Package net.shibboleth.idp.plugin.oidc.op.oauth2.profile.impl

Class RevokeToken

java.lang.Object

net.shibboleth.shared.component.AbstractInitializableComponent

org.opensaml.profile.action.AbstractProfileAction

org.opensaml.profile.action.AbstractConditionalProfileAction

net.shibboleth.idp.profile.AbstractProfileAction

net.shibboleth.idp.plugin.oidc.op.oauth2.profile.impl.RevokeToken

All Implemented Interfaces:

Component, DestructableComponent, InitializableComponent, ProfileAction, Aware, MessageSource, MessageSourceAware, Action

public class RevokeToken
extends AbstractProfileAction

Action that revokes a single token or the full chain of tokens, depending on the result of the configured lookup strategy for the revocation method. The full chain of tokens refer to the token that is fed to this action together with all other tokens related to the same root token identifier. For legacy reasons, if the root token identifier is not existing in the claims set but the full chain is to be revoked, the JWT identifier (jti) from the claims set is used as the root token identifier.

Event:

EventIds.PROCEED_EVENT_ID, OidcEventIds.REVOCATION_FAILED

Field Summary

Fields

Modifier and Type	Field	Description
private Function<ProfileRequestContext,Duration>	chainRevocationLifetimeLookupStrategy	Lookup function to supply chain revocation lifetime.
private JWTClaimsSet	claimsSet	The claims set to operate on.
private org.slf4j.Logger	log	Class logger.
private RevocationCache	revocationCache	Message revocation cache instance to use.
private Duration	revocationLifetime	Revocation lifetime to use.
private OAuth2TokenRevocationConfiguration.OAuth2TokenRevocationMethod	revocationMethod	Revocation method used when revoking a token.
private Function<ProfileRequestContext,OAuth2TokenRevocationConfiguration.OAuth2TokenRevocationMethod>	revocationMethodLookupStrategy	Which revocation method should be used when revoking a token.
private Function<JWTClaimsSet,String>	rootTokenIdentifierLookupStrategy	Lookup function to supply root token identifier.
private Function<JWTClaimsSet,Duration>	tokenRevocationLifetimeLookupStrategy	Lookup function to supply token revocation lifetime.

Constructor Summary

Constructors

Constructor	Description
RevokeToken()	Constructor.

Method Summary

Modifier and Type	Method	Description
protected void	doExecute(ProfileRequestContext profileRequestContext)
protected void	doInitialize()
protected boolean	doPreExecute(ProfileRequestContext profileRequestContext)
void	setChainRevocationLifetimeLookupStrategy(Function<ProfileRequestContext,Duration> strategy)	Set a lookup strategy for the chain revocation lifetime.
void	setRevocationCache(RevocationCache cache)	Set the revocation cache instance to use.
void	setRevocationMethodLookupStrategy(Function<ProfileRequestContext,OAuth2TokenRevocationConfiguration.OAuth2TokenRevocationMethod> strategy)	Set strategy for looking up which revocation method should be used when revoking a token.
void	setRootTokenIdentifierLookupStrategy(Function<JWTClaimsSet,String> strategy)	Set a lookup strategy for the root token identifier.
void	setTokenRevocationLifetimeLookupStrategy(Function<JWTClaimsSet,Duration> strategy)	Set a lookup strategy for the token revocation lifetime.

Methods inherited from class net.shibboleth.idp.profile.AbstractProfileAction

doExecute, execute, getBean, getBean, getMessage, getMessage, getMessage, getParameter, getParameter, getProfileContextLookupStrategy, getRequestContext, getResult, setMessageSource, setProfileContextLookupStrategy

Methods inherited from class org.opensaml.profile.action.AbstractConditionalProfileAction

getActivationCondition, setActivationCondition

Methods inherited from class org.opensaml.profile.action.AbstractProfileAction

doPostExecute, doPostExecute, ensureHttpServletRequest, ensureHttpServletResponse, execute, getHttpServletRequest, getHttpServletRequestSupplier, getHttpServletResponse, getHttpServletResponseSupplier, getLogPrefix, isPreExecuteCalled, setHttpServletRequestSupplier, setHttpServletResponseSupplier

