugin.openidvci.statuslist.messaging.impl;
import java.net.URI;
import java.net.URISyntaxException;
@@ -122,6 +122,7 @@ public class StatusListAssignmentsRequest extends AbstractOptionallyIdentifiedRe
return null;
}
+// Checkstyle: CyclomaticComplexity OFF
/**
* Parse a request for records of status list assignments.
*
@@ -192,5 +193,6 @@ public class StatusListAssignmentsRequest extends AbstractOptionallyIdentifiedRe
return request;
}
+// Checkstyle: CyclomaticComplexity ON
}
diff --git a/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/oauth/statuslist/messaging/impl/StatusListAssignmentsSuccessResponse.java b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/statuslist/messaging/impl/StatusListAssignmentsSuccessResponse.java
similarity index 93%
rename from openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/oauth/statuslist/messaging/impl/StatusListAssignmentsSuccessResponse.java
rename to openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/statuslist/messaging/impl/StatusListAssignmentsSuccessResponse.java
index bb6e6cc..0e06350 100644
--- a/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/oauth/statuslist/messaging/impl/StatusListAssignmentsSuccessResponse.java
+++ b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/statuslist/messaging/impl/StatusListAssignmentsSuccessResponse.java
@@ -14,14 +14,14 @@
* limitations under the License.
*/
-package org.geant.shibboleth.plugin.oauth.statuslist.messaging.impl;
+package org.geant.shibboleth.plugin.openidvci.statuslist.messaging.impl;
import java.time.ZonedDateTime;
import java.time.format.DateTimeFormatter;
import javax.annotation.Nonnull;
-import org.geant.shibboleth.plugin.oauth.statuslist.storage.StatusListAssignments;
+import org.geant.shibboleth.plugin.openidvci.statuslist.storage.StatusListAssignments;
import com.fasterxml.jackson.core.JsonProcessingException;
import com.nimbusds.common.contenttype.ContentType;
diff --git a/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/oauth/statuslist/messaging/impl/StatusListRevokeRequest.java b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/statuslist/messaging/impl/StatusListRevokeRequest.java
similarity index 96%
rename from openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/oauth/statuslist/messaging/impl/StatusListRevokeRequest.java
rename to openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/statuslist/messaging/impl/StatusListRevokeRequest.java
index 88f7ee8..ac1e579 100644
--- a/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/oauth/statuslist/messaging/impl/StatusListRevokeRequest.java
+++ b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/statuslist/messaging/impl/StatusListRevokeRequest.java
@@ -14,7 +14,7 @@
* limitations under the License.
*/
-package org.geant.shibboleth.plugin.oauth.statuslist.messaging.impl;
+package org.geant.shibboleth.plugin.openidvci.statuslist.messaging.impl;
import java.net.URI;
import java.net.URISyntaxException;
@@ -23,7 +23,7 @@ import java.util.Map;
import javax.annotation.Nonnull;
import javax.annotation.Nullable;
-import org.geant.shibboleth.plugin.oauth.statuslist.StatusListParameters;
+import org.geant.shibboleth.plugin.openidvci.statuslist.StatusListParameters;
import com.fasterxml.jackson.core.JsonProcessingException;
import com.fasterxml.jackson.core.type.TypeReference;
@@ -114,6 +114,7 @@ public class StatusListRevokeRequest extends AbstractOptionallyIdentifiedRequest
return null;
}
+// Checkstyle: CyclomaticComplexity OFF
/**
* Parse a revocation request.
*
@@ -176,5 +177,6 @@ public class StatusListRevokeRequest extends AbstractOptionallyIdentifiedRequest
return request;
}
+// Checkstyle: CyclomaticComplexity ON
}
diff --git a/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/oauth/statuslist/messaging/impl/StatusListRevokeSuccessResponse.java b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/statuslist/messaging/impl/StatusListRevokeSuccessResponse.java
similarity index 94%
rename from openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/oauth/statuslist/messaging/impl/StatusListRevokeSuccessResponse.java
rename to openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/statuslist/messaging/impl/StatusListRevokeSuccessResponse.java
index 0321466..8d03def 100644
--- a/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/oauth/statuslist/messaging/impl/StatusListRevokeSuccessResponse.java
+++ b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/statuslist/messaging/impl/StatusListRevokeSuccessResponse.java
@@ -14,7 +14,7 @@
* limitations under the License.
*/
-package org.geant.shibboleth.plugin.oauth.statuslist.messaging.impl;
+package org.geant.shibboleth.plugin.openidvci.statuslist.messaging.impl;
import com.nimbusds.oauth2.sdk.SuccessResponse;
import com.nimbusds.oauth2.sdk.http.HTTPResponse;
diff --git a/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/oauth/statuslist/messaging/impl/StatusListSuccessResponse.java b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/statuslist/messaging/impl/StatusListSuccessResponse.java
similarity index 97%
rename from openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/oauth/statuslist/messaging/impl/StatusListSuccessResponse.java
rename to openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/statuslist/messaging/impl/StatusListSuccessResponse.java
index 5192dd8..1cdb5e4 100644
--- a/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/oauth/statuslist/messaging/impl/StatusListSuccessResponse.java
+++ b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/statuslist/messaging/impl/StatusListSuccessResponse.java
@@ -14,7 +14,7 @@
* limitations under the License.
*/
-package org.geant.shibboleth.plugin.oauth.statuslist.messaging.impl;
+package org.geant.shibboleth.plugin.openidvci.statuslist.messaging.impl;
import java.text.ParseException;
import java.time.ZonedDateTime;
diff --git a/openid-vci-api/src/main/java/org/geant/shibboleth/plugin/oauth/statuslist/StatusListBucket.java b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/statuslist/messaging/impl/package-info.java
similarity index 52%
copy from openid-vci-api/src/main/java/org/geant/shibboleth/plugin/oauth/statuslist/StatusListBucket.java
copy to openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/statuslist/messaging/impl/package-info.java
index 8a3d844..959dc94 100644
--- a/openid-vci-api/src/main/java/org/geant/shibboleth/plugin/oauth/statuslist/StatusListBucket.java
+++ b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/statuslist/messaging/impl/package-info.java
@@ -14,21 +14,7 @@
* limitations under the License.
*/
-package org.geant.shibboleth.plugin.oauth.statuslist;
-
-import java.time.Instant;
-
-import javax.annotation.Nonnull;
-
/**
- * Immutable identity of one Status List as in
- * <a href="https://datatracker.ietf.org/doc/draft-ietf-oauth-status-list/">
- * draft-ietf-oauth-status-list</a>.
- *
- * A bucket holds credentials that all expire before the end of the bucket.
- *
- * @param id identifier, used as storage key
- * @param end upper bound for expiration of any credential in this bucket
+ * Status List request and response message objects.
*/
-public record StatusListBucket(@Nonnull String id, @Nonnull Instant end) {
-}
+package org.geant.shibboleth.plugin.openidvci.statuslist.messaging.impl;
diff --git a/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/oauth/statuslist/config/DefaultStatusListAssignmentsConfiguration.java b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/statuslist/profile/config/impl/DefaultStatusListAssignmentsConfiguration.java
similarity index 87%
rename from openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/oauth/statuslist/config/DefaultStatusListAssignmentsConfiguration.java
rename to openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/statuslist/profile/config/impl/DefaultStatusListAssignmentsConfiguration.java
index f9643b5..3d2138c 100644
--- a/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/oauth/statuslist/config/DefaultStatusListAssignmentsConfiguration.java
+++ b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/statuslist/profile/config/impl/DefaultStatusListAssignmentsConfiguration.java
@@ -14,11 +14,11 @@
* limitations under the License.
*/
-package org.geant.shibboleth.plugin.oauth.statuslist.config;
+package org.geant.shibboleth.plugin.openidvci.statuslist.profile.config.impl;
import javax.annotation.Nonnull;
-import org.geant.shibboleth.plugin.openidvci.config.impl.AbstractOpenIDVCIConfiguration;
+import org.geant.shibboleth.plugin.openidvci.profile.config.impl.AbstractOpenIDVCIConfiguration;
import net.shibboleth.shared.annotation.constraint.NotEmpty;
diff --git a/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/oauth/statuslist/config/DefaultStatusListConfiguration.java b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/statuslist/profile/config/impl/DefaultStatusListConfiguration.java
similarity index 96%
rename from openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/oauth/statuslist/config/DefaultStatusListConfiguration.java
rename to openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/statuslist/profile/config/impl/DefaultStatusListConfiguration.java
index 0ed6b15..52e6c2c 100644
--- a/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/oauth/statuslist/config/DefaultStatusListConfiguration.java
+++ b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/statuslist/profile/config/impl/DefaultStatusListConfiguration.java
@@ -14,7 +14,7 @@
* limitations under the License.
*/
-package org.geant.shibboleth.plugin.oauth.statuslist.config;
+package org.geant.shibboleth.plugin.openidvci.statuslist.profile.config.impl;
import java.util.function.Function;
@@ -49,7 +49,8 @@ public class DefaultStatusListConfiguration extends AbstractInterceptorAwareProf
/** Signing of Status List Tokens. */
@Nonnull
- private Function<ProfileRequestContext, SignatureSigningConfiguration> statusListSignatureSigningConfigurationLookupStrategy;
+ private Function<ProfileRequestContext, SignatureSigningConfiguration>
+ statusListSignatureSigningConfigurationLookupStrategy;
/** Constructor. */
public DefaultStatusListConfiguration() {
diff --git a/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/oauth/statuslist/config/DefaultStatusListRevokeConfiguration.java b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/statuslist/profile/config/impl/DefaultStatusListRevokeConfiguration.java
similarity index 87%
rename from openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/oauth/statuslist/config/DefaultStatusListRevokeConfiguration.java
rename to openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/statuslist/profile/config/impl/DefaultStatusListRevokeConfiguration.java
index d7e1220..9a42ec5 100644
--- a/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/oauth/statuslist/config/DefaultStatusListRevokeConfiguration.java
+++ b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/statuslist/profile/config/impl/DefaultStatusListRevokeConfiguration.java
@@ -14,11 +14,11 @@
* limitations under the License.
*/
-package org.geant.shibboleth.plugin.oauth.statuslist.config;
+package org.geant.shibboleth.plugin.openidvci.statuslist.profile.config.impl;
import javax.annotation.Nonnull;
-import org.geant.shibboleth.plugin.openidvci.config.impl.AbstractOpenIDVCIConfiguration;
+import org.geant.shibboleth.plugin.openidvci.profile.config.impl.AbstractOpenIDVCIConfiguration;
import net.shibboleth.shared.annotation.constraint.NotEmpty;
diff --git a/openid-vci-api/src/main/java/org/geant/shibboleth/plugin/oauth/statuslist/StatusListBucket.java b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/statuslist/profile/config/impl/package-info.java
similarity index 52%
copy from openid-vci-api/src/main/java/org/geant/shibboleth/plugin/oauth/statuslist/StatusListBucket.java
copy to openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/statuslist/profile/config/impl/package-info.java
index 8a3d844..4ff7959 100644
--- a/openid-vci-api/src/main/java/org/geant/shibboleth/plugin/oauth/statuslist/StatusListBucket.java
+++ b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/statuslist/profile/config/impl/package-info.java
@@ -14,21 +14,7 @@
* limitations under the License.
*/
-package org.geant.shibboleth.plugin.oauth.statuslist;
-
-import java.time.Instant;
-
-import javax.annotation.Nonnull;
-
/**
- * Immutable identity of one Status List as in
- * <a href="https://datatracker.ietf.org/doc/draft-ietf-oauth-status-list/">
- * draft-ietf-oauth-status-list</a>.
- *
- * A bucket holds credentials that all expire before the end of the bucket.
- *
- * @param id identifier, used as storage key
- * @param end upper bound for expiration of any credential in this bucket
+ * Status List profile configuration implementations.
