Package net.shibboleth.idp.plugin.oidc.op.oauth2.profile.impl

Class AbstractProcessTokenAction<T>

java.lang.Object

net.shibboleth.shared.component.AbstractInitializableComponent

org.opensaml.profile.action.AbstractProfileAction

org.opensaml.profile.action.AbstractConditionalProfileAction

net.shibboleth.idp.profile.AbstractProfileAction

net.shibboleth.idp.plugin.oidc.op.profile.impl.AbstractOIDCRequestAction<T>

net.shibboleth.idp.plugin.oidc.op.oauth2.profile.impl.AbstractProcessTokenAction<T>

Type Parameters:

T - request message type

All Implemented Interfaces:

Component, DestructableComponent, InitializableComponent, ProfileAction, Aware, MessageSource, MessageSourceAware, Action

Direct Known Subclasses:

ProcessTokenForIntrospection, ProcessTokenForRevocation

public abstract class AbstractProcessTokenAction<T>
extends AbstractOIDCRequestAction<T>

Action that processes a token by validating it and populating the resulting JWTClaimsSet into an OAuth2TokenMgmtResponseContext placed beneath the outbound MessageContext.

If the token can't be validated, the context is not populated.

Since:

3.1.0

Event:

EventIds.PROCEED_EVENT_ID, IdPEventIds.INVALID_PROFILE_CONFIG

Postcondition:

If the token is valid for use, ProfileRequestContext.getOutboundMessageContext().getSubcontext( OAuth2TokenMgmtResponseContext.class) != null and the context contains the token's JWTClaimsSet.

Field Summary

Fields

Modifier and Type	Field	Description
private ClaimsValidator	claimsValidator	The claims validator to use.
private Function<ProfileRequestContext,ClaimsValidator>	claimsValidatorLookupStrategy	Lookup strategy for claims validator.
private CredentialResolver	credentialResolver	Source of signing keys.
private DataSealer	dataSealer	Data sealer for unwrapping token.
private org.slf4j.Logger	log	Class logger.
private List<BiFunction<ProfileRequestContext,String,RefreshTokenClaimsSet>>	refreshTokenDeserializers	List of deserializer bi-functions for refresh tokens to be used in addition to unsealing opaque value.
private SignedJWT	signedJWT	Copy of signed JWT for non-opaque access tokens.

Constructor Summary

Constructors

Constructor	Description
AbstractProcessTokenAction()	Constructor.

Method Summary

Modifier and Type	Method	Description
protected void	doExecute(ProfileRequestContext profileRequestContext)
protected void	doInitialize()
protected boolean	doPreExecute(ProfileRequestContext profileRequestContext)
protected abstract Token	getToken(ProfileRequestContext profileRequestContext)	Get the token to process.
protected JWTClaimsSet	parseAccessToken(Token token)	Attempt to parse token.
protected JWTClaimsSet	parseRefreshToken(ProfileRequestContext profileRequestContext, Token token)	Attempt to parse refresh token.
void	setClaimsValidatorLookupStrategy(Function<ProfileRequestContext,ClaimsValidator> strategy)	Set the claims validator lookup strategy.
void	setCredentialResolver(CredentialResolver resolver)	Set the source of signing keys to use for JWT signature verification.
void	setDataSealer(DataSealer sealer)	Set the data sealer instance to use.
void	setRefreshTokenDeserializers(List<BiFunction<ProfileRequestContext,String,RefreshTokenClaimsSet>> deserializers)	Set the list of deserializer bi-functions for refresh tokens to be used in addition to unsealing opaque value.

