Package net.shibboleth.idp.plugin.oidc.op.admin.impl

Class IssueRegistrationAccessToken

java.lang.Object
net.shibboleth.shared.component.AbstractInitializableComponent
org.opensaml.profile.action.AbstractProfileAction
org.opensaml.profile.action.AbstractConditionalProfileAction
net.shibboleth.idp.profile.AbstractProfileAction
net.shibboleth.idp.plugin.oidc.op.admin.impl.AbstractAdminApiProfileAction
net.shibboleth.idp.plugin.oidc.op.admin.impl.IssueRegistrationAccessToken
All Implemented Interfaces:
Component, DestructableComponent, InitializableComponent, ProfileAction, Aware, MessageSource, MessageSourceAware, Action
public class IssueRegistrationAccessToken extends AbstractAdminApiProfileAction
Action that issues access token to be used for the OIDC dynamic registration endpoint.

On success, AccessTokenResponse is built and attached as a message for the outbound message context. Also a proceed event is built. On error, a non-proceed event is built.

Several access control checks are made to named policies in the case that certain options are supplied.

Since:
3.1.0
Event:
EventIds.PROCEED_EVENT_ID, EventIds.INVALID_PROFILE_CTX, EventIds.IO_ERROR

  • Field Details

  • Constructor Details

    • IssueRegistrationAccessToken

      public IssueRegistrationAccessToken()
      Constructor.

  • Method Details

    • setSealer

      public void setSealer(@Nonnull DataSealer sealer)
      Set the data sealer for handling access token.
      Parameters:
      sealer - data sealer.

    • setAccessControlService

      public void setAccessControlService(@Nonnull AccessControlService acs)
      Set the AccessControlService to use.
      Parameters:
      acs - service to use

    • setIdentifierGeneratorLookupStrategy

      public void setIdentifierGeneratorLookupStrategy(@Nonnull Function<ProfileRequestContext,IdentifierGenerationStrategy> strategy)
      Set the strategy used to locate the IdentifierGenerationStrategy to use.
      Parameters:
      strategy - lookup strategy

    • setIssuerLookupStrategy

      public void setIssuerLookupStrategy(@Nonnull Function<ProfileRequestContext,String> strategy)
      Set a lookup strategy for the token issuer.
      Parameters:
      strategy - lookup strategy

    • setMetadataPolicyLookupStrategy

      public void setMetadataPolicyLookupStrategy(@Nonnull Function<ProfileRequestContext,Map<String,MetadataPolicy>> strategy)
      Set a lookup strategy for the metadata policy.
      Parameters:
      strategy - lookup strategy

    • setTokenLifetimeLookupStrategy

      public void setTokenLifetimeLookupStrategy(@Nonnull Function<ProfileRequestContext,String> strategy)
      Set a lookup strategy for the token lifetime.
      Parameters:
      strategy - lookup strategy

    • setPolicyLocationLookupStrategy

      public void setPolicyLocationLookupStrategy(@Nonnull Function<ProfileRequestContext,String> strategy)
      Set a lookup strategy for the metadata policy location.
      Parameters:
      strategy - lookup strategy

    • setPolicyIdLookupStrategy

      public void setPolicyIdLookupStrategy(@Nonnull Function<ProfileRequestContext,String> strategy)
      Set a lookup strategy for the relying party identifier.
      Parameters:
      strategy - lookup strategy

    • setClientIdLookupStrategy

      public void setClientIdLookupStrategy(@Nonnull Function<ProfileRequestContext,String> strategy)
      Set a lookup strategy for the client identifier.
      Parameters:
      strategy - lookup strategy

    • setReplacementLookupStrategy

      public void setReplacementLookupStrategy(@Nonnull Function<ProfileRequestContext,String> strategy)
      Set a lookup strategy for the flag signaling registration replacement is allowed.
      Parameters:
      strategy - lookup strategy

    • setPolicyLocationPolicyName

      public void setPolicyLocationPolicyName(@Nullable @NotEmpty String name)
      Set an explicit policy name to apply governing policyLocation usage.
      Parameters:
      name - policy name

    • setPolicyIdPolicyName

      public void setPolicyIdPolicyName(@Nullable @NotEmpty String name)
      Set an explicit policy name to apply governing policyId usage.
      Parameters:
      name - policy name

    • setClientIdPolicyName

      public void setClientIdPolicyName(@Nullable @NotEmpty String name)
      Set an explicit policy name to apply governing clientId usage.
      Parameters:
      name - policy name

    • setDefaultTokenLifetime

      public void setDefaultTokenLifetime(@Nonnull Duration lifetime)
      Set the default token lifetime.
      Parameters:
      lifetime - token lifetime

    • setXmlSafeIdentifier

      public void setXmlSafeIdentifier(boolean flag)
      Set the xmlSafe-flag passed to the identifier generator
      Parameters:
      flag - xmlSafe-flag

    • doInitialize

      protected void doInitialize() throws ComponentInitializationException
      Overrides:
      doInitialize in class AbstractAdminApiProfileAction
      Throws:
      ComponentInitializationException

    • doPreExecute

      protected boolean doPreExecute(@Nonnull ProfileRequestContext profileRequestContext)
      Overrides:
      doPreExecute in class AbstractAdminApiProfileAction

    • doExecute

      protected void doExecute(@Nonnull ProfileRequestContext profileRequestContext)
      Overrides:
      doExecute in class AbstractProfileAction

    • checkAccess

      private boolean checkAccess(@Nonnull ProfileRequestContext profileRequestContext)
      Check access policies.
      Parameters:
      profileRequestContext - current profile request context
      Returns:
      true iff checks pass

    • addAuthenticationClaims

      private void addAuthenticationClaims(@Nonnull ProfileRequestContext profileRequestContext, @Nonnull RegistrationClaimsSet.Builder builder)
      Decorate the token with authentication-related claims.
      Parameters:
      profileRequestContext - profile request context
      builder - claims set builder