Package net.shibboleth.idp.plugin.authn.oidc.rp.impl
package net.shibboleth.idp.plugin.authn.oidc.rp.impl
This package has an authentication implementation for OpenID Connect authentication providers.
-
ClassesClassDescriptionAbstractHttpOIDCAuthenticationAction<T extends com.nimbusds.oauth2.sdk.Response>An abstract class for OIDC actions that make synchronous HTTP requests and return
responses.Abstract class for actions based on theAuthenticationResponselocated under theInOutOperationContext.getInboundMessageContext()and the builtOIDCAuthenticationRequestlocated under theInOutOperationContext.getOutboundMessageContext().A mapping strategy that locates theAccessTokenResponseContextfrom theProfileRequestContextand constructs and returns anOAuth2AccessTokenPrincipalfrom the access_token, token_type, and expires_in.Servlet compatible with theExternalAuthenticationinterface that begins, by HTTP redirect, an OpenID Connect authentication request to an OpenID Connect Provider (an OAuth 2.0 Authorization Server that supports OpenID Connect).Action that creates a Request ObjectJWT, and sets it to the work contextOIDCAuthenticationRequestlocated underInOutOperationContext.getOutboundMessageContext().A default merging strategy for combing claims in the UserInfo response with those from the id_token.Produce a claims set from the JWT claims set without the validation claims, leaving the identity, authorization, and misc.Constructive, pure, function that returns a redirect_uri from one of (ordered): A pre-registered redirect_uri on theOAuth2ClientContext.getRedirectUriOverride().Action to exchange the authorization code in the authentication response for an OAuth access token which contains an OIDC id_token.An action that creates anOIDCAuthenticationRequestshell to populate in future steps, and sets it to the outbound message context.Action that adds an outboundMessageContextto the outbound message context inside theProfileRequestContext.Anactionthat initializes anOAuth2ClientAuthenticationContextfor later use.Anactionthat resolves the Client Authentication method for the chosen upstream OpenID Provider (issuer) from the profile configuration, and adds it to theOAuth2ClientAuthenticationContext.Anactionthat resolves the client identifier and redirect URI for the chosen provider (issuer).Initialize an outbound message context with an OIDC peer entity context ready for an authorization/authentication request to be built.Action that adds aRelyingPartyContextto the currentProfileRequestContexttree via a creation function.Action that adds an unverifiedRelyingPartyContextto the currentProfileRequestContexttree via a creation function.Support class for OIDC proxy related implementations.Action that adds an inboundMessageContextand aOIDCPeerEntityContextto theProfileRequestContextbased on the identity of a relying party, by default from theAuthenticationContext.getAuthenticatingAuthority().Process the end-user claims from the id_token and possible UserInfo claims sets.An action that operates on aSubjectCanonicalizationContextchild of the currentProfileRequestContext, and transforms the inputSubjectinto a principal name by searching for one and only oneOIDCSubjectIdentifierPrincipalcustom principal.A predicate that determines if this action can run or not.Simple action to log the response from an unsupported grant type.Request information from the UserInfo OAuth2.0 endpoint using the access_token already present in the context.An action that checks the inbound authentication response indicated success as opposed to an error.An action that checks for aExternalAuthenticationContextfor a signalled event via theExternalAuthenticationContext.getAuthnError()method.Validation action that validates the OAuth Access Token Response against RFC 6749 section 5.1 and OpenID Connect Core 1.0 section 3.1.3.3.An action that builds anAuthenticationResultbased on an inbound OIDC authentication response.Authentication action that validates the authentication response state parameter (which is required in the Proxy flow) matches that in the authentication request.Action that validates the claims of a JWT using the suppliedclaims validator.Validate a successful UserInfo JSON Object Response according to section 5.3.2 of OpenID Connect Core 1.0.