Methods inherited from class net.shibboleth.idp.plugin.oidc.op.profile.impl.AbstractOIDCRequestAction

getRequest

Methods inherited from class net.shibboleth.idp.profile.AbstractProfileAction

doExecute, execute, getBean, getBean, getMessage, getMessage, getMessage, getParameter, getParameter, getProfileContextLookupStrategy, getRequestContext, getResult, setMessageSource, setProfileContextLookupStrategy

Methods inherited from class org.opensaml.profile.action.AbstractConditionalProfileAction

getActivationCondition, setActivationCondition

Methods inherited from class org.opensaml.profile.action.AbstractProfileAction

doPostExecute, doPostExecute, ensureHttpServletRequest, ensureHttpServletResponse, execute, getHttpServletRequest, getHttpServletRequestSupplier, getHttpServletResponse, getHttpServletResponseSupplier, getLogPrefix, isPreExecuteCalled, setHttpServletRequestSupplier, setHttpServletResponseSupplier

Methods inherited from class net.shibboleth.shared.component.AbstractInitializableComponent

checkComponentActive, checkSetterPreconditions, destroy, doDestroy, ifDestroyedThrowDestroyedComponentException, ifInitializedThrowUnmodifiabledComponentException, ifNotInitializedThrowUninitializedComponentException, initialize, isDestroyed, isInitialized

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Methods inherited from interface net.shibboleth.shared.component.InitializableComponent

initialize, isInitialized

Field Details

log

@Nonnull
private org.slf4j.Logger log

Class logger.

dataSealer

@Nullable
private DataSealer dataSealer

Data sealer for unwrapping token.

claimsValidatorLookupStrategy

@Nonnull
private Function<ProfileRequestContext,ClaimsValidator> claimsValidatorLookupStrategy

Lookup strategy for claims validator.

claimsValidator

@Nullable
private ClaimsValidator claimsValidator

The claims validator to use.

credentialResolver

@NonnullAfterInit
private CredentialResolver credentialResolver

Source of signing keys.

refreshTokenDeserializers

@Nonnull
private List<BiFunction<ProfileRequestContext,String,RefreshTokenClaimsSet>> refreshTokenDeserializers

List of deserializer bi-functions for refresh tokens to be used in addition to unsealing opaque value.

signedJWT

@Nullable
private SignedJWT signedJWT

Copy of signed JWT for non-opaque access tokens.

Constructor Details

AbstractProcessTokenAction

public AbstractProcessTokenAction()

Constructor.

Method Details

setDataSealer

public void setDataSealer(@Nullable
 DataSealer sealer)

Set the data sealer instance to use.

Parameters:

sealer - data sealer to use

setClaimsValidatorLookupStrategy

public void setClaimsValidatorLookupStrategy(@Nonnull
 Function<ProfileRequestContext,ClaimsValidator> strategy)

Set the claims validator lookup strategy.

Parameters:

strategy - lookup strategy

setCredentialResolver

public void setCredentialResolver(@Nullable
 CredentialResolver resolver)

Set the source of signing keys to use for JWT signature verification.

Parameters:

resolver - signing key resolver

setRefreshTokenDeserializers

public void setRefreshTokenDeserializers(@Nonnull
 List<BiFunction<ProfileRequestContext,String,RefreshTokenClaimsSet>> deserializers)

Set the list of deserializer bi-functions for refresh tokens to be used in addition to unsealing opaque value.

Parameters:

deserializers - list of deserializers

doInitialize

protected void doInitialize()
                     throws ComponentInitializationException

Overrides:

doInitialize in class AbstractInitializableComponent

Throws:

ComponentInitializationException

doPreExecute

protected boolean doPreExecute(@Nonnull
 ProfileRequestContext profileRequestContext)

Overrides:

doPreExecute in class AbstractOIDCRequestAction<T>

doExecute

protected void doExecute(@Nonnull
 ProfileRequestContext profileRequestContext)

Overrides:

doExecute in class AbstractProfileAction

parseAccessToken

@Nullable
protected JWTClaimsSet parseAccessToken(@Nonnull @NotEmpty
 Token token)

Attempt to parse token.

Parameters:

token - the token

Returns:

parsed claim set or null

parseRefreshToken

@Nullable
protected JWTClaimsSet parseRefreshToken(@Nonnull
 ProfileRequestContext profileRequestContext,
 @Nonnull @NotEmpty
 Token token)

Attempt to parse refresh token.

Parameters:

profileRequestContext - the profile request context

token - the token

Returns:

parsed claim set or null

getToken

@Nullable
protected abstract Token getToken(@Nonnull
 ProfileRequestContext profileRequestContext)

Get the token to process.

Parameters:

profileRequestContext - current profile request context

Returns:

the token to process