Package net.shibboleth.idp.plugin.oidc.op.oauth2.profile.impl

Class ValidateDPoPProof

java.lang.Object

net.shibboleth.shared.component.AbstractInitializableComponent

org.opensaml.profile.action.AbstractProfileAction

org.opensaml.profile.action.AbstractConditionalProfileAction

net.shibboleth.idp.profile.AbstractProfileAction

net.shibboleth.idp.plugin.oidc.op.profile.impl.AbstractOIDCRequestAction<Request>

net.shibboleth.idp.plugin.oidc.op.oauth2.profile.impl.ValidateDPoPProof

All Implemented Interfaces:

Component, DestructableComponent, InitializableComponent, ProfileAction, org.springframework.beans.factory.Aware, org.springframework.context.MessageSource, org.springframework.context.MessageSourceAware, org.springframework.webflow.execution.Action

public class ValidateDPoPProof
extends AbstractOIDCRequestAction<Request>

Action validates DPoP Proof JWT if already stored to the context. If validation succeeds, the JWK thumbprint is stored in the context.

Field Summary

Fields

Modifier and Type	Field	Description
private ClaimsValidator	claimsValidator	The claims validator to be applied for validating the DPoP proof.
private Function<ProfileRequestContext,ClaimsValidator>	claimsValidatorLookupStrategy	Lookup for the claims validator to be applied for validating the DPoP proof.
private org.slf4j.Logger	log	Class logger.
private Function<ProfileRequestContext,Function<ProfileRequestContext,String>>	nonceGeneratorLookupStrategy	Lookup for the nonce generator used for generating nonces.

Constructor Summary

Constructors

Constructor	Description
ValidateDPoPProof()	Constructor.

Method Summary

Modifier and Type	Method	Description
protected void	doExecute(ProfileRequestContext profileRequestContext)
protected boolean	doPreExecute(ProfileRequestContext profileRequestContext)
protected void	handleNonceValidationFailure(ProfileRequestContext profileRequestContext)	Attach a new nonce to the HTTP servlet response or builds the corresponding event ID to the given PRC if the nonce cannot be generated or attached.
void	setClaimsValidatorLookupStrategy(Function<ProfileRequestContext,ClaimsValidator> strategy)	Set the lookup strategy for the claims validator used for validating the DPoP proof.
void	setDpopProofNonceGeneratorLookupStrategy(Function<ProfileRequestContext,Function<ProfileRequestContext,String>> strategy)	Set the lookup strategy for the nonce generator to create nonces to be used in DPoP proof.

Methods inherited from class net.shibboleth.idp.plugin.oidc.op.profile.impl.AbstractOIDCRequestAction

getRequest

Methods inherited from class net.shibboleth.idp.profile.AbstractProfileAction

doExecute, execute, getBean, getBean, getMessage, getMessage, getMessage, getParameter, getParameter, getProfileContextLookupStrategy, getRequestContext, getResult, setMessageSource, setProfileContextLookupStrategy

Methods inherited from class org.opensaml.profile.action.AbstractConditionalProfileAction

getActivationCondition, setActivationCondition

Methods inherited from class org.opensaml.profile.action.AbstractProfileAction

doPostExecute, doPostExecute, ensureHttpServletRequest, ensureHttpServletResponse, execute, getHttpServletRequest, getHttpServletRequestSupplier, getHttpServletResponse, getHttpServletResponseSupplier, getLogPrefix, isPreExecuteCalled, setHttpServletRequestSupplier, setHttpServletResponseSupplier

Methods inherited from class net.shibboleth.shared.component.AbstractInitializableComponent

checkComponentActive, checkSetterPreconditions, destroy, doDestroy, doInitialize, ifDestroyedThrowDestroyedComponentException, ifInitializedThrowUnmodifiabledComponentException, ifNotInitializedThrowUninitializedComponentException, initialize, isDestroyed, isInitialized

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Methods inherited from interface net.shibboleth.shared.component.InitializableComponent

initialize, isInitialized

Field Details

log

@Nonnull
private org.slf4j.Logger log

Class logger.

claimsValidatorLookupStrategy

@Nonnull
private Function<ProfileRequestContext,ClaimsValidator> claimsValidatorLookupStrategy

Lookup for the claims validator to be applied for validating the DPoP proof.

nonceGeneratorLookupStrategy

@Nonnull
private Function<ProfileRequestContext,Function<ProfileRequestContext,String>> nonceGeneratorLookupStrategy

Lookup for the nonce generator used for generating nonces.

claimsValidator

@Nullable
private ClaimsValidator claimsValidator

The claims validator to be applied for validating the DPoP proof.

Constructor Details

ValidateDPoPProof

public ValidateDPoPProof()

Constructor.

Method Details

setClaimsValidatorLookupStrategy

public void setClaimsValidatorLookupStrategy(@Nonnull
 Function<ProfileRequestContext,ClaimsValidator> strategy)

Set the lookup strategy for the claims validator used for validating the DPoP proof.

Parameters:

strategy - What to set

setDpopProofNonceGeneratorLookupStrategy

public void setDpopProofNonceGeneratorLookupStrategy(@Nonnull
 Function<ProfileRequestContext,Function<ProfileRequestContext,String>> strategy)

Set the lookup strategy for the nonce generator to create nonces to be used in DPoP proof.

Parameters:

strategy - What to set

doPreExecute

protected boolean doPreExecute(@Nonnull
 ProfileRequestContext profileRequestContext)

Overrides:

doPreExecute in class AbstractOIDCRequestAction<Request>

doExecute

protected void doExecute(@Nonnull
 ProfileRequestContext profileRequestContext)

Overrides:

doExecute in class AbstractProfileAction

handleNonceValidationFailure

protected void handleNonceValidationFailure(@Nonnull
 ProfileRequestContext profileRequestContext)

Attach a new nonce to the HTTP servlet response or builds the corresponding event ID to the given PRC if the nonce cannot be generated or attached.

Parameters:

profileRequestContext - the context to be populated with error event ID