*/
-public record StatusListBucket(@Nonnull String id, @Nonnull Instant end) {
-}
+package org.geant.shibboleth.plugin.openidvci.statuslist.profile.config.impl;
diff --git a/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/oauth/statuslist/config/navigate/StatusListSignatureSigningConfigurationLookupFunction.java b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/statuslist/profile/config/navigate/StatusListSignatureSigningConfigurationLookupFunction.java
similarity index 92%
rename from openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/oauth/statuslist/config/navigate/StatusListSignatureSigningConfigurationLookupFunction.java
rename to openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/statuslist/profile/config/navigate/StatusListSignatureSigningConfigurationLookupFunction.java
index b1b9d76..c61ed83 100644
--- a/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/oauth/statuslist/config/navigate/StatusListSignatureSigningConfigurationLookupFunction.java
+++ b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/statuslist/profile/config/navigate/StatusListSignatureSigningConfigurationLookupFunction.java
@@ -13,14 +13,14 @@
* See the License for the specific language governing permissions and
* limitations under the License.
*/
-package org.geant.shibboleth.plugin.oauth.statuslist.config.navigate;
+package org.geant.shibboleth.plugin.openidvci.statuslist.profile.config.navigate;
import java.util.List;
import javax.annotation.Nonnull;
import javax.annotation.Nullable;
-import org.geant.shibboleth.plugin.oauth.statuslist.config.DefaultStatusListConfiguration;
+import org.geant.shibboleth.plugin.openidvci.statuslist.profile.config.impl.DefaultStatusListConfiguration;
import org.opensaml.profile.context.ProfileRequestContext;
import net.shibboleth.oidc.security.jose.SignatureSigningConfiguration;
diff --git a/openid-vci-api/src/main/java/org/geant/shibboleth/plugin/oauth/statuslist/StatusListBucket.java b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/statuslist/profile/config/navigate/package-info.java
similarity index 52%
copy from openid-vci-api/src/main/java/org/geant/shibboleth/plugin/oauth/statuslist/StatusListBucket.java
copy to openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/statuslist/profile/config/navigate/package-info.java
index 8a3d844..a4e47b1 100644
--- a/openid-vci-api/src/main/java/org/geant/shibboleth/plugin/oauth/statuslist/StatusListBucket.java
+++ b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/statuslist/profile/config/navigate/package-info.java
@@ -14,21 +14,7 @@
* limitations under the License.
*/
-package org.geant.shibboleth.plugin.oauth.statuslist;
-
-import java.time.Instant;
-
-import javax.annotation.Nonnull;
-
/**
- * Immutable identity of one Status List as in
- * <a href="https://datatracker.ietf.org/doc/draft-ietf-oauth-status-list/">
- * draft-ietf-oauth-status-list</a>.
- *
- * A bucket holds credentials that all expire before the end of the bucket.
- *
- * @param id identifier, used as storage key
- * @param end upper bound for expiration of any credential in this bucket
+ * Lookup functions resolving Status List profile configuration settings.
*/
-public record StatusListBucket(@Nonnull String id, @Nonnull Instant end) {
-}
+package org.geant.shibboleth.plugin.openidvci.statuslist.profile.config.navigate;
diff --git a/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/oauth/statuslist/profile/impl/AllocateIndex.java b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/statuslist/profile/impl/AllocateIndex.java
similarity index 90%
rename from openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/oauth/statuslist/profile/impl/AllocateIndex.java
rename to openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/statuslist/profile/impl/AllocateIndex.java
index ab9c93b..ed372c9 100644
--- a/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/oauth/statuslist/profile/impl/AllocateIndex.java
+++ b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/statuslist/profile/impl/AllocateIndex.java
@@ -1,18 +1,20 @@
/*
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
+ * Copyright (c) 2025, GÉANT
+ *
+ * Licensed under the Apache License, Version 2.0 (the “License”); you may not
+ * use this file except in compliance with the License. You may obtain a copy
+ * of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
+ * distributed under the License is distributed on an “AS IS” BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
-package org.geant.shibboleth.plugin.oauth.statuslist.profile.impl;
+package org.geant.shibboleth.plugin.openidvci.statuslist.profile.impl;
import java.io.IOException;
import java.net.URI;
@@ -24,11 +26,11 @@ import java.util.function.Function;
import javax.annotation.Nonnull;
import javax.annotation.Nullable;
-import org.geant.shibboleth.plugin.oauth.statuslist.MonthlyBucketStrategy;
-import org.geant.shibboleth.plugin.oauth.statuslist.StatusListBucket;
-import org.geant.shibboleth.plugin.oauth.statuslist.StatusListParameters;
-import org.geant.shibboleth.plugin.oauth.statuslist.context.StatusListContext;
-import org.geant.shibboleth.plugin.oauth.statuslist.storage.StatusListIndexAllocator;
+import org.geant.shibboleth.plugin.openidvci.statuslist.MonthlyBucketStrategy;
+import org.geant.shibboleth.plugin.openidvci.statuslist.StatusListBucket;
+import org.geant.shibboleth.plugin.openidvci.statuslist.StatusListParameters;
+import org.geant.shibboleth.plugin.openidvci.statuslist.context.StatusListContext;
+import org.geant.shibboleth.plugin.openidvci.statuslist.storage.StatusListIndexAllocator;
import org.opensaml.messaging.context.MessageContext;
import org.opensaml.profile.action.ActionSupport;
import org.opensaml.profile.action.EventIds;
@@ -234,7 +236,7 @@ public class AllocateIndex extends AbstractProfileAction {
@Nonnull
private URI buildURIIgnoreDefaultPorts(@Nonnull final String scheme, @Nonnull final String host, final int port,
@Nonnull final String path, @Nonnull final String query) throws URISyntaxException {
- final boolean defaultPort = ("https".equals(scheme) && port == 443) || ("http".equals(scheme) && port == 80);
+ final boolean defaultPort = "https".equals(scheme) && port == 443 || "http".equals(scheme) && port == 80;
return new URI(scheme, null, host, defaultPort ? -1 : port, path, query, null);
}
diff --git a/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/oauth/statuslist/profile/impl/AssignIndex.java b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/statuslist/profile/impl/AssignIndex.java
similarity index 93%
rename from openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/oauth/statuslist/profile/impl/AssignIndex.java
rename to openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/statuslist/profile/impl/AssignIndex.java
index d418df3..3c45eb8 100644
--- a/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/oauth/statuslist/profile/impl/AssignIndex.java
+++ b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/statuslist/profile/impl/AssignIndex.java
@@ -14,7 +14,7 @@
* limitations under the License.
*/
-package org.geant.shibboleth.plugin.oauth.statuslist.profile.impl;
+package org.geant.shibboleth.plugin.openidvci.statuslist.profile.impl;
import java.io.IOException;
import java.time.Instant;
@@ -31,10 +31,10 @@ import net.shibboleth.shared.component.ComponentInitializationException;
import net.shibboleth.shared.logic.Constraint;
import net.shibboleth.shared.primitive.LoggerFactory;
-import org.geant.shibboleth.plugin.oauth.statuslist.MonthlyBucketStrategy;
-import org.geant.shibboleth.plugin.oauth.statuslist.context.StatusListContext;
-import org.geant.shibboleth.plugin.oauth.statuslist.storage.StatusListAssignment;
-import org.geant.shibboleth.plugin.oauth.statuslist.storage.StatusListAssignmentStore;
+import org.geant.shibboleth.plugin.openidvci.statuslist.MonthlyBucketStrategy;
+import org.geant.shibboleth.plugin.openidvci.statuslist.context.StatusListContext;
+import org.geant.shibboleth.plugin.openidvci.statuslist.storage.StatusListAssignment;
+import org.geant.shibboleth.plugin.openidvci.statuslist.storage.StatusListAssignmentStore;
import org.opensaml.profile.action.ActionSupport;
import org.opensaml.profile.action.EventIds;
import org.opensaml.profile.context.ProfileRequestContext;
diff --git a/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/oauth/statuslist/profile/impl/FormOutboundStatusListAssignmentsResponseMessage.java b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/statuslist/profile/impl/FormOutboundStatusListAssignmentsResponseMessage.java
similarity index 89%
rename from openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/oauth/statuslist/profile/impl/FormOutboundStatusListAssignmentsResponseMessage.java
rename to openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/statuslist/profile/impl/FormOutboundStatusListAssignmentsResponseMessage.java
index 8ae8607..820ab13 100644
--- a/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/oauth/statuslist/profile/impl/FormOutboundStatusListAssignmentsResponseMessage.java
+++ b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/statuslist/profile/impl/FormOutboundStatusListAssignmentsResponseMessage.java
@@ -14,7 +14,7 @@
* limitations under the License.
*/
-package org.geant.shibboleth.plugin.oauth.statuslist.profile.impl;
+package org.geant.shibboleth.plugin.openidvci.statuslist.profile.impl;
import java.io.IOException;
@@ -27,10 +27,10 @@ import net.shibboleth.shared.component.ComponentInitializationException;
import net.shibboleth.shared.logic.Constraint;
import net.shibboleth.shared.primitive.LoggerFactory;
-import org.geant.shibboleth.plugin.oauth.statuslist.messaging.impl.StatusListAssignmentsRequest;
-import org.geant.shibboleth.plugin.oauth.statuslist.messaging.impl.StatusListAssignmentsSuccessResponse;
-import org.geant.shibboleth.plugin.oauth.statuslist.storage.StatusListAssignmentStore;
-import org.geant.shibboleth.plugin.oauth.statuslist.storage.StatusListAssignments;
+import org.geant.shibboleth.plugin.openidvci.statuslist.messaging.impl.StatusListAssignmentsRequest;
+import org.geant.shibboleth.plugin.openidvci.statuslist.messaging.impl.StatusListAssignmentsSuccessResponse;
+import org.geant.shibboleth.plugin.openidvci.statuslist.storage.StatusListAssignmentStore;
+import org.geant.shibboleth.plugin.openidvci.statuslist.storage.StatusListAssignments;
import org.opensaml.profile.action.ActionSupport;
import org.opensaml.profile.action.EventIds;
import org.opensaml.profile.context.ProfileRequestContext;
diff --git a/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/oauth/statuslist/profile/impl/FormOutboundStatusListResponseMessage.java b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/statuslist/profile/impl/FormOutboundStatusListResponseMessage.java
similarity index 93%
rename from openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/oauth/statuslist/profile/impl/FormOutboundStatusListResponseMessage.java
rename to openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/statuslist/profile/impl/FormOutboundStatusListResponseMessage.java
index 4ecd2ea..ffba9e1 100644
--- a/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/oauth/statuslist/profile/impl/FormOutboundStatusListResponseMessage.java
+++ b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/statuslist/profile/impl/FormOutboundStatusListResponseMessage.java
@@ -14,14 +14,14 @@
* limitations under the License.
*/
-package org.geant.shibboleth.plugin.oauth.statuslist.profile.impl;
+package org.geant.shibboleth.plugin.openidvci.statuslist.profile.impl;
import java.util.function.Function;
import javax.annotation.Nonnull;
-import org.geant.shibboleth.plugin.oauth.statuslist.context.StatusListTokenContext;
-import org.geant.shibboleth.plugin.oauth.statuslist.messaging.impl.StatusListSuccessResponse;
+import org.geant.shibboleth.plugin.openidvci.statuslist.context.StatusListTokenContext;
+import org.geant.shibboleth.plugin.openidvci.statuslist.messaging.impl.StatusListSuccessResponse;
import org.opensaml.messaging.context.navigate.ChildContextLookup;
import org.opensaml.profile.action.ActionSupport;
import org.opensaml.profile.action.EventIds;
diff --git a/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/oauth/statuslist/profile/impl/FormOutboundStatusListRevokeResponseMessage.java b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/statuslist/profile/impl/FormOutboundStatusListRevokeResponseMessage.java
similarity index 86%
rename from openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/oauth/statuslist/profile/impl/FormOutboundStatusListRevokeResponseMessage.java
rename to openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/statuslist/profile/impl/FormOutboundStatusListRevokeResponseMessage.java
index 2c08bdd..5a949b9 100644
--- a/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/oauth/statuslist/profile/impl/FormOutboundStatusListRevokeResponseMessage.java
+++ b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/statuslist/profile/impl/FormOutboundStatusListRevokeResponseMessage.java
@@ -14,11 +14,11 @@
* limitations under the License.
