Package net.shibboleth.idp.plugin.oidc.op.profile.logic

Class DefaultJwtRefreshTokenDeserializationFunction

java.lang.Object

net.shibboleth.shared.component.AbstractInitializableComponent

net.shibboleth.idp.plugin.oidc.op.profile.logic.DefaultJwtRefreshTokenDeserializationFunction

All Implemented Interfaces:

BiFunction<ProfileRequestContext,String,RefreshTokenClaimsSet>, Component, DestructableComponent, InitializableComponent

public class DefaultJwtRefreshTokenDeserializationFunction
extends AbstractInitializableComponent
implements BiFunction<ProfileRequestContext,String,RefreshTokenClaimsSet>

Default implementation for deserializing an incoming JWT refresh token into the refresh token claims set. The JWT needs to be signed in a way that it can be validated using a credential returned by the configurable CredentialResolver. The JWT claims are validated via configurable ClaimsValidator, before the contents of the 'for_op' claim are decrypted into RefreshTokenClaimsSet.

Field Summary

Fields

Modifier and Type	Field	Description
private ClaimsValidator	claimsValidator	The claims validator to use for validating the JWT refresh token.
private CredentialResolver	credentialResolver	Source of signing keys used for validating the signature of the JWT refresh token.
private DataSealer	dataSealer	Data sealer for decrypting the private parts of the refresh token.
private final org.slf4j.Logger	log	Class logger.
private BiPredicate<ProfileRequestContext,String>	typeHeaderValidationStrategy	Strategy used to validate the incoming JWT type header value.

Constructor Summary

Constructors

Constructor	Description
DefaultJwtRefreshTokenDeserializationFunction()	Constructor.

Method Summary

Modifier and Type	Method	Description
RefreshTokenClaimsSet	apply(ProfileRequestContext profileRequestContext, String token)
protected RefreshTokenClaimsSet	decryptSealedClaimsSet(com.nimbusds.jwt.JWTClaimsSet claimsSet)	Decrypt the sealed claims from 'for_op' claim and build RefreshTokenClaimsSet out of its contents.
protected void	doInitialize()
void	setClaimsValidator(ClaimsValidator validator)	Set the claims validator lookup strategy.
void	setCredentialResolver(CredentialResolver resolver)	Set the source of signing keys to use for JWT signature verification.
void	setDataSealer(DataSealer sealer)	Set the data sealer instance to use.
void	setTypeHeaderValidationStrategy(BiPredicate<ProfileRequestContext,String> strategy)	Set the strategy used to validate the incoming JWT type header value.

Methods inherited from class net.shibboleth.shared.component.AbstractInitializableComponent

checkComponentActive, checkSetterPreconditions, destroy, doDestroy, ifDestroyedThrowDestroyedComponentException, ifInitializedThrowUnmodifiabledComponentException, ifNotInitializedThrowUninitializedComponentException, initialize, isDestroyed, isInitialized

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Methods inherited from interface java.util.function.BiFunction

andThen

Field Details

log

@Nonnull
private final org.slf4j.Logger log

Class logger.

claimsValidator

@NonnullAfterInit
private ClaimsValidator claimsValidator

The claims validator to use for validating the JWT refresh token.

credentialResolver

@NonnullAfterInit
private CredentialResolver credentialResolver

Source of signing keys used for validating the signature of the JWT refresh token.

dataSealer

@NonnullAfterInit
private DataSealer dataSealer

Data sealer for decrypting the private parts of the refresh token.

typeHeaderValidationStrategy

@NonnullAfterInit
private BiPredicate<ProfileRequestContext,String> typeHeaderValidationStrategy

Strategy used to validate the incoming JWT type header value.

Constructor Details

DefaultJwtRefreshTokenDeserializationFunction

public DefaultJwtRefreshTokenDeserializationFunction()

Constructor.

Method Details

setDataSealer

public void setDataSealer(@Nonnull
 DataSealer sealer)

Set the data sealer instance to use.

Parameters:

sealer - data sealer to use

setClaimsValidator

public void setClaimsValidator(@Nonnull
 ClaimsValidator validator)

Set the claims validator lookup strategy.

Parameters:

validator - claims validator

setCredentialResolver

public void setCredentialResolver(@Nullable
 CredentialResolver resolver)

Set the source of signing keys to use for JWT signature verification.

Parameters:

resolver - signing key resolver

setTypeHeaderValidationStrategy

public void setTypeHeaderValidationStrategy(@Nonnull
 BiPredicate<ProfileRequestContext,String> strategy)

Set the strategy used to validate the incoming JWT type header value.

Parameters:

strategy - What to set.

doInitialize

protected void doInitialize()
                     throws ComponentInitializationException

Overrides:

doInitialize in class AbstractInitializableComponent

Throws:

ComponentInitializationException

apply

@Nullable
public RefreshTokenClaimsSet apply(@Nullable
 ProfileRequestContext profileRequestContext,
 @Nullable
 String token)

Specified by:

apply in interface BiFunction<ProfileRequestContext,String,RefreshTokenClaimsSet>

decryptSealedClaimsSet

protected RefreshTokenClaimsSet decryptSealedClaimsSet(@Nonnull
 com.nimbusds.jwt.JWTClaimsSet claimsSet)

Decrypt the sealed claims from 'for_op' claim and build RefreshTokenClaimsSet out of its contents.

Parameters:

claimsSet - The claims set containing the 'for_op' claim.

Returns:

The refresh token claims set, or null if it couldn't be parsed from the claim