Package net.shibboleth.idp.plugin.authn.oidc.rp.impl

Class ProcessEndUserClaims

java.lang.Object

net.shibboleth.utilities.java.support.component.AbstractInitializableComponent

org.opensaml.profile.action.AbstractProfileAction

org.opensaml.profile.action.AbstractConditionalProfileAction

net.shibboleth.idp.profile.AbstractProfileAction

net.shibboleth.idp.authn.AbstractAuthenticationAction

net.shibboleth.idp.plugin.authn.oidc.rp.impl.ProcessEndUserClaims

All Implemented Interfaces:

Component, DestructableComponent, InitializableComponent, ProfileAction, Aware, MessageSource, MessageSourceAware, Action

public class ProcessEndUserClaims
extends AbstractAuthenticationAction

Process the end-user claims from the id_token and possible UserInfo claims sets.

Sanitized both claims sets using a replaceable strategy. For example, by default to remove standard JWT 'validation' claims that should not be exposed further by the system.

Merge the claims sets together to produce an aggregate claims set. The UserInfo claims can be empty i.e. claims from the UserInfo endpoint were not requested.

Event:

EventIds.PROCEED_EVENT_ID, EventIds.INVALID_PROFILE_CTX

Postcondition:

Add a set of merged and sanatized claims to the EndUserClaimsContext.

Field Summary

Fields

Modifier and Type	Field	Description
private Function<ProfileRequestContext,AccessTokenResponseContext>	accessTokenResponseContextLookupStrategy	Strategy used to look up the AccessTokenResponseContext .
private BinaryOperator<com.nimbusds.openid.connect.sdk.claims.ClaimsSet>	claimMergingStrategy	The strategy used to merge UserInfo claims with id_token claims.
private UnaryOperator<com.nimbusds.openid.connect.sdk.claims.ClaimsSet>	claimSanitizationStrategy	The strategy used to sanitize claims in an input claimset.
private Function<ProfileRequestContext,EndUserClaimsContext>	endUserClaimsContextLookupStrategy	Strategy used to look up the EndUserClaimsContext to set the parameters for.
private com.nimbusds.jwt.JWTClaimsSet	idTokenClaims	The stashed id_token claims.
private org.slf4j.Logger	log	Class logger.
private com.nimbusds.openid.connect.sdk.claims.ClaimsSet	userInfoClaims	The stashed UserInfo claims.
private Function<ProfileRequestContext,UserInfoResponseContext>	userInfoResponseContextLookupStrategy	Strategy used to look up the UserInfoResponseContext.

Constructor Summary

Constructors

Constructor	Description
ProcessEndUserClaims()	Constructor.

Method Summary

Modifier and Type	Method	Description
protected void	doExecute(ProfileRequestContext profileRequestContext, AuthenticationContext authenticationContext)
protected boolean	doPreExecute(ProfileRequestContext profileRequestContext, AuthenticationContext authenticationContext)
void	setAccessTokenResponseContextLookupStrategy(Function<ProfileRequestContext,AccessTokenResponseContext> strategy)	Set the strategy used to look up a AccessTokenResponseContext.
void	setClaimMergingStrategy(BinaryOperator<com.nimbusds.openid.connect.sdk.claims.ClaimsSet> strategy)	Set the strategy used to merge UserInfo claims with id_token claims.
void	setClaimSanitizationStrategy(UnaryOperator<com.nimbusds.openid.connect.sdk.claims.ClaimsSet> strategy)	Set the strategy used to sanitize claims from both the id_token and UserInfo claims set to produce a clean claims set.
void	setEnableClaimSanitizationStrategy(boolean enable)	Set whether to enable claim sanitization.
void	setEndUserClaimsContextLookupStrategy(Function<ProfileRequestContext,EndUserClaimsContext> strategy)	Set the strategy used to lookup a EndUserClaimsContext.
void	setUserInfoResponseContextLookupStrategy(Function<ProfileRequestContext,UserInfoResponseContext> strategy)	Set the strategy used to look up a UserInfoResponseContext.

Methods inherited from class net.shibboleth.idp.authn.AbstractAuthenticationAction

doExecute, doPreExecute, setAuthenticationContextLookupStrategy

Methods inherited from class net.shibboleth.idp.profile.AbstractProfileAction

doExecute, execute, getBean, getBean, getMessage, getMessage, getMessage, getParameter, getParameter, getProfileContextLookupStrategy, getRequestContext, getResult, setMessageSource, setProfileContextLookupStrategy

Methods inherited from class org.opensaml.profile.action.AbstractConditionalProfileAction

getActivationCondition, setActivationCondition

Methods inherited from class org.opensaml.profile.action.AbstractProfileAction

doPostExecute, doPostExecute, execute, getHttpServletRequest, getHttpServletRequestSupplier, getHttpServletResponse, getHttpServletResponseSupplier, getLogPrefix, setHttpServletRequest, setHttpServletRequestSupplier, setHttpServletResponse, setHttpServletResponseSupplier

