Package net.shibboleth.idp.plugin.authn.oidc.rp.impl

Class ProcessEndUserClaims

java.lang.Object
net.shibboleth.shared.component.AbstractInitializableComponent
org.opensaml.profile.action.AbstractProfileAction
org.opensaml.profile.action.AbstractConditionalProfileAction
net.shibboleth.idp.profile.AbstractProfileAction
net.shibboleth.idp.authn.AbstractAuthenticationAction
net.shibboleth.idp.plugin.authn.oidc.rp.impl.ProcessEndUserClaims
All Implemented Interfaces:
Component, DestructableComponent, InitializableComponent, ProfileAction, Aware, MessageSource, MessageSourceAware, Action
public class ProcessEndUserClaims extends AbstractAuthenticationAction
Process the end-user claims from the id_token and possible UserInfo claims sets.

Sanitized both claims sets using a replaceable strategy. For example, by default to remove standard JWT 'validation' claims that should not be exposed further by the system.

Merge the claims sets together to produce an aggregate claims set. The UserInfo claims can be empty i.e. claims from the UserInfo endpoint were not requested.

Event:
EventIds.PROCEED_EVENT_ID, EventIds.INVALID_PROFILE_CTX
Postcondition:
Add a set of merged and sanatized claims to the EndUserClaimsContext.

  • Field Details

  • Constructor Details

    • ProcessEndUserClaims

      public ProcessEndUserClaims()
      Constructor.

  • Method Details

    • setClaimMergingStrategy

      public void setClaimMergingStrategy(@Nonnull BinaryOperator<com.nimbusds.openid.connect.sdk.claims.ClaimsSet> strategy)
      Set the strategy used to merge UserInfo claims with id_token claims.
      Parameters:
      strategy - the strategy to use.

    • setClaimSanitizationStrategy

      public void setClaimSanitizationStrategy(@Nonnull UnaryOperator<com.nimbusds.openid.connect.sdk.claims.ClaimsSet> strategy)
      Set the strategy used to sanitize claims from both the id_token and UserInfo claims set to produce a clean claims set.
      Parameters:
      strategy - the strategy to use.

    • setEnableClaimSanitizationStrategy

      public void setEnableClaimSanitizationStrategy(boolean enable)
      Set whether to enable claim sanitization. If true, whatever claimSanatizationStrategy is set is used. If false, a no-op strategy is created which just returns a new claims set based on the same claims that exist in the input claims set. By default, claims sanitization uses the DefaultClaimSanitizationStrategy.
      Parameters:
      enable - enable or disable claims sanitization

    • setEndUserClaimsContextLookupStrategy

      public void setEndUserClaimsContextLookupStrategy(@Nonnull Function<ProfileRequestContext,EndUserClaimsContext> strategy)
      Set the strategy used to lookup a EndUserClaimsContext.
      Parameters:
      strategy - the strategy

    • setAccessTokenResponseContextLookupStrategy

      public void setAccessTokenResponseContextLookupStrategy(@Nonnull Function<ProfileRequestContext,AccessTokenResponseContext> strategy)
      Set the strategy used to look up a AccessTokenResponseContext.
      Parameters:
      strategy - lookup strategy

    • setUserInfoResponseContextLookupStrategy

      public void setUserInfoResponseContextLookupStrategy(@Nonnull Function<ProfileRequestContext,UserInfoResponseContext> strategy)
      Set the strategy used to look up a UserInfoResponseContext.
      Parameters:
      strategy - lookup strategy

    • doPreExecute

      protected boolean doPreExecute(@Nonnull ProfileRequestContext profileRequestContext, @Nonnull AuthenticationContext authenticationContext)
      Overrides:
      doPreExecute in class AbstractAuthenticationAction

    • doExecute

      protected void doExecute(@Nonnull ProfileRequestContext profileRequestContext, @Nonnull AuthenticationContext authenticationContext)
      Overrides:
      doExecute in class AbstractAuthenticationAction