Package net.shibboleth.idp.plugin.authn.oidc.rp.impl

Class InitializeOAuth2ClientAuthenticationMethodHandler

java.lang.Object

net.shibboleth.shared.component.AbstractInitializableComponent

org.opensaml.messaging.handler.AbstractMessageHandler

net.shibboleth.idp.plugin.authn.oidc.rp.impl.InitializeOAuth2ClientAuthenticationMethodHandler

All Implemented Interfaces:

Component, DestructableComponent, InitializableComponent, MessageHandler

public class InitializeOAuth2ClientAuthenticationMethodHandler
extends AbstractMessageHandler

An action that resolves the Client Authentication method for the chosen upstream OpenID Provider (issuer) from the profile configuration, and adds it to the OAuth2ClientAuthenticationContext.

If a JWT client authentication type, the security parameters context is used to create a signed JWT client assertion.

Event:

EventIds.PROCEED_EVENT_ID, IdPEventIds.INVALID_PROFILE_CONFIG, EventIds.INVALID_PROFILE_CTX, IdPEventIds.INVALID_RELYING_PARTY_CONFIG

Postcondition:

Add the ClientAuthenticationMethod to the OAuth2ClientAuthenticationContext

Field Summary

Fields

Modifier and Type	Field	Description
private String	clientAuthMethod	The stashed client authentication method to use.
private ClientSecretCredential	clientCredential	The stashed client_secret to use if required.
private String	clientId	The stashed client identifier for this request.
private SecurityParametersContext	jwtBearerClientAuthSecurityParameters	Stashed security parameters context for JWT Bearer Token client authentication methods.
private Duration	jwtBearerExpiryOffset	The offset to add to the 'exp' claim time for JWT client authentication methods.
private final org.slf4j.Logger	log	Class logger.
private OAuth2ClientAuthenticationContext	oauth2ClientAuthenticationContext	The stashed OAuth2 client authentication context.
private Function<MessageContext,OAuth2ClientAuthenticationContext>	oauth2ClientAuthenticationContextLookupStrategy	The strategy used to lookup or create the OAuth2ClientAuthenticationContext for storing the client authentication.
private Function<MessageContext,OIDCPeerEntityContext>	oidcPeerEntityContextLookupStrategy	Strategy to resolve the OIDC entity context class.
private OIDCPeerEntityContext	peerEntityContext	The stashed peer entity context.
private static final ParentProfileRequestContextLookup<MessageContext>	PRC_LOOKUP	Lookup function for parent ProfileRequestContext.
private OIDCAuthenticationRelyingPartyProfileConfiguration	profileConfiguration	Applicable stashed profile configuration.
private com.nimbusds.openid.connect.sdk.op.OIDCProviderMetadata	providerMetadata	The stashed provider metadata.
private Function<MessageContext,OIDCProviderMetadataContext>	providerMetadataLookupStrategy	Lookup strategy to locate the OP metadata to use.
private Function<ProfileRequestContext,RelyingPartyContext>	relyingPartyContextLookupStrategy	Lookup function for relying party context.
private Function<MessageContext,SecurityParametersContext>	securityParametersContextLookupStrategy	Strategy used to look up the SecurityParametersContext to set the parameters for.

Constructor Summary

Constructors

Constructor	Description
InitializeOAuth2ClientAuthenticationMethodHandler()	Constructor.

