Package net.shibboleth.idp.plugin.authn.oidc.rp.impl

Class ValidateUserInfoJSONObjectClaims

java.lang.Object

net.shibboleth.shared.component.AbstractInitializableComponent

org.opensaml.profile.action.AbstractProfileAction

org.opensaml.profile.action.AbstractConditionalProfileAction

net.shibboleth.idp.profile.AbstractProfileAction

net.shibboleth.idp.plugin.authn.oidc.rp.impl.ValidateUserInfoJSONObjectClaims

All Implemented Interfaces:

Component, DestructableComponent, InitializableComponent, ProfileAction, Aware, MessageSource, MessageSourceAware, Action

public class ValidateUserInfoJSONObjectClaims
extends AbstractProfileAction

Validate a successful UserInfo JSON Object Response according to section 5.3.2 of OpenID Connect Core 1.0.

Event:

EventIds.PROCEED_EVENT_ID, OidcEventIds.INVALID_USERINFO_CLAIMS, EventIds.INVALID_PROFILE_CTX

Precondition:

ProfileRequestContext.getSubcontext(AuthenticationContext.class, false) != null

Field Summary

Fields

Modifier and Type	Field	Description
private com.nimbusds.jwt.JWTClaimsSet	idTokenClaims	The stashed id_token claims.
private final org.slf4j.Logger	log	Class logger.
private Function<ProfileRequestContext,AccessTokenResponseContext>	tokenResponseContextLookupStrategy	Strategy used to look up the AccessTokenResponseContext.
private com.nimbusds.openid.connect.sdk.UserInfoSuccessResponse	userInfo	The stashed user info response.
private UserInfoResponseContext	userInfoCtx	The stashed user info response context.
private Function<ProfileRequestContext,UserInfoResponseContext>	userInfoResponseContextLookupStrategy	Strategy used to look up the UserInfoResponseContext.

Constructor Summary

Constructors

Constructor	Description
ValidateUserInfoJSONObjectClaims()	Constructor.

Method Summary

Modifier and Type	Method	Description
protected void	doExecute(ProfileRequestContext profileRequestContext)
protected boolean	doPreExecute(ProfileRequestContext profileRequestContext)
private com.nimbusds.openid.connect.sdk.claims.ClaimsSet	resolveClaimsSet(com.nimbusds.openid.connect.sdk.UserInfoResponse response)	Resolve the UserInfo claims from the user info response.
void	setTokenResponseContextLookupStrategy(Function<ProfileRequestContext,AccessTokenResponseContext> strategy)	Set the strategy used to look up a AccessTokenResponseContext.
void	setUserInfoResponseContextLookupStrategy(Function<ProfileRequestContext,UserInfoResponseContext> strategy)	Set the strategy used to look up a UserInfoResponseContext.

Methods inherited from class net.shibboleth.idp.profile.AbstractProfileAction

doExecute, execute, getBean, getBean, getMessage, getMessage, getMessage, getParameter, getParameter, getProfileContextLookupStrategy, getRequestContext, getResult, setMessageSource, setProfileContextLookupStrategy

Methods inherited from class org.opensaml.profile.action.AbstractConditionalProfileAction

getActivationCondition, setActivationCondition

Methods inherited from class org.opensaml.profile.action.AbstractProfileAction

doPostExecute, doPostExecute, ensureHttpServletRequest, ensureHttpServletResponse, execute, getHttpServletRequest, getHttpServletRequestSupplier, getHttpServletResponse, getHttpServletResponseSupplier, getLogPrefix, isPreExecuteCalled, setHttpServletRequestSupplier, setHttpServletResponseSupplier

Methods inherited from class net.shibboleth.shared.component.AbstractInitializableComponent

checkComponentActive, checkSetterPreconditions, destroy, doDestroy, doInitialize, ifDestroyedThrowDestroyedComponentException, ifInitializedThrowUnmodifiabledComponentException, ifNotInitializedThrowUninitializedComponentException, initialize, isDestroyed, isInitialized

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Methods inherited from interface net.shibboleth.shared.component.InitializableComponent

initialize, isInitialized

Field Details

log

@Nonnull
private final org.slf4j.Logger log

Class logger.

userInfoResponseContextLookupStrategy

@Nonnull
private Function<ProfileRequestContext,UserInfoResponseContext> userInfoResponseContextLookupStrategy

Strategy used to look up the UserInfoResponseContext.

tokenResponseContextLookupStrategy

@Nonnull
private Function<ProfileRequestContext,AccessTokenResponseContext> tokenResponseContextLookupStrategy

Strategy used to look up the AccessTokenResponseContext.

userInfoCtx

@NonnullBeforeExec
private UserInfoResponseContext userInfoCtx

The stashed user info response context.

userInfo

@NonnullBeforeExec
private com.nimbusds.openid.connect.sdk.UserInfoSuccessResponse userInfo

The stashed user info response.

idTokenClaims

@NonnullBeforeExec
private com.nimbusds.jwt.JWTClaimsSet idTokenClaims

The stashed id_token claims.

Constructor Details

ValidateUserInfoJSONObjectClaims

public ValidateUserInfoJSONObjectClaims()

Constructor.

Method Details

setTokenResponseContextLookupStrategy

public void setTokenResponseContextLookupStrategy(@Nonnull
 Function<ProfileRequestContext,AccessTokenResponseContext> strategy)

Set the strategy used to look up a AccessTokenResponseContext.

Parameters:

strategy - lookup strategy

setUserInfoResponseContextLookupStrategy

public void setUserInfoResponseContextLookupStrategy(@Nonnull
 Function<ProfileRequestContext,UserInfoResponseContext> strategy)

Set the strategy used to look up a UserInfoResponseContext.

Parameters:

strategy - lookup strategy

doPreExecute

protected boolean doPreExecute(@Nonnull
 ProfileRequestContext profileRequestContext)

Overrides:

doPreExecute in class AbstractConditionalProfileAction

doExecute

protected void doExecute(@Nonnull
 ProfileRequestContext profileRequestContext)

Overrides:

doExecute in class AbstractProfileAction

resolveClaimsSet

@Nullable
private com.nimbusds.openid.connect.sdk.claims.ClaimsSet resolveClaimsSet(@Nonnull
 com.nimbusds.openid.connect.sdk.UserInfoResponse response)

Resolve the UserInfo claims from the user info response. If JWT type, extract from the JWT claims. If plain JSON object type, resolve directly from the UserInfo claims set.

Parameters:

response - the UserInfo response

Returns:

the UserInfo claims. Return null if not found, wrong response type, or there was a parsing exception