Methods inherited from class net.shibboleth.shared.component.AbstractInitializableComponent

checkComponentActive, checkSetterPreconditions, destroy, doDestroy, ifDestroyedThrowDestroyedComponentException, ifInitializedThrowUnmodifiabledComponentException, ifNotInitializedThrowUninitializedComponentException, initialize, isDestroyed, isInitialized

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Methods inherited from interface net.shibboleth.shared.component.InitializableComponent

initialize, isInitialized

Field Details

log

@Nonnull
private org.slf4j.Logger log

Class logger.

revocationCache

@NonnullAfterInit
private RevocationCache revocationCache

Message revocation cache instance to use.

revocationMethodLookupStrategy

@Nonnull
private Function<ProfileRequestContext,OAuth2TokenRevocationConfiguration.OAuth2TokenRevocationMethod> revocationMethodLookupStrategy

Which revocation method should be used when revoking a token. Supported values are CHAIN and TOKEN. The default is CHAIN.

chainRevocationLifetimeLookupStrategy

@Nonnull
private Function<ProfileRequestContext,Duration> chainRevocationLifetimeLookupStrategy

Lookup function to supply chain revocation lifetime.

tokenRevocationLifetimeLookupStrategy

@Nonnull
private Function<JWTClaimsSet,Duration> tokenRevocationLifetimeLookupStrategy

Lookup function to supply token revocation lifetime.

rootTokenIdentifierLookupStrategy

@Nonnull
private Function<JWTClaimsSet,String> rootTokenIdentifierLookupStrategy

Lookup function to supply root token identifier.

revocationMethod

private OAuth2TokenRevocationConfiguration.OAuth2TokenRevocationMethod revocationMethod

Revocation method used when revoking a token.

revocationLifetime

private Duration revocationLifetime

Revocation lifetime to use.

claimsSet

private JWTClaimsSet claimsSet

The claims set to operate on.

Constructor Details

RevokeToken

public RevokeToken()

Constructor.

Method Details

setRevocationCache

public void setRevocationCache(@Nonnull
 RevocationCache cache)

Set the revocation cache instance to use.

Parameters:

cache - The revocationCache to set.

setRevocationMethodLookupStrategy

public void setRevocationMethodLookupStrategy(@Nonnull
 Function<ProfileRequestContext,OAuth2TokenRevocationConfiguration.OAuth2TokenRevocationMethod> strategy)

Set strategy for looking up which revocation method should be used when revoking a token.

Parameters:

strategy - What to set.

setChainRevocationLifetimeLookupStrategy

public void setChainRevocationLifetimeLookupStrategy(@Nullable
 Function<ProfileRequestContext,Duration> strategy)

Set a lookup strategy for the chain revocation lifetime.

Parameters:

strategy - What to set.

setTokenRevocationLifetimeLookupStrategy

public void setTokenRevocationLifetimeLookupStrategy(@Nullable
 Function<JWTClaimsSet,Duration> strategy)

Set a lookup strategy for the token revocation lifetime.

Parameters:

strategy - What to set.

setRootTokenIdentifierLookupStrategy

public void setRootTokenIdentifierLookupStrategy(@Nullable
 Function<JWTClaimsSet,String> strategy)

Set a lookup strategy for the root token identifier.

Parameters:

strategy - What to set.

doInitialize

protected void doInitialize()
                     throws ComponentInitializationException

Overrides:

doInitialize in class AbstractInitializableComponent

Throws:

ComponentInitializationException

doPreExecute

protected boolean doPreExecute(@Nonnull
 ProfileRequestContext profileRequestContext)

Overrides:

doPreExecute in class AbstractConditionalProfileAction

doExecute

protected void doExecute(@Nonnull
 ProfileRequestContext profileRequestContext)

Overrides:

doExecute in class AbstractProfileAction