Method Summary

Modifier and Type	Method	Description
private com.nimbusds.jwt.SignedJWT	buildClientAuthenticationJwt(MessageContext messageContext)	Build a signed JWT bearer token for client authentication using the populated security parameters.
private com.nimbusds.jwt.JWTClaimsSet	buildClientAuthenticationJwtClaims(MessageContext messageContext)	Build the claim values required for a client authentication bearer JWT.
protected void	doInvoke(MessageContext messageContext)
protected boolean	doPreInvoke(MessageContext messageContext)
void	setJwtBearerExpiryOffset(Duration expiry)	Set the JWT expiry time offset for appropriate client authentication methods.
void	setOAuth2ClientAuthenticationContextLookupStrategy(Function<MessageContext,OAuth2ClientAuthenticationContext> strgy)	Set the strategy to lookup the OAuth2ClientAuthenticationContext from the MessageContext.
void	setOidcPeerEntityContextLookupStrategy(Function<MessageContext,OIDCPeerEntityContext> strategy)	Set the lookup strategy to find the OIDCPeerEntityContext.
void	setProviderMetadataLookupStrategy(Function<MessageContext,OIDCProviderMetadataContext> strategy)	Set the lookup strategy to locate the OpenID providers metadata.
void	setRelyingPartyContextLookupStrategy(Function<ProfileRequestContext,RelyingPartyContext> strategy)	Set lookup strategy for relying party context.
void	setSecurityParametersContextLookupStrategy(Function<MessageContext,SecurityParametersContext> strategy)	Set the strategy used to look up the SecurityParametersContext.
private void	verifySuitableClientSecretJWTSecurityContext()	Check the populated security context is using the correct algorithm family for client_secret_jwt client authentication.
private void	verifySuitablePrivateKetJWTSecurityContext()	Check the populated security context is using the correct algorithm family for private_key_jwt client authentication.

Methods inherited from class org.opensaml.messaging.handler.AbstractMessageHandler

doPostInvoke, doPostInvoke, getActivationCondition, getLogPrefix, invoke, isPreInvokeCalled, setActivationCondition

Methods inherited from class net.shibboleth.shared.component.AbstractInitializableComponent

checkComponentActive, checkSetterPreconditions, destroy, doDestroy, doInitialize, ifDestroyedThrowDestroyedComponentException, ifInitializedThrowUnmodifiabledComponentException, ifNotInitializedThrowUninitializedComponentException, initialize, isDestroyed, isInitialized

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Methods inherited from interface net.shibboleth.shared.component.InitializableComponent

initialize, isInitialized

Field Details

log

@Nonnull
private final org.slf4j.Logger log

Class logger.

PRC_LOOKUP

@Nonnull
private static final ParentProfileRequestContextLookup<MessageContext> PRC_LOOKUP

Lookup function for parent ProfileRequestContext.

oauth2ClientAuthenticationContextLookupStrategy

@Nonnull
private Function<MessageContext,OAuth2ClientAuthenticationContext> oauth2ClientAuthenticationContextLookupStrategy

The strategy used to lookup or create the OAuth2ClientAuthenticationContext for storing the client authentication.

oauth2ClientAuthenticationContext

@NonnullBeforeExec
private OAuth2ClientAuthenticationContext oauth2ClientAuthenticationContext

The stashed OAuth2 client authentication context.

providerMetadataLookupStrategy

@Nonnull
private Function<MessageContext,OIDCProviderMetadataContext> providerMetadataLookupStrategy

Lookup strategy to locate the OP metadata to use.

relyingPartyContextLookupStrategy

@Nonnull
private Function<ProfileRequestContext,RelyingPartyContext> relyingPartyContextLookupStrategy

Lookup function for relying party context.

oidcPeerEntityContextLookupStrategy

@Nonnull
private Function<MessageContext,OIDCPeerEntityContext> oidcPeerEntityContextLookupStrategy

Strategy to resolve the OIDC entity context class.

profileConfiguration

@NonnullBeforeExec
private OIDCAuthenticationRelyingPartyProfileConfiguration profileConfiguration

Applicable stashed profile configuration.

securityParametersContextLookupStrategy

@Nonnull
private Function<MessageContext,SecurityParametersContext> securityParametersContextLookupStrategy

Strategy used to look up the SecurityParametersContext to set the parameters for.

jwtBearerExpiryOffset

@Nonnull
private Duration jwtBearerExpiryOffset

The offset to add to the 'exp' claim time for JWT client authentication methods. Default is 30 seconds.

jwtBearerClientAuthSecurityParameters

@Nullable
private SecurityParametersContext jwtBearerClientAuthSecurityParameters

Stashed security parameters context for JWT Bearer Token client authentication methods. Can be null if those client authentication methods are not used.

providerMetadata

@NonnullBeforeExec
private com.nimbusds.openid.connect.sdk.op.OIDCProviderMetadata providerMetadata

The stashed provider metadata.

clientCredential

@Nullable
private ClientSecretCredential clientCredential

The stashed client_secret to use if required.

clientAuthMethod

@Nullable
private String clientAuthMethod

The stashed client authentication method to use.

clientId

@Nullable
private String clientId

The stashed client identifier for this request.

peerEntityContext

@Nullable
private OIDCPeerEntityContext peerEntityContext

The stashed peer entity context.

