Package net.shibboleth.idp.plugin.oidc.op.profile.impl

Class UnwrapGrant

java.lang.Object
net.shibboleth.shared.component.AbstractInitializableComponent
org.opensaml.profile.action.AbstractProfileAction
org.opensaml.profile.action.AbstractConditionalProfileAction
net.shibboleth.idp.profile.AbstractProfileAction
net.shibboleth.idp.plugin.oidc.op.profile.impl.AbstractOIDCRequestAction<com.nimbusds.oauth2.sdk.TokenRequest>
net.shibboleth.idp.plugin.oidc.op.profile.impl.AbstractOIDCTokenRequestAction
net.shibboleth.idp.plugin.oidc.op.profile.impl.AbstractOIDCTokenResponseAction
net.shibboleth.idp.plugin.oidc.op.profile.impl.UnwrapGrant
All Implemented Interfaces:
Component, DestructableComponent, InitializableComponent, ProfileAction, Aware, MessageSource, MessageSourceAware, Action
public class UnwrapGrant extends AbstractOIDCTokenResponseAction
Action that unwraps an authorization grant or refresh token grant.

Operation is valid if it is successfully unwrapped, parsed as a code or refresh token, is unexpired and was issued to the expected client.

The claims set from the grant is stored to response context via OIDCAuthenticationResponseContext.setAuthorizationGrantClaimsSet(TokenClaimsSet).

Note that the addition of support for the "client_credentials" grant type means that there may not in fact be a grant, or resulting claims set.

Since:
4.4.0

  • Field Details

    • log

      @Nonnull private org.slf4j.Logger log
      Class logger.

    • dataSealer

      @Nonnull private final DataSealer dataSealer
      Data sealer for unwrapping authorization code.

    • clientIDLookupStrategy

      @Nonnull private Function<MessageContext,com.nimbusds.oauth2.sdk.id.ClientID> clientIDLookupStrategy
      Strategy used to obtain the client id value from token request.

    • refreshTokenDeserializers

      @Nonnull private List<BiFunction<ProfileRequestContext,String,RefreshTokenClaimsSet>> refreshTokenDeserializers
      List of deserializer bi-functions for refresh tokens to be used in addition to unsealing opaque value.

  • Constructor Details

    • UnwrapGrant

      public UnwrapGrant(@Nonnull @ParameterName(name="sealer") DataSealer sealer)
      Constructor.
      Parameters:
      sealer - sealer to decrypt/hmac authorize code.

  • Method Details

    • setRefreshTokenDeserializers

      public void setRefreshTokenDeserializers(@Nonnull List<BiFunction<ProfileRequestContext,String,RefreshTokenClaimsSet>> deserializers)
      Set the list of deserializer bi-functions for refresh tokens to be used in addition to unsealing opaque value.
      Parameters:
      deserializers - list of deserializers

    • setClientIDLookupStrategy

      public void setClientIDLookupStrategy(@Nonnull Function<MessageContext,com.nimbusds.oauth2.sdk.id.ClientID> strategy)
      Set the strategy used to locate the client id of the request.
      Parameters:
      strategy - lookup strategy

    • doExecute

      protected void doExecute(@Nonnull ProfileRequestContext profileRequestContext)
      Overrides:
      doExecute in class AbstractProfileAction

    • deserializeRefreshToken

      protected RefreshTokenClaimsSet deserializeRefreshToken(@Nonnull ProfileRequestContext profileRequestContext, @Nonnull String refreshToken)
      Attempt to deseriaalize a (serialized) refresh token value via configured deserializers.
      Parameters:
      profileRequestContext - The profile request context given to the deserializers
      refreshToken - The serialized refresh token value
      Returns:
      refresh token claims set, or null if it couldn't be parsed