*/
-package org.geant.shibboleth.plugin.oauth.statuslist.profile.impl;
+package org.geant.shibboleth.plugin.openidvci.statuslist.profile.impl;
import javax.annotation.Nonnull;
-import org.geant.shibboleth.plugin.oauth.statuslist.messaging.impl.StatusListRevokeSuccessResponse;
+import org.geant.shibboleth.plugin.openidvci.statuslist.messaging.impl.StatusListRevokeSuccessResponse;
import org.opensaml.profile.context.ProfileRequestContext;
import net.shibboleth.idp.profile.AbstractProfileAction;
diff --git a/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/oauth/statuslist/profile/impl/FormStatusListToken.java b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/statuslist/profile/impl/FormStatusListToken.java
similarity index 91%
rename from openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/oauth/statuslist/profile/impl/FormStatusListToken.java
rename to openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/statuslist/profile/impl/FormStatusListToken.java
index 4a6256b..ceae6fc 100644
--- a/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/oauth/statuslist/profile/impl/FormStatusListToken.java
+++ b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/statuslist/profile/impl/FormStatusListToken.java
@@ -14,7 +14,7 @@
* limitations under the License.
*/
-package org.geant.shibboleth.plugin.oauth.statuslist.profile.impl;
+package org.geant.shibboleth.plugin.openidvci.statuslist.profile.impl;
import java.io.IOException;
import java.time.Duration;
@@ -26,13 +26,13 @@ import java.util.function.Function;
import javax.annotation.Nonnull;
import javax.annotation.Nullable;
-import org.geant.shibboleth.plugin.oauth.statuslist.MonthlyBucketStrategy;
-import org.geant.shibboleth.plugin.oauth.statuslist.StatusListBucket;
-import org.geant.shibboleth.plugin.oauth.statuslist.StatusListCodec;
-import org.geant.shibboleth.plugin.oauth.statuslist.StatusListParameters;
-import org.geant.shibboleth.plugin.oauth.statuslist.context.StatusListTokenContext;
-import org.geant.shibboleth.plugin.oauth.statuslist.profile.StatusListEventIds;
-import org.geant.shibboleth.plugin.oauth.statuslist.storage.StatusListStore;
+import org.geant.shibboleth.plugin.openidvci.statuslist.MonthlyBucketStrategy;
+import org.geant.shibboleth.plugin.openidvci.statuslist.StatusListBucket;
+import org.geant.shibboleth.plugin.openidvci.statuslist.StatusListCodec;
+import org.geant.shibboleth.plugin.openidvci.statuslist.StatusListParameters;
+import org.geant.shibboleth.plugin.openidvci.statuslist.context.StatusListTokenContext;
+import org.geant.shibboleth.plugin.openidvci.statuslist.profile.StatusListEventIds;
+import org.geant.shibboleth.plugin.openidvci.statuslist.storage.StatusListStore;
import org.opensaml.messaging.context.MessageContext;
import org.opensaml.profile.action.ActionSupport;
import org.opensaml.profile.action.EventIds;
@@ -48,7 +48,7 @@ import net.shibboleth.shared.component.ComponentInitializationException;
import net.shibboleth.shared.logic.Constraint;
import net.shibboleth.shared.primitive.LoggerFactory;
-import org.geant.shibboleth.plugin.oauth.profile.logic.CredentialIssuerLookupFunction;
+import org.geant.shibboleth.plugin.openidvci.profile.logic.CredentialIssuerLookupFunction;
/**
* Action that forms claims of a Status List Token and sets them to
diff --git a/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/oauth/statuslist/profile/impl/RevokeStatusListIndex.java b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/statuslist/profile/impl/RevokeStatusListIndex.java
similarity index 90%
rename from openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/oauth/statuslist/profile/impl/RevokeStatusListIndex.java
rename to openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/statuslist/profile/impl/RevokeStatusListIndex.java
index 09ba87a..9b097a1 100644
--- a/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/oauth/statuslist/profile/impl/RevokeStatusListIndex.java
+++ b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/statuslist/profile/impl/RevokeStatusListIndex.java
@@ -14,17 +14,17 @@
* limitations under the License.
*/
-package org.geant.shibboleth.plugin.oauth.statuslist.profile.impl;
+package org.geant.shibboleth.plugin.openidvci.statuslist.profile.impl;
import java.io.IOException;
import javax.annotation.Nonnull;
-import org.geant.shibboleth.plugin.oauth.statuslist.MonthlyBucketStrategy;
-import org.geant.shibboleth.plugin.oauth.statuslist.StatusListBucket;
-import org.geant.shibboleth.plugin.oauth.statuslist.StatusListParameters;
-import org.geant.shibboleth.plugin.oauth.statuslist.messaging.impl.StatusListRevokeRequest;
-import org.geant.shibboleth.plugin.oauth.statuslist.storage.StatusListStore;
+import org.geant.shibboleth.plugin.openidvci.statuslist.MonthlyBucketStrategy;
+import org.geant.shibboleth.plugin.openidvci.statuslist.StatusListBucket;
+import org.geant.shibboleth.plugin.openidvci.statuslist.StatusListParameters;
+import org.geant.shibboleth.plugin.openidvci.statuslist.messaging.impl.StatusListRevokeRequest;
+import org.geant.shibboleth.plugin.openidvci.statuslist.storage.StatusListStore;
import org.opensaml.profile.action.ActionSupport;
import org.opensaml.profile.action.EventIds;
import org.opensaml.profile.context.ProfileRequestContext;
diff --git a/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/oauth/statuslist/profile/impl/SignStatusListToken.java b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/statuslist/profile/impl/SignStatusListToken.java
similarity index 96%
rename from openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/oauth/statuslist/profile/impl/SignStatusListToken.java
rename to openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/statuslist/profile/impl/SignStatusListToken.java
index 976afb7..1646ad2 100644
--- a/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/oauth/statuslist/profile/impl/SignStatusListToken.java
+++ b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/statuslist/profile/impl/SignStatusListToken.java
@@ -14,15 +14,15 @@
* limitations under the License.
*/
-package org.geant.shibboleth.plugin.oauth.statuslist.profile.impl;
+package org.geant.shibboleth.plugin.openidvci.statuslist.profile.impl;
import java.util.function.Function;
import javax.annotation.Nonnull;
import javax.annotation.Nullable;
-import org.geant.shibboleth.plugin.oauth.security.DidJwkSupport;
-import org.geant.shibboleth.plugin.oauth.statuslist.context.StatusListTokenContext;
+import org.geant.shibboleth.plugin.openidvci.security.impl.DidJwkSupport;
+import org.geant.shibboleth.plugin.openidvci.statuslist.context.StatusListTokenContext;
import org.opensaml.messaging.context.navigate.ChildContextLookup;
import org.opensaml.profile.action.ActionSupport;
import org.opensaml.profile.action.EventIds;
diff --git a/openid-vci-api/src/main/java/org/geant/shibboleth/plugin/oauth/statuslist/StatusListBucket.java b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/statuslist/profile/impl/package-info.java
similarity index 52%
copy from openid-vci-api/src/main/java/org/geant/shibboleth/plugin/oauth/statuslist/StatusListBucket.java
copy to openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/statuslist/profile/impl/package-info.java
index 8a3d844..3bad1d6 100644
--- a/openid-vci-api/src/main/java/org/geant/shibboleth/plugin/oauth/statuslist/StatusListBucket.java
+++ b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/statuslist/profile/impl/package-info.java
@@ -14,21 +14,7 @@
* limitations under the License.
*/
-package org.geant.shibboleth.plugin.oauth.statuslist;
-
-import java.time.Instant;
-
-import javax.annotation.Nonnull;
-
/**
- * Immutable identity of one Status List as in
- * <a href="https://datatracker.ietf.org/doc/draft-ietf-oauth-status-list/">
- * draft-ietf-oauth-status-list</a>.
- *
- * A bucket holds credentials that all expire before the end of the bucket.
- *
- * @param id identifier, used as storage key
- * @param end upper bound for expiration of any credential in this bucket
+ * Profile actions implementing Token Status Lists.
*/
-public record StatusListBucket(@Nonnull String id, @Nonnull Instant end) {
-}
+package org.geant.shibboleth.plugin.openidvci.statuslist.profile.impl;
diff --git a/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/oauth/statuslist/storage/FeistelIndexPermutation.java b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/statuslist/storage/FeistelIndexPermutation.java
similarity index 98%
rename from openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/oauth/statuslist/storage/FeistelIndexPermutation.java
rename to openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/statuslist/storage/FeistelIndexPermutation.java
index 2d8e418..294547b 100644
--- a/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/oauth/statuslist/storage/FeistelIndexPermutation.java
+++ b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/statuslist/storage/FeistelIndexPermutation.java
@@ -14,7 +14,7 @@
* limitations under the License.
*/
-package org.geant.shibboleth.plugin.oauth.statuslist.storage;
+package org.geant.shibboleth.plugin.openidvci.statuslist.storage;
import java.nio.charset.StandardCharsets;
import java.security.MessageDigest;
diff --git a/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/oauth/statuslist/storage/StatusListAssignment.java b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/statuslist/storage/StatusListAssignment.java
similarity index 98%
rename from openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/oauth/statuslist/storage/StatusListAssignment.java
rename to openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/statuslist/storage/StatusListAssignment.java
index 63a19ca..f442875 100644
--- a/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/oauth/statuslist/storage/StatusListAssignment.java
+++ b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/statuslist/storage/StatusListAssignment.java
@@ -14,7 +14,7 @@
* limitations under the License.
*/
-package org.geant.shibboleth.plugin.oauth.statuslist.storage;
+package org.geant.shibboleth.plugin.openidvci.statuslist.storage;
import java.util.List;
import java.util.Map;
diff --git a/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/oauth/statuslist/storage/StatusListAssignmentStore.java b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/statuslist/storage/StatusListAssignmentStore.java
similarity index 99%
rename from openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/oauth/statuslist/storage/StatusListAssignmentStore.java
rename to openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/statuslist/storage/StatusListAssignmentStore.java
index 35d9b1a..308ec71 100644
--- a/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/oauth/statuslist/storage/StatusListAssignmentStore.java
+++ b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/statuslist/storage/StatusListAssignmentStore.java
@@ -14,7 +14,7 @@
* limitations under the License.
*/
-package org.geant.shibboleth.plugin.oauth.statuslist.storage;
+package org.geant.shibboleth.plugin.openidvci.statuslist.storage;
import java.io.IOException;
import java.time.Duration;
@@ -51,10 +51,6 @@ import com.fasterxml.jackson.core.JsonProcessingException;
@ThreadSafeAfterInit
public class StatusListAssignmentStore extends AbstractIdentifiableInitializableComponent {
- /** Logger. */
- @Nonnull
- private final Logger log = LoggerFactory.getLogger(StatusListAssignmentStore.class);
-
/** Storage context for the records. */
@Nonnull
@NotEmpty
@@ -73,6 +69,10 @@ public class StatusListAssignmentStore extends AbstractIdentifiableInitializable
/** Positions probed per record asked for, bounding the work of one read. */
private static final int PROBE_FACTOR = 10;
+ /** Logger. */
+ @Nonnull
+ private final Logger log = LoggerFactory.getLogger(StatusListAssignmentStore.class);
+
/** How long a record waits to be collected. */
@Nonnull
private Duration retention = Duration.ofDays(7);
diff --git a/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/oauth/statuslist/storage/StatusListAssignments.java b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/statuslist/storage/StatusListAssignments.java
similarity index 97%
rename from openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/oauth/statuslist/storage/StatusListAssignments.java
rename to openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/statuslist/storage/StatusListAssignments.java
index 271e136..b650615 100644
--- a/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/oauth/statuslist/storage/StatusListAssignments.java
+++ b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/statuslist/storage/StatusListAssignments.java
@@ -14,7 +14,7 @@
* limitations under the License.
*/
-package org.geant.shibboleth.plugin.oauth.statuslist.storage;
+package org.geant.shibboleth.plugin.openidvci.statuslist.storage;
import java.util.List;
diff --git a/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/oauth/statuslist/storage/StatusListIndexAllocator.java b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/statuslist/storage/StatusListIndexAllocator.java
similarity index 97%
rename from openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/oauth/statuslist/storage/StatusListIndexAllocator.java
rename to openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/statuslist/storage/StatusListIndexAllocator.java
index 808c5f8..bde484b 100644
--- a/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/oauth/statuslist/storage/StatusListIndexAllocator.java
+++ b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/statuslist/storage/StatusListIndexAllocator.java
@@ -14,7 +14,7 @@
* limitations under the License.
