Package net.shibboleth.oidc.profile.config.impl

Class DefaultOIDCAuthorizationConfiguration

    • Field Detail

      • acrRequestAlwaysEssentialPredicate

        @Nonnull
private Predicate<ProfileRequestContext> acrRequestAlwaysEssentialPredicate
        Whether all acr claim requests should be treated as Essential.

      • encodeConsentInTokensPredicate

        @Nonnull
private Predicate<ProfileRequestContext> encodeConsentInTokensPredicate
        Whether to encode consent in authorization code and access/refresh tokens.

      • authorizeCodeLifetimeLookupStrategy

        @Nonnull
private Function<ProfileRequestContext,​Duration> authorizeCodeLifetimeLookupStrategy
        Lookup function to supply lifetime of authz code.

      • encodedAttributesLookupStrategy

        @Nonnull
private Function<ProfileRequestContext,​Set<String>> encodedAttributesLookupStrategy
        Lookup function to supply attribute IDs to embed in authorization code or access token.

      • useRequestObjectPredicate

        @Nonnull
private Predicate<ProfileRequestContext> useRequestObjectPredicate
        Whether to encode authentication request parameters inside a JWT request object .

      • signRequestObjectPredicate

        @Nonnull
private Predicate<ProfileRequestContext> signRequestObjectPredicate
        Predicate used to determine if the generated request object should be signed. Default returns true.

      • encryptRequestObjectPredicate

        @Nonnull
private Predicate<ProfileRequestContext> encryptRequestObjectPredicate
        Predicate used to determine if the generated request object should be encrypted. Default returns false.

      • deniedUserInfoAttributesLookupStrategy

        @Nonnull
private Function<ProfileRequestContext,​Set<String>> deniedUserInfoAttributesLookupStrategy
        Lookup function to supply attribute IDs to omit from UserInfo token.

      • includeIssuerInResponsePredicate

        @Nonnull
private Predicate<ProfileRequestContext> includeIssuerInResponsePredicate
        Whether to include iss parameter in the authentication response.

      • retrieveUserInfoEndpointClaims

        @Nonnull
private Predicate<ProfileRequestContext> retrieveUserInfoEndpointClaims
        Whether to make a UserInfo Endpoint request for End-User claims.

      • redirectUriOverrideLookupStrategy

        @Nonnull
private Function<ProfileRequestContext,​String> redirectUriOverrideLookupStrategy
        An override to specify a specific redirect_uri to use over the normally computed one.

      • proxiedAuthnInstantPredicate

        @Nonnull
private Predicate<ProfileRequestContext> proxiedAuthnInstantPredicate
        Whether authentication results should carry the proxied auth_time in the id_token.

      • httpRequestMethodLookupStrategy

        @Nonnull
private Function<ProfileRequestContext,​String> httpRequestMethodLookupStrategy
        Which HTTP method should be used to issue OIDC authentication requests. Supported values are POST and GET. The default is GET.

      • maxAuthenticationAgeLookupStrategy

        @Nonnull
private Function<ProfileRequestContext,​Duration> maxAuthenticationAgeLookupStrategy
        Lookup function to determine the max_age of an authentication request.

      • loginHintLookupStrategy

        @Nonnull
private Function<ProfileRequestContext,​String> loginHintLookupStrategy
        Lookup function to determine the login_hint of an authentication request.

      • userInfoHttpRequestMethodLookupStrategy

        @Nonnull
private Function<ProfileRequestContext,​String> userInfoHttpRequestMethodLookupStrategy
        Which HTTP method should be used to issue the UserInfo requests. Supported values are POST and GET. The default is GET.

      • responseModeLookupStrategy

        @Nonnull
private Function<ProfileRequestContext,​String> responseModeLookupStrategy
        Lookup function to override the default response_mode for a given response_type.

      • tlsServerValidationOnlyPredicate

        @Nonnull
private Predicate<ProfileRequestContext> tlsServerValidationOnlyPredicate
        Whether TLS server validation alone is sufficient to verify the id_token (true), or whether the id_token's signature should be validated (false). The default is false, the id_token signature should be validated.

