Package net.shibboleth.idp.plugin.oidc.op.authn.impl

Class JWTCredentialValidator

java.lang.Object

net.shibboleth.shared.component.AbstractInitializableComponent

net.shibboleth.shared.component.AbstractIdentifiedInitializableComponent

net.shibboleth.idp.authn.AbstractCredentialValidator

net.shibboleth.idp.plugin.oidc.op.authn.impl.JWTCredentialValidator

All Implemented Interfaces:

CredentialValidator, PrincipalSupportingComponent, Component, DestructableComponent, IdentifiableComponent, IdentifiedComponent, InitializableComponent

@ThreadSafeAfterInit
public class JWTCredentialValidator
extends AbstractCredentialValidator

A validator that handles authentication via signed JWT.

For now, implemented via Nimbus APIs.

TODO: there will be additional validation checks added once implemented on the older branch

Nested Class Summary

Nested classes/interfaces inherited from interface net.shibboleth.idp.authn.CredentialValidator

CredentialValidator.ErrorHandler, CredentialValidator.WarningHandler

Field Summary

Fields

Modifier and Type	Field	Description
private Function<ProfileRequestContext,ClaimsValidator>	claimsValidatorLookupStrategy	Strategy used to obtain ClaimsValidator.
private Function<ProfileRequestContext,OAuth2ClientAuthenticationContext>	clientAuthContextLookupStrategy	Strategy that will return OAuth2ClientAuthenticationContext.
private final org.slf4j.Logger	log	Class logger.
private boolean	saveTokenToCredentialSet	Whether to save the JWT in the Java Subject's public credentials.
private Function<ProfileRequestContext,SecurityParametersContext>	securityParametersLookupStrategy	Strategy used to locate the SecurityParametersContext to use for verification.

Constructor Summary

Constructors

Constructor	Description
JWTCredentialValidator()	Constructor.

Method Summary

Modifier and Type	Method	Description
protected Subject	doValidate(ProfileRequestContext profileRequestContext, AuthenticationContext authenticationContext, CredentialValidator.WarningHandler warningHandler, CredentialValidator.ErrorHandler errorHandler)
protected Subject	populateSubject(com.nimbusds.oauth2.sdk.id.ClientID clientId, com.nimbusds.jwt.SignedJWT token)	Builds a subject with "standard" content from the validation.
void	setClaimsValidatorLookupStrategy(Function<ProfileRequestContext,ClaimsValidator> strategy)	Set the strategy used to locate ClaimsValidator used.
void	setOAuth2ClientAuthenticationLookupStrategy(Function<ProfileRequestContext,OAuth2ClientAuthenticationContext> strategy)	Set the strategy used to return the OAuth2ClientAuthenticationContext.
void	setSaveTokenToCredentialSet(boolean flag)	Set whether to save the JWT in the Java Subject's public credentials.
void	setSecurityParametersLookupStrategy(Function<ProfileRequestContext,SecurityParametersContext> strategy)	Set the strategy used to locate the SecurityParametersContext to use.
protected void	validateJWTClaims(ProfileRequestContext profileRequestContext, com.nimbusds.jwt.SignedJWT jwt, com.nimbusds.oauth2.sdk.id.ClientID clientId)	Validates the contents of the given JWT against the requirements set in the OIDC core specification section 9.

Methods inherited from class net.shibboleth.idp.authn.AbstractCredentialValidator

getLogPrefix, getSupportedPrincipals, isAcceptable, populateSubject, setActivationCondition, setId, setSupportedPrincipals, validate

Methods inherited from class net.shibboleth.shared.component.AbstractIdentifiedInitializableComponent

doInitialize, ensureId, getId, ifDestroyedThrowDestroyedComponentException, ifInitializedThrowUnmodifiabledComponentException, ifNotInitializedThrowUninitializedComponentException

Methods inherited from class net.shibboleth.shared.component.AbstractInitializableComponent

checkComponentActive, checkSetterPreconditions, destroy, doDestroy, initialize, isDestroyed, isInitialized

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Methods inherited from interface net.shibboleth.shared.component.IdentifiedComponent

getId

Field Details

log

@Nonnull
private final org.slf4j.Logger log

Class logger.

clientAuthContextLookupStrategy

@Nonnull
private Function<ProfileRequestContext,OAuth2ClientAuthenticationContext> clientAuthContextLookupStrategy

Strategy that will return OAuth2ClientAuthenticationContext.

securityParametersLookupStrategy

@Nonnull
private Function<ProfileRequestContext,SecurityParametersContext> securityParametersLookupStrategy

Strategy used to locate the SecurityParametersContext to use for verification.

claimsValidatorLookupStrategy

@Nonnull
private Function<ProfileRequestContext,ClaimsValidator> claimsValidatorLookupStrategy

Strategy used to obtain ClaimsValidator.

saveTokenToCredentialSet

private boolean saveTokenToCredentialSet

Whether to save the JWT in the Java Subject's public credentials.

Constructor Details

JWTCredentialValidator

public JWTCredentialValidator()

Constructor.

Method Details

setOAuth2ClientAuthenticationLookupStrategy

public void setOAuth2ClientAuthenticationLookupStrategy(@Nonnull
 Function<ProfileRequestContext,OAuth2ClientAuthenticationContext> strategy)

Set the strategy used to return the OAuth2ClientAuthenticationContext.

Parameters:

strategy - lookup strategy

setSecurityParametersLookupStrategy

public void setSecurityParametersLookupStrategy(@Nonnull
 Function<ProfileRequestContext,SecurityParametersContext> strategy)

Set the strategy used to locate the SecurityParametersContext to use.

Parameters:

strategy - lookup strategy

setClaimsValidatorLookupStrategy

public void setClaimsValidatorLookupStrategy(@Nonnull
 Function<ProfileRequestContext,ClaimsValidator> strategy)

Set the strategy used to locate ClaimsValidator used.

Parameters:

strategy - lookup strategy

setSaveTokenToCredentialSet

public void setSaveTokenToCredentialSet(boolean flag)

Set whether to save the JWT in the Java Subject's public credentials.

Defaults to true

Parameters:

flag - flag to set

doValidate

@Nullable
protected Subject doValidate(@Nonnull
 ProfileRequestContext profileRequestContext,
 @Nonnull
 AuthenticationContext authenticationContext,
 @Nullable
 CredentialValidator.WarningHandler warningHandler,
 @Nullable
 CredentialValidator.ErrorHandler errorHandler)
                      throws Exception

Specified by:

doValidate in class AbstractCredentialValidator

Throws:

Exception

validateJWTClaims

protected void validateJWTClaims(@Nonnull
 ProfileRequestContext profileRequestContext,
 @Nonnull
 com.nimbusds.jwt.SignedJWT jwt,
 @Nonnull
 com.nimbusds.oauth2.sdk.id.ClientID clientId)
                          throws ParseException,
JWTValidationException

Validates the contents of the given JWT against the requirements set in the OIDC core specification section 9.

Parameters:

jwt - JWT to be validated

clientId - client ID from which the JWT is coming from

profileRequestContext - profile request context

Throws:

ParseException - if unable to parse the claim set

JWTValidationException - if the claims fail to validate

populateSubject

@Nonnull
protected Subject populateSubject(@Nonnull @NotEmpty
 com.nimbusds.oauth2.sdk.id.ClientID clientId,
 @Nonnull
 com.nimbusds.jwt.SignedJWT token)

Builds a subject with "standard" content from the validation.

Parameters:

clientId - client ID

token - the token validated

Returns:

the decorated subject