*/
-package org.geant.shibboleth.plugin.oauth.statuslist.storage;
+package org.geant.shibboleth.plugin.openidvci.statuslist.storage;
import java.io.IOException;
import java.nio.charset.StandardCharsets;
@@ -31,8 +31,8 @@ import net.shibboleth.shared.component.AbstractIdentifiableInitializableComponen
import net.shibboleth.shared.component.ComponentInitializationException;
import net.shibboleth.shared.logic.Constraint;
-import org.geant.shibboleth.plugin.oauth.statuslist.StatusListBucket;
-import org.geant.shibboleth.plugin.oauth.statuslist.StatusListParameters;
+import org.geant.shibboleth.plugin.openidvci.statuslist.StatusListBucket;
+import org.geant.shibboleth.plugin.openidvci.statuslist.StatusListParameters;
import org.opensaml.storage.StorageCapabilities;
import org.opensaml.storage.StorageRecord;
import org.opensaml.storage.StorageService;
@@ -53,10 +53,6 @@ import org.slf4j.LoggerFactory;
@ThreadSafeAfterInit
public class StatusListIndexAllocator extends AbstractIdentifiableInitializableComponent {
- /** Logger. */
- @Nonnull
- private final Logger log = LoggerFactory.getLogger(StatusListIndexAllocator.class);
-
/** Storage context for allocator state. */
@Nonnull
@NotEmpty
@@ -86,6 +82,10 @@ public class StatusListIndexAllocator extends AbstractIdentifiableInitializableC
@Nonnull
private static final Duration RETENTION = StatusListParameters.RETENTION;
+ /** Logger. */
+ @Nonnull
+ private final Logger log = LoggerFactory.getLogger(StatusListIndexAllocator.class);
+
/** Defensive ceiling on the number of slots one call may draw. */
private int maxSlotsPerAllocation = 1024;
diff --git a/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/oauth/statuslist/storage/StatusListStore.java b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/statuslist/storage/StatusListStore.java
similarity index 96%
rename from openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/oauth/statuslist/storage/StatusListStore.java
rename to openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/statuslist/storage/StatusListStore.java
index 9280c07..9d6fb4c 100644
--- a/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/oauth/statuslist/storage/StatusListStore.java
+++ b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/statuslist/storage/StatusListStore.java
@@ -14,7 +14,7 @@
* limitations under the License.
*/
-package org.geant.shibboleth.plugin.oauth.statuslist.storage;
+package org.geant.shibboleth.plugin.openidvci.statuslist.storage;
import java.io.IOException;
@@ -28,9 +28,9 @@ import net.shibboleth.shared.component.AbstractIdentifiableInitializableComponen
import net.shibboleth.shared.component.ComponentInitializationException;
import net.shibboleth.shared.logic.Constraint;
-import org.geant.shibboleth.plugin.oauth.statuslist.StatusListBucket;
-import org.geant.shibboleth.plugin.oauth.statuslist.StatusListCodec;
-import org.geant.shibboleth.plugin.oauth.statuslist.StatusListParameters;
+import org.geant.shibboleth.plugin.openidvci.statuslist.StatusListBucket;
+import org.geant.shibboleth.plugin.openidvci.statuslist.StatusListCodec;
+import org.geant.shibboleth.plugin.openidvci.statuslist.StatusListParameters;
import org.opensaml.storage.StorageCapabilities;
import org.opensaml.storage.StorageRecord;
import org.opensaml.storage.StorageService;
@@ -43,17 +43,13 @@ import org.slf4j.LoggerFactory;
* {@link StorageService}.
*
* A list is stored per {@link StatusListBucket} in
- * {@value org.geant.shibboleth.plugin.oauth.statuslist.StatusListParameters#CHUNKS}
+ * {@value org.geant.shibboleth.plugin.openidvci.statuslist.StatusListParameters#CHUNKS}
* pieces of fixed size, keyed by the bucket identifier and the number of the
* piece. Records expire when no credential of the bucket can be valid anymore.
*/
@ThreadSafeAfterInit
public class StatusListStore extends AbstractIdentifiableInitializableComponent {
- /** Logger. */
- @Nonnull
- private final Logger log = LoggerFactory.getLogger(StatusListStore.class);
-
/** Storage context for the lists. */
@Nonnull
@NotEmpty
@@ -62,6 +58,10 @@ public class StatusListStore extends AbstractIdentifiableInitializableComponent
/** Bounded retry cap for optimistic-update contention. */
private static final int MAX_RETRIES = 32;
+ /** Logger. */
+ @Nonnull
+ private final Logger log = LoggerFactory.getLogger(StatusListStore.class);
+
/** Backing storage for the lists. */
private StorageService storage;
diff --git a/openid-vci-api/src/main/java/org/geant/shibboleth/plugin/oauth/statuslist/StatusListBucket.java b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/statuslist/storage/package-info.java
similarity index 52%
copy from openid-vci-api/src/main/java/org/geant/shibboleth/plugin/oauth/statuslist/StatusListBucket.java
copy to openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/statuslist/storage/package-info.java
index 8a3d844..a2046e1 100644
--- a/openid-vci-api/src/main/java/org/geant/shibboleth/plugin/oauth/statuslist/StatusListBucket.java
+++ b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/statuslist/storage/package-info.java
@@ -14,21 +14,7 @@
* limitations under the License.
*/
-package org.geant.shibboleth.plugin.oauth.statuslist;
-
-import java.time.Instant;
-
-import javax.annotation.Nonnull;
-
/**
- * Immutable identity of one Status List as in
- * <a href="https://datatracker.ietf.org/doc/draft-ietf-oauth-status-list/">
- * draft-ietf-oauth-status-list</a>.
- *
- * A bucket holds credentials that all expire before the end of the bucket.
- *
- * @param id identifier, used as storage key
- * @param end upper bound for expiration of any credential in this bucket
+ * Storage of Status List index assignments.
*/
-public record StatusListBucket(@Nonnull String id, @Nonnull Instant end) {
-}
+package org.geant.shibboleth.plugin.openidvci.statuslist.storage;
diff --git a/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/storage/CredentialOfferCache.java b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/storage/CredentialOfferCache.java
index 214295e..42ae8f7 100644
--- a/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/storage/CredentialOfferCache.java
+++ b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/storage/CredentialOfferCache.java
@@ -46,9 +46,6 @@ import org.slf4j.LoggerFactory;
@ThreadSafeAfterInit
public class CredentialOfferCache extends AbstractIdentifiableInitializableComponent {
- /** Logger. */
- private final Logger log = LoggerFactory.getLogger(CredentialOfferCache.class);
-
/**
* ID of credential offer context.
*/
@@ -56,6 +53,9 @@ public class CredentialOfferCache extends AbstractIdentifiableInitializableCompo
@NotEmpty
public static final String CONTEXT_CREDENTIAL_OFFER = CredentialOfferCache.class.getName();
+ /** Logger. */
+ private final Logger log = LoggerFactory.getLogger(CredentialOfferCache.class);
+
/** Backing storage for the cache. */
private StorageService storage;
@@ -99,8 +99,8 @@ public class CredentialOfferCache extends AbstractIdentifiableInitializableCompo
* @param key key to adjust
* @return key, either original or adjusted.
*/
- private String adjustKey(@Nonnull String key) {
- StorageCapabilities caps = storage.getCapabilities();
+ private String adjustKey(@Nonnull final String key) {
+ final StorageCapabilities caps = storage.getCapabilities();
return key.length() > caps.getKeySize() ? DigestUtils.sha256Hex(key) : key;
}
@@ -114,9 +114,10 @@ public class CredentialOfferCache extends AbstractIdentifiableInitializableCompo
* @return true if stored successfully.
* @throws IOException if something went wrong with storage.
*/
- public synchronized boolean storeCredentialOffer(@Nonnull CredentialOfferObject object, @Nonnull String code,
- long expiration) throws IOException {
- String preAuthorizationKey = adjustKey(code);
+ public synchronized boolean storeCredentialOffer(@Nonnull final CredentialOfferObject object,
+ @Nonnull final String code,
+ final long expiration) throws IOException {
+ final String preAuthorizationKey = adjustKey(code);
if (!storage.create(CONTEXT_CREDENTIAL_OFFER, preAuthorizationKey, object.serialize(),
System.currentTimeMillis() + expiration)) {
log.debug("Pre-Authorization code collision for code {}", code);
@@ -135,17 +136,17 @@ public class CredentialOfferCache extends AbstractIdentifiableInitializableCompo
* @throws ParseException if CredentialOfferObject was not parsed successfully.
*/
@SuppressWarnings("rawtypes")
- public synchronized CredentialOfferObject getCredentialOffer(@Nonnull String code)
+ public synchronized CredentialOfferObject getCredentialOffer(@Nonnull final String code)
throws IOException, ParseException {
- String key = adjustKey(code);
- StorageRecord entry = storage.read(CONTEXT_CREDENTIAL_OFFER, key);
+ final String key = adjustKey(code);
+ final StorageRecord entry = storage.read(CONTEXT_CREDENTIAL_OFFER, key);
if (entry == null) {
return null;
}
try {
- CredentialOfferObject result = CredentialOfferObject.parse(entry.getValue());
+ final CredentialOfferObject result = CredentialOfferObject.parse(entry.getValue());
return result;
- } catch (com.nimbusds.oauth2.sdk.ParseException e) {
+ } catch (final com.nimbusds.oauth2.sdk.ParseException e) {
log.error("Failed parsing CredentialOfferObject", e);
}
return null;
@@ -155,13 +156,10 @@ public class CredentialOfferCache extends AbstractIdentifiableInitializableCompo
* Remove CredentialOfferObject keyed with pre-authorization code.
*
* @param code key to CredentialOfferObject.
- * @return CredentialOfferObject keyed with pre-authorization code. Null if not
- * located.
- * @throws IOException if something went wrong with storage.
- * @throws ParseException if CredentialOfferObject was not parsed successfully.
+ * @throws IOException if something went wrong with storage.
*/
- public synchronized void removeCredentialOffer(@Nonnull String code) throws IOException {
- String key = adjustKey(code);
+ public synchronized void removeCredentialOffer(@Nonnull final String code) throws IOException {
+ final String key = adjustKey(code);
storage.delete(CONTEXT_CREDENTIAL_OFFER, key);
}
diff --git a/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/storage/CredentialOfferObject.java b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/storage/CredentialOfferObject.java
index 67df0a5..d224f1d 100644
--- a/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/storage/CredentialOfferObject.java
+++ b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/storage/CredentialOfferObject.java
@@ -56,14 +56,17 @@ public class CredentialOfferObject {
* Constructor.
*
* @param clientID Client ID of the relying party
- * @param preAuthorizedCredentials Credential offer
+ * @param preAuthorizedCredentials Credentials offered in the pre-authorized code flow
+ * @param codeCredentials Credentials offered in the authorization code flow
+ * @param credentialOfferTxCode Transaction Code the wallet must present
*/
@JsonCreator
public CredentialOfferObject(
- @JsonProperty("clientID") @Nullable ClientID clientID,
- @JsonProperty("preAuthorizedCredentials") @Nullable final Map<String, CredentialOfferRequestedCredential> preAuthorizedCredentials,
+ @JsonProperty("clientID") @Nullable final ClientID clientID,
+ @JsonProperty("preAuthorizedCredentials") @Nullable
+ final Map<String, CredentialOfferRequestedCredential> preAuthorizedCredentials,
@JsonProperty("codeCredentials") @Nullable final List<String> codeCredentials,
- @JsonProperty("credentialOfferTxCode") @Nullable CredentialOfferTxCode credentialOfferTxCode) {
+ @JsonProperty("credentialOfferTxCode") @Nullable final CredentialOfferTxCode credentialOfferTxCode) {
this.clientID = clientID;
this.preAuthorizedCredentials = preAuthorizedCredentials;
this.codeCredentials = codeCredentials;
@@ -112,14 +115,21 @@ public class CredentialOfferObject {
/**
* Serialize object to json.
*
- * @return
- * @throws JsonProcessingException
+ * @return this Credential Offer as a json string
+ * @throws JsonProcessingException if serialization fails
*/
public String serialize() throws JsonProcessingException {
return new ObjectMapper().writeValueAsString(this);
}
- public static CredentialOfferObject parse(@Nonnull String request)
+ /**
+ * Parse a Credential Offer from its JSON representation.