Methods inherited from class net.shibboleth.utilities.java.support.component.AbstractInitializableComponent

destroy, doDestroy, doInitialize, initialize, isDestroyed, isInitialized

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Methods inherited from interface net.shibboleth.utilities.java.support.component.InitializableComponent

initialize, isInitialized

Field Detail

log

@Nonnull
private final org.slf4j.Logger log

Class logger.

userInfoResponseContextLookupStrategy

@Nonnull
private Function<ProfileRequestContext,UserInfoResponseContext> userInfoResponseContextLookupStrategy

Strategy used to look up the UserInfoResponseContext.

accessTokenResponseContextLookupStrategy

@Nonnull
private Function<ProfileRequestContext,AccessTokenResponseContext> accessTokenResponseContextLookupStrategy

Strategy used to look up the AccessTokenResponseContext .

endUserClaimsContextLookupStrategy

@Nonnull
private Function<ProfileRequestContext,EndUserClaimsContext> endUserClaimsContextLookupStrategy

Strategy used to look up the EndUserClaimsContext to set the parameters for.

claimMergingStrategy

@Nonnull
private BinaryOperator<com.nimbusds.openid.connect.sdk.claims.ClaimsSet> claimMergingStrategy

The strategy used to merge UserInfo claims with id_token claims.

claimSanitizationStrategy

@Nonnull
private UnaryOperator<com.nimbusds.openid.connect.sdk.claims.ClaimsSet> claimSanitizationStrategy

The strategy used to sanitize claims in an input claimset. By default, produces a set of claims without the validation claims (e.g. nonce, exp), but leaving the identity, authorization and misc claims.

userInfoClaims

@Nullable
private com.nimbusds.openid.connect.sdk.claims.ClaimsSet userInfoClaims

The stashed UserInfo claims. This is allowably empty if the UserInfo endpoint was not used.

idTokenClaims

@Nullable
private com.nimbusds.jwt.JWTClaimsSet idTokenClaims

The stashed id_token claims. This should never be null or empty once AbstractAuthenticationAction.doPreExecute(ProfileRequestContext) has run.

Constructor Detail

ProcessEndUserClaims

public ProcessEndUserClaims()

Constructor.

Method Detail

setClaimMergingStrategy

public void setClaimMergingStrategy(@Nonnull
                                    BinaryOperator<com.nimbusds.openid.connect.sdk.claims.ClaimsSet> strategy)

Set the strategy used to merge UserInfo claims with id_token claims.

Parameters:

strategy - the strategy to use.

setClaimSanitizationStrategy

public void setClaimSanitizationStrategy(@Nonnull
                                         UnaryOperator<com.nimbusds.openid.connect.sdk.claims.ClaimsSet> strategy)

Set the strategy used to sanitize claims from both the id_token and UserInfo claims set to produce a clean claims set.

Parameters:

strategy - the strategy to use.

setEnableClaimSanitizationStrategy

public void setEnableClaimSanitizationStrategy(boolean enable)

Set whether to enable claim sanitization. If true, whatever claimSanatizationStrategy is set is used. If false, a no-op strategy is created which just returns a new claims set based on the same claims that exist in the input claims set. By default, claims sanitization uses the DefaultClaimSanitizationStrategy.

Parameters:

enable - enable or disable claims sanitization

setEndUserClaimsContextLookupStrategy

public void setEndUserClaimsContextLookupStrategy(@Nonnull
                                                  Function<ProfileRequestContext,EndUserClaimsContext> strategy)

Set the strategy used to lookup a EndUserClaimsContext.

Parameters:

strategy - the strategy

setAccessTokenResponseContextLookupStrategy

public void setAccessTokenResponseContextLookupStrategy(@Nonnull
                                                        Function<ProfileRequestContext,AccessTokenResponseContext> strategy)

Set the strategy used to look up a AccessTokenResponseContext.

Parameters:

strategy - lookup strategy

setUserInfoResponseContextLookupStrategy

public void setUserInfoResponseContextLookupStrategy(@Nonnull
                                                     Function<ProfileRequestContext,UserInfoResponseContext> strategy)

Set the strategy used to look up a UserInfoResponseContext.

Parameters:

strategy - lookup strategy

doPreExecute

protected boolean doPreExecute(@Nonnull
                               ProfileRequestContext profileRequestContext,
                               @Nonnull
                               AuthenticationContext authenticationContext)

Overrides:

doPreExecute in class AbstractAuthenticationAction

doExecute

protected void doExecute(@Nonnull
                         ProfileRequestContext profileRequestContext,
                         @Nonnull
                         AuthenticationContext authenticationContext)

Overrides:

doExecute in class AbstractAuthenticationAction