Package net.shibboleth.idp.plugin.oidc.op.profile.logic
package net.shibboleth.idp.plugin.oidc.op.profile.logic
Functions and predicates supporting common oidc profile behavior.
-
ClassesClassDescriptionBase component for the pushed authorization request URI serializer and deserializer functions.A predicate implementation that checks if attribute consent flag is enabled.A function that returns subject identifier from filtered claims.Default function for looking up the allowed scope.Validation strategy for the inbound message.Default lookup function for fetching the chain revocation lifetime.A predicate that returns true if all the following conditions are met:
DefaultEnforceSelfAudienceCondition.limitInitialAccessTokenToSelfPredicatereturns true The inbound message is aTokenRequestThe token request grant_type is authorization_codeDefault implementation for deserializing an incoming JWT refresh token into the refresh token claims set.Default implementation for serializing the refresh token claims set into a JWT refresh token.Default validation strategy for logout hints.A function returning aCriteriaSetwhich contains the metadata policy document location asResourceLocationCriterion.A function that merges two maps of metadata policies according to the rules specified in the OIDC federation spec (draft 17), section 5.1.3.1:Default validation strategy for post logout redirection URIs.Default deserialization function for decoding the request URI into claims set within OAuth2 PAR.Default serialization function for the request URI claims set within OAuth2 PAR.Default predicate to decide if the pre-existing consent should be revoked.Default lookup function for fetching the root token identifier from the given claims set.Function to decide on subject type.Default lookup function for fetching the token revocation lifetime from the given claims set.Default lookup function for fetching the allowed scope from the unregistered client policy.Default validator for the unregistered client policies.Deprecated, for removal: This API element is subject to removal in a future version.The response type validation is handled against the policy in the SWF actionA function that calculates a hash of the DPoP access token from theHttpServletRequestif found.A predicate returning true it detects a DPoP access token from theHttpServletRequest.Activation condition returning true if validated scope contains 'openid' scope.A custom bi-predicate for redirect URI validation exploiting metadata policy.A predicate for matching if the OIDC metadata value with a configurable key is equal to a configurable value.A predicate returning true if validated scope contains 'offline_access' value.Activation condition returning true if pairwise subject is requested.Activation condition returning true if public subject is requested.Default deserialization function for decoding the request URI into claims set within OAuth2 PAR.A serialization function for the request URI claims set within OAuth2 PAR.Activation condition returning true if subject cannot be located from oidc response context.