+ *
+ * @param request JSON to parse
+ * @return parsed Credential Offer
+ * @throws JsonProcessingException if the JSON cannot be parsed
+ */
+ public static CredentialOfferObject parse(@Nonnull final String request)
throws ParseException, JsonMappingException, JsonProcessingException {
return new ObjectMapper().readValue(request, CredentialOfferObject.class);
diff --git a/openid-vci-api/src/main/java/org/geant/shibboleth/plugin/oauth/statuslist/StatusListBucket.java b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/storage/package-info.java
similarity index 52%
rename from openid-vci-api/src/main/java/org/geant/shibboleth/plugin/oauth/statuslist/StatusListBucket.java
rename to openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/storage/package-info.java
index 8a3d844..817f5be 100644
--- a/openid-vci-api/src/main/java/org/geant/shibboleth/plugin/oauth/statuslist/StatusListBucket.java
+++ b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/storage/package-info.java
@@ -14,21 +14,7 @@
* limitations under the License.
*/
-package org.geant.shibboleth.plugin.oauth.statuslist;
-
-import java.time.Instant;
-
-import javax.annotation.Nonnull;
-
/**
- * Immutable identity of one Status List as in
- * <a href="https://datatracker.ietf.org/doc/draft-ietf-oauth-status-list/">
- * draft-ietf-oauth-status-list</a>.
- *
- * A bucket holds credentials that all expire before the end of the bucket.
- *
- * @param id identifier, used as storage key
- * @param end upper bound for expiration of any credential in this bucket
+ * Storage of Credential Offers.
*/
-public record StatusListBucket(@Nonnull String id, @Nonnull Instant end) {
-}
+package org.geant.shibboleth.plugin.openidvci.storage;
diff --git a/openid-vci-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oauth/status-list/assign/assign-beans.xml b/openid-vci-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oauth/status-list/assign/assign-beans.xml
index 3c55919..efe384e 100644
--- a/openid-vci-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oauth/status-list/assign/assign-beans.xml
+++ b/openid-vci-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oauth/status-list/assign/assign-beans.xml
@@ -12,14 +12,14 @@
default-init-method="initialize" default-destroy-method="destroy">
<bean id="oauth.StatusListIndexAllocator"
- class="org.geant.shibboleth.plugin.oauth.statuslist.storage.StatusListIndexAllocator"
+ class="org.geant.shibboleth.plugin.openidvci.statuslist.storage.StatusListIndexAllocator"
depends-on="shibboleth.LoggingService"
p:id="oauth.StatusListIndexAllocator"
p:storage-ref="#{'%{oauth.StatusListIndexAllocator:shibboleth.StorageService}'.trim()}"
p:permutationKey="%{oauth.statuslist.indexPermutationKey:}" />
<bean id="AllocateIndex"
- class="org.geant.shibboleth.plugin.oauth.statuslist.profile.impl.AllocateIndex"
+ class="org.geant.shibboleth.plugin.openidvci.statuslist.profile.impl.AllocateIndex"
scope="prototype"
p:statusListAllocator-ref="oauth.StatusListIndexAllocator"
p:httpServletRequestSupplier-ref="shibboleth.HttpServletRequestSupplier">
@@ -32,14 +32,14 @@
</bean>
<bean id="oauth.StatusListAssignmentStore"
- class="org.geant.shibboleth.plugin.oauth.statuslist.storage.StatusListAssignmentStore"
+ class="org.geant.shibboleth.plugin.openidvci.statuslist.storage.StatusListAssignmentStore"
depends-on="shibboleth.LoggingService"
p:id="oauth.StatusListAssignmentStore"
p:retention="%{oauth.statuslist.assignmentRetention:P7D}"
p:storage-ref="#{'%{oauth.StatusListAssignmentStore:shibboleth.StorageService}'.trim()}" />
<bean id="AssignIndex"
- class="org.geant.shibboleth.plugin.oauth.statuslist.profile.impl.AssignIndex"
+ class="org.geant.shibboleth.plugin.openidvci.statuslist.profile.impl.AssignIndex"
scope="prototype"
p:statusListAssignmentStore-ref="oauth.StatusListAssignmentStore">
<property name="expirationLookupStrategy">
diff --git a/openid-vci-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oauth/status-list/assignments/assignments-beans.xml b/openid-vci-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oauth/status-list/assignments/assignments-beans.xml
index 520dfa2..bde4ace 100644
--- a/openid-vci-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oauth/status-list/assignments/assignments-beans.xml
+++ b/openid-vci-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oauth/status-list/assignments/assignments-beans.xml
@@ -16,7 +16,7 @@
<bean id="DecodeMessage" class="org.opensaml.profile.action.impl.DecodeMessage" scope="prototype">
<constructor-arg>
- <bean class="org.geant.shibboleth.plugin.oauth.statuslist.decoding.impl.StatusListAssignmentsRequestDecoder"
+ <bean class="org.geant.shibboleth.plugin.openidvci.statuslist.decoding.impl.StatusListAssignmentsRequestDecoder"
scope="prototype" p:httpServletRequestSupplier-ref="shibboleth.HttpServletRequestSupplier" />
</constructor-arg>
</bean>
@@ -29,14 +29,14 @@
class="net.shibboleth.idp.plugin.oidc.op.messaging.context.navigate.TokenRequestClientIDLookupFunction" />
<bean id="oauth.StatusListAssignmentStore"
- class="org.geant.shibboleth.plugin.oauth.statuslist.storage.StatusListAssignmentStore"
+ class="org.geant.shibboleth.plugin.openidvci.statuslist.storage.StatusListAssignmentStore"
depends-on="shibboleth.LoggingService"
p:id="oauth.StatusListAssignmentStore"
p:retention="%{oauth.statuslist.assignmentRetention:P7D}"
p:storage-ref="#{'%{oauth.StatusListAssignmentStore:shibboleth.StorageService}'.trim()}" />
<bean id="FormOutboundMessage"
- class="org.geant.shibboleth.plugin.oauth.statuslist.profile.impl.FormOutboundStatusListAssignmentsResponseMessage"
+ class="org.geant.shibboleth.plugin.openidvci.statuslist.profile.impl.FormOutboundStatusListAssignmentsResponseMessage"
scope="prototype"
p:statusListAssignmentStore-ref="oauth.StatusListAssignmentStore" />
diff --git a/openid-vci-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oauth/status-list/list/list-beans.xml b/openid-vci-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oauth/status-list/list/list-beans.xml
index 135a6cf..655c8e6 100644
--- a/openid-vci-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oauth/status-list/list/list-beans.xml
+++ b/openid-vci-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oauth/status-list/list/list-beans.xml
@@ -22,7 +22,7 @@
c:strategy-ref="shibboleth.MessageContextLookup.Outbound">
<property name="configurationLookupStrategy">
<bean lazy-init="true"
- class="org.geant.shibboleth.plugin.oauth.statuslist.config.navigate.StatusListSignatureSigningConfigurationLookupFunction" />
+ class="org.geant.shibboleth.plugin.openidvci.statuslist.profile.config.navigate.StatusListSignatureSigningConfigurationLookupFunction" />
</property>
<!--
Status List Token is signed with issuer's own key. Basic resolver is used, client
@@ -35,17 +35,17 @@
</bean>
<bean id="openidvci.IssuerLookupStrategy"
- class="org.geant.shibboleth.plugin.oauth.profile.logic.CredentialIssuerLookupFunction"
+ class="org.geant.shibboleth.plugin.openidvci.profile.logic.CredentialIssuerLookupFunction"
p:issuer="%{openidvci.issuer:}" />
<bean id="oauth.StatusListStore"
- class="org.geant.shibboleth.plugin.oauth.statuslist.storage.StatusListStore"
+ class="org.geant.shibboleth.plugin.openidvci.statuslist.storage.StatusListStore"
depends-on="shibboleth.LoggingService"
p:id="oauth.StatusListStore"
p:storage-ref="#{'%{oauth.StatusListStore:shibboleth.StorageService}'.trim()}" />
<bean id="FormStatusListToken"
- class="org.geant.shibboleth.plugin.oauth.statuslist.profile.impl.FormStatusListToken"
+ class="org.geant.shibboleth.plugin.openidvci.statuslist.profile.impl.FormStatusListToken"
scope="prototype"
p:statusListStore-ref="oauth.StatusListStore"
p:ttl="%{oauth.statuslist.ttl:PT1H}"
@@ -53,11 +53,11 @@
p:httpServletRequestSupplier-ref="shibboleth.HttpServletRequestSupplier" />
<bean id="SignStatusListToken"
- class="org.geant.shibboleth.plugin.oauth.statuslist.profile.impl.SignStatusListToken"
+ class="org.geant.shibboleth.plugin.openidvci.statuslist.profile.impl.SignStatusListToken"
scope="prototype" />
<bean id="FormOutboundMessage"
- class="org.geant.shibboleth.plugin.oauth.statuslist.profile.impl.FormOutboundStatusListResponseMessage"
+ class="org.geant.shibboleth.plugin.openidvci.statuslist.profile.impl.FormOutboundStatusListResponseMessage"
scope="prototype" />
<bean id="BuildErrorResponseFromEvent" class="net.shibboleth.oidc.profile.impl.BuildJSONErrorResponseFromEvent"
scope="prototype" p:defaultStatusCode="400" p:defaultCode="invalid_request"
@@ -68,10 +68,10 @@
<property name="mappedErrors">
<map value-type="com.nimbusds.oauth2.sdk.ErrorObject">
<!-- Unknown list is 404 and a retired list is 410, so a verifier can tell them apart. -->
- <entry key="#{T(org.geant.shibboleth.plugin.oauth.statuslist.profile.StatusListEventIds).NO_STATUS_LIST}"
- value="#{T(org.geant.shibboleth.plugin.oauth.statuslist.messaging.error.StatusListError).UNKNOWN_STATUS_LIST}" />
- <entry key="#{T(org.geant.shibboleth.plugin.oauth.statuslist.profile.StatusListEventIds).STATUS_LIST_RETIRED}"
- value="#{T(org.geant.shibboleth.plugin.oauth.statuslist.messaging.error.StatusListError).RETIRED_STATUS_LIST}" />
+ <entry key="#{T(org.geant.shibboleth.plugin.openidvci.statuslist.profile.StatusListEventIds).NO_STATUS_LIST}"
+ value="#{T(org.geant.shibboleth.plugin.openidvci.statuslist.messaging.error.StatusListError).UNKNOWN_STATUS_LIST}" />
+ <entry key="#{T(org.geant.shibboleth.plugin.openidvci.statuslist.profile.StatusListEventIds).STATUS_LIST_RETIRED}"
+ value="#{T(org.geant.shibboleth.plugin.openidvci.statuslist.messaging.error.StatusListError).RETIRED_STATUS_LIST}" />
<entry key="#{T(org.opensaml.profile.action.EventIds).IO_ERROR}"
value="#{T(com.nimbusds.oauth2.sdk.OAuth2Error).SERVER_ERROR}" />
</map>
diff --git a/openid-vci-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oauth/status-list/revoke/revoke-beans.xml b/openid-vci-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oauth/status-list/revoke/revoke-beans.xml
index 10deaed..eb4daf0 100644
--- a/openid-vci-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oauth/status-list/revoke/revoke-beans.xml
+++ b/openid-vci-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oauth/status-list/revoke/revoke-beans.xml
@@ -16,7 +16,7 @@
<bean id="DecodeMessage" class="org.opensaml.profile.action.impl.DecodeMessage" scope="prototype">
<constructor-arg>
- <bean class="org.geant.shibboleth.plugin.oauth.statuslist.decoding.impl.StatusListRevokeRequestDecoder"
+ <bean class="org.geant.shibboleth.plugin.openidvci.statuslist.decoding.impl.StatusListRevokeRequestDecoder"
scope="prototype" p:httpServletRequestSupplier-ref="shibboleth.HttpServletRequestSupplier" />
