Package net.shibboleth.idp.plugin.authn.oidc.rp.impl

Class ValidateOIDCAuthentication

java.lang.Object

net.shibboleth.shared.component.AbstractInitializableComponent

org.opensaml.profile.action.AbstractProfileAction

org.opensaml.profile.action.AbstractConditionalProfileAction

net.shibboleth.idp.profile.AbstractProfileAction

net.shibboleth.idp.authn.AbstractAuthenticationAction

net.shibboleth.idp.authn.AbstractValidationAction

net.shibboleth.idp.plugin.authn.oidc.rp.impl.ValidateOIDCAuthentication

All Implemented Interfaces:

PrincipalSupportingComponent, Component, DestructableComponent, InitializableComponent, ProfileAction, Aware, MessageSource, MessageSourceAware, Action

public class ValidateOIDCAuthentication
extends AbstractValidationAction

An action that builds an AuthenticationResult based on an inbound OIDC authentication response.

A EndUserClaimsContext is used as the basis of the result, which stores the merged id_token and UserInfo claims set, alongside the raw id_token claims.

Actual validation is all upstream of this action, but the use of the ValidationAction subclass is a convenience for auditing and handling the result.

Event:

EventIds.PROCEED_EVENT_ID, EventIds.INVALID_PROFILE_CTX, IdPEventIds.INVALID_RELYING_PARTY_CTX, IdPEventIds.INVALID_PROFILE_CONFIG, AuthnEventIds.NO_CREDENTIALS

Precondition:

ProfileRequestContext.getSubcontext(AuthenticationContext.class).getAttemptedFlow() != null

Postcondition:

If AuthenticationContext.getSubcontext(EndUserClaimsContext.class, false)!= null, then an AuthenticationResult is saved to the AuthenticationContext.

Field Summary

Fields

Modifier and Type	Field	Description
private Function<Collection<String>,Collection<Principal>>	acrTranslator	Incoming context translation function for converting OIDC ACRs into Principals.
private Function<Collection<String>,Collection<Principal>>	amrTranslator	Incoming context translation function for converting OIDC ACRs into Principals.
private AttributeContext	attributeContext	Context for externally supplied inbound attributes.
private Function<ProfileRequestContext,Collection<IdPAttribute>>	attributeExtractionStrategy	Pluggable strategy function for generalized extraction of data.
private ReloadableService<AttributeFilter>	attributeFilterService	Service used to get the engine used to filter attributes.
private Function<ProfileRequestContext,Collection<Principal>>	contextToPrivateCredentialsMappingStrategy	A hook to map context information to private credentials.
private static final String	DEFAULT_METRIC_NAME	Default prefix for metrics.
private final Function<ProfileRequestContext,EndUserClaimsContext>	endUserClaimsContextLookupStrategy	Strategy used to look up the EndUserClaimsContext to set the parameters for.
private EndUserClaimsContext	endUserContext	The context with claims pertaining to the end-user of this authentication.
private final org.slf4j.Logger	log	Class logger.
private MetadataResolver	metadataResolver	Optional supplemental metadata source for filtering.
private ProfileRequestContext	prc	The profile request context.
private OIDCAuthenticationRelyingPartyProfileConfiguration	profileConfiguration	Store off profile config.
private Function<ProfileRequestContext,RelyingPartyContext>	relyingPartyContextLookupStrategy	Strategy used to look up a RelyingPartyContext for configuration options.
private ReloadableService<AttributeTranscoderRegistry>	transcoderRegistry	Transcoder registry service object.
private com.nimbusds.jwt.JWTClaimsSet	unprocessedIdTokenClaims	The set of id_token claims before they are processed.

Constructor Summary

Constructors

Constructor	Description
ValidateOIDCAuthentication()	Constructor.

