Package net.shibboleth.idp.plugin.oidc.op.profile.impl

Class SetRefreshTokenToResponseContext

java.lang.Object
net.shibboleth.shared.component.AbstractInitializableComponent
org.opensaml.profile.action.AbstractProfileAction
org.opensaml.profile.action.AbstractConditionalProfileAction
net.shibboleth.idp.profile.AbstractProfileAction
net.shibboleth.idp.plugin.oidc.op.profile.impl.AbstractOIDCResponseAction
net.shibboleth.idp.plugin.oidc.op.profile.impl.SetRefreshTokenToResponseContext
All Implemented Interfaces:
Component, DestructableComponent, InitializableComponent, ProfileAction, Aware, MessageSource, MessageSourceAware, Action
public class SetRefreshTokenToResponseContext extends AbstractOIDCResponseAction
Action that creates a Refresh Token, and sets it to work context OIDCAuthenticationResponseContext.getRefreshToken() located under InOutOperationContext.getOutboundMessageContext(). The refresh_token is created only if the request contains offline_access - scope.

  • Field Details

  • Constructor Details

    • SetRefreshTokenToResponseContext

      public SetRefreshTokenToResponseContext(@Nonnull @ParameterName(name="sealer") DataSealer sealer)
      Constructor.
      Parameters:
      sealer - sealer to encrypt/hmac refresh token.

  • Method Details

    • setRevocationCache

      public void setRevocationCache(@Nonnull RevocationCache cache)
      Set the revocation cache instance to use.
      Parameters:
      cache - The revocationCache to set.

    • setRefreshTokenChainLifetimeLookupStrategy

      public void setRefreshTokenChainLifetimeLookupStrategy(@Nonnull Function<ProfileRequestContext,Duration> strategy)
      Set the strategy used to obtain the refresh token chain lifetime.
      Parameters:
      strategy - lookup strategy

    • setRefreshTokenTimeoutLookupStrategy

      public void setRefreshTokenTimeoutLookupStrategy(@Nonnull Function<ProfileRequestContext,Duration> strategy)
      Set the strategy used to obtain the refresh token timeout.
      Parameters:
      strategy - lookup strategy

    • setTokenClaimsSetManipulationStrategyLookupStrategy

      public void setTokenClaimsSetManipulationStrategyLookupStrategy(@Nonnull Function<ProfileRequestContext,BiFunction<ProfileRequestContext,Map<String,Object>,Map<String,Object>>> strategy)
      Set the lookup function to supply strategy bi-function for manipulating token claims set.
      Parameters:
      strategy - What to set

    • setIdentifierGeneratorLookupStrategy

      public void setIdentifierGeneratorLookupStrategy(@Nonnull Function<ProfileRequestContext,IdentifierGenerationStrategy> strategy)
      Set the strategy used to locate the IdentifierGenerationStrategy to use.
      Parameters:
      strategy - lookup strategy

    • setEnforceRefreshTokenRotationCondition

      public void setEnforceRefreshTokenRotationCondition(@Nonnull Predicate<ProfileRequestContext> condition)
      Set the condition used to determine whether to revoke refresh tokens once they're used.
      Parameters:
      condition - condition to apply

    • setTokenRevocationLifetimeLookupStrategy

      public void setTokenRevocationLifetimeLookupStrategy(@Nullable Function<com.nimbusds.jwt.JWTClaimsSet,Duration> strategy)
      Set a lookup strategy for the token revocation lifetime.
      Parameters:
      strategy - What to set.

    • setRefreshTokenTypeLookupStrategy

      public void setRefreshTokenTypeLookupStrategy(@Nonnull Function<ProfileRequestContext,String> strategy)
      Set a lookup strategy to obtain the refresh token type to issue.
      Parameters:
      strategy - What to set.

    • setRefreshTokenSerializationStrategies

      public void setRefreshTokenSerializationStrategies(@Nonnull Map<String,BiFunction<ProfileRequestContext,RefreshTokenClaimsSet,String>> strategies)
      Set the strategies used for serializing refresh token claims set, key referring to the refresh token type.
      Parameters:
      strategies - What to set.

    • setXmlSafeIdentifier

      public void setXmlSafeIdentifier(boolean flag)
      Set the xmlSafe-flag passed to the identifier generator
      Parameters:
      flag - xmlSafe-flag

    • doInitialize

      protected void doInitialize() throws ComponentInitializationException
      Overrides:
      doInitialize in class AbstractInitializableComponent
      Throws:
      ComponentInitializationException

    • doPreExecute

      protected boolean doPreExecute(@Nonnull ProfileRequestContext profileRequestContext)
      Overrides:
      doPreExecute in class AbstractOIDCResponseAction

    • doExecute

      protected void doExecute(@Nonnull ProfileRequestContext profileRequestContext)
      Overrides:
      doExecute in class AbstractProfileAction

    • getExistingChainExp

      protected Instant getExistingChainExp(@Nonnull TokenClaimsSet tokenClaimsSet)
      Get the possibly existing chain expiration instant from the claims set.
      Parameters:
      tokenClaimsSet - the claims set input
      Returns:
      the existing value if exists, null otherwise

    • calculateChainExp

      @Nonnull protected Instant calculateChainExp(@Nonnull TokenClaimsSet tokenClaimsSet)
      Calculates the chain expiration time by taking the closest from the existing item in the claims set (if exists) and the value calculated via current profile configuration.
      Parameters:
      tokenClaimsSet - The claims set to operate on. If it doesn't contain authentication time, the chain expiration time is set to now.
      Returns:
      the instant to be used as the chain expiration time