</constructor-arg>
</bean>
@@ -29,18 +29,18 @@
class="net.shibboleth.idp.plugin.oidc.op.messaging.context.navigate.TokenRequestClientIDLookupFunction" />
<bean id="oauth.StatusListStore"
- class="org.geant.shibboleth.plugin.oauth.statuslist.storage.StatusListStore"
+ class="org.geant.shibboleth.plugin.openidvci.statuslist.storage.StatusListStore"
depends-on="shibboleth.LoggingService"
p:id="oauth.StatusListStore"
p:storage-ref="#{'%{oauth.StatusListStore:shibboleth.StorageService}'.trim()}" />
<bean id="RevokeStatusListIndex"
- class="org.geant.shibboleth.plugin.oauth.statuslist.profile.impl.RevokeStatusListIndex"
+ class="org.geant.shibboleth.plugin.openidvci.statuslist.profile.impl.RevokeStatusListIndex"
scope="prototype"
p:statusListStore-ref="oauth.StatusListStore" />
<bean id="FormOutboundMessage"
- class="org.geant.shibboleth.plugin.oauth.statuslist.profile.impl.FormOutboundStatusListRevokeResponseMessage"
+ class="org.geant.shibboleth.plugin.openidvci.statuslist.profile.impl.FormOutboundStatusListRevokeResponseMessage"
scope="prototype" />
<bean id="BuildErrorResponseFromEvent" class="net.shibboleth.oidc.profile.impl.BuildJSONErrorResponseFromEvent"
diff --git a/openid-vci-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/openid/vci/credentials/credentials-beans.xml b/openid-vci-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/openid/vci/credentials/credentials-beans.xml
index d4cb317..6ede675 100644
--- a/openid-vci-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/openid/vci/credentials/credentials-beans.xml
+++ b/openid-vci-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/openid/vci/credentials/credentials-beans.xml
@@ -21,7 +21,7 @@
</bean>
<bean id="ParseAccessToken"
- class="org.geant.shibboleth.plugin.openidvci.profile.impl.stolen.ParseAccessToken" scope="prototype"
+ class="org.geant.shibboleth.plugin.openidvci.profile.impl.ParseAccessToken" scope="prototype"
p:dataSealer-ref="#{'%{idp.oidc.tokenSealer:shibboleth.oidc.TokenSealer}'.trim()}"
p:credentialResolver-ref="RelyingPartyCredentialResolver">
<property name="dpopAccessTokenCondition">
@@ -65,7 +65,7 @@
c:strategy-ref="shibboleth.MessageContextLookup.Inbound"
p:securityParametersContextLookupStrategy-ref="ProofSecurityParametersContextProfileRequestContextLookup">
<property name="configurationLookupStrategy">
- <bean class="org.geant.shibboleth.plugin.openidvci.config.navigate.ProofSignatureValidationConfigurationLookupFunction" />
+ <bean class="org.geant.shibboleth.plugin.openidvci.profile.config.navigate.ProofSignatureValidationConfigurationLookupFunction" />
</property>
<property name="signatureValidationParametersResolver">
<bean class="net.shibboleth.oidc.security.jose.impl.BasicSignatureValidationParametersResolver" />
@@ -83,7 +83,7 @@
<bean class="org.opensaml.messaging.handler.impl.BasicMessageHandlerChain">
<property name="handlers">
<list>
- <bean class="org.geant.shibboleth.plugin.openidvci.security.JWTMessageSignaturesSecurityHandler"
+ <bean class="org.geant.shibboleth.plugin.openidvci.security.impl.JWTMessageSignaturesSecurityHandler"
scope="prototype"
p:securityParametersContextLookupStrategy-ref="ProofSecurityParametersContextMessageContextLookup">
<property name="jwtTokenLookupStrategy">
@@ -115,7 +115,7 @@
c:strategy-ref="shibboleth.MessageContextLookup.Inbound">
<property name="configurationLookupStrategy">
<bean lazy-init="true"
- class="org.geant.shibboleth.plugin.openidvci.config.navigate.CredentialSignatureSigningConfigurationLookupFunction" />
+ class="org.geant.shibboleth.plugin.openidvci.profile.config.navigate.CredentialSignatureSigningConfigurationLookupFunction" />
</property>
<!--
Credential is signed with issuer's own key. Basic resolver is used, client
@@ -137,7 +137,7 @@
scope="prototype" />
<bean id="openidvci.IssuerLookupStrategy"
- class="org.geant.shibboleth.plugin.oauth.profile.logic.CredentialIssuerLookupFunction"
+ class="org.geant.shibboleth.plugin.openidvci.profile.logic.CredentialIssuerLookupFunction"
p:issuer="%{openidvci.issuer:}" />
<bean id="AddCredentialShell" class="org.geant.shibboleth.plugin.openidvci.profile.impl.AddCredentialShell"
diff --git a/openid-vci-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/openid/vci/issuer-metadata/issuer-metadata-beans.xml b/openid-vci-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/openid/vci/issuer-metadata/issuer-metadata-beans.xml
index 3d95bc9..d238566 100644
--- a/openid-vci-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/openid/vci/issuer-metadata/issuer-metadata-beans.xml
+++ b/openid-vci-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/openid/vci/issuer-metadata/issuer-metadata-beans.xml
@@ -23,7 +23,7 @@
c:strategy-ref="shibboleth.MessageContextLookup.Outbound">
<property name="configurationLookupStrategy">
<bean lazy-init="true"
- class="org.geant.shibboleth.plugin.openidvci.config.navigate.IssuerMetadataSignatureSigningConfigurationLookupFunction" />
+ class="org.geant.shibboleth.plugin.openidvci.profile.config.navigate.IssuerMetadataSignatureSigningConfigurationLookupFunction" />
</property>
<!-- Metadata is signed with the issuer's own key, there is no client to have one. -->
<property name="signatureSigningParametersResolver">
diff --git a/openid-vci-impl/src/main/resources/META-INF/net/shibboleth/idp/service/relying-party/postconfig.xml b/openid-vci-impl/src/main/resources/META-INF/net/shibboleth/idp/service/relying-party/postconfig.xml
index 7d055b4..32e4956 100644
--- a/openid-vci-impl/src/main/resources/META-INF/net/shibboleth/idp/service/relying-party/postconfig.xml
+++ b/openid-vci-impl/src/main/resources/META-INF/net/shibboleth/idp/service/relying-party/postconfig.xml
@@ -37,36 +37,36 @@
p:proofClaimsValidator="#{getObject('openidvci.DefaultProofBodyClaimsValidator')}" />
<bean id="OpenID.VCI.CredentialOffer" parent="AbstractVCIProfile" lazy-init="true"
- class="org.geant.shibboleth.plugin.openidvci.config.impl.DefaultOpenIDVCICredentialOfferConfiguration" />
+ class="org.geant.shibboleth.plugin.openidvci.profile.config.impl.DefaultOpenIDVCICredentialOfferConfiguration" />
<bean id="OpenID.VCI.Token" parent="AbstractVCIProfile" lazy-init="true"
- class="org.geant.shibboleth.plugin.openidvci.config.impl.DefaultOpenIDVCITokenConfiguration" />
+ class="org.geant.shibboleth.plugin.openidvci.profile.config.impl.DefaultOpenIDVCITokenConfiguration" />
<bean id="OpenID.VCI.Nonce" parent="AbstractVCIProfile" lazy-init="true"
- class="org.geant.shibboleth.plugin.openidvci.config.impl.DefaultOpenIDVCINonceConfiguration" />
+ class="org.geant.shibboleth.plugin.openidvci.profile.config.impl.DefaultOpenIDVCINonceConfiguration" />
<bean id="OpenID.VCI.Credentials" parent="AbstractVCIProfile" lazy-init="true"
- class="org.geant.shibboleth.plugin.openidvci.config.impl.DefaultOpenIDVCICredentialsConfiguration" />
+ class="org.geant.shibboleth.plugin.openidvci.profile.config.impl.DefaultOpenIDVCICredentialsConfiguration" />
<!--
Endpoint publishing Credential Issuer metadata. Serves wallets before there is a
client, so there is nothing of the VCI profile settings to inherit here.
-->
<bean id="OpenID.VCI.IssuerMetadata" lazy-init="true"
- class="org.geant.shibboleth.plugin.openidvci.config.impl.DefaultOpenIDVCIIssuerMetadataConfiguration"
+ class="org.geant.shibboleth.plugin.openidvci.profile.config.impl.DefaultOpenIDVCIIssuerMetadataConfiguration"
p:securityConfiguration-ref="%{idp.security.oidc.config:shibboleth.oidc.DefaultSecurityConfiguration}"
p:issuerMetadataSignatureSigningConfiguration-ref="openidvci.issuerMetadata.SigningConfiguration" />
<bean id="OAuth.StatusList" lazy-init="true"
- class="org.geant.shibboleth.plugin.oauth.statuslist.config.DefaultStatusListConfiguration"
+ class="org.geant.shibboleth.plugin.openidvci.statuslist.profile.config.impl.DefaultStatusListConfiguration"
p:securityConfiguration-ref="%{idp.security.oidc.config:shibboleth.oidc.DefaultSecurityConfiguration}"
p:statusListSignatureSigningConfiguration="#{getObject('oauth.statuslist.SigningConfiguration')}" />
<bean id="OAuth.StatusList.Revoke" parent="AbstractVCIProfile" lazy-init="true"
- class="org.geant.shibboleth.plugin.oauth.statuslist.config.DefaultStatusListRevokeConfiguration" />
+ class="org.geant.shibboleth.plugin.openidvci.statuslist.profile.config.impl.DefaultStatusListRevokeConfiguration" />
<bean id="OAuth.StatusList.Assignments" parent="AbstractVCIProfile" lazy-init="true"
- class="org.geant.shibboleth.plugin.oauth.statuslist.config.DefaultStatusListAssignmentsConfiguration" />
+ class="org.geant.shibboleth.plugin.openidvci.statuslist.profile.config.impl.DefaultStatusListAssignmentsConfiguration" />
<!-- The generator does not tie client id to nonce to accomodate unprotected Nonce endpoint. -->
<bean id="openidvci.DefaultOpenIDVCINonceGenerator" parent="DefaultOAuth2DPoPNonceGenerator" lazy-init="true"
@@ -85,7 +85,7 @@
p:claimValidators-ref="openidvci.ProofBodyClaimsValidator" />
<bean id="openidvci.ProofNonceGeneratorLookupFunction"
- class="org.geant.shibboleth.plugin.openidvci.config.navigate.ProofNonceGeneratorLookupFunction" />
+ class="org.geant.shibboleth.plugin.openidvci.profile.config.navigate.ProofNonceGeneratorLookupFunction" />
<util:list id="openidvci.ProofBodyClaimsValidator" value-type="net.shibboleth.oidc.jwt.claims.ClaimsValidator">
<bean id="openidvci.ProofNonceValidator"
@@ -133,7 +133,7 @@
p:signatureTrustEngine-ref="openidvci.TokenKeyTrustEngineForProofJWT"/>
<bean id="openidvci.TokenKeyTrustEngineForProofJWT"
- class="org.geant.shibboleth.plugin.openidvci.security.TokenKeyTrustEngine">
+ class="org.geant.shibboleth.plugin.openidvci.security.impl.TokenKeyTrustEngine">
<constructor-arg>
<bean class="org.geant.shibboleth.plugin.openidvci.security.credential.impl.ExtendedJOSEObjectCredentialResolver"/>
</constructor-arg>
diff --git a/openid-vci-impl/src/test/java/org/geant/shibboleth/plugin/openidvci/util/SelectiveDisclosureClaimSetUtilTest.java b/openid-vci-impl/src/test/java/org/geant/shibboleth/plugin/openidvci/credential/impl/SelectiveDisclosureClaimSetUtilTest.java
similarity index 94%
rename from openid-vci-impl/src/test/java/org/geant/shibboleth/plugin/openidvci/util/SelectiveDisclosureClaimSetUtilTest.java
rename to openid-vci-impl/src/test/java/org/geant/shibboleth/plugin/openidvci/credential/impl/SelectiveDisclosureClaimSetUtilTest.java
index 50d5b99..5524df7 100644
--- a/openid-vci-impl/src/test/java/org/geant/shibboleth/plugin/openidvci/util/SelectiveDisclosureClaimSetUtilTest.java
+++ b/openid-vci-impl/src/test/java/org/geant/shibboleth/plugin/openidvci/credential/impl/SelectiveDisclosureClaimSetUtilTest.java
@@ -14,7 +14,7 @@
* limitations under the License.
