Package net.shibboleth.idp.plugin.oidc.op.userinfo.profile.impl

Class ParseAccessToken

java.lang.Object

net.shibboleth.shared.component.AbstractInitializableComponent

org.opensaml.profile.action.AbstractProfileAction

org.opensaml.profile.action.AbstractConditionalProfileAction

net.shibboleth.idp.profile.AbstractProfileAction

net.shibboleth.idp.plugin.oidc.op.profile.impl.AbstractOIDCRequestAction<UserInfoRequest>

net.shibboleth.idp.plugin.oidc.op.userinfo.profile.impl.AbstractOIDCUserInfoRequestAction

net.shibboleth.idp.plugin.oidc.op.userinfo.profile.impl.AbstractOIDCUserInfoValidationResponseAction

net.shibboleth.idp.plugin.oidc.op.userinfo.profile.impl.ParseAccessToken

All Implemented Interfaces:

Component, DestructableComponent, InitializableComponent, ProfileAction, Aware, MessageSource, MessageSourceAware, Action

public class ParseAccessToken
extends AbstractOIDCUserInfoValidationResponseAction

Action that parses an access token and initially populates the claims for later validation.

Signed JWTs are also signature-checked here.

The parsed token is stored to the response context retrievable as claims via OIDCAuthenticationResponseContext.getAuthorizationGrantClaimsSet(). Claims validation takes place later in order to allow for metadata and relying-party/profile config lookup to allow for pluggable validation, an overridden OP/issuer name, etc.

Since:

3.2.0

Event:

EventIds.PROCEED_EVENT_ID, OidcEventIds.INVALID_ACCESS_TOKEN, OidcEventIds.INVALID_DPOP_ACCESS_TOKEN

Field Summary

Fields

Modifier and Type	Field	Description
private CredentialResolver	credentialResolver	Source of signing keys.
private DataSealer	dataSealer	Data sealer for unwrapping authorization code.
private Predicate<ProfileRequestContext>	dpopAccessTokenCondition	Predicate for deciding to refer to DPoP in error responses.
private org.slf4j.Logger	log	Class logger.
private SignedJWT	signedJWT	Copy of signed JWT for non-opaque access tokens.

Constructor Summary

Constructors

Constructor	Description
ParseAccessToken()

Method Summary

Modifier and Type	Method	Description
protected void	doExecute(ProfileRequestContext profileRequestContext)
protected void	doInitialize()
protected AccessTokenClaimsSet	parseAccessToken(AccessToken token)	Attempt to parse token.
void	setCredentialResolver(CredentialResolver resolver)	Set the source of signing keys to use for JWT signature verification.
void	setDataSealer(DataSealer sealer)	Set the data sealer instance to use.
void	setDpopAccessTokenCondition(Predicate<ProfileRequestContext> condition)	Set the predicate for deciding to refer to DPoP in error responses.

Methods inherited from class net.shibboleth.idp.plugin.oidc.op.userinfo.profile.impl.AbstractOIDCUserInfoValidationResponseAction

doPreExecute, getOidcResponseContext

Methods inherited from class net.shibboleth.idp.plugin.oidc.op.userinfo.profile.impl.AbstractOIDCUserInfoRequestAction

getUserInfoRequest

Methods inherited from class net.shibboleth.idp.plugin.oidc.op.profile.impl.AbstractOIDCRequestAction

getRequest

Methods inherited from class net.shibboleth.idp.profile.AbstractProfileAction

doExecute, execute, getBean, getBean, getMessage, getMessage, getMessage, getParameter, getParameter, getProfileContextLookupStrategy, getRequestContext, getResult, setMessageSource, setProfileContextLookupStrategy

Methods inherited from class org.opensaml.profile.action.AbstractConditionalProfileAction

getActivationCondition, setActivationCondition

Methods inherited from class org.opensaml.profile.action.AbstractProfileAction

doPostExecute, doPostExecute, ensureHttpServletRequest, ensureHttpServletResponse, execute, getHttpServletRequest, getHttpServletRequestSupplier, getHttpServletResponse, getHttpServletResponseSupplier, getLogPrefix, isPreExecuteCalled, setHttpServletRequestSupplier, setHttpServletResponseSupplier

Methods inherited from class net.shibboleth.shared.component.AbstractInitializableComponent

checkComponentActive, checkSetterPreconditions, destroy, doDestroy, ifDestroyedThrowDestroyedComponentException, ifInitializedThrowUnmodifiabledComponentException, ifNotInitializedThrowUninitializedComponentException, initialize, isDestroyed, isInitialized

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Methods inherited from interface net.shibboleth.shared.component.InitializableComponent

initialize, isInitialized

Field Details

log

@Nonnull
private org.slf4j.Logger log

Class logger.

dataSealer

@NonnullAfterInit
private DataSealer dataSealer

Data sealer for unwrapping authorization code.

credentialResolver

@Nullable
private CredentialResolver credentialResolver

Source of signing keys.

dpopAccessTokenCondition

@NonnullAfterInit
private Predicate<ProfileRequestContext> dpopAccessTokenCondition

Predicate for deciding to refer to DPoP in error responses.

signedJWT

@Nullable
private SignedJWT signedJWT

Copy of signed JWT for non-opaque access tokens.

Constructor Details

ParseAccessToken

public ParseAccessToken()

Method Details

setDataSealer

public void setDataSealer(@Nonnull
 DataSealer sealer)

Set the data sealer instance to use.

Parameters:

sealer - sealer to use

setCredentialResolver

public void setCredentialResolver(@Nullable
 CredentialResolver resolver)

Set the source of signing keys to use for JWT signature verification.

Parameters:

resolver - signing key resolver

setDpopAccessTokenCondition

public void setDpopAccessTokenCondition(@Nonnull
 Predicate<ProfileRequestContext> condition)

Set the predicate for deciding to refer to DPoP in error responses.

Parameters:

condition - predicate to set

Since:

4.2.0

doInitialize

protected void doInitialize()
                     throws ComponentInitializationException

Overrides:

doInitialize in class AbstractInitializableComponent

Throws:

ComponentInitializationException

doExecute

protected void doExecute(@Nonnull
 ProfileRequestContext profileRequestContext)

Overrides:

doExecute in class AbstractProfileAction

parseAccessToken

@Nullable
protected AccessTokenClaimsSet parseAccessToken(@Nonnull @NotEmpty
 AccessToken token)

Attempt to parse token.

Parameters:

token - the token

Returns:

parsed claim set or null