Package net.shibboleth.idp.plugin.oidc.op.profile.impl

Class ManipulateClaimsForIDToken

java.lang.Object

net.shibboleth.shared.component.AbstractInitializableComponent

org.opensaml.profile.action.AbstractProfileAction

org.opensaml.profile.action.AbstractConditionalProfileAction

net.shibboleth.idp.profile.AbstractProfileAction

net.shibboleth.idp.plugin.oidc.op.profile.impl.AbstractOIDCRequestAction<com.nimbusds.openid.connect.sdk.AuthenticationRequest>

net.shibboleth.idp.plugin.oidc.op.profile.impl.AbstractOIDCAuthenticationRequestAction

net.shibboleth.idp.plugin.oidc.op.profile.impl.AbstractOIDCAuthenticationResponseAction

net.shibboleth.idp.plugin.oidc.op.profile.impl.ManipulateClaimsForIDToken

All Implemented Interfaces:

Component, DestructableComponent, InitializableComponent, ProfileAction, Aware, MessageSource, MessageSourceAware, Action

public class ManipulateClaimsForIDToken
extends AbstractOIDCAuthenticationResponseAction

An action that can be used for manipulating id_token claims via configurable strategy (bi-function). If the function exists, its result (a Map) is used as-is for building new contents for the upcoming id_token, i.e. the previously built claims set is replaced. If the function returns null, the existing id_token contents are not replaced.

Event:

EventIds.INVALID_MSG_CTX If the id_token does not exist., IdPEventIds.INVALID_PROFILE_CONFIG If the new claims set is not compatible with the id_token requirements (e.g. due to missing mandatory claims, or claims having unexpected syntax).

Field Summary

Fields

Modifier and Type	Field	Description
private com.nimbusds.openid.connect.sdk.claims.IDTokenClaimsSet	idToken	The id_token to operate on.
private Function<ProfileRequestContext,BiFunction<ProfileRequestContext,Map<String,Object>,Map<String,Object>>>	idTokenManipulationStrategyLookupStrategy	Lookup function to supply strategy bi-function for manipulating id_token claims.
private org.slf4j.Logger	log	Class logger.
private BiFunction<ProfileRequestContext,Map<String,Object>,Map<String,Object>>	manipulationStrategy	The strategy used for manipulating the id_token.
private com.fasterxml.jackson.databind.ObjectMapper	objectMapper	Object mapper used for pretty-printing JWT contents.
private org.slf4j.Logger	protocolMessageLog	Used to log protocol messages.

Constructor Summary

Constructors

Constructor	Description
ManipulateClaimsForIDToken()	Constructor.

Method Summary

Modifier and Type	Method	Description
protected void	doExecute(ProfileRequestContext profileRequestContext)
protected void	doInitialize()
protected boolean	doPreExecute(ProfileRequestContext profileRequestContext)
protected void	doProtocolLog(ProfileRequestContext profileRequestContext, com.nimbusds.openid.connect.sdk.claims.IDTokenClaimsSet claimsSet)	Create a protocol message containing the pretty-printed contents of the given claims set.
void	setIDTokenManipulationStrategyLookupStrategy(Function<ProfileRequestContext,BiFunction<ProfileRequestContext,Map<String,Object>,Map<String,Object>>> strategy)	Set the lookup function to supply strategy bi-function for manipulating id_token claims.
void	setObjectMapper(com.fasterxml.jackson.databind.ObjectMapper mapper)	Set the object mapper used for pretty-printing JWT contents.

