Package net.shibboleth.idp.plugin.authn.oidc.rp.impl

Class InitializeOAuth2ClientAuthenticationMethodHandler

    • Field Detail

      • log

        @Nonnull
private final org.slf4j.Logger log
        Class logger.

      • oauth2ClientAuthenticationContext

        @Nullable
private OAuth2ClientAuthenticationContext oauth2ClientAuthenticationContext
        The stashed OAuth2 client authentication context.

      • jwtBearerExpiryOffset

        @Nonnull
private Duration jwtBearerExpiryOffset
        The offset to add to the 'exp' claim time for JWT client authentication methods. Default is 30 seconds.

      • jwtBearerClientAuthSecurityParameters

        @Nullable
private SecurityParametersContext jwtBearerClientAuthSecurityParameters
        Stashed security parameters context for JWT Bearer Token client authentication methods. Can be null if those client authentication methods are not used.

      • providerMetadata

        @Nullable
private com.nimbusds.openid.connect.sdk.op.OIDCProviderMetadata providerMetadata
        The stashed provider metadata.

      • clientCredential

        @Nullable
private ClientSecretCredential clientCredential
        The stashed client_secret to use if required.

      • clientAuthMethod

        @Nullable
private String clientAuthMethod
        The stashed client authentication method to use.

      • clientId

        @Nullable
private String clientId
        The stashed client identifier for this request.

    • Constructor Detail

      • InitializeOAuth2ClientAuthenticationMethodHandler

        public InitializeOAuth2ClientAuthenticationMethodHandler()
        Constructor.

    • Method Detail

      • setJwtBearerExpiryOffset

        public void setJwtBearerExpiryOffset​(@Nonnull
                                     Duration expiry)
        Set the JWT expiry time offset for appropriate client authentication methods.
        Parameters:
        expiry - the JWT 'exp' claim offset

      • setProviderMetadataLookupStrategy

        public void setProviderMetadataLookupStrategy​(@Nonnull
                                              Function<MessageContext,​OIDCProviderMetadataContext> strategy)
        Set the lookup strategy to locate the OpenID providers metadata.
        Parameters:
        strategy - the strategy.

      • setRelyingPartyContextLookupStrategy

        public void setRelyingPartyContextLookupStrategy​(@Nonnull
                                                 Function<ProfileRequestContext,​RelyingPartyContext> strategy)
        Set lookup strategy for relying party context.
        Parameters:
        strategy - lookup strategy

      • verifySuitableClientSecretJWTSecurityContext

        private void verifySuitableClientSecretJWTSecurityContext()
                                                   throws MessageHandlerException
        Check the populated security context is using the correct algorithm family for client_secret_jwt client authentication.
        Throws:
        MessageHandlerException - if the wrong algorithm family is specified in the security context

      • verifySuitablePrivateKetJWTSecurityContext

        private void verifySuitablePrivateKetJWTSecurityContext()
                                                 throws MessageHandlerException
        Check the populated security context is using the correct algorithm family for private_key_jwt client authentication.
        Throws:
        MessageHandlerException - if the wrong algorithm family is specified in the security context

      • buildClientAuthenticationJwtClaims

        private com.nimbusds.jwt.JWTClaimsSet buildClientAuthenticationJwtClaims()
        Build the claim values required for a client authentication bearer JWT.
        Returns:
        the constructed JWT claims set

      • buildClientAuthenticationJwt

        @Nullable
private com.nimbusds.jwt.SignedJWT buildClientAuthenticationJwt()
        Build a signed JWT bearer token for client authentication using the populated security parameters. Relies on the correct alg and credential existing in the security context ahead of time for the correct SignedJWT to be returned e.g. for either client_secret_jwt or private_key_jwt.
        Returns:
        a signed JWT bearer token, or null if there was an error during construction

      • signClaims

        @Nullable
private com.nimbusds.jwt.SignedJWT signClaims​(@Nonnull
                                              com.nimbusds.jwt.JWTClaimsSet jwtClaimSetToSign,
                                              @Nonnull
                                              SecurityParametersContext secContext)
        Sign the given JWT claims set using the signing parameters from the context.
        Parameters:
        jwtClaimSetToSign - the claims to sign
        secContext - the security context to determine the signing algorithm and keys
        Returns:
        a signed JWT or null if an error occurs.

      • getSigner

        private com.nimbusds.jose.JWSSigner getSigner​(com.nimbusds.jose.Algorithm jwsAlgorithm,
                                              Credential credential)
                                       throws com.nimbusds.jose.JOSEException
        Returns correct implementation of signer based on algorithm type.
        Parameters:
        jwsAlgorithm - JWS algorithm
        credential - the credential to use
        Returns:
        signer for algorithm and private key
        Throws:
        com.nimbusds.jose.JOSEException - if algorithm cannot be supported

      • resolveAlgorithm

        protected com.nimbusds.jose.JWSAlgorithm resolveAlgorithm​(@Nonnull
                                                          SignatureSigningParameters params)
        Resolves JWS algorithm from signature signing parameters.
        Parameters:
        params - the signature signing parameters
        Returns:
        JWS algorithm

      • convertSecretKeyToString

        @Nullable
private String convertSecretKeyToString​(@Nullable
                                        SecretKey key)
        Convert the encoded byte array representing the secret into a UTF-8 String.
        Parameters:
        key - the key to convert
        Returns:
        the UTF-8 encoded string value of the secret.