Package net.shibboleth.idp.plugin.authn.oidc.rp.impl

Class ProcessEndUserClaims

java.lang.Object
net.shibboleth.shared.component.AbstractInitializableComponent
org.opensaml.profile.action.AbstractProfileAction
org.opensaml.profile.action.AbstractConditionalProfileAction
net.shibboleth.idp.profile.AbstractProfileAction
net.shibboleth.idp.plugin.authn.oidc.rp.impl.ProcessEndUserClaims
All Implemented Interfaces:
Component, DestructableComponent, InitializableComponent, ProfileAction, Aware, MessageSource, MessageSourceAware, Action
public class ProcessEndUserClaims extends AbstractProfileAction
Process the end-user claims from the id_token and possible UserInfo claims sets.

Sanitized both claims sets using a replaceable strategy. For example, by default to remove standard JWT 'validation' claims that should not be exposed further by the system.

Merge the claims sets together to produce an aggregate claims set. The UserInfo claims can be empty i.e. claims from the UserInfo endpoint were not requested.

Event:
EventIds.PROCEED_EVENT_ID, EventIds.INVALID_PROFILE_CTX
Postcondition:
Add a set of merged and sanatized claims to the EndUserClaimsContext.

  • Field Details

    • log

      @Nonnull private final org.slf4j.Logger log
      Class logger.

    • userInfoResponseContextLookupStrategy

      @Nonnull private Function<ProfileRequestContext,UserInfoResponseContext> userInfoResponseContextLookupStrategy
      Strategy used to look up the UserInfoResponseContext.

    • accessTokenResponseContextLookupStrategy

      @Nonnull private Function<ProfileRequestContext,AccessTokenResponseContext> accessTokenResponseContextLookupStrategy
      Strategy used to look up the AccessTokenResponseContext .

    • endUserClaimsContextLookupStrategy

      @Nonnull private Function<ProfileRequestContext,EndUserClaimsContext> endUserClaimsContextLookupStrategy
      Strategy used to look up the EndUserClaimsContext to set the parameters for.

    • claimMergingStrategy

      @Nonnull private BinaryOperator<com.nimbusds.openid.connect.sdk.claims.ClaimsSet> claimMergingStrategy
      The strategy used to merge UserInfo claims with id_token claims.

    • claimSanitizationStrategy

      @Nonnull private UnaryOperator<com.nimbusds.openid.connect.sdk.claims.ClaimsSet> claimSanitizationStrategy
      The strategy used to sanitize claims in an input claimset. By default, produces a set of claims without the validation claims (e.g. nonce, exp), but leaving the identity, authorization and misc claims.

    • userInfoClaims

      @NonnullBeforeExec private com.nimbusds.openid.connect.sdk.claims.ClaimsSet userInfoClaims
      The stashed UserInfo claims. This is allowably empty if the UserInfo endpoint was not used.

    • idTokenClaims

      @NonnullBeforeExec private com.nimbusds.jwt.JWTClaimsSet idTokenClaims
      The stashed id_token claims. This should never be null or empty once doPreExecute(ProfileRequestContext) has run.

  • Constructor Details

    • ProcessEndUserClaims

      public ProcessEndUserClaims()
      Constructor.

  • Method Details

    • setClaimMergingStrategy

      public void setClaimMergingStrategy(@Nonnull BinaryOperator<com.nimbusds.openid.connect.sdk.claims.ClaimsSet> strategy)
      Set the strategy used to merge UserInfo claims with id_token claims.
      Parameters:
      strategy - the strategy to use.

    • setClaimSanitizationStrategy

      public void setClaimSanitizationStrategy(@Nonnull UnaryOperator<com.nimbusds.openid.connect.sdk.claims.ClaimsSet> strategy)
      Set the strategy used to sanitize claims from both the id_token and UserInfo claims set to produce a clean claims set.
      Parameters:
      strategy - the strategy to use.

    • setEnableClaimSanitizationStrategy

      public void setEnableClaimSanitizationStrategy(boolean enable)
      Set whether to enable claim sanitization. If true, whatever claimSanatizationStrategy is set is used. If false, a no-op strategy is created which just returns a new claims set based on the same claims that exist in the input claims set. By default, claims sanitization uses the DefaultClaimSanitizationStrategy.
      Parameters:
      enable - enable or disable claims sanitization

    • setEndUserClaimsContextLookupStrategy

      public void setEndUserClaimsContextLookupStrategy(@Nonnull Function<ProfileRequestContext,EndUserClaimsContext> strategy)
      Set the strategy used to lookup a EndUserClaimsContext.
      Parameters:
      strategy - the strategy

    • setAccessTokenResponseContextLookupStrategy

      public void setAccessTokenResponseContextLookupStrategy(@Nonnull Function<ProfileRequestContext,AccessTokenResponseContext> strategy)
      Set the strategy used to look up a AccessTokenResponseContext.
      Parameters:
      strategy - lookup strategy

    • setUserInfoResponseContextLookupStrategy

      public void setUserInfoResponseContextLookupStrategy(@Nonnull Function<ProfileRequestContext,UserInfoResponseContext> strategy)
      Set the strategy used to look up a UserInfoResponseContext.
      Parameters:
      strategy - lookup strategy

    • doPreExecute

      protected boolean doPreExecute(@Nonnull ProfileRequestContext profileRequestContext)
      Overrides:
      doPreExecute in class AbstractConditionalProfileAction

    • doExecute

      protected void doExecute(@Nonnull ProfileRequestContext profileRequestContext)
      Overrides:
      doExecute in class AbstractProfileAction