Package net.shibboleth.idp.plugin.oidc.op.oauth2.profile.impl

Class ValidateClientIDAgainstPolicy

java.lang.Object

net.shibboleth.shared.component.AbstractInitializableComponent

org.opensaml.profile.action.AbstractProfileAction

org.opensaml.profile.action.AbstractConditionalProfileAction

net.shibboleth.idp.profile.AbstractProfileAction

net.shibboleth.idp.plugin.oidc.op.oauth2.profile.impl.ValidateClientIDAgainstPolicy

All Implemented Interfaces:

Component, DestructableComponent, InitializableComponent, ProfileAction, Aware, MessageSource, MessageSourceAware, Action

public class ValidateClientIDAgainstPolicy
extends AbstractProfileAction

Validates a client ID against unregistered client policy via configurable policy enforcer. The validation is done only if OIDCMetadataContext is not found under the inbound message context.

Since:

4.0.0

Field Summary

Fields

Modifier and Type	Field	Description
private com.nimbusds.oauth2.sdk.id.ClientID	clientId	OAuth2 client id.
private Function<MessageContext,com.nimbusds.oauth2.sdk.id.ClientID>	clientIDLookupStrategy	Strategy used to obtain the client id value for authorize/token request.
private final org.slf4j.Logger	log	Class logger.
private Map<String,UnregisteredClientPolicy>	policies	The policies used for validating client id.
private BiFunction<Object,MetadataPolicy,Pair<Object,Boolean>>	unregisteredClientPolicyEnforcer	Enforcer function for validating client ID against the configured policy.
private Function<ProfileRequestContext,Map<String,UnregisteredClientPolicy>>	unregisteredClientPolicyLookupStrategy	Strategy used to locate the unregistered client policy configured for the profile.

Constructor Summary

Constructors

Constructor	Description
ValidateClientIDAgainstPolicy()	Constructor.

Method Summary

Modifier and Type	Method	Description
protected void	doExecute(ProfileRequestContext profileRequestContext)
protected boolean	doPreExecute(ProfileRequestContext profileRequestContext)
void	setClientIDLookupStrategy(Function<MessageContext,com.nimbusds.oauth2.sdk.id.ClientID> strategy)	Set the strategy used to locate the client id of the request.
void	setUnregisteredClientPolicyEnforcer(BiFunction<Object,MetadataPolicy,Pair<Object,Boolean>> enforcer)	Set the enforcer function for validating client ID against the configured policy.
void	setUnregisteredClientPolicyLookupStrategy(Function<ProfileRequestContext,Map<String,UnregisteredClientPolicy>> strategy)	Set the strategy used to locate the unregistered client policy configured for the profile.

Methods inherited from class net.shibboleth.idp.profile.AbstractProfileAction

doExecute, execute, getBean, getBean, getMessage, getMessage, getMessage, getParameter, getParameter, getProfileContextLookupStrategy, getRequestContext, getResult, setMessageSource, setProfileContextLookupStrategy

Methods inherited from class org.opensaml.profile.action.AbstractConditionalProfileAction

getActivationCondition, setActivationCondition

Methods inherited from class org.opensaml.profile.action.AbstractProfileAction

doPostExecute, doPostExecute, ensureHttpServletRequest, ensureHttpServletResponse, execute, getHttpServletRequest, getHttpServletRequestSupplier, getHttpServletResponse, getHttpServletResponseSupplier, getLogPrefix, isPreExecuteCalled, setHttpServletRequestSupplier, setHttpServletResponseSupplier

Methods inherited from class net.shibboleth.shared.component.AbstractInitializableComponent

checkComponentActive, checkSetterPreconditions, destroy, doDestroy, doInitialize, ifDestroyedThrowDestroyedComponentException, ifInitializedThrowUnmodifiabledComponentException, ifNotInitializedThrowUninitializedComponentException, initialize, isDestroyed, isInitialized

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Methods inherited from interface net.shibboleth.shared.component.InitializableComponent

initialize, isInitialized

Field Details

log

@Nonnull
private final org.slf4j.Logger log

Class logger.

unregisteredClientPolicyLookupStrategy

@NonnullAfterInit
private Function<ProfileRequestContext,Map<String,UnregisteredClientPolicy>> unregisteredClientPolicyLookupStrategy

Strategy used to locate the unregistered client policy configured for the profile.

clientIDLookupStrategy

@Nonnull
private Function<MessageContext,com.nimbusds.oauth2.sdk.id.ClientID> clientIDLookupStrategy

Strategy used to obtain the client id value for authorize/token request.

unregisteredClientPolicyEnforcer

@Nonnull
private BiFunction<Object,MetadataPolicy,Pair<Object,Boolean>> unregisteredClientPolicyEnforcer

Enforcer function for validating client ID against the configured policy.

clientId

@Nullable
private com.nimbusds.oauth2.sdk.id.ClientID clientId

OAuth2 client id.

policies

@Nullable
private Map<String,UnregisteredClientPolicy> policies

The policies used for validating client id.

Constructor Details

ValidateClientIDAgainstPolicy

public ValidateClientIDAgainstPolicy()

Constructor.

Method Details

setClientIDLookupStrategy

public void setClientIDLookupStrategy(@Nonnull
 Function<MessageContext,com.nimbusds.oauth2.sdk.id.ClientID> strategy)

Set the strategy used to locate the client id of the request.

Parameters:

strategy - lookup strategy

setUnregisteredClientPolicyLookupStrategy

public void setUnregisteredClientPolicyLookupStrategy(Function<ProfileRequestContext,Map<String,UnregisteredClientPolicy>> strategy)

Set the strategy used to locate the unregistered client policy configured for the profile.

Parameters:

strategy - lookup strategy

setUnregisteredClientPolicyEnforcer

public void setUnregisteredClientPolicyEnforcer(BiFunction<Object,MetadataPolicy,Pair<Object,Boolean>> enforcer)

Set the enforcer function for validating client ID against the configured policy.

Parameters:

enforcer - policy enforcer

doPreExecute

protected boolean doPreExecute(@Nonnull
 ProfileRequestContext profileRequestContext)

Overrides:

doPreExecute in class AbstractConditionalProfileAction

doExecute

protected void doExecute(@Nonnull
 ProfileRequestContext profileRequestContext)

Overrides:

doExecute in class AbstractProfileAction