Package net.shibboleth.oidc.security.jose.impl

Class RelyingPartySigningParametersResolver

java.lang.Object

org.opensaml.xmlsec.impl.AbstractSecurityParametersResolver<SignatureSigningParameters>

net.shibboleth.oidc.security.jose.impl.BasicSignatureSigningParametersResolver

net.shibboleth.oidc.security.jose.impl.RelyingPartySigningParametersResolver

All Implemented Interfaces:

SignatureSigningParametersResolver, Resolver<SignatureSigningParameters,CriteriaSet>

public class RelyingPartySigningParametersResolver
extends BasicSignatureSigningParametersResolver

A specialization of BasicSignatureSigningParametersResolver which supports selecting signing credentials from client_secret credential criterion (e.g. from the relying party configuration) in addition to the configured signing credentials inside the signing configuration (determined by the superclass).

The OpenID Providers's metadata is also used to filter for those algorithms supported by the OP in addition to those supported by the security configuration.

*

In addition to the Criterion inputs documented in BasicSignatureSigningParametersResolver, the following inputs are also supported:

• ClientSecretCredentialCriterion - optional
• ProviderMetadataCriterion - required

Field Summary

Fields

Modifier and Type	Field	Description
private final org.slf4j.Logger	log	Logger.
private Function<com.nimbusds.openid.connect.sdk.op.OIDCProviderMetadata,List<String>>	providerMetadataAlgorithmLookupStrategy	A strategy to pull out the correct set of supported algorithms from the OIDCProviderMetadata.

Constructor Summary

Constructors

Constructor	Description
RelyingPartySigningParametersResolver()	Constructor.

Method Summary

Modifier and Type	Method	Description
private List<com.nimbusds.jose.JWSAlgorithm>	convertSupportAlgorithmsToJwkAlgorithms(List<String> algos)	Convert the algorithms represented as strings, into Nimbus Algorithms for later comparison.
private List<String>	filterForProviderSupportedAlgorithms(CriteriaSet criteria, List<String> algorithms)	Filter the set of algorithms against the set supported by the OpenID Provider.
protected void	resolveAndPopulateCredentialAndSignatureAlgorithm(SignatureSigningParameters params, CriteriaSet criteria, Predicate<String> includeExcludePredicate)	Resolve and populate the signing credential and signature method algorithm URI on the supplied parameters instance.
void	setProviderMetadataAlgorithmLookupStrategy(Function<com.nimbusds.openid.connect.sdk.op.OIDCProviderMetadata,List<String>> strategy)	Set the strategy used to locate the supported signing algorithms from the OP's metadata for this resolver instance.

Methods inherited from class net.shibboleth.oidc.security.jose.impl.BasicSignatureSigningParametersResolver

credentialSupportsSigningAlgorithm, findCompatibleAlgorithmAndCredential, getAlgorithmRegistry, getAlgorithmRuntimeSupportedPredicate, getEffectiveSignatureAlgorithms, getEffectiveSigningCredentials, getIncludeExcludePredicate, logResult, resolve, resolveSingle, setAlgorithmRegistry, validate

Methods inherited from class org.opensaml.xmlsec.impl.AbstractSecurityParametersResolver

lookupKeyInfoGenerator, resolveAndPopulateIncludesExcludes, resolveEffectiveExcludes, resolveEffectiveIncludes, resolveIncludeExcludePrecedence, resolveIncludeExcludePredicate

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Field Details

log

@Nonnull
private final org.slf4j.Logger log

Logger.

providerMetadataAlgorithmLookupStrategy

@Nonnull
private Function<com.nimbusds.openid.connect.sdk.op.OIDCProviderMetadata,List<String>> providerMetadataAlgorithmLookupStrategy

A strategy to pull out the correct set of supported algorithms from the OIDCProviderMetadata. By default returns null, signalling 'do not filter'.

Constructor Details

RelyingPartySigningParametersResolver

public RelyingPartySigningParametersResolver()

Constructor.

Method Details

setProviderMetadataAlgorithmLookupStrategy

public void setProviderMetadataAlgorithmLookupStrategy(@Nonnull
 Function<com.nimbusds.openid.connect.sdk.op.OIDCProviderMetadata,List<String>> strategy)

Set the strategy used to locate the supported signing algorithms from the OP's metadata for this resolver instance. For example, id_token or request object signing algorithms.

Parameters:

strategy - the strategy

resolveAndPopulateCredentialAndSignatureAlgorithm

protected void resolveAndPopulateCredentialAndSignatureAlgorithm(@Nonnull
 SignatureSigningParameters params,
 @Nonnull
 CriteriaSet criteria,
 @Nonnull
 Predicate<String> includeExcludePredicate)

Description copied from class: BasicSignatureSigningParametersResolver

Resolve and populate the signing credential and signature method algorithm URI on the supplied parameters instance.

Overrides:

resolveAndPopulateCredentialAndSignatureAlgorithm in class BasicSignatureSigningParametersResolver

Parameters:

params - the parameters instance being populated

criteria - the input criteria being evaluated

includeExcludePredicate - the include/exclude predicate with which to evaluate the candidate signing method algorithm URIs

convertSupportAlgorithmsToJwkAlgorithms

@Nonnull
private List<com.nimbusds.jose.JWSAlgorithm> convertSupportAlgorithmsToJwkAlgorithms(@Nonnull
 List<String> algos)

Convert the algorithms represented as strings, into Nimbus Algorithms for later comparison.

Parameters:

algos - the algorithms to convert

Returns:

the converted algorithms

filterForProviderSupportedAlgorithms

private List<String> filterForProviderSupportedAlgorithms(@Nonnull
 CriteriaSet criteria,
 @Nonnull
 List<String> algorithms)

Filter the set of algorithms against the set supported by the OpenID Provider. Always returns a new list reference. The ordering of the input algorithms should be preserved.

Parameters:

criteria - the criteria to extract the OP's metadata from to check supported algorithms.

algorithms - the current set of supported algorithms

Returns:

the current set of supported algorithms filtered by those also supported by the OP.