    • Constructor Detail

      • DefaultOIDCAuthorizationConfiguration

        public DefaultOIDCAuthorizationConfiguration()
        Constructor.

      • DefaultOIDCAuthorizationConfiguration

        public DefaultOIDCAuthorizationConfiguration​(@Nonnull @NotEmpty
                                             String profileId)
        Creates a new configuration instance.
        Parameters:
        profileId - Unique profile identifier.

    • Method Detail

      • setAcrRequestAlwaysEssential

        public void setAcrRequestAlwaysEssential​(boolean flag)
        Set whether all acr claim requests should be treated as Essential.
        Parameters:
        flag - flag to set

      • setAcrRequestAlwaysEssentialPredicate

        public void setAcrRequestAlwaysEssentialPredicate​(@Nonnull
                                                  Predicate<ProfileRequestContext> condition)
        Set condition for whether all acr claim requests should be treated as Essential.
        Parameters:
        condition - condition to set

      • setUseRequestObject

        public void setUseRequestObject​(boolean flag)
        Set whether the authentication request parameters should be passed in a single, self contained, JWT.
        Parameters:
        flag - flag to set

      • setUseRequestObjectPredicate

        public void setUseRequestObjectPredicate​(@Nonnull
                                         Predicate<ProfileRequestContext> condition)
        Set condition for whether the authentication request parameters should be passed in a single, self contained, JWT.
        Parameters:
        condition - condition to set

      • setEncodeConsentInTokens

        public void setEncodeConsentInTokens​(boolean flag)
        Set whether to encode consent in authorization code and access/refresh tokens.
        Parameters:
        flag - flag to set

      • setEncodeConsentInTokensPredicate

        public void setEncodeConsentInTokensPredicate​(@Nonnull
                                              Predicate<ProfileRequestContext> condition)
        Set condition for whether to encode consent in authorization code and access/refresh tokens.
        Parameters:
        condition - condition to set

      • setRetrieveUserInfoEndpointClaims

        public void setRetrieveUserInfoEndpointClaims​(boolean flag)
        Set whether to make a request to the UserInfo Endpoint to obtain authenticated End-User claims.
        Parameters:
        flag - flag to set
        Since:
        2.2.0

      • setRetrieveUserInfoEndpointClaims

        public void setRetrieveUserInfoEndpointClaims​(@Nonnull
                                              Predicate<ProfileRequestContext> condition)
        Set condition for whether to make a request to the UserInfo Endpoint to obtain authenticated End-User claims.
        Parameters:
        condition - condition to set
        Since:
        2.2.0

      • setSignRequestObject

        public void setSignRequestObject​(boolean flag)
        Set whether the RequestObject should be signed.
        Parameters:
        flag - flag to set
        Since:
        2.2.0

      • setSignRequestObjectPredicate

        public void setSignRequestObjectPredicate​(Predicate<ProfileRequestContext> condition)
        Set the predicate to determine if the RequestObject should be signed.
        Parameters:
        condition - the condition
        Since:
        2.2.0

      • setEncryptRequestObject

        public void setEncryptRequestObject​(boolean flag)
        Set whether the RequestObject should be encrypted.
        Parameters:
        flag - flag to set
        Since:
        2.2.0

      • setEncryptRequestObjectPredicate

        public void setEncryptRequestObjectPredicate​(Predicate<ProfileRequestContext> condition)
        Set the predicate to determine if the RequestObject should be encrypted.
        Parameters:
        condition - the condition
        Since:
        2.2.0

      • setRedirectUriOverrideLookupStrategy

        public void setRedirectUriOverrideLookupStrategy​(@Nonnull
                                                 Function<ProfileRequestContext,​String> strategy)
        Set the redirect_uri lookup strategy used to locate an overridden redirect.
        Parameters:
        strategy - the strategy to use.
        Since:
        2.2.0

      • setRedirectUriOverride

        public void setRedirectUriOverride​(@Nullable
                                   String uri)
        Set the override redirect_uri.
        Parameters:
        uri - the redirect_uri
        Since:
        2.2.0