*/
-package org.geant.shibboleth.plugin.openidvci.util;
+package org.geant.shibboleth.plugin.openidvci.credential.impl;
import java.nio.charset.StandardCharsets;
import java.security.MessageDigest;
@@ -165,9 +165,9 @@ public class SelectiveDisclosureClaimSetUtilTest {
for (final String disclosure : util.getFormattedDisclosures().split("~")) {
final String expected = Base64.getUrlEncoder().withoutPadding()
.encodeToString(digest.digest(disclosure.getBytes(StandardCharsets.UTF_8)));
- Assert.assertTrue(util.get_sd().contains(expected), "Missing digest of disclosure " + disclosure);
+ Assert.assertTrue(util.getSd().contains(expected), "Missing digest of disclosure " + disclosure);
}
- Assert.assertEquals(util.get_sd().size(), 3);
+ Assert.assertEquals(util.getSd().size(), 3);
}
@Test
@@ -180,9 +180,9 @@ public class SelectiveDisclosureClaimSetUtilTest {
claims.put("birthdate", "1940-01-01");
final SelectiveDisclosureClaimSetUtil util = new SelectiveDisclosureClaimSetUtil(claims);
- final List<String> sorted = new ArrayList<>(util.get_sd());
+ final List<String> sorted = new ArrayList<>(util.getSd());
sorted.sort(null);
- Assert.assertEquals(util.get_sd(), sorted);
+ Assert.assertEquals(util.getSd(), sorted);
}
@Test
@@ -221,19 +221,19 @@ public class SelectiveDisclosureClaimSetUtilTest {
final SelectiveDisclosureClaimSetUtil util = new SelectiveDisclosureClaimSetUtil(claims);
Assert.assertEquals(util.getFormattedDisclosures().split("~").length, 4);
- Assert.assertEquals(util.get_sd().size(), 4);
+ Assert.assertEquals(util.getSd().size(), 4);
}
@Test
public void testDefaultAlgorithm() {
- Assert.assertEquals(new SelectiveDisclosureClaimSetUtil(Map.<String, Object>of("given_name", "John")).get_alg(),
+ Assert.assertEquals(new SelectiveDisclosureClaimSetUtil(Map.<String, Object>of("given_name", "John")).getAlg(),
"sha-256");
}
@Test
public void testAlgorithmIsLowerCased() {
Assert.assertEquals(
- new SelectiveDisclosureClaimSetUtil(Map.<String, Object>of("given_name", "John"), "SHA-512").get_alg(),
+ new SelectiveDisclosureClaimSetUtil(Map.<String, Object>of("given_name", "John"), "SHA-512").getAlg(),
"sha-512");
}
@@ -245,7 +245,7 @@ public class SelectiveDisclosureClaimSetUtilTest {
final String disclosure = util.getFormattedDisclosures();
final String expected = Base64.getUrlEncoder().withoutPadding().encodeToString(
MessageDigest.getInstance("SHA-512").digest(disclosure.getBytes(StandardCharsets.UTF_8)));
- Assert.assertEquals(util.get_sd().get(0), expected);
+ Assert.assertEquals(util.getSd().get(0), expected);
}
@Test(expectedExceptions = IllegalArgumentException.class)
@@ -256,7 +256,7 @@ public class SelectiveDisclosureClaimSetUtilTest {
@Test
public void testNoClaims() {
final SelectiveDisclosureClaimSetUtil util = new SelectiveDisclosureClaimSetUtil(Map.of());
- Assert.assertTrue(util.get_sd().isEmpty());
+ Assert.assertTrue(util.getSd().isEmpty());
Assert.assertEquals(util.getFormattedDisclosures(), "");
}
}
diff --git a/openid-vci-impl/src/test/java/org/geant/shibboleth/plugin/openidvci/util/SelectiveDisclosureClaimTreeTest.java b/openid-vci-impl/src/test/java/org/geant/shibboleth/plugin/openidvci/credential/impl/SelectiveDisclosureClaimTreeTest.java
similarity index 99%
rename from openid-vci-impl/src/test/java/org/geant/shibboleth/plugin/openidvci/util/SelectiveDisclosureClaimTreeTest.java
rename to openid-vci-impl/src/test/java/org/geant/shibboleth/plugin/openidvci/credential/impl/SelectiveDisclosureClaimTreeTest.java
index afcaf0f..3f328af 100644
--- a/openid-vci-impl/src/test/java/org/geant/shibboleth/plugin/openidvci/util/SelectiveDisclosureClaimTreeTest.java
+++ b/openid-vci-impl/src/test/java/org/geant/shibboleth/plugin/openidvci/credential/impl/SelectiveDisclosureClaimTreeTest.java
@@ -14,7 +14,7 @@
* limitations under the License.
*/
-package org.geant.shibboleth.plugin.openidvci.util;
+package org.geant.shibboleth.plugin.openidvci.credential.impl;
import java.nio.charset.StandardCharsets;
import java.util.ArrayList;
diff --git a/openid-vci-impl/src/test/java/org/geant/shibboleth/plugin/openidvci/messaging/impl/OpenIDVCITokenRequestTest.java b/openid-vci-impl/src/test/java/org/geant/shibboleth/plugin/openidvci/messaging/impl/OpenIDVCITokenRequestTest.java
index e56cf9a..0002459 100644
--- a/openid-vci-impl/src/test/java/org/geant/shibboleth/plugin/openidvci/messaging/impl/OpenIDVCITokenRequestTest.java
+++ b/openid-vci-impl/src/test/java/org/geant/shibboleth/plugin/openidvci/messaging/impl/OpenIDVCITokenRequestTest.java
@@ -55,7 +55,7 @@ public class OpenIDVCITokenRequestTest {
public void testGetters() throws MessageDecodingException {
Assert.assertEquals("clientID", message.getClientID().getValue());
Assert.assertEquals("123456", message.getPreAuthorizedCode());
- Assert.assertEquals(OpenIDVCITokenRequest.grantTypeValuePreAuth, message.getGrantType());
+ Assert.assertEquals(OpenIDVCITokenRequest.GRANT_TYPE_VALUE_PRE_AUTH, message.getGrantType());
Assert.assertNull(message.getClientAuthentication());
Assert.assertEquals("http://example.com", message.getEndpointURI().toString());
Assert.assertEquals("txCodeValue", message.getTxCode());
@@ -92,17 +92,17 @@ public class OpenIDVCITokenRequestTest {
// @Test(expectedExceptions = IllegalArgumentException.class)
public void testMissingCode() throws MessageDecodingException, URISyntaxException {
message = new OpenIDVCITokenRequest(new URI("http://example.com"), new ClientID("clientID"),
- OpenIDVCITokenRequest.grantTypeValuePreAuth, null, null, null, null, null, null);
+ OpenIDVCITokenRequest.GRANT_TYPE_VALUE_PRE_AUTH, null, null, null, null, null, null);
}
// @Test
public void testClientAuthnGetters() throws MessageDecodingException, ParseException, URISyntaxException {
ClientAuthentication clientAuth = new ClientSecretBasic(new ClientID("clientID"), new Secret());
message = new OpenIDVCITokenRequest(new URI("http://example.com"), clientAuth,
- OpenIDVCITokenRequest.grantTypeValuePreAuth, "123456", null, null, null, null, null);
+ OpenIDVCITokenRequest.GRANT_TYPE_VALUE_PRE_AUTH, "123456", null, null, null, null, null);
Assert.assertNull(message.getClientID());
Assert.assertEquals("123456", message.getPreAuthorizedCode());
- Assert.assertEquals(OpenIDVCITokenRequest.grantTypeValuePreAuth, message.getGrantType());
+ Assert.assertEquals(OpenIDVCITokenRequest.GRANT_TYPE_VALUE_PRE_AUTH, message.getGrantType());
Assert.assertEquals("clientID", message.getClientAuthentication().getClientID().getValue());
Assert.assertEquals("http://example.com", message.getEndpointURI().toString());
}
diff --git a/openid-vci-impl/src/test/java/org/geant/shibboleth/plugin/openidvci/profile/impl/ValidateExpectedGrantTypeTest.java b/openid-vci-impl/src/test/java/org/geant/shibboleth/plugin/openidvci/profile/impl/ValidateExpectedGrantTypeTest.java
index d71c6d6..751246e 100644
--- a/openid-vci-impl/src/test/java/org/geant/shibboleth/plugin/openidvci/profile/impl/ValidateExpectedGrantTypeTest.java
+++ b/openid-vci-impl/src/test/java/org/geant/shibboleth/plugin/openidvci/profile/impl/ValidateExpectedGrantTypeTest.java
@@ -65,7 +65,7 @@ public class ValidateExpectedGrantTypeTest {
metaData = new OIDCClientMetadata();
Set<GrantType> grantTypes = new HashSet<GrantType>();
grantTypes.add(GrantType.parse("refresh_token"));
- grantTypes.add(GrantType.parse(OpenIDVCITokenRequest.grantTypeValuePreAuth));
+ grantTypes.add(GrantType.parse(OpenIDVCITokenRequest.GRANT_TYPE_VALUE_PRE_AUTH));
metaData.setGrantTypes(grantTypes);
OIDCClientInformation information =
new OIDCClientInformation(new ClientID("test"), null, metaData, null, null, null);
diff --git a/openid-vci-impl/src/test/java/org/geant/shibboleth/plugin/oauth/profile/logic/CredentialIssuerLookupFunctionTest.java b/openid-vci-impl/src/test/java/org/geant/shibboleth/plugin/openidvci/profile/logic/CredentialIssuerLookupFunctionTest.java
similarity index 97%
rename from openid-vci-impl/src/test/java/org/geant/shibboleth/plugin/oauth/profile/logic/CredentialIssuerLookupFunctionTest.java
rename to openid-vci-impl/src/test/java/org/geant/shibboleth/plugin/openidvci/profile/logic/CredentialIssuerLookupFunctionTest.java
index 8bf475c..063e0f7 100644
--- a/openid-vci-impl/src/test/java/org/geant/shibboleth/plugin/oauth/profile/logic/CredentialIssuerLookupFunctionTest.java
+++ b/openid-vci-impl/src/test/java/org/geant/shibboleth/plugin/openidvci/profile/logic/CredentialIssuerLookupFunctionTest.java
@@ -14,7 +14,7 @@
* limitations under the License.
*/
-package org.geant.shibboleth.plugin.oauth.profile.logic;
+package org.geant.shibboleth.plugin.openidvci.profile.logic;
import java.security.interfaces.ECPublicKey;
diff --git a/openid-vci-impl/src/test/java/org/geant/shibboleth/plugin/oauth/security/DidJwkSupportTest.java b/openid-vci-impl/src/test/java/org/geant/shibboleth/plugin/openidvci/security/impl/DidJwkSupportTest.java
similarity index 98%
rename from openid-vci-impl/src/test/java/org/geant/shibboleth/plugin/oauth/security/DidJwkSupportTest.java
rename to openid-vci-impl/src/test/java/org/geant/shibboleth/plugin/openidvci/security/impl/DidJwkSupportTest.java
index 70cc2f5..1703a34 100644
--- a/openid-vci-impl/src/test/java/org/geant/shibboleth/plugin/oauth/security/DidJwkSupportTest.java
+++ b/openid-vci-impl/src/test/java/org/geant/shibboleth/plugin/openidvci/security/impl/DidJwkSupportTest.java
@@ -14,7 +14,7 @@
* limitations under the License.
*/
-package org.geant.shibboleth.plugin.oauth.security;
+package org.geant.shibboleth.plugin.openidvci.security.impl;
import org.testng.Assert;
import org.testng.annotations.BeforeMethod;
diff --git a/openid-vci-impl/src/test/java/org/geant/shibboleth/plugin/oauth/statuslist/StatusListCodecTest.java b/openid-vci-impl/src/test/java/org/geant/shibboleth/plugin/openidvci/statuslist/StatusListCodecTest.java
similarity index 99%
rename from openid-vci-impl/src/test/java/org/geant/shibboleth/plugin/oauth/statuslist/StatusListCodecTest.java
rename to openid-vci-impl/src/test/java/org/geant/shibboleth/plugin/openidvci/statuslist/StatusListCodecTest.java
index 1fb44a0..3e1d11c 100644
--- a/openid-vci-impl/src/test/java/org/geant/shibboleth/plugin/oauth/statuslist/StatusListCodecTest.java
+++ b/openid-vci-impl/src/test/java/org/geant/shibboleth/plugin/openidvci/statuslist/StatusListCodecTest.java
@@ -14,7 +14,7 @@
* limitations under the License.
