Package net.shibboleth.idp.plugin.oidc.op.profile.impl

Class SetTokenDeliveryAttributesToResponseContext

java.lang.Object

net.shibboleth.utilities.java.support.component.AbstractInitializableComponent

org.opensaml.profile.action.AbstractProfileAction

org.opensaml.profile.action.AbstractConditionalProfileAction

net.shibboleth.idp.profile.AbstractProfileAction

net.shibboleth.idp.plugin.oidc.op.profile.impl.AbstractOIDCResponseAction

net.shibboleth.idp.plugin.oidc.op.profile.impl.SetTokenDeliveryAttributesToResponseContext

All Implemented Interfaces:

Component, DestructableComponent, InitializableComponent, ProfileAction, Aware, MessageSource, MessageSourceAware, Action

public class SetTokenDeliveryAttributesToResponseContext
extends AbstractOIDCResponseAction

Action that checks for any released attributes marked for token delivery. For such attributes OIDCAuthenticationResponseTokenClaimsContext is created under OIDCAuthenticationResponseContext and the marked attributes are placed there.

Field Summary

Fields

Modifier and Type	Field	Description
private Set<String>	alwaysIncludedAttributes	Attributes to include in ID token no matter what.
private Function<ProfileRequestContext,Set<String>>	alwaysIncludedAttributesLookupStrategy	Strategy used to obtain the set of attribute IDs to include in the ID token in all cases.
private Function<ProfileRequestContext,AttributeContext>	attributeContextLookupStrategy	Strategy used to locate the AttributeContext associated with a given ProfileRequestContext.
private AttributeContext	attributeCtx	AttributeContext to use.
private Set<String>	deniedUserInfoAttributes	Attributes to omit from UserInfo token.
private Function<ProfileRequestContext,Set<String>>	deniedUserInfoAttributesLookupStrategy	Strategy used to obtain the set of attribute IDs to omit from the UserInfo token.
private Set<String>	encodedAttributes	Attributes to encode for recovery.
private Function<ProfileRequestContext,Set<String>>	encodedAttributesLookupStrategy	Strategy used to obtain the set of attribute IDs to encode for back-channel recovery.
private boolean	ignoringUnencodableAttributes	Whether attributes that result in an AttributeEncodingException when being encoded should be ignored or result in an IdPEventIds.UNABLE_ENCODE_ATTRIBUTE transition.
private org.slf4j.Logger	log	Class logger.
private ReloadableService<AttributeTranscoderRegistry>	transcoderRegistry	Transcoder registry service object.

Constructor Summary

Constructors

Constructor	Description
SetTokenDeliveryAttributesToResponseContext()	Constructor.

Method Summary

Modifier and Type	Method	Description
protected void	doExecute(ProfileRequestContext profileRequestContext)
protected void	doInitialize()
protected boolean	doPreExecute(ProfileRequestContext profileRequestContext)
private void	encodeAttribute(AttributeTranscoderRegistry registry, ProfileRequestContext profileRequestContext, IdPAttribute attribute)	Access the registry of transcoding rules to transform the input attribute into claims.
void	setAlwaysIncludedAttributesLookupStrategy(Function<ProfileRequestContext,Set<String>> strategy)	Set the strategy used to obtain the set of attribute IDs always included in ID tokens.
void	setAttributeContextLookupStrategy(Function<ProfileRequestContext,AttributeContext> strategy)	Set the strategy used to locate the AttributeContext associated with a given ProfileRequestContext.
void	setDeniedUserInfoAttributesLookupStrategy(Function<ProfileRequestContext,Set<String>> strategy)	Set the strategy used to obtain the set of attribute IDs to omit from UserInfo tokens.
void	setEncodedAttributesLookupStrategy(Function<ProfileRequestContext,Set<String>> strategy)	Set the strategy used to obtain the set of attribute IDs to encode for back-channel recovery.
void	setIgnoringUnencodableAttributes(boolean flag)	Set whether the attributes that result in an AttributeEncodingException when being encoded should be ignored or result in an IdPEventIds.UNABLE_ENCODE_ATTRIBUTE transition.
void	setTranscoderRegistry(ReloadableService<AttributeTranscoderRegistry> registry)	Sets the registry of transcoding rules to apply to encode attributes.

Methods inherited from class net.shibboleth.idp.plugin.oidc.op.profile.impl.AbstractOIDCResponseAction

getMetadataContext, getOidcResponseContext

Methods inherited from class net.shibboleth.idp.profile.AbstractProfileAction

doExecute, execute, getBean, getBean, getMessage, getMessage, getMessage, getParameter, getParameter, getProfileContextLookupStrategy, getRequestContext, getResult, setMessageSource, setProfileContextLookupStrategy

Methods inherited from class org.opensaml.profile.action.AbstractConditionalProfileAction

getActivationCondition, setActivationCondition

Methods inherited from class org.opensaml.profile.action.AbstractProfileAction

doPostExecute, doPostExecute, execute, getHttpServletRequest, getHttpServletRequestSupplier, getHttpServletResponse, getHttpServletResponseSupplier, getLogPrefix, setHttpServletRequest, setHttpServletRequestSupplier, setHttpServletResponse, setHttpServletResponseSupplier

