Package net.shibboleth.idp.plugin.oidc.op.profile.logic

Class AttributeTokenRevocationCondition

java.lang.Object

net.shibboleth.shared.component.AbstractInitializableComponent

net.shibboleth.idp.plugin.oidc.op.profile.logic.AttributeTokenRevocationCondition

All Implemented Interfaces:

BiPredicate<ProfileRequestContext,JWTClaimsSet>, Component, DestructableComponent, InitializableComponent

public class AttributeTokenRevocationCondition
extends AbstractInitializableComponent
implements BiPredicate<ProfileRequestContext,JWTClaimsSet>

A condition that checks for token revocation against a resolved IdPAttribute.

Since:

4.3.0

Field Summary

Fields

Modifier and Type	Field	Description
private String	attributeId	Attribute ID to resolve.
private ReloadableService<AttributeResolver>	attributeResolver	Attribute Resolver service.
private Function<ProfileRequestContext,String>	issuerLookupStrategy	Strategy used to locate the identity of the issuer associated with the attribute resolution.
private final org.slf4j.Logger	log	Class logger.
private BiFunction<ProfileRequestContext,JWTClaimsSet,String>	principalNameLookupStrategy	Lookup strategy for principal name.
private Function<ProfileRequestContext,String>	recipientLookupStrategy	Strategy used to locate the identity of the recipient associated with the attribute resolution.

Constructor Summary

Constructors

Constructor	Description
AttributeTokenRevocationCondition()	Constructor.

Method Summary

Modifier and Type	Method	Description
private AttributeResolutionContext	buildResolutionContext(ProfileRequestContext profileRequestContext, String principal)	Build an AttributeResolutionContext to use.
protected void	doInitialize()
protected boolean	isRevoked(String principal, JWTClaimsSet claimsSet, Collection<Instant> revocationRecords)	Check the revocation records' timestamps for applicability.
void	setAttributeId(String id)	Set the ID of an IdPAttribute to resolve to obtain revocation records for the principal.
void	setAttributeResolver(ReloadableService<AttributeResolver> service)	Set AttributeResolver to use.
void	setIssuerLookupStrategy(Function<ProfileRequestContext,String> strategy)	Set the strategy used to lookup the issuer for this attribute resolution.
void	setPrincipalNameLookupStrategy(BiFunction<ProfileRequestContext,JWTClaimsSet,String> strategy)	Set lookup strategy for principal name.
void	setRecipientLookupStrategy(Function<ProfileRequestContext,String> strategy)	Set the strategy used to lookup the recipient for this attribute resolution.
boolean	test(ProfileRequestContext profileRequestContext, JWTClaimsSet claimsSet)

Methods inherited from class net.shibboleth.shared.component.AbstractInitializableComponent

checkComponentActive, checkSetterPreconditions, destroy, doDestroy, ifDestroyedThrowDestroyedComponentException, ifInitializedThrowUnmodifiabledComponentException, ifNotInitializedThrowUninitializedComponentException, initialize, isDestroyed, isInitialized

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Methods inherited from interface java.util.function.BiPredicate

and, negate, or

Field Details

log

@Nonnull
private final org.slf4j.Logger log

Class logger.

principalNameLookupStrategy

@NonnullAfterInit
private BiFunction<ProfileRequestContext,JWTClaimsSet,String> principalNameLookupStrategy

Lookup strategy for principal name.

issuerLookupStrategy

@Nullable
private Function<ProfileRequestContext,String> issuerLookupStrategy

Strategy used to locate the identity of the issuer associated with the attribute resolution.

recipientLookupStrategy

@Nullable
private Function<ProfileRequestContext,String> recipientLookupStrategy

Strategy used to locate the identity of the recipient associated with the attribute resolution.

attributeResolver

@NonnullAfterInit
private ReloadableService<AttributeResolver> attributeResolver

Attribute Resolver service.

attributeId

@NonnullAfterInit
@NotEmpty
private String attributeId

Attribute ID to resolve.

Constructor Details

AttributeTokenRevocationCondition

public AttributeTokenRevocationCondition()

Constructor.

Method Details

setPrincipalNameLookupStrategy

public void setPrincipalNameLookupStrategy(@Nonnull
 BiFunction<ProfileRequestContext,JWTClaimsSet,String> strategy)

Set lookup strategy for principal name.

Parameters:

strategy - lookup strategy

setIssuerLookupStrategy

public void setIssuerLookupStrategy(@Nullable
 Function<ProfileRequestContext,String> strategy)

Set the strategy used to lookup the issuer for this attribute resolution.

Parameters:

strategy - lookup strategy

setRecipientLookupStrategy

public void setRecipientLookupStrategy(@Nullable
 Function<ProfileRequestContext,String> strategy)

Set the strategy used to lookup the recipient for this attribute resolution.

Parameters:

strategy - lookup strategy

setAttributeResolver

public void setAttributeResolver(@Nonnull
 ReloadableService<AttributeResolver> service)

Set AttributeResolver to use.

Parameters:

service - attribute resolver service

setAttributeId

public void setAttributeId(@Nonnull @NotEmpty
 String id)

Set the ID of an IdPAttribute to resolve to obtain revocation records for the principal.

Parameters:

id - attribute ID to resolve

doInitialize

protected void doInitialize()
                     throws ComponentInitializationException

Overrides:

doInitialize in class AbstractInitializableComponent

Throws:

ComponentInitializationException

test

public boolean test(@Nullable
 ProfileRequestContext profileRequestContext,
 @Nullable
 JWTClaimsSet claimsSet)

Specified by:

test in interface BiPredicate<ProfileRequestContext,JWTClaimsSet>

buildResolutionContext

@Nonnull
private AttributeResolutionContext buildResolutionContext(@Nonnull
 ProfileRequestContext profileRequestContext,
 @Nonnull @NotEmpty
 String principal)

Build an AttributeResolutionContext to use.

Parameters:

profileRequestContext - profile request context

principal - name of principal

Returns:

the attached context

isRevoked

protected boolean isRevoked(@Nonnull @NotEmpty
 String principal,
 @Nonnull
 JWTClaimsSet claimsSet,
 @Nonnull
 Collection<Instant> revocationRecords)

Check the revocation records' timestamps for applicability.

Parameters:

principal - name of principal

claimsSet - claims set containing TokenClaimsSet.KEY_AUTH_TIME

revocationRecords - the records from the cache

Returns:

true iff the revocation applies to this claims set