Method Summary

Modifier and Type	Method	Description
private ProxyAuthenticationPrincipal	buildProxyPrincipal()	Construct a populated ProxyAuthenticationPrincipal based on the upstream OP (the issuer of the id_token).
private void	decodeAttribute(AttributeTranscoderRegistry registry, ProfileRequestContext profileRequestContext, net.minidev.json.JSONObject input, Multimap<String,IdPAttribute> results)	Access the registry of transcoding rules to transform (decode) the input claims to IdP Attributes.
protected void	doExecute(ProfileRequestContext profileRequestContext, AuthenticationContext authenticationContext)
protected boolean	doPreExecute(ProfileRequestContext profileRequestContext, AuthenticationContext authenticationContext)
private void	filterAttributes(ProfileRequestContext profileRequestContext)	Check for inbound attributes and apply filtering.
private void	populateFilterContext(ProfileRequestContext profileRequestContext, AttributeFilterContext filterContext)	Fill in the filter context data.
protected Subject	populateSubject(Subject subject)
private void	processAttributes(ProfileRequestContext profileRequestContext)	Process the inbound OIDC claims.
void	setAttributeExtractionStrategy(Function<ProfileRequestContext,Collection<IdPAttribute>> strategy)	Sets the strategy function to invoke for generalized extraction of data into IdPAttribute objects for inclusion in the AuthenticationResult.
void	setAttributeFilter(ReloadableService<AttributeFilter> filterService)	Sets the filter service to use for inbound attributes.
void	setContextToPrivateCredentialsMappingStrategy(Function<ProfileRequestContext,Collection<Principal>> strategy)	Set the context to principal mapping strategy for mapping context information into principal collections to place in the private credentials set of the subject.
void	setMetadataResolver(MetadataResolver resolver)	Set a metadata source to use during filtering.
void	setRelyingPartyContextLookupStrategy(Function<ProfileRequestContext,RelyingPartyContext> strategy)	Set the strategy used to return the RelyingPartyContext for configuration options.
void	setTranscoderRegistry(ReloadableService<AttributeTranscoderRegistry> registry)	Sets the registry of transcoding rules to apply to encode attributes.
private static Map<String,IdPAttribute>	toMapMergeDuplicates(Collection<IdPAttribute> attributes)	Convert a collection of IdPAttribute objects into a mutable Map keyed by IdPAttribute.getId().
private static Map<String,IdPAttribute>	withMapMergeDuplicates(Map<String,IdPAttribute> existingAttributes, Collection<IdPAttribute> newAttributes)	Add a collection of IdPAttribute objects into a mutable input Map keyed by IdPAttribute.getId().

Methods inherited from class net.shibboleth.idp.authn.AbstractValidationAction

addDefaultPrincipals, buildAuthenticationResult, getClassifiedErrors, getCleanupHook, getMetricName, getRequesterLookupStrategy, getResponderLookupStrategy, getResultCachingPredicate, getSubject, getSupportedPrincipals, handleError, handleError, handleWarning, recordFailure, recordSuccess, setAddDefaultPrincipals, setClassifiedMessages, setCleanupHook, setMetricName, setRequesterLookupStrategy, setResponderLookupStrategy, setResultCachingPredicate, setSupportedPrincipals

Methods inherited from class net.shibboleth.idp.authn.AbstractAuthenticationAction

doExecute, doPreExecute, setAuthenticationContextLookupStrategy

Methods inherited from class net.shibboleth.idp.profile.AbstractProfileAction

doExecute, execute, getBean, getBean, getMessage, getMessage, getMessage, getParameter, getParameter, getProfileContextLookupStrategy, getRequestContext, getResult, setMessageSource, setProfileContextLookupStrategy

Methods inherited from class org.opensaml.profile.action.AbstractConditionalProfileAction

getActivationCondition, setActivationCondition

Methods inherited from class org.opensaml.profile.action.AbstractProfileAction

doPostExecute, doPostExecute, ensureHttpServletRequest, ensureHttpServletResponse, execute, getHttpServletRequest, getHttpServletRequestSupplier, getHttpServletResponse, getHttpServletResponseSupplier, getLogPrefix, isPreExecuteCalled, setHttpServletRequestSupplier, setHttpServletResponseSupplier

