Package net.shibboleth.oidc.security.credential.impl

Class ProviderMetadataCredentialResolver

java.lang.Object
org.opensaml.security.credential.impl.AbstractCredentialResolver
org.opensaml.security.credential.impl.AbstractCriteriaFilteringCredentialResolver
net.shibboleth.oidc.security.credential.impl.BasicJOSEObjectCredentialResolver
net.shibboleth.oidc.security.credential.impl.ProviderMetadataCredentialResolver
All Implemented Interfaces:
JOSEObjectCredentialResolver, Component, InitializableComponent, Resolver<Credential,CriteriaSet>, CredentialResolver
public class ProviderMetadataCredentialResolver extends BasicJOSEObjectCredentialResolver implements InitializableComponent
A LocalJOSEObjectCredentialResolver that resolves credentials from the jwks_uri of an OpenID Provider. Further filtering of credentials is provided by the AbstractCriteriaFilteringCredentialResolver parent class.

Note, only RSA or EC keys are resolved as these are the only key types which should be exposed in public JWKS documents.

  • Field Details

    • log

      @Nonnull private final org.slf4j.Logger log
      Class logger.

    • isInitialized

      private boolean isInitialized
      Initialization flag.

    • remoteJwkSetCache

      @NonnullAfterInit private RemoteJwkSetCache remoteJwkSetCache
      The cache for remote JWK key sets.

    • keyFetchInterval

      @Positive private Duration keyFetchInterval
      The remote key refresh interval. Default value: 30 minutes.

  • Constructor Details

    • ProviderMetadataCredentialResolver

      public ProviderMetadataCredentialResolver()

  • Method Details

    • isInitialized

      public boolean isInitialized()
      Specified by:
      isInitialized in interface InitializableComponent

    • initialize

      public void initialize() throws ComponentInitializationException
      Specified by:
      initialize in interface InitializableComponent
      Throws:
      ComponentInitializationException

    • setKeyFetchInterval

      public void setKeyFetchInterval(@Positive Duration interval)
      Set the remote key refresh interval.
      Parameters:
      interval - What to set.

    • setRemoteJwkSetCache

      public void setRemoteJwkSetCache(RemoteJwkSetCache jwkSetCache)
      Set the cache for remote JWK key sets.
      Parameters:
      jwkSetCache - What to set.

    • resolveFromSource

      protected Iterable<Credential> resolveFromSource(@Nonnull CriteriaSet criteriaSet) throws ResolverException
      Overrides:
      resolveFromSource in class BasicJOSEObjectCredentialResolver
      Throws:
      ResolverException

    • resolveFromMetadata

      @Nonnull protected Collection<Credential> resolveFromMetadata(@Nonnull CriteriaSet criteriaSet, @Nonnull com.nimbusds.openid.connect.sdk.op.OIDCProviderMetadata metadata)
      Fetch the remote JWK Set from the jwk_uri in the OpenID Provider's metadata. Convert each JWK into a Credential and return. Only supports EC (key agreement) and RSA (key encryption) keys.

      If a keyId is passed through in the criteria set, it is used as a parameter to the remote JWK cache. This ensures if the key is not found any cached keyset document, the document is re-fetched irrespective of the cache entry expiry.

      Parameters:
      criteriaSet - the criteria set
      metadata - the OpenID Provider's metadata
      Returns:
      a collection of credentials that represents EC and RSA keys in the remote JWK Set (if any)