Package net.shibboleth.idp.plugin.oidc.op.oauth2.profile.impl

Class AbstractProcessTokenAction<T>

java.lang.Object
net.shibboleth.shared.component.AbstractInitializableComponent
org.opensaml.profile.action.AbstractProfileAction
org.opensaml.profile.action.AbstractConditionalProfileAction
net.shibboleth.idp.profile.AbstractProfileAction
net.shibboleth.idp.plugin.oidc.op.profile.impl.AbstractOIDCRequestAction<T>
net.shibboleth.idp.plugin.oidc.op.oauth2.profile.impl.AbstractProcessTokenAction<T>
Type Parameters:
T - request message type
All Implemented Interfaces:
Component, DestructableComponent, InitializableComponent, ProfileAction, Aware, MessageSource, MessageSourceAware, Action
Direct Known Subclasses:
ProcessTokenForIntrospection, ProcessTokenForRevocation
public abstract class AbstractProcessTokenAction<T> extends AbstractOIDCRequestAction<T>
Action that processes a token by validating it and populating the resulting JWTClaimsSet into an OAuth2TokenMgmtResponseContext placed beneath the outbound MessageContext.

If the token can't be validated, the context is not populated.

Since:
3.1.0
Event:
EventIds.PROCEED_EVENT_ID, IdPEventIds.INVALID_PROFILE_CONFIG
Postcondition:
If the token is valid for use, ProfileRequestContext.getOutboundMessageContext().getSubcontext( OAuth2TokenMgmtResponseContext.class) != null and the context contains the token's JWTClaimsSet.

  • Field Details

    • log

      @Nonnull private org.slf4j.Logger log
      Class logger.

    • dataSealer

      @Nullable private DataSealer dataSealer
      Data sealer for unwrapping token.

    • claimsValidatorLookupStrategy

      @Nonnull private Function<ProfileRequestContext,ClaimsValidator> claimsValidatorLookupStrategy
      Lookup strategy for claims validator.

    • claimsValidator

      @Nullable private ClaimsValidator claimsValidator
      The claims validator to use.

    • credentialResolver

      @NonnullAfterInit private CredentialResolver credentialResolver
      Source of signing keys.

    • refreshTokenDeserializers

      @Nonnull private List<BiFunction<ProfileRequestContext,String,RefreshTokenClaimsSet>> refreshTokenDeserializers
      List of deserializer bi-functions for refresh tokens to be used in addition to unsealing opaque value.

    • signedJWT

      @Nullable private com.nimbusds.jwt.SignedJWT signedJWT
      Copy of signed JWT for non-opaque access tokens.

  • Constructor Details

    • AbstractProcessTokenAction

      public AbstractProcessTokenAction()
      Constructor.

  • Method Details

    • setDataSealer

      public void setDataSealer(@Nullable DataSealer sealer)
      Set the data sealer instance to use.
      Parameters:
      sealer - data sealer to use

    • setClaimsValidatorLookupStrategy

      public void setClaimsValidatorLookupStrategy(@Nonnull Function<ProfileRequestContext,ClaimsValidator> strategy)
      Set the claims validator lookup strategy.
      Parameters:
      strategy - lookup strategy

    • setCredentialResolver

      public void setCredentialResolver(@Nullable CredentialResolver resolver)
      Set the source of signing keys to use for JWT signature verification.
      Parameters:
      resolver - signing key resolver

    • setRefreshTokenDeserializers

      public void setRefreshTokenDeserializers(@Nonnull List<BiFunction<ProfileRequestContext,String,RefreshTokenClaimsSet>> deserializers)
      Set the list of deserializer bi-functions for refresh tokens to be used in addition to unsealing opaque value.
      Parameters:
      deserializers - list of deserializers

    • doInitialize

      protected void doInitialize() throws ComponentInitializationException
      Overrides:
      doInitialize in class AbstractInitializableComponent
      Throws:
      ComponentInitializationException

    • doPreExecute

      protected boolean doPreExecute(@Nonnull ProfileRequestContext profileRequestContext)
      Overrides:
      doPreExecute in class AbstractOIDCRequestAction<T>

    • doExecute

      protected void doExecute(@Nonnull ProfileRequestContext profileRequestContext)
      Overrides:
      doExecute in class AbstractProfileAction

    • parseAccessToken

      @Nullable protected com.nimbusds.jwt.JWTClaimsSet parseAccessToken(@Nonnull @NotEmpty com.nimbusds.oauth2.sdk.token.Token token)
      Attempt to parse token.
      Parameters:
      token - the token
      Returns:
      parsed claim set or null

    • parseRefreshToken

      @Nullable protected com.nimbusds.jwt.JWTClaimsSet parseRefreshToken(@Nonnull ProfileRequestContext profileRequestContext, @Nonnull @NotEmpty com.nimbusds.oauth2.sdk.token.Token token)
      Attempt to parse refresh token.
      Parameters:
      profileRequestContext - the profile request context
      token - the token
      Returns:
      parsed claim set or null

    • getToken

      @Nullable protected abstract com.nimbusds.oauth2.sdk.token.Token getToken(@Nonnull ProfileRequestContext profileRequestContext)
      Get the token to process.
      Parameters:
      profileRequestContext - current profile request context
      Returns:
      the token to process