Methods inherited from class net.shibboleth.shared.component.AbstractInitializableComponent

checkComponentActive, checkSetterPreconditions, destroy, doDestroy, doInitialize, ifDestroyedThrowDestroyedComponentException, ifInitializedThrowUnmodifiabledComponentException, ifNotInitializedThrowUninitializedComponentException, initialize, isDestroyed, isInitialized

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Methods inherited from interface net.shibboleth.shared.component.InitializableComponent

initialize, isInitialized

Field Details

DEFAULT_METRIC_NAME

@Nonnull
@NotEmpty
private static final String DEFAULT_METRIC_NAME

Default prefix for metrics.

See Also:

• Constant Field Values

log

@Nonnull
private final org.slf4j.Logger log

Class logger.

transcoderRegistry

@NonnullAfterInit
private ReloadableService<AttributeTranscoderRegistry> transcoderRegistry

Transcoder registry service object.

attributeFilterService

@Nullable
private ReloadableService<AttributeFilter> attributeFilterService

Service used to get the engine used to filter attributes.

metadataResolver

@Nullable
private MetadataResolver metadataResolver

Optional supplemental metadata source for filtering.

relyingPartyContextLookupStrategy

@Nonnull
private Function<ProfileRequestContext,RelyingPartyContext> relyingPartyContextLookupStrategy

Strategy used to look up a RelyingPartyContext for configuration options.

contextToPrivateCredentialsMappingStrategy

@Nullable
private Function<ProfileRequestContext,Collection<Principal>> contextToPrivateCredentialsMappingStrategy

A hook to map context information to private credentials.

profileConfiguration

@NonnullBeforeExec
private OIDCAuthenticationRelyingPartyProfileConfiguration profileConfiguration

Store off profile config.

endUserContext

@NonnullBeforeExec
private EndUserClaimsContext endUserContext

The context with claims pertaining to the end-user of this authentication.

unprocessedIdTokenClaims

@NonnullBeforeExec
private com.nimbusds.jwt.JWTClaimsSet unprocessedIdTokenClaims

The set of id_token claims before they are processed.

endUserClaimsContextLookupStrategy

@Nonnull
private final Function<ProfileRequestContext,EndUserClaimsContext> endUserClaimsContextLookupStrategy

Strategy used to look up the EndUserClaimsContext to set the parameters for.

attributeContext

@Nullable
private AttributeContext attributeContext

Context for externally supplied inbound attributes.

acrTranslator

@Nullable
private Function<Collection<String>,Collection<Principal>> acrTranslator

Incoming context translation function for converting OIDC ACRs into Principals.

amrTranslator

@Nullable
private Function<Collection<String>,Collection<Principal>> amrTranslator

Incoming context translation function for converting OIDC ACRs into Principals.

attributeExtractionStrategy

@Nullable
private Function<ProfileRequestContext,Collection<IdPAttribute>> attributeExtractionStrategy

Pluggable strategy function for generalized extraction of data.

prc

@Nullable
private ProfileRequestContext prc

The profile request context.

Constructor Details

ValidateOIDCAuthentication

public ValidateOIDCAuthentication()

Constructor.

Method Details

setContextToPrivateCredentialsMappingStrategy

public void setContextToPrivateCredentialsMappingStrategy(@Nullable
 Function<ProfileRequestContext,Collection<Principal>> strategy)

Set the context to principal mapping strategy for mapping context information into principal collections to place in the private credentials set of the subject.

Parameters:

strategy - the strategy to use

setAttributeFilter

public void setAttributeFilter(@Nullable
 ReloadableService<AttributeFilter> filterService)

Sets the filter service to use for inbound attributes.

Parameters:

filterService - optional filter service for inbound attributes

setTranscoderRegistry

public void setTranscoderRegistry(@Nonnull
 ReloadableService<AttributeTranscoderRegistry> registry)

Sets the registry of transcoding rules to apply to encode attributes.

Parameters:

registry - registry service interface

setMetadataResolver

public void setMetadataResolver(@Nullable
 MetadataResolver resolver)

Set a metadata source to use during filtering.