*/
-package org.geant.shibboleth.plugin.oauth.statuslist;
+package org.geant.shibboleth.plugin.openidvci.statuslist;
import java.io.ByteArrayOutputStream;
import java.util.zip.Inflater;
diff --git a/openid-vci-impl/src/test/java/org/geant/shibboleth/plugin/oauth/statuslist/profile/impl/AllocateIndexTest.java b/openid-vci-impl/src/test/java/org/geant/shibboleth/plugin/openidvci/statuslist/profile/impl/AllocateIndexTest.java
similarity index 97%
rename from openid-vci-impl/src/test/java/org/geant/shibboleth/plugin/oauth/statuslist/profile/impl/AllocateIndexTest.java
rename to openid-vci-impl/src/test/java/org/geant/shibboleth/plugin/openidvci/statuslist/profile/impl/AllocateIndexTest.java
index 5a6afd5..d43a2aa 100644
--- a/openid-vci-impl/src/test/java/org/geant/shibboleth/plugin/oauth/statuslist/profile/impl/AllocateIndexTest.java
+++ b/openid-vci-impl/src/test/java/org/geant/shibboleth/plugin/openidvci/statuslist/profile/impl/AllocateIndexTest.java
@@ -14,16 +14,16 @@
* limitations under the License.
*/
-package org.geant.shibboleth.plugin.oauth.statuslist.profile.impl;
+package org.geant.shibboleth.plugin.openidvci.statuslist.profile.impl;
import java.io.IOException;
import java.time.Instant;
import java.util.HashSet;
import java.util.List;
-import org.geant.shibboleth.plugin.oauth.statuslist.StatusListBucket;
-import org.geant.shibboleth.plugin.oauth.statuslist.context.StatusListContext;
-import org.geant.shibboleth.plugin.oauth.statuslist.storage.StatusListIndexAllocator;
+import org.geant.shibboleth.plugin.openidvci.statuslist.StatusListBucket;
+import org.geant.shibboleth.plugin.openidvci.statuslist.context.StatusListContext;
+import org.geant.shibboleth.plugin.openidvci.statuslist.storage.StatusListIndexAllocator;
import org.opensaml.messaging.context.MessageContext;
import org.opensaml.profile.action.EventIds;
import org.opensaml.profile.context.ProfileRequestContext;
diff --git a/openid-vci-impl/src/test/java/org/geant/shibboleth/plugin/oauth/statuslist/storage/FeistelIndexPermutationTest.java b/openid-vci-impl/src/test/java/org/geant/shibboleth/plugin/openidvci/statuslist/storage/FeistelIndexPermutationTest.java
similarity index 97%
rename from openid-vci-impl/src/test/java/org/geant/shibboleth/plugin/oauth/statuslist/storage/FeistelIndexPermutationTest.java
rename to openid-vci-impl/src/test/java/org/geant/shibboleth/plugin/openidvci/statuslist/storage/FeistelIndexPermutationTest.java
index acefc37..f521281 100644
--- a/openid-vci-impl/src/test/java/org/geant/shibboleth/plugin/oauth/statuslist/storage/FeistelIndexPermutationTest.java
+++ b/openid-vci-impl/src/test/java/org/geant/shibboleth/plugin/openidvci/statuslist/storage/FeistelIndexPermutationTest.java
@@ -14,13 +14,13 @@
* limitations under the License.
*/
-package org.geant.shibboleth.plugin.oauth.statuslist.storage;
+package org.geant.shibboleth.plugin.openidvci.statuslist.storage;
import java.nio.charset.StandardCharsets;
import java.util.HashSet;
import java.util.Set;
-import org.geant.shibboleth.plugin.oauth.statuslist.StatusListParameters;
+import org.geant.shibboleth.plugin.openidvci.statuslist.StatusListParameters;
import org.testng.Assert;
import org.testng.annotations.Test;
diff --git a/openid-vci-impl/src/test/java/org/geant/shibboleth/plugin/oauth/statuslist/storage/StatusListAssignmentStoreTest.java b/openid-vci-impl/src/test/java/org/geant/shibboleth/plugin/openidvci/statuslist/storage/StatusListAssignmentStoreTest.java
similarity index 99%
rename from openid-vci-impl/src/test/java/org/geant/shibboleth/plugin/oauth/statuslist/storage/StatusListAssignmentStoreTest.java
rename to openid-vci-impl/src/test/java/org/geant/shibboleth/plugin/openidvci/statuslist/storage/StatusListAssignmentStoreTest.java
index 2f504fa..302566f 100644
--- a/openid-vci-impl/src/test/java/org/geant/shibboleth/plugin/oauth/statuslist/storage/StatusListAssignmentStoreTest.java
+++ b/openid-vci-impl/src/test/java/org/geant/shibboleth/plugin/openidvci/statuslist/storage/StatusListAssignmentStoreTest.java
@@ -14,7 +14,7 @@
* limitations under the License.
*/
-package org.geant.shibboleth.plugin.oauth.statuslist.storage;
+package org.geant.shibboleth.plugin.openidvci.statuslist.storage;
import java.io.IOException;
import java.time.Duration;
diff --git a/openid-vci-impl/src/test/java/org/geant/shibboleth/plugin/oauth/statuslist/storage/StatusListIndexAllocatorTest.java b/openid-vci-impl/src/test/java/org/geant/shibboleth/plugin/openidvci/statuslist/storage/StatusListIndexAllocatorTest.java
similarity index 98%
rename from openid-vci-impl/src/test/java/org/geant/shibboleth/plugin/oauth/statuslist/storage/StatusListIndexAllocatorTest.java
rename to openid-vci-impl/src/test/java/org/geant/shibboleth/plugin/openidvci/statuslist/storage/StatusListIndexAllocatorTest.java
index 13fa1eb..69a5493 100644
--- a/openid-vci-impl/src/test/java/org/geant/shibboleth/plugin/oauth/statuslist/storage/StatusListIndexAllocatorTest.java
+++ b/openid-vci-impl/src/test/java/org/geant/shibboleth/plugin/openidvci/statuslist/storage/StatusListIndexAllocatorTest.java
@@ -14,7 +14,7 @@
* limitations under the License.
*/
-package org.geant.shibboleth.plugin.oauth.statuslist.storage;
+package org.geant.shibboleth.plugin.openidvci.statuslist.storage;
import java.io.IOException;
import java.time.Duration;
@@ -23,7 +23,7 @@ import java.util.HashSet;
import java.util.List;
import java.util.Set;
-import org.geant.shibboleth.plugin.oauth.statuslist.StatusListBucket;
+import org.geant.shibboleth.plugin.openidvci.statuslist.StatusListBucket;
import org.opensaml.storage.StorageRecord;
import org.opensaml.storage.impl.MemoryStorageService;
import org.opensaml.storage.impl.client.ClientStorageService;
diff --git a/openid-vci-impl/src/test/java/org/geant/shibboleth/plugin/oauth/statuslist/storage/StatusListStoreTest.java b/openid-vci-impl/src/test/java/org/geant/shibboleth/plugin/openidvci/statuslist/storage/StatusListStoreTest.java
similarity index 95%
rename from openid-vci-impl/src/test/java/org/geant/shibboleth/plugin/oauth/statuslist/storage/StatusListStoreTest.java
rename to openid-vci-impl/src/test/java/org/geant/shibboleth/plugin/openidvci/statuslist/storage/StatusListStoreTest.java
index 927b4bb..3f77d8f 100644
--- a/openid-vci-impl/src/test/java/org/geant/shibboleth/plugin/oauth/statuslist/storage/StatusListStoreTest.java
+++ b/openid-vci-impl/src/test/java/org/geant/shibboleth/plugin/openidvci/statuslist/storage/StatusListStoreTest.java
@@ -14,7 +14,7 @@
* limitations under the License.
*/
-package org.geant.shibboleth.plugin.oauth.statuslist.storage;
+package org.geant.shibboleth.plugin.openidvci.statuslist.storage;
import java.io.ByteArrayOutputStream;
import java.io.IOException;
@@ -22,9 +22,9 @@ import java.time.Duration;
import java.time.Instant;
import java.util.zip.Inflater;
-import org.geant.shibboleth.plugin.oauth.statuslist.StatusListBucket;
-import org.geant.shibboleth.plugin.oauth.statuslist.StatusListCodec;
-import org.geant.shibboleth.plugin.oauth.statuslist.StatusListParameters;
+import org.geant.shibboleth.plugin.openidvci.statuslist.StatusListBucket;
+import org.geant.shibboleth.plugin.openidvci.statuslist.StatusListCodec;
+import org.geant.shibboleth.plugin.openidvci.statuslist.StatusListParameters;
import org.opensaml.storage.StorageRecord;
import org.opensaml.storage.impl.MemoryStorageService;
import org.testng.Assert;
diff --git a/pom.xml b/pom.xml
index 7a42b0d..4572194 100644
--- a/pom.xml
+++ b/pom.xml
@@ -37,7 +37,7 @@
<opensaml.version>5.0.0</opensaml.version>
<oidc.config.version>3.0.0</oidc.config.version>
<commons.io.version>2.6</commons.io.version>
- <checkstyle.configLocation>${project.basedir}/resources/checkstyle.xml</checkstyle.configLocation>
+ <checkstyle.configLocation>${project.basedir}/resources/checkstyle/checkstyle.xml</checkstyle.configLocation>
<!-- Dependency management in oidc-common-bom, but versions needed here for javadoc links -->
<nimbus-jose-jwt.version>9.40</nimbus-jose-jwt.version>
<oauth2-oidc-sdk.version>10.15</oauth2-oidc-sdk.version>
@@ -105,6 +105,12 @@
<version>${oidc.op.version}</version>
<scope>provided</scope>
</dependency>
+ <dependency>
+ <groupId>net.shibboleth.idp.plugin.oidc</groupId>
+ <artifactId>idp-plugin-oidc-op-impl</artifactId>
+ <version>${oidc.op.version}</version>
+ <scope>provided</scope>
+ </dependency>
<!-- IdP BOM when importing IdP dependencies -->
<dependency>
<groupId>${idp.groupId}</groupId>
@@ -181,4 +187,29 @@
</dependency>
</dependencies>
</dependencyManagement>
+ <build>
+ <plugins>
+ <plugin>
+ <groupId>org.apache.maven.plugins</groupId>
+ <artifactId>maven-checkstyle-plugin</artifactId>
+ <configuration>
+ <configLocation>${checkstyle.configLocation}</configLocation>
+ <violationSeverity>warning</violationSeverity>
+ <consoleOutput>true</consoleOutput>
+ <failOnViolation>false</failOnViolation>
+ <includeResources>false</includeResources>
+ <includeTestResources>false</includeTestResources>
+ </configuration>
+ <executions>
+ <execution>
+ <id>checkstyle-check</id>
+ <phase>verify</phase>
+ <goals>
+ <goal>check</goal>
+ </goals>
+ </execution>
+ </executions>
+ </plugin>
+ </plugins>
+ </build>
</project>
diff --git a/checkstyle.xml b/resources/checkstyle/checkstyle.xml
similarity index 84%
rename from checkstyle.xml
rename to resources/checkstyle/checkstyle.xml
index f456c13..ebc1d44 100644
--- a/checkstyle.xml
+++ b/resources/checkstyle/checkstyle.xml
@@ -53,7 +53,10 @@
<module name="RightCurly"/>
<module name="EmptyStatement"/>
<module name="EqualsHashCode"/>
- <module name="HiddenField"/>
+ <module name="HiddenField">
+ <property name="ignoreConstructorParameter" value="true"/>
+ <property name="ignoreSetter" value="true"/>
+ </module>
<module name="IllegalInstantiation"/>
<module name="InnerAssignment"/>
<module name="MissingSwitchDefault"/>
@@ -113,7 +116,7 @@
<property name="max" value="1000"/>
</module>
<module name="Header">
- <property name="header" value="/*\n * Licensed under the Apache License, Version 2.0 (the "License");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n * http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an "AS IS" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, eit [...]
+ <property name="header" value="/*\n * Copyright (c) 2025, GÉANT\n *\n * Licensed under the Apache License, Version 2.0 (the “License”); you may not\n * use this file except in compliance with the License. You may obtain a copy\n * of the License at\n *\n * http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an “AS IS” BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF [...]
</module>
<module name="JavadocPackage"/>
<module name="LineLength">
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list