Package net.shibboleth.idp.plugin.oidc.op.token.support

Class TokenClaimsSet

java.lang.Object
net.shibboleth.idp.plugin.oidc.op.token.support.TokenClaimsSet
Direct Known Subclasses:
AccessTokenClaimsSet, AuthorizeCodeClaimsSet, RefreshTokenClaimsSet
@NotThreadSafe public class TokenClaimsSet extends Object
Class to extend for token claims sets. Offers the base functionality to Authorize Code, Refresh Token and Access Token.

  • Field Details

  • Constructor Details

    • TokenClaimsSet

      protected TokenClaimsSet()
      Default constructor for some subclasses.

    • TokenClaimsSet

      protected TokenClaimsSet(@Nonnull JWTClaimsSet jwt)
      Constructor.
      Parameters:
      jwt - the claim set to wrap
      Since:
      3.1.0

  • Method Details

    • verifyParsedClaims

      protected static void verifyParsedClaims(@Nonnull @NotEmpty String tokenType, @Nonnull JWTClaimsSet tokenClaimsSet) throws ParseException
      Helper to verify parsed claims are what is expected.
      Parameters:
      tokenType - The type of the expected token
      tokenClaimsSet - token claims set
      Throws:
      ParseException - if claims set is not expected one.

    • serialize

      @Nonnull @NotEmpty public String serialize()
      Serialize the token as JSON String.
      Returns:
      token as JSON String

    • serialize

      @Nonnull public String serialize(@Nonnull DataSealer dataSealer) throws DataSealerException
      Serialize the token as JSON String wrapped with sealer.
      Parameters:
      dataSealer - data sealer to wrap the JSON serialization
      Returns:
      token as JSON String wrapped with sealer
      Throws:
      DataSealerException - is thrown if unwrapping fails

    • setClaimsSet

      public void setClaimsSet(@Nonnull JWTClaimsSet claimsSet)
      Set the token claims set.
      Parameters:
      claimsSet - What to set

    • getClaimsSet

      @Nullable public JWTClaimsSet getClaimsSet()
      Get the token claims set.
      Returns:
      token claims set

    • assertedClaimsSet

      @Nonnull protected JWTClaimsSet assertedClaimsSet()
      Get the token claims set. If the claims set is null a ConstraintViolationException is thrown.
      Returns:
      token claims set
      Since:
      4.1.0

    • getIssuer

      @Nonnull @NotEmpty public String getIssuer()
      Get the issuer.
      Returns:
      issuer
      Since:
      3.1.0

    • getIssuedAt

      @Nonnull public Instant getIssuedAt()
      Get issuance time of the token.
      Returns:
      issuance time
      Since:
      3.1.0

    • getExp

      @Nonnull public Instant getExp()
      Get expiration time of the token.
      Returns:
      expiration time of the token

    • getNotBefore

      @Nullable public Instant getNotBefore()
      Get not before time of the token, if any.
      Returns:
      not before time of the token
      Since:
      3.1.0

    • isTimeValid

      public boolean isTimeValid()
      Check if the token is valid with respect to expiration and not before limits.
      Returns:
      true iff token is time valid
      Since:
      3.1.0

    • getRedirectURI

      @Nullable public URI getRedirectURI()
      Get redirect uri of the request.
      Returns:
      redirect uri of the request, null if not located.

    • getACR

      @Nullable public String getACR()
      Get acr of the performed authentication.
      Returns:
      acr of the performed authentication.

    • getType

      @Nullable public String getType()
      Get type of the claims set.
      Returns:
      Type of the claims set.

    • getPrincipal

      @Nullable public String getPrincipal()
      Get principal of the user.
      Returns:
      principal of the user.

    • getSubject

      @Nullable public String getSubject()
      Get subject claim.
      Returns:
      subject claim
      Since:
      3.1.0

    • getAuthenticationTime

      @Nullable public Instant getAuthenticationTime()
      Get auth time of the user.
      Returns:
      auth time of the user.

    • getNonce

      @Nullable public Nonce getNonce()
      Get nonce of the authentication request.
      Returns:
      nonce of the authentication request.

    • getClaimsRequest

      @Nullable public OIDCClaimsRequest getClaimsRequest()
      Get claims request of the authentication request.
      Returns:
      claims request in authentication request, null if not existing.

    • getDeliveryClaims

      @Nullable public ClaimsSet getDeliveryClaims()
      Get token delivery claims.
      Returns:
      token delivery claims

    • getIDTokenDeliveryClaims

      @Nullable public ClaimsSet getIDTokenDeliveryClaims()
      Get id token token delivery claims.
      Returns:
      id token token delivery claims

    • getUserinfoDeliveryClaims

      @Nullable public ClaimsSet getUserinfoDeliveryClaims()
      Get user info response token delivery claims.
      Returns:
      user info response token delivery claims

    • getConsentedClaims

      @Nullable @NonnullElements public List<Object> getConsentedClaims()
      Get consented claims.
      Returns:
      consented claims

    • isConsentEnabled

      public boolean isConsentEnabled()
      Get whether consent has been enabled.
      Returns:
      whether consent has been enabled

    • getScope

      @Nullable public Scope getScope()
      Get scope of the token.
      Returns:
      scope of the token

    • getAudience

      @Nonnull @NonnullElements @NotLive @Unmodifiable public List<String> getAudience()
      Get audience of the token.
      Returns:
      audience of the token
      Since:
      3.1.0

    • getCodeChallenge

      @Nullable public String getCodeChallenge()
      Get code challenge of the authentication request.
      Returns:
      code challenge of the authentication request.

    • getID

      @Nullable public String getID()
      Get the id of the token.
      Returns:
      id of the token

    • getClientID

      @Nullable public ClientID getClientID()
      Get Client ID of the token.
      Returns:
      Client ID of the token

    • getRootTokenIdentifier

      @Nullable public String getRootTokenIdentifier()
      Get the root token identifier.
      Returns:
      the root token identifier.
      Since:
      3.2.0

    • getSessionIdentifier

      @Nullable public String getSessionIdentifier()
      Get the session identifier.
      Returns:
      the session identifier.
      Since:
      3.3.0

    • getDpopProofJwkThumbprint

      @Nullable public String getDpopProofJwkThumbprint()
      Get the DPoP Proof JWK thumbprint.
      Returns:
      the DPoP Proof JWK thumbprint.
      Since:
      4.2.0