Package net.shibboleth.idp.plugin.authn.oidc.rp.messaging.impl

Class AddPCKECodeVerifierAndChallenge

java.lang.Object

net.shibboleth.shared.component.AbstractInitializableComponent

org.opensaml.messaging.handler.AbstractMessageHandler

net.shibboleth.idp.plugin.authn.oidc.rp.messaging.impl.AbstractOIDCAuthenticationRequestActionMessageHandler

net.shibboleth.idp.plugin.authn.oidc.rp.messaging.impl.AddPCKECodeVerifierAndChallenge

All Implemented Interfaces:

Component, DestructableComponent, InitializableComponent, MessageHandler

public class AddPCKECodeVerifierAndChallenge
extends AbstractOIDCAuthenticationRequestActionMessageHandler

Create an OAuth 2.0 PCKE code_verifier to use in the token request, and derives a code_challenge for immediate use in the authorization request.

Since:

2.1.0

Field Summary

Fields

Modifier and Type	Field	Description
private final org.slf4j.Logger	log	Logger.

Constructor Summary

Constructors

Constructor	Description
AddPCKECodeVerifierAndChallenge()

Method Summary

Modifier and Type	Method	Description
private String	computeCodeChallenge(String codeVerifier, OAuthAuthorizationRequest.CodeChallengeMethod method)	Compute the code_challenge from the code_verifier.
protected void	doInvoke(MessageContext messageContext)
private static String	generateCodeVerifier(Integer length)	Generates a code_verifier for use during Proof Key for Code Exchange.

Methods inherited from class net.shibboleth.idp.plugin.authn.oidc.rp.messaging.impl.AbstractOIDCAuthenticationRequestActionMessageHandler

adapt, adapt, doPreInvoke, getAuthenticationRequest, getHttpServletRequest, getHttpServletRequestSupplier, getProfileConfiguration, getProviderMetadata, lookupProfileRequestContext, setHttpServletRequestSupplier, setProviderMetadataLookupStrategy, setRelyingPartyContextLookupStrategy

Methods inherited from class org.opensaml.messaging.handler.AbstractMessageHandler

doPostInvoke, doPostInvoke, getActivationCondition, getLogPrefix, invoke, isPreInvokeCalled, setActivationCondition

Methods inherited from class net.shibboleth.shared.component.AbstractInitializableComponent

checkComponentActive, checkSetterPreconditions, destroy, doDestroy, doInitialize, ifDestroyedThrowDestroyedComponentException, ifInitializedThrowUnmodifiabledComponentException, ifNotInitializedThrowUninitializedComponentException, initialize, isDestroyed, isInitialized

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Methods inherited from interface net.shibboleth.shared.component.InitializableComponent

initialize, isInitialized

Field Details

log

@Nonnull
private final org.slf4j.Logger log

Logger.

Constructor Details

AddPCKECodeVerifierAndChallenge

public AddPCKECodeVerifierAndChallenge()

Method Details

doInvoke

protected void doInvoke(MessageContext messageContext)
                 throws MessageHandlerException

Specified by:

doInvoke in class AbstractMessageHandler

Throws:

MessageHandlerException

generateCodeVerifier

@Nonnull
private static String generateCodeVerifier(@Nonnull
 Integer length)
                                    throws MessageHandlerException

Generates a code_verifier for use during Proof Key for Code Exchange. The generated bytes are base64 URL encoded before they are returned.

Parameters:

length - the byte length of the code_verifier. Must be at least 32 bytes long (RFC7636 section 7.1).

Returns:

the base64 URL encoded coder_verifier value.

Throws:

MessageHandlerException - if there is an error generating the verifier.

computeCodeChallenge

@Nonnull
@NotEmpty
private String computeCodeChallenge(@Nonnull @NotEmpty
 String codeVerifier,
 @Nonnull
 OAuthAuthorizationRequest.CodeChallengeMethod method)
                             throws MessageHandlerException

Compute the code_challenge from the code_verifier. If the OAuthAuthorizationRequest.CodeChallengeMethod.PLAIN method is used, the codeVerifier is returned directly. If the OAuthAuthorizationRequest.CodeChallengeMethod.S256 method is used, the bytes of the codeVerifier are SHA-256 hashed and base 64 URL encoded before being returned.

Parameters:

codeVerifier - the code_verifier to compute the code_challenge from

method - the code_challenge_method

Returns:

the computed code_challenge

Throws:

MessageHandlerException - on error computing the code_challenge