Methods inherited from class net.shibboleth.idp.plugin.oidc.op.profile.impl.AbstractOIDCAuthenticationResponseAction

getMetadataContext, getOidcResponseContext

Methods inherited from class net.shibboleth.idp.plugin.oidc.op.profile.impl.AbstractOIDCAuthenticationRequestAction

getAuthenticationRequest

Methods inherited from class net.shibboleth.idp.plugin.oidc.op.profile.impl.AbstractOIDCRequestAction

getRequest

Methods inherited from class net.shibboleth.idp.profile.AbstractProfileAction

doExecute, execute, getBean, getBean, getMessage, getMessage, getMessage, getParameter, getParameter, getProfileContextLookupStrategy, getRequestContext, getResult, setMessageSource, setProfileContextLookupStrategy

Methods inherited from class org.opensaml.profile.action.AbstractConditionalProfileAction

getActivationCondition, setActivationCondition

Methods inherited from class org.opensaml.profile.action.AbstractProfileAction

doPostExecute, doPostExecute, ensureHttpServletRequest, ensureHttpServletResponse, execute, getHttpServletRequest, getHttpServletRequestSupplier, getHttpServletResponse, getHttpServletResponseSupplier, getLogPrefix, isPreExecuteCalled, setHttpServletRequestSupplier, setHttpServletResponseSupplier

Methods inherited from class net.shibboleth.shared.component.AbstractInitializableComponent

checkComponentActive, checkSetterPreconditions, destroy, doDestroy, ifDestroyedThrowDestroyedComponentException, ifInitializedThrowUnmodifiabledComponentException, ifNotInitializedThrowUninitializedComponentException, initialize, isDestroyed, isInitialized

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Methods inherited from interface net.shibboleth.shared.component.InitializableComponent

initialize, isInitialized

Field Details

log

@Nonnull
private org.slf4j.Logger log

Class logger.

protocolMessageLog

@Nonnull
private org.slf4j.Logger protocolMessageLog

Used to log protocol messages.

idTokenManipulationStrategyLookupStrategy

@Nonnull
private Function<ProfileRequestContext,BiFunction<ProfileRequestContext,Map<String,Object>,Map<String,Object>>> idTokenManipulationStrategyLookupStrategy

Lookup function to supply strategy bi-function for manipulating id_token claims.

manipulationStrategy

private BiFunction<ProfileRequestContext,Map<String,Object>,Map<String,Object>> manipulationStrategy

The strategy used for manipulating the id_token.

objectMapper

@NonnullAfterInit
private com.fasterxml.jackson.databind.ObjectMapper objectMapper

Object mapper used for pretty-printing JWT contents.

idToken

private com.nimbusds.openid.connect.sdk.claims.IDTokenClaimsSet idToken

The id_token to operate on.

Constructor Details

ManipulateClaimsForIDToken

public ManipulateClaimsForIDToken()

Constructor.

Method Details

setIDTokenManipulationStrategyLookupStrategy

public void setIDTokenManipulationStrategyLookupStrategy(@Nonnull
 Function<ProfileRequestContext,BiFunction<ProfileRequestContext,Map<String,Object>,Map<String,Object>>> strategy)

Set the lookup function to supply strategy bi-function for manipulating id_token claims.

Parameters:

strategy - What to set

setObjectMapper

public void setObjectMapper(@Nonnull
 com.fasterxml.jackson.databind.ObjectMapper mapper)

Set the object mapper used for pretty-printing JWT contents.

Parameters:

mapper - What to set.

Since:

4.1.0

doInitialize

protected void doInitialize()
                     throws ComponentInitializationException

Overrides:

doInitialize in class AbstractInitializableComponent

Throws:

ComponentInitializationException

doPreExecute

protected boolean doPreExecute(@Nonnull
 ProfileRequestContext profileRequestContext)

Overrides:

doPreExecute in class AbstractOIDCAuthenticationResponseAction

doExecute

protected void doExecute(@Nonnull
 ProfileRequestContext profileRequestContext)

Overrides:

doExecute in class AbstractProfileAction

doProtocolLog

protected void doProtocolLog(@Nonnull
 ProfileRequestContext profileRequestContext,
 @Nonnull
 com.nimbusds.openid.connect.sdk.claims.IDTokenClaimsSet claimsSet)

Create a protocol message containing the pretty-printed contents of the given claims set.

Parameters:

profileRequestContext - Profile request context where to publish possible error event

claimsSet - The claims set to be logged