Constructor Details

InitializeOAuth2ClientAuthenticationMethodHandler

public InitializeOAuth2ClientAuthenticationMethodHandler()

Constructor.

Method Details

setOidcPeerEntityContextLookupStrategy

public void setOidcPeerEntityContextLookupStrategy(Function<MessageContext,OIDCPeerEntityContext> strategy)

Set the lookup strategy to find the OIDCPeerEntityContext.

Parameters:

strategy - the strategy to set.

Since:

2.3.0

setJwtBearerExpiryOffset

public void setJwtBearerExpiryOffset(@Nonnull
 Duration expiry)

Set the JWT expiry time offset for appropriate client authentication methods.

Parameters:

expiry - the JWT 'exp' claim offset

setProviderMetadataLookupStrategy

public void setProviderMetadataLookupStrategy(@Nonnull
 Function<MessageContext,OIDCProviderMetadataContext> strategy)

Set the lookup strategy to locate the OpenID providers metadata.

Parameters:

strategy - the strategy.

setSecurityParametersContextLookupStrategy

public void setSecurityParametersContextLookupStrategy(@Nonnull
 Function<MessageContext,SecurityParametersContext> strategy)

Set the strategy used to look up the SecurityParametersContext.

Parameters:

strategy - lookup strategy

setRelyingPartyContextLookupStrategy

public void setRelyingPartyContextLookupStrategy(@Nonnull
 Function<ProfileRequestContext,RelyingPartyContext> strategy)

Set lookup strategy for relying party context.

Parameters:

strategy - lookup strategy

setOAuth2ClientAuthenticationContextLookupStrategy

public void setOAuth2ClientAuthenticationContextLookupStrategy(@Nonnull
 Function<MessageContext,OAuth2ClientAuthenticationContext> strgy)

Set the strategy to lookup the OAuth2ClientAuthenticationContext from the MessageContext.

Parameters:

strgy - the strategy.

doPreInvoke

protected boolean doPreInvoke(@Nonnull
 MessageContext messageContext)
                       throws MessageHandlerException

Overrides:

doPreInvoke in class AbstractMessageHandler

Throws:

MessageHandlerException

doInvoke

protected void doInvoke(MessageContext messageContext)
                 throws MessageHandlerException

Specified by:

doInvoke in class AbstractMessageHandler

Throws:

MessageHandlerException

verifySuitableClientSecretJWTSecurityContext

private void verifySuitableClientSecretJWTSecurityContext()
                                                   throws MessageHandlerException

Check the populated security context is using the correct algorithm family for client_secret_jwt client authentication.

Throws:

MessageHandlerException - if the wrong algorithm family is specified in the security context

verifySuitablePrivateKetJWTSecurityContext

private void verifySuitablePrivateKetJWTSecurityContext()
                                                 throws MessageHandlerException

Check the populated security context is using the correct algorithm family for private_key_jwt client authentication.

Throws:

MessageHandlerException - if the wrong algorithm family is specified in the security context

buildClientAuthenticationJwtClaims

@Nonnull
private com.nimbusds.jwt.JWTClaimsSet buildClientAuthenticationJwtClaims(@Nonnull
 MessageContext messageContext)
                                                                  throws MessageHandlerException

Build the claim values required for a client authentication bearer JWT. By default, the audience is set to the issuer identifier of the OP, but there is a flag that allows this to be changed to the token endpoint URL, which was the previous default.

Parameters:

messageContext - the message context

Returns:

the constructed JWT claims set

Throws:

MessageHandlerException - on error constructing the JWT

buildClientAuthenticationJwt

@Nonnull
private com.nimbusds.jwt.SignedJWT buildClientAuthenticationJwt(@Nonnull
 MessageContext messageContext)
                                                         throws MessageHandlerException

Build a signed JWT bearer token for client authentication using the populated security parameters. Relies on the correct 'alg' and credential existing in the security context ahead of time for the correct SignedJWT to be returned e.g. for either client_secret_jwt or private_key_jwt.

Parameters:

messageContext - the message context

Returns:

a signed JWT bearer token, or throws an exception if there was an error during construction

Throws:

MessageHandlerException - on error constructing the JWT