Parameters:

resolver - metadata resolver

setRelyingPartyContextLookupStrategy

public void setRelyingPartyContextLookupStrategy(@Nonnull
 Function<ProfileRequestContext,RelyingPartyContext> strategy)

Set the strategy used to return the RelyingPartyContext for configuration options.

Parameters:

strategy - lookup strategy

setAttributeExtractionStrategy

public void setAttributeExtractionStrategy(@Nullable
 Function<ProfileRequestContext,Collection<IdPAttribute>> strategy)

Sets the strategy function to invoke for generalized extraction of data into IdPAttribute objects for inclusion in the AuthenticationResult.

Parameters:

strategy - extraction strategy

doPreExecute

protected boolean doPreExecute(@Nonnull
 ProfileRequestContext profileRequestContext,
 @Nonnull
 AuthenticationContext authenticationContext)

Overrides:

doPreExecute in class AbstractValidationAction

doExecute

protected void doExecute(@Nonnull
 ProfileRequestContext profileRequestContext,
 @Nonnull
 AuthenticationContext authenticationContext)

Overrides:

doExecute in class AbstractAuthenticationAction

populateSubject

protected Subject populateSubject(@Nonnull
 Subject subject)

Specified by:

populateSubject in class AbstractValidationAction

buildProxyPrincipal

@Nonnull
private ProxyAuthenticationPrincipal buildProxyPrincipal()

Construct a populated ProxyAuthenticationPrincipal based on the upstream OP (the issuer of the id_token).

Returns:

a constructed ProxyAuthenticationPrincipal to include in the Subject

processAttributes

private void processAttributes(@Nonnull
 ProfileRequestContext profileRequestContext)

Process the inbound OIDC claims.

Parameters:

profileRequestContext - current profile request context

filterAttributes

private void filterAttributes(@Nonnull
 ProfileRequestContext profileRequestContext)

Check for inbound attributes and apply filtering.

Parameters:

profileRequestContext - current profile request context

populateFilterContext

private void populateFilterContext(@Nonnull
 ProfileRequestContext profileRequestContext,
 @Nonnull
 AttributeFilterContext filterContext)

Fill in the filter context data.

Parameters:

profileRequestContext - current profile request context

filterContext - context to populate

decodeAttribute

private void decodeAttribute(@Nonnull
 AttributeTranscoderRegistry registry,
 @Nonnull
 ProfileRequestContext profileRequestContext,
 @Nonnull
 net.minidev.json.JSONObject input,
 @Nonnull @NonnullElements @Live
 Multimap<String,IdPAttribute> results)
                      throws AttributeDecodingException

Access the registry of transcoding rules to transform (decode) the input claims to IdP Attributes.

Parameters:

registry - registry of transcoding rules

profileRequestContext - current profile request context

input - input attribute

results - collection to add results to

Throws:

AttributeDecodingException - if a non-ignorable error occurs

toMapMergeDuplicates

@Nonnull
@Live
private static Map<String,IdPAttribute> toMapMergeDuplicates(@Nullable
 Collection<IdPAttribute> attributes)

Convert a collection of IdPAttribute objects into a mutable Map keyed by IdPAttribute.getId().

If an attribute with a duplicate ID is found, then we merge the values into a single attribute.

Parameters:

attributes - collection of attributes

Returns:

the input attributes in a map keyed by IdPAttribute.getId()

withMapMergeDuplicates

@Nonnull
@Live
private static Map<String,IdPAttribute> withMapMergeDuplicates(@Nonnull @Live
 Map<String,IdPAttribute> existingAttributes,
 @Nullable
 Collection<IdPAttribute> newAttributes)

Add a collection of IdPAttribute objects into a mutable input Map keyed by IdPAttribute.getId().

If an attribute with a duplicate ID is found, then we merge the values into a single attribute.

Parameters:

existingAttributes - an existing mutable map to merge into

newAttributes - collection to merge into map

Returns:

the input map after merging is done