Methods inherited from class net.shibboleth.utilities.java.support.component.AbstractInitializableComponent

destroy, doDestroy, initialize, isDestroyed, isInitialized

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Methods inherited from interface net.shibboleth.utilities.java.support.component.InitializableComponent

initialize, isInitialized

Field Detail

log

@Nonnull
private org.slf4j.Logger log

Class logger.

attributeContextLookupStrategy

@Nonnull
private Function<ProfileRequestContext,AttributeContext> attributeContextLookupStrategy

Strategy used to locate the AttributeContext associated with a given ProfileRequestContext.

encodedAttributesLookupStrategy

@Nonnull
private Function<ProfileRequestContext,Set<String>> encodedAttributesLookupStrategy

Strategy used to obtain the set of attribute IDs to encode for back-channel recovery.

alwaysIncludedAttributesLookupStrategy

@Nonnull
private Function<ProfileRequestContext,Set<String>> alwaysIncludedAttributesLookupStrategy

Strategy used to obtain the set of attribute IDs to include in the ID token in all cases.

deniedUserInfoAttributesLookupStrategy

@Nonnull
private Function<ProfileRequestContext,Set<String>> deniedUserInfoAttributesLookupStrategy

Strategy used to obtain the set of attribute IDs to omit from the UserInfo token.

transcoderRegistry

@NonnullAfterInit
private ReloadableService<AttributeTranscoderRegistry> transcoderRegistry

Transcoder registry service object.

ignoringUnencodableAttributes

private boolean ignoringUnencodableAttributes

Whether attributes that result in an AttributeEncodingException when being encoded should be ignored or result in an IdPEventIds.UNABLE_ENCODE_ATTRIBUTE transition.

attributeCtx

@Nullable
private AttributeContext attributeCtx

AttributeContext to use.

encodedAttributes

@Nullable
@NonnullElements
private Set<String> encodedAttributes

Attributes to encode for recovery.

alwaysIncludedAttributes

@Nullable
@NonnullElements
private Set<String> alwaysIncludedAttributes

Attributes to include in ID token no matter what.

deniedUserInfoAttributes

@Nullable
@NonnullElements
private Set<String> deniedUserInfoAttributes

Attributes to omit from UserInfo token.

Constructor Detail

SetTokenDeliveryAttributesToResponseContext

SetTokenDeliveryAttributesToResponseContext()

Constructor.

Method Detail

setTranscoderRegistry

public void setTranscoderRegistry(@Nonnull
                                  ReloadableService<AttributeTranscoderRegistry> registry)

Sets the registry of transcoding rules to apply to encode attributes.

Parameters:

registry - registry service interface

setIgnoringUnencodableAttributes

public void setIgnoringUnencodableAttributes(boolean flag)

Set whether the attributes that result in an AttributeEncodingException when being encoded should be ignored or result in an IdPEventIds.UNABLE_ENCODE_ATTRIBUTE transition.

Parameters:

flag - flag to set

setAttributeContextLookupStrategy

public void setAttributeContextLookupStrategy(@Nonnull
                                              Function<ProfileRequestContext,AttributeContext> strategy)

Set the strategy used to locate the AttributeContext associated with a given ProfileRequestContext.

Parameters:

strategy - strategy used to locate the AttributeContext associated with a given ProfileRequestContext

setEncodedAttributesLookupStrategy

public void setEncodedAttributesLookupStrategy(@Nonnull
                                               Function<ProfileRequestContext,Set<String>> strategy)

Set the strategy used to obtain the set of attribute IDs to encode for back-channel recovery.

Parameters:

strategy - lookup strategy

setAlwaysIncludedAttributesLookupStrategy

public void setAlwaysIncludedAttributesLookupStrategy(@Nonnull
                                                      Function<ProfileRequestContext,Set<String>> strategy)

Set the strategy used to obtain the set of attribute IDs always included in ID tokens.

Parameters:

strategy - lookup strategy

setDeniedUserInfoAttributesLookupStrategy

public void setDeniedUserInfoAttributesLookupStrategy(@Nonnull
                                                      Function<ProfileRequestContext,Set<String>> strategy)

Set the strategy used to obtain the set of attribute IDs to omit from UserInfo tokens.

Parameters:

strategy - lookup strategy

doInitialize

protected void doInitialize()
                     throws ComponentInitializationException

Overrides:

doInitialize in class AbstractInitializableComponent

Throws:

ComponentInitializationException

doPreExecute

protected boolean doPreExecute(@Nonnull
                               ProfileRequestContext profileRequestContext)

Overrides:

doPreExecute in class AbstractOIDCResponseAction

doExecute

protected void doExecute(@Nonnull
                         ProfileRequestContext profileRequestContext)

Overrides:

doExecute in class AbstractProfileAction

encodeAttribute

private void encodeAttribute(@Nonnull
                             AttributeTranscoderRegistry registry,
                             @Nonnull
                             ProfileRequestContext profileRequestContext,
                             @Nonnull
                             IdPAttribute attribute)
                      throws AttributeEncodingException

Access the registry of transcoding rules to transform the input attribute into claims.

Parameters:

registry - registry of transcoding rules

profileRequestContext - current profile request context

attribute - input attribute

Throws:

AttributeEncodingException - if a non-ignorable error occurs