Package net.shibboleth.idp.plugin.authn.oidc.rp.impl

Class ValidateTokenClaims

java.lang.Object

net.shibboleth.shared.component.AbstractInitializableComponent

org.opensaml.profile.action.AbstractProfileAction

org.opensaml.profile.action.AbstractConditionalProfileAction

net.shibboleth.idp.profile.AbstractProfileAction

net.shibboleth.idp.authn.AbstractAuthenticationAction

net.shibboleth.idp.plugin.authn.oidc.rp.impl.ValidateTokenClaims

All Implemented Interfaces:

Component, DestructableComponent, InitializableComponent, ProfileAction, Aware, MessageSource, MessageSourceAware, Action

public class ValidateTokenClaims
extends AbstractAuthenticationAction

Action that validates the claims of a JWT using the supplied claims validator. The verifier must be thread-safe and validate, at minimum, the claims set against the OpenID Connect core 1.0 section 3.1.3.7 specification.

Event:

EventIds.PROCEED_EVENT_ID, AuthnEventIds.INVALID_AUTHN_CTX, OidcEventIds.INVALID_TOKEN

Precondition:

ProfileRequestContext.getSubcontext(AuthenticationContext.class, false) != null

,

JWT.getJWTClaimsSet() != null

Field Summary

Fields

Modifier and Type	Field	Description
private com.nimbusds.jwt.JWTClaimsSet	claimsSet	The parsed claimset.
private ClaimsValidator	claimsValidator	The JWT claims validator used to verify the claimsset.
private Consumer<ProfileRequestContext>	cleanupHook	A cleanup hook to execute after either a successful or unsuccessful claims validation.
private Function<ProfileRequestContext,com.nimbusds.jwt.JWT>	jwtLookupStrategy	Strategy used to pull out a JWT to validate from the context.
private final org.slf4j.Logger	log	Class logger.

Constructor Summary

Constructors

Constructor	Description
ValidateTokenClaims()

Method Summary

Modifier and Type	Method	Description
protected void	doExecute(ProfileRequestContext profileRequestContext, AuthenticationContext authenticationContext)
protected void	doInitialize()
protected boolean	doPreExecute(ProfileRequestContext profileRequestContext, AuthenticationContext authenticationContext)
void	setClaimsValidator(ClaimsValidator validator)	Set the JWT claims verifier to use.
void	setCleanupHook(Consumer<ProfileRequestContext> hook)	Set the cleanup hook to execute after either a successful or unsuccessful claims validation.
void	setJwtLookupStrategy(Function<ProfileRequestContext,com.nimbusds.jwt.JWT> strategy)	Set the lookup strategy that locates the JWT to validate from the context.

Methods inherited from class net.shibboleth.idp.authn.AbstractAuthenticationAction

doExecute, doPreExecute, setAuthenticationContextLookupStrategy

Methods inherited from class net.shibboleth.idp.profile.AbstractProfileAction

doExecute, execute, getBean, getBean, getMessage, getMessage, getMessage, getParameter, getParameter, getProfileContextLookupStrategy, getRequestContext, getResult, setMessageSource, setProfileContextLookupStrategy

Methods inherited from class org.opensaml.profile.action.AbstractConditionalProfileAction

getActivationCondition, setActivationCondition

Methods inherited from class org.opensaml.profile.action.AbstractProfileAction

doPostExecute, doPostExecute, ensureHttpServletRequest, ensureHttpServletResponse, execute, getHttpServletRequest, getHttpServletRequestSupplier, getHttpServletResponse, getHttpServletResponseSupplier, getLogPrefix, isPreExecuteCalled, setHttpServletRequestSupplier, setHttpServletResponseSupplier

Methods inherited from class net.shibboleth.shared.component.AbstractInitializableComponent

checkComponentActive, checkSetterPreconditions, destroy, doDestroy, ifDestroyedThrowDestroyedComponentException, ifInitializedThrowUnmodifiabledComponentException, ifNotInitializedThrowUninitializedComponentException, initialize, isDestroyed, isInitialized

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Methods inherited from interface net.shibboleth.shared.component.InitializableComponent

initialize, isInitialized

Field Details

log

@Nonnull
private final org.slf4j.Logger log

Class logger.

cleanupHook

@Nullable
private Consumer<ProfileRequestContext> cleanupHook

A cleanup hook to execute after either a successful or unsuccessful claims validation.

claimsSet

@NonnullBeforeExec
private com.nimbusds.jwt.JWTClaimsSet claimsSet

The parsed claimset.

claimsValidator

@NonnullAfterInit
private ClaimsValidator claimsValidator

The JWT claims validator used to verify the claimsset.

jwtLookupStrategy

@NonnullAfterInit
private Function<ProfileRequestContext,com.nimbusds.jwt.JWT> jwtLookupStrategy

Strategy used to pull out a JWT to validate from the context.

Constructor Details

ValidateTokenClaims

public ValidateTokenClaims()

Method Details

doInitialize

protected void doInitialize()
                     throws ComponentInitializationException

Overrides:

doInitialize in class AbstractInitializableComponent

Throws:

ComponentInitializationException

setJwtLookupStrategy

public void setJwtLookupStrategy(@Nonnull
 Function<ProfileRequestContext,com.nimbusds.jwt.JWT> strategy)

Set the lookup strategy that locates the JWT to validate from the context.

Parameters:

strategy - the strategy

setCleanupHook

public void setCleanupHook(@Nullable
 Consumer<ProfileRequestContext> hook)

Set the cleanup hook to execute after either a successful or unsuccessful claims validation.

Parameters:

hook - cleanup hook

setClaimsValidator

public void setClaimsValidator(@Nonnull
 ClaimsValidator validator)

Set the JWT claims verifier to use.

Parameters:

validator - the claims validator.

doPreExecute

protected boolean doPreExecute(@Nonnull
 ProfileRequestContext profileRequestContext,
 @Nonnull
 AuthenticationContext authenticationContext)

Overrides:

doPreExecute in class AbstractAuthenticationAction

doExecute

protected void doExecute(@Nonnull
 ProfileRequestContext profileRequestContext,
 @Nonnull
 AuthenticationContext authenticationContext)

Overrides:

doExecute in class AbstractAuthenticationAction