Package net.shibboleth.idp.plugin.oidc.op.oauth2.profile.impl

Class ValidateScope

java.lang.Object
net.shibboleth.shared.component.AbstractInitializableComponent
org.opensaml.profile.action.AbstractProfileAction
org.opensaml.profile.action.AbstractConditionalProfileAction
net.shibboleth.idp.profile.AbstractProfileAction
net.shibboleth.idp.plugin.oidc.op.profile.impl.AbstractOIDCRequestAction<com.nimbusds.oauth2.sdk.AuthorizationRequest>
net.shibboleth.idp.plugin.oidc.op.oauth2.profile.impl.AbstractOAuthAuthorizationRequestAction
net.shibboleth.idp.plugin.oidc.op.oauth2.profile.impl.AbstractOAuthAuthorizationResponseAction
net.shibboleth.idp.plugin.oidc.op.oauth2.profile.impl.ValidateScope
All Implemented Interfaces:
Component, DestructableComponent, InitializableComponent, ProfileAction, Aware, MessageSource, MessageSourceAware, Action
public class ValidateScope extends AbstractOAuthAuthorizationResponseAction
Action that validates requested and previously granted scopes are also registered in client metadata and stores the resulting set in the response context.

Requested scopes come from the inbound message and are possible but optional for both authorization and token requests. They come from lookup functions aware of each message type. If the request contains 'openid' scope but it's not allowed for this request, an error event published.

Previously granted scopes are stored in the response context's slot for previous authorization grant claims. In the case where no scopes are explicitly requested, we still filter the previous grants against the metadata.

Explicitly requested scopes are also filtered against, and override, any scopes previously validated as part of an authorization grant claim set. If this occurs, any grant-borne claims are removed because the association to specific scopes is gone by this point.

The "offline_access" scope is ignored and stripped for the authentication endpoint unless the response type includes "code".

  • Field Details

  • Constructor Details

    • ValidateScope

      public ValidateScope()
      Constructor.

  • Method Details

    • setRelyingPartyIdLookupStrategy

      public void setRelyingPartyIdLookupStrategy(@Nonnull Function<ProfileRequestContext,String> strategy)
      Set the strategy used to obtain the relying party ID.
      Parameters:
      strategy - lookup strategy

    • setRequestedScopeLookupStrategy

      public void setRequestedScopeLookupStrategy(@Nullable Function<ProfileRequestContext,com.nimbusds.oauth2.sdk.Scope> strategy)
      Set the strategy used to locate the requested scope to validate.
      Parameters:
      strategy - lookup strategy

    • setAllowedScopeLookupStrategy

      public void setAllowedScopeLookupStrategy(@Nonnull Function<ProfileRequestContext,com.nimbusds.oauth2.sdk.Scope> strategy)
      Set the strategy used to locate the allowed scope for the client.
      Parameters:
      strategy - lookup strategy

    • setMandatoryScopeLookupStrategy

      public void setMandatoryScopeLookupStrategy(@Nonnull Function<ProfileRequestContext,com.nimbusds.oauth2.sdk.Scope> strategy)
      Set the strategy used to locate the mandatory scope value.
      Parameters:
      strategy - lookup strategy

    • setOIDCAuthenticationResponseTokenClaimsContextLookupStrategy

      public void setOIDCAuthenticationResponseTokenClaimsContextLookupStrategy(@Nonnull Function<ProfileRequestContext,OIDCAuthenticationResponseTokenClaimsContext> strategy)
      Set the strategy used to locate the OIDCAuthenticationResponseTokenClaimsContext associated with a given ProfileRequestContext.
      Parameters:
      strategy - lookup strategy

    • setRequestedResponseTypeLookupStrategy

      public void setRequestedResponseTypeLookupStrategy(@Nullable Function<ProfileRequestContext,com.nimbusds.oauth2.sdk.ResponseType> strategy)
      Set the lookup strategy for fetching the requested response type.
      Parameters:
      strategy - What to set.

    • setStrictScopeValidationCondition

      public void setStrictScopeValidationCondition(@Nonnull Predicate<ProfileRequestContext> predicate)
      Set the condition whether to apply strict scope validation, i.e. unallowed scope is an error.
      Parameters:
      predicate - What to set.

    • doExecute

      protected void doExecute(@Nonnull ProfileRequestContext profileRequestContext)
      Overrides:
      doExecute in class AbstractProfileAction