Package net.shibboleth.idp.plugin.oidc.op.profile.impl

Class ValidateGrant

java.lang.Object
net.shibboleth.shared.component.AbstractInitializableComponent
org.opensaml.profile.action.AbstractProfileAction
org.opensaml.profile.action.AbstractConditionalProfileAction
net.shibboleth.idp.profile.AbstractProfileAction
net.shibboleth.idp.plugin.oidc.op.profile.impl.AbstractOIDCRequestAction<TokenRequest>
net.shibboleth.idp.plugin.oidc.op.profile.impl.AbstractOIDCTokenRequestAction
net.shibboleth.idp.plugin.oidc.op.profile.impl.AbstractOIDCTokenResponseAction
net.shibboleth.idp.plugin.oidc.op.profile.impl.ValidateGrant
All Implemented Interfaces:
Component, DestructableComponent, InitializableComponent, ProfileAction, org.springframework.beans.factory.Aware, org.springframework.context.MessageSource, org.springframework.context.MessageSourceAware, org.springframework.webflow.execution.Action
public class ValidateGrant extends AbstractOIDCTokenResponseAction
Action that validates an authorization grant.

A grant is valid if it is successfully unwrapped, parsed as a code or refresh token, is unexpired, was issued to the expected client and has not been used before (authz code) or the authz code used to produce it has not been revoked (refresh token).

The validated claims from the grant are stored to response context via OIDCAuthenticationResponseContext.getAuthorizationGrantClaimsSet().

Note that the addition of support for the "client_credentials" grant type means that there may not in fact be a grant, or resulting claims set.

  • Field Details

  • Constructor Details

    • ValidateGrant

      public ValidateGrant(@Nonnull @ParameterName(name="sealer") DataSealer sealer)
      Constructor.
      Parameters:
      sealer - sealer to decrypt/hmac authorize code.

  • Method Details

    • setRelyingPartyContextLookupStrategy

      public void setRelyingPartyContextLookupStrategy(@Nonnull Function<ProfileRequestContext,RelyingPartyContext> strategy)
      Set the strategy used to locate the RelyingPartyContext associated with a given ProfileRequestContext.
      Parameters:
      strategy - strategy used to locate the RelyingPartyContext associated with a given ProfileRequestContext

    • setRefreshTokensEnabledPredicate

      public void setRefreshTokensEnabledPredicate(@Nonnull Predicate<ProfileRequestContext> predicate)
      Set the predicate used to indicate whether refresh tokens are enabled.
      Parameters:
      predicate - predicate used to indicate whether refresh tokens are enabled.

    • setReplayCache

      public void setReplayCache(@Nonnull ReplayCache cache)
      Set the replay cache instance to use.
      Parameters:
      cache - The replayCache to set.

    • setRevocationCache

      public void setRevocationCache(@Nonnull RevocationCache cache)
      Set the revocation cache instance to use.
      Parameters:
      cache - The revocationCache to set.

    • setChainRevocationLifetimeLookupStrategy

      public void setChainRevocationLifetimeLookupStrategy(@Nullable Function<ProfileRequestContext,Duration> strategy)
      Set a lookup strategy for the chain revocation lifetime.
      Parameters:
      strategy - What to set.

    • setRefreshTokenChainLifetimeLookupStrategy

      public void setRefreshTokenChainLifetimeLookupStrategy(@Nonnull Function<ProfileRequestContext,Duration> strategy)
      Set the strategy used to obtain the refresh token chain lifetime.
      Parameters:
      strategy - lookup strategy

    • setRefreshTokenDeserializers

      public void setRefreshTokenDeserializers(@Nonnull List<BiFunction<ProfileRequestContext,String,RefreshTokenClaimsSet>> deserializers)
      Set the list of deserializer bi-functions for refresh tokens to be used in addition to unsealing opaque value.
      Parameters:
      deserializers - list of deserializers

    • setDpopProofThumbprintLookupStrategy

      public void setDpopProofThumbprintLookupStrategy(@Nonnull Function<ProfileRequestContext,String> strategy)
      Set the strategy used to locate the thumbprint of validated DPoP Proof JWT.
      Parameters:
      strategy - lookup strategy
      Since:
      4.2.0

    • setTokenRevocationCondition

      public void setTokenRevocationCondition(@Nullable BiPredicate<ProfileRequestContext,JWTClaimsSet> condition)
      Set the predicate used to indicate whether the authorization code or refresh token is revoked.
      Parameters:
      condition - token revocation condition
      Since:
      4.3.0

    • doInitialize

      protected void doInitialize() throws ComponentInitializationException
      Overrides:
      doInitialize in class AbstractInitializableComponent
      Throws:
      ComponentInitializationException

    • doPreExecute

      protected boolean doPreExecute(@Nonnull ProfileRequestContext profileRequestContext)
      Overrides:
      doPreExecute in class AbstractOIDCTokenResponseAction

    • doExecute

      protected void doExecute(@Nonnull ProfileRequestContext profileRequestContext)
      Overrides:
      doExecute in class AbstractProfileAction

    • isPublicClient

      protected boolean isPublicClient()
      Checks if the client is a public client. If not metadata exists for the client, it's assumed to be confidential. The client is considered as confidential if its metadata doesn't specify "none" as the token endpoint authentication method.
      Returns:
      true if the client is public, false otherwise.

    • deserializeRefreshToken

      protected RefreshTokenClaimsSet deserializeRefreshToken(@Nonnull ProfileRequestContext profileRequestContext, @Nonnull String refreshToken)
      Attempt to deseriaalize a (serialized) refresh token value via configured deserializers.
      Parameters:
      profileRequestContext - The profile request context given to the deserializers
      refreshToken - The serialized refresh token value
      Returns:
      refresh token claims set, or null if it couldn't be parsed

    • revokeChain

      protected boolean revokeChain(@Nonnull String id, @Nullable Duration lifetime)
      Revokes the token chain with the given id, optionally with a given lifetime. If the given lifetime is null, the default lifetime set to the RevocationCache is used.
      Parameters:
      id - The identifier to be revoked in RevocationCacheContexts.AUTHORIZATION_CODE context.
      lifetime - The lifetime for the revocation
      Returns:
      The result returned by the RevocationCache