Package net.shibboleth.idp.plugin.oidc.op.oauth2.profile.impl

Class ValidateCodeChallenge

java.lang.Object

net.shibboleth.shared.component.AbstractInitializableComponent

org.opensaml.profile.action.AbstractProfileAction

org.opensaml.profile.action.AbstractConditionalProfileAction

net.shibboleth.idp.profile.AbstractProfileAction

net.shibboleth.idp.plugin.oidc.op.profile.impl.AbstractOIDCRequestAction<com.nimbusds.oauth2.sdk.AuthorizationRequest>

net.shibboleth.idp.plugin.oidc.op.oauth2.profile.impl.AbstractOAuthAuthorizationRequestAction

net.shibboleth.idp.plugin.oidc.op.oauth2.profile.impl.AbstractOAuthAuthorizationResponseAction

net.shibboleth.idp.plugin.oidc.op.oauth2.profile.impl.ValidateCodeChallenge

All Implemented Interfaces:

Component, DestructableComponent, InitializableComponent, ProfileAction, Aware, MessageSource, MessageSourceAware, Action

public class ValidateCodeChallenge
extends AbstractOAuthAuthorizationResponseAction

Validates the presence of PKCE code challenge parameter from the incoming authentication request.

Field Summary

Fields

Modifier and Type	Field	Description
private Predicate<ProfileRequestContext>	allowPKCEPlainCondition	Strategy used to determine whether to allow plaintext PKCE.
private String	codeChallenge	PKCE code challenge.
private Function<ProfileRequestContext,String>	codeChallengeLookupStrategy	Strategy used to locate the code challenge.
private String	codeChallengeMethod	PKCE code challenge method.
private Function<ProfileRequestContext,String>	codeChallengeMethodLookupStrategy	Strategy used to locate the code challenge method.
private boolean	forcePKCE	Whether PKCE is mandatory.
private Predicate<ProfileRequestContext>	forcePKCECondition	Strategy used to determine whether to require PKCE.
private org.slf4j.Logger	log	Class logger.
private boolean	plainPKCE	Whether plain PKCE is allowed.

Constructor Summary

Constructors

Constructor	Description
ValidateCodeChallenge()	Constructor.

Method Summary

Modifier and Type	Method	Description
protected void	doExecute(ProfileRequestContext profileRequestContext)
protected void	doInitialize()
protected boolean	doPreExecute(ProfileRequestContext profileRequestContext)
void	setAllowPKCEPlainCondition(Predicate<ProfileRequestContext> condition)	Set the condition used to determine whether to allow plaintext PKCE.
void	setCodeChallengeLookupStrategy(Function<ProfileRequestContext,String> strategy)	Set the strategy used to locate the Code Challenge of the request.
void	setCodeChallengeMethodLookupStrategy(Function<ProfileRequestContext,String> strategy)	Set the strategy used to locate the Code Challenge Method of the request.
void	setForcePKCECondition(Predicate<ProfileRequestContext> condition)	Set the condition used to determine whether to require PKCE.

Methods inherited from class net.shibboleth.idp.plugin.oidc.op.oauth2.profile.impl.AbstractOAuthAuthorizationResponseAction

getMetadataContext, getOidcResponseContext

Methods inherited from class net.shibboleth.idp.plugin.oidc.op.oauth2.profile.impl.AbstractOAuthAuthorizationRequestAction

getAuthorizationRequest

Methods inherited from class net.shibboleth.idp.plugin.oidc.op.profile.impl.AbstractOIDCRequestAction

getRequest

Methods inherited from class net.shibboleth.idp.profile.AbstractProfileAction

doExecute, execute, getBean, getBean, getMessage, getMessage, getMessage, getParameter, getParameter, getProfileContextLookupStrategy, getRequestContext, getResult, setMessageSource, setProfileContextLookupStrategy

Methods inherited from class org.opensaml.profile.action.AbstractConditionalProfileAction

getActivationCondition, setActivationCondition

Methods inherited from class org.opensaml.profile.action.AbstractProfileAction

doPostExecute, doPostExecute, ensureHttpServletRequest, ensureHttpServletResponse, execute, getHttpServletRequest, getHttpServletRequestSupplier, getHttpServletResponse, getHttpServletResponseSupplier, getLogPrefix, isPreExecuteCalled, setHttpServletRequestSupplier, setHttpServletResponseSupplier

Methods inherited from class net.shibboleth.shared.component.AbstractInitializableComponent

checkComponentActive, checkSetterPreconditions, destroy, doDestroy, ifDestroyedThrowDestroyedComponentException, ifInitializedThrowUnmodifiabledComponentException, ifNotInitializedThrowUninitializedComponentException, initialize, isDestroyed, isInitialized

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Methods inherited from interface net.shibboleth.shared.component.InitializableComponent

initialize, isInitialized

Field Details

log

@Nonnull
private org.slf4j.Logger log

Class logger.

forcePKCECondition

@Nonnull
private Predicate<ProfileRequestContext> forcePKCECondition

Strategy used to determine whether to require PKCE.

allowPKCEPlainCondition

@Nonnull
private Predicate<ProfileRequestContext> allowPKCEPlainCondition

Strategy used to determine whether to allow plaintext PKCE.

codeChallengeLookupStrategy

@NonnullAfterInit
private Function<ProfileRequestContext,String> codeChallengeLookupStrategy

Strategy used to locate the code challenge.

codeChallengeMethodLookupStrategy

@NonnullAfterInit
private Function<ProfileRequestContext,String> codeChallengeMethodLookupStrategy

Strategy used to locate the code challenge method.

forcePKCE

private boolean forcePKCE

Whether PKCE is mandatory.

plainPKCE

private boolean plainPKCE

Whether plain PKCE is allowed.

codeChallenge

@Nullable
private String codeChallenge

PKCE code challenge.

codeChallengeMethod

@Nullable
private String codeChallengeMethod

PKCE code challenge method.

Constructor Details

ValidateCodeChallenge

public ValidateCodeChallenge()

Constructor.

Method Details

setForcePKCECondition

public void setForcePKCECondition(@Nonnull
 Predicate<ProfileRequestContext> condition)

Set the condition used to determine whether to require PKCE.

Parameters:

condition - condition to apply

setAllowPKCEPlainCondition

public void setAllowPKCEPlainCondition(@Nonnull
 Predicate<ProfileRequestContext> condition)

Set the condition used to determine whether to allow plaintext PKCE.

Parameters:

condition - condition to apply

setCodeChallengeLookupStrategy

public void setCodeChallengeLookupStrategy(@Nonnull
 Function<ProfileRequestContext,String> strategy)

Set the strategy used to locate the Code Challenge of the request.

Parameters:

strategy - lookup strategy

setCodeChallengeMethodLookupStrategy

public void setCodeChallengeMethodLookupStrategy(@Nonnull
 Function<ProfileRequestContext,String> strategy)

Set the strategy used to locate the Code Challenge Method of the request.

Parameters:

strategy - lookup strategy

doInitialize

protected void doInitialize()
                     throws ComponentInitializationException

Overrides:

doInitialize in class AbstractInitializableComponent

Throws:

ComponentInitializationException

doPreExecute

protected boolean doPreExecute(@Nonnull
 ProfileRequestContext profileRequestContext)

Overrides:

doPreExecute in class AbstractOAuthAuthorizationResponseAction

doExecute

protected void doExecute(@Nonnull
 ProfileRequestContext profileRequestContext)

Overrides:

doExecute in class AbstractProfileAction