Package net.shibboleth.idp.plugin.authn.oidc.rp.impl

Class InitializeOAuth2ClientAuthenticationMethodHandler

java.lang.Object
net.shibboleth.shared.component.AbstractInitializableComponent
org.opensaml.messaging.handler.AbstractMessageHandler
net.shibboleth.idp.plugin.authn.oidc.rp.impl.InitializeOAuth2ClientAuthenticationMethodHandler
All Implemented Interfaces:
Component, DestructableComponent, InitializableComponent, MessageHandler
public class InitializeOAuth2ClientAuthenticationMethodHandler extends AbstractMessageHandler
An action that resolves the Client Authentication method for the chosen upstream OpenID Provider (issuer) from the profile configuration, and adds it to the OAuth2ClientAuthenticationContext.

If a JWT client authentication type, the security parameters context is used to create a signed JWT client assertion.

Event:
EventIds.PROCEED_EVENT_ID, IdPEventIds.INVALID_PROFILE_CONFIG, EventIds.INVALID_PROFILE_CTX, IdPEventIds.INVALID_RELYING_PARTY_CONFIG
Postcondition:
Add the ClientAuthenticationMethod to the OAuth2ClientAuthenticationContext

  • Field Details

  • Constructor Details

    • InitializeOAuth2ClientAuthenticationMethodHandler

      public InitializeOAuth2ClientAuthenticationMethodHandler()
      Constructor.

  • Method Details

    • setJwtBearerExpiryOffset

      public void setJwtBearerExpiryOffset(@Nonnull Duration expiry)
      Set the JWT expiry time offset for appropriate client authentication methods.
      Parameters:
      expiry - the JWT 'exp' claim offset

    • setProviderMetadataLookupStrategy

      public void setProviderMetadataLookupStrategy(@Nonnull Function<MessageContext,OIDCProviderMetadataContext> strategy)
      Set the lookup strategy to locate the OpenID providers metadata.
      Parameters:
      strategy - the strategy.

    • setSecurityParametersContextLookupStrategy

      public void setSecurityParametersContextLookupStrategy(@Nonnull Function<MessageContext,SecurityParametersContext> strategy)
      Set the strategy used to look up the SecurityParametersContext.
      Parameters:
      strategy - lookup strategy

    • setRelyingPartyContextLookupStrategy

      public void setRelyingPartyContextLookupStrategy(@Nonnull Function<ProfileRequestContext,RelyingPartyContext> strategy)
      Set lookup strategy for relying party context.
      Parameters:
      strategy - lookup strategy

    • setOAuth2ClientAuthenticationContextLookupStrategy

      public void setOAuth2ClientAuthenticationContextLookupStrategy(@Nonnull Function<MessageContext,OAuth2ClientAuthenticationContext> strgy)
      Set the strategy to lookup the OAuth2ClientAuthenticationContext from the MessageContext.
      Parameters:
      strgy - the strategy.

    • doPreInvoke

      protected boolean doPreInvoke(@Nonnull MessageContext messageContext) throws MessageHandlerException
      Overrides:
      doPreInvoke in class AbstractMessageHandler
      Throws:
      MessageHandlerException

    • doInvoke

      protected void doInvoke(MessageContext messageContext) throws MessageHandlerException
      Specified by:
      doInvoke in class AbstractMessageHandler
      Throws:
      MessageHandlerException

    • verifySuitableClientSecretJWTSecurityContext

      private void verifySuitableClientSecretJWTSecurityContext() throws MessageHandlerException
      Check the populated security context is using the correct algorithm family for client_secret_jwt client authentication.
      Throws:
      MessageHandlerException - if the wrong algorithm family is specified in the security context

    • verifySuitablePrivateKetJWTSecurityContext

      private void verifySuitablePrivateKetJWTSecurityContext() throws MessageHandlerException
      Check the populated security context is using the correct algorithm family for private_key_jwt client authentication.
      Throws:
      MessageHandlerException - if the wrong algorithm family is specified in the security context

    • buildClientAuthenticationJwtClaims

      @Nonnull private com.nimbusds.jwt.JWTClaimsSet buildClientAuthenticationJwtClaims()
      Build the claim values required for a client authentication bearer JWT.
      Returns:
      the constructed JWT claims set

    • buildClientAuthenticationJwt

      @Nullable private com.nimbusds.jwt.SignedJWT buildClientAuthenticationJwt()
      Build a signed JWT bearer token for client authentication using the populated security parameters. Relies on the correct 'alg' and credential existing in the security context ahead of time for the correct SignedJWT to be returned e.g. for either client_secret_jwt or private_key_jwt.
      Returns:
      a signed JWT bearer token, or null if there was an error during construction

    • signClaims

      @Nullable private com.nimbusds.jwt.SignedJWT signClaims(@Nonnull com.nimbusds.jwt.JWTClaimsSet jwtClaimSetToSign, @Nonnull SignatureSigningParameters signingParams)
      Sign the given JWT claims set using the signing parameters from the context.
      Parameters:
      jwtClaimSetToSign - the claims to sign
      signingParams - the signing parameters required to sign the JWT
      Returns:
      a signed JWT or null if an error occurs.

    • getSigner

      private com.nimbusds.jose.JWSSigner getSigner(@Nonnull com.nimbusds.jose.Algorithm jwsAlgorithm, @Nonnull Credential credential) throws com.nimbusds.jose.JOSEException
      Returns correct implementation of signer based on algorithm type.
      Parameters:
      jwsAlgorithm - JWS algorithm
      credential - the credential to use
      Returns:
      signer for algorithm and private key
      Throws:
      com.nimbusds.jose.JOSEException - if algorithm cannot be supported

    • resolveAlgorithm

      @Nullable protected com.nimbusds.jose.JWSAlgorithm resolveAlgorithm(@Nonnull SignatureSigningParameters params)
      Resolves JWS algorithm from signature signing parameters.
      Parameters:
      params - the signature signing parameters
      Returns:
      JWS algorithm

    • convertSecretKeyToString

      @Nullable private String convertSecretKeyToString(@Nullable SecretKey key)
      Convert the encoded byte array representing the secret into a UTF-8 String.
      Parameters:
      key - the key to convert
      Returns:
      the UTF-8 encoded string value of the secret.