Package net.shibboleth.idp.plugin.authn.oidc.rp.impl

Class AuthorizationController

java.lang.Object

net.shibboleth.shared.component.AbstractInitializableComponent

net.shibboleth.idp.plugin.authn.oidc.rp.impl.AuthorizationController

All Implemented Interfaces:

Component, DestructableComponent, InitializableComponent

@ThreadSafe
@Controller
@RequestMapping("%{idp.authn.oidc.rp.externalAuthnPath:/Authn/OIDC/RP}")
public class AuthorizationController
extends AbstractInitializableComponent

Servlet compatible with the ExternalAuthentication interface that begins, by HTTP redirect, an OpenID Connect authentication request to an OpenID Connect Provider (an OAuth 2.0 Authorization Server that supports OpenID Connect).

The servlet also consumes the HTTP authentication response from the OpenID Connect provider, decodes it, adds it the the input message context, and resumes IdP processing.

Field Summary

Fields

Modifier and Type	Field	Description
static final String	AUTHORIZE_PATH_SEGMENT	The final part of the IdP URL path which is called to begin authorization.
static final String	CALLBACK_PATH_SEGMENT	The final part of the IdP URL path which is called to end authorization via the callback.
static final String	CODE_PARAMETER	The name of the Http parameter that stores the authorisation code.
private final org.slf4j.Logger	log	Class logger.
private Function<ProfileRequestContext,OIDCAuthnContext>	oidcContextLookupStrategy	Lookup strategy to locate the SAML context.
private Function<ProfileRequestContext,ProfileRequestContext>	profileRequestContextLookupStrategy	Lookup strategy to locate the nested ProfileRequestContext.
static final String	STATE_PARAMETER	The name of the Http parameter that stores the state value.

Constructor Summary

Constructors

Constructor	Description
AuthorizationController()	Constructor.

Method Summary

Modifier and Type	Method	Description
void	authorizationCallback(HttpServletRequest httpRequest, HttpServletResponse httpResponse)	Callback endpoint to accept the authorization response.
void	authorizationRequest(HttpServletRequest httpRequest, HttpServletResponse httpResponse)	Begin an authorization request to the configured upstream OP.
void	setOidcAuthnContextLookupStrategy(Function<ProfileRequestContext,OIDCAuthnContext> strategy)	Set the lookup strategy used to locate the OIDCAuthnContext.
void	setProfileRequestContextLookupStrategy(Function<ProfileRequestContext,ProfileRequestContext> strategy)	Set the lookup strategy used to locate the nested ProfileRequestContext.

Methods inherited from class net.shibboleth.shared.component.AbstractInitializableComponent

checkComponentActive, checkSetterPreconditions, destroy, doDestroy, doInitialize, ifDestroyedThrowDestroyedComponentException, ifInitializedThrowUnmodifiabledComponentException, ifNotInitializedThrowUninitializedComponentException, initialize, isDestroyed, isInitialized

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Field Details

AUTHORIZE_PATH_SEGMENT

@Nonnull
@NotEmpty
public static final String AUTHORIZE_PATH_SEGMENT

The final part of the IdP URL path which is called to begin authorization.

See Also:

• Constant Field Values

CALLBACK_PATH_SEGMENT

@Nonnull
@NotEmpty
public static final String CALLBACK_PATH_SEGMENT

The final part of the IdP URL path which is called to end authorization via the callback.

See Also:

• Constant Field Values

CODE_PARAMETER

@Nonnull
@NotEmpty
public static final String CODE_PARAMETER

The name of the Http parameter that stores the authorisation code.

See Also:

• Constant Field Values

STATE_PARAMETER

@Nonnull
@NotEmpty
public static final String STATE_PARAMETER

The name of the Http parameter that stores the state value.

See Also:

• Constant Field Values

log

@Nonnull
private final org.slf4j.Logger log

Class logger.

profileRequestContextLookupStrategy

@Nonnull
private Function<ProfileRequestContext,ProfileRequestContext> profileRequestContextLookupStrategy

Lookup strategy to locate the nested ProfileRequestContext.

oidcContextLookupStrategy

@Nonnull
private Function<ProfileRequestContext,OIDCAuthnContext> oidcContextLookupStrategy

Lookup strategy to locate the SAML context.

Constructor Details

AuthorizationController

public AuthorizationController()

Constructor.

Method Details

setProfileRequestContextLookupStrategy

public void setProfileRequestContextLookupStrategy(@Nonnull
 Function<ProfileRequestContext,ProfileRequestContext> strategy)

Set the lookup strategy used to locate the nested ProfileRequestContext.

Parameters:

strategy - lookup strategy

setOidcAuthnContextLookupStrategy

public void setOidcAuthnContextLookupStrategy(@Nonnull
 Function<ProfileRequestContext,OIDCAuthnContext> strategy)

Set the lookup strategy used to locate the OIDCAuthnContext.

Parameters:

strategy - lookup strategy

authorizationRequest

@GetMapping("/authz")
public void authorizationRequest(@Nonnull
 HttpServletRequest httpRequest,
 @Nonnull
 HttpServletResponse httpResponse)
                          throws ServletException,
IOException,
ExternalAuthenticationException

Begin an authorization request to the configured upstream OP.

Parameters:

httpRequest - the servlet request.

httpResponse - the servlet response.

Throws:

ServletException - throw if there is an error constructing an authz request.

IOException - throw if there is an error constructing an authz request.

ExternalAuthenticationException - throw if there is a general error constructing an authz request.

authorizationCallback

@RequestMapping("/callback")
public void authorizationCallback(@Nonnull
 HttpServletRequest httpRequest,
 @Nonnull
 HttpServletResponse httpResponse)
                           throws ExternalAuthenticationException,
IOException

Callback endpoint to accept the authorization response.

Parameters:

httpRequest - the servlet request.

httpResponse - the servlet response.

Throws:

ExternalAuthenticationException - throw if there is an error accepting the authz response.

IOException - throw if there is an error accepting the authz response.