      • setAuthorizeCodeLifetime

        public void setAuthorizeCodeLifetime​(@Positive @Nonnull
                                     Duration lifetime)
        Set the lifetime of authz code.
        Parameters:
        lifetime - lifetime of authz code

      • setAuthorizeCodeLifetimeLookupStrategy

        public void setAuthorizeCodeLifetimeLookupStrategy​(@Nonnull
                                                   Function<ProfileRequestContext,​Duration> strategy)
        Set a lookup strategy for the authz code lifetime.
        Parameters:
        strategy - lookup strategy

      • setHttpRequestMethodLookupStrategy

        public void setHttpRequestMethodLookupStrategy​(@Nonnull
                                               Function<ProfileRequestContext,​String> strategy)
        Set a lookup strategy to determine the HTTP request method for an authentication request.
        Parameters:
        strategy - the strategy to set.

      • setEncodedAttributes

        public void setEncodedAttributes​(@Nullable @NonnullElements
                                 Collection<String> attributes)
        Set the set of attribute IDs which should be encoded in encrypted form into the authorization code and/or access/refresh tokens to enable recovery on the back-channel.
        Parameters:
        attributes - the attribute IDs to encode

      • setEncodedAttributesLookupStrategy

        public void setEncodedAttributesLookupStrategy​(@Nonnull
                                               Function<ProfileRequestContext,​Set<String>> strategy)
        Set a lookup strategy for the attribute IDs which should be encoded in encrypted form into the authorization code and/or access/refresh tokens to enable recovery on the back-channel.
        Parameters:
        strategy - lookup strategy

      • setDeniedUserInfoAttributes

        public void setDeniedUserInfoAttributes​(@Nullable @NonnullElements
                                        Collection<String> attributes)
        Set the set of attribute IDs which should be omitted from the UserInfo token.

        Default behavior is to include all claims, but omiited claims also affect the set that may need to be embedded for recovery into the access/refresh tokens.

        Parameters:
        attributes - the attribute IDs to omit from UserInfo token

      • setDeniedUserInfoAttributesLookupStrategy

        public void setDeniedUserInfoAttributesLookupStrategy​(@Nonnull
                                                      Function<ProfileRequestContext,​Set<String>> strategy)
        Set a lookup strategy for the set of attribute IDs which should be omitted from the UserInfo token.
        Parameters:
        strategy - lookup strategy

      • setIncludeIssuerInResponse

        public void setIncludeIssuerInResponse​(boolean flag)
        Set whether to include iss parameter in the authentication response.
        Parameters:
        flag - flag to set
        Since:
        2.1.0

      • setIncludeIssuerInResponsePredicate

        public void setIncludeIssuerInResponsePredicate​(@Nonnull
                                                Predicate<ProfileRequestContext> condition)
        Set condition for whether to include iss parameter in the authentication response.
        Parameters:
        condition - condition to set
        Since:
        2.1.0

      • setResponseTypeLookupStrategy

        public void setResponseTypeLookupStrategy​(@Nonnull
                                          Function<ProfileRequestContext,​String> strategy)
        Set the lookup strategy to determine the response_type for authentication requests.
        Parameters:
        strategy - the strategy to use
        Since:
        2.2.0

      • setResponseType

        public void setResponseType​(@Nullable
                            String responseType)
        Set the response_type to use for authentication requests.
        Parameters:
        responseType - the response_type to use
        Since:
        2.2.0

      • setAuthorizationCodeClaimsSetManipulationStrategy

        public void setAuthorizationCodeClaimsSetManipulationStrategy​(@Nullable
                                                              BiFunction<ProfileRequestContext,​Map<String,​Object>,​Map<String,​Object>> strategy)
        Set the bi-function for manipulating authorization code claims set.
        Parameters:
        strategy - bi-function for manipulating authorization code claims set
        Since:
        2.1.0

      • setScopesLookupStrategy

        public void setScopesLookupStrategy​(@Nonnull
                                    Function<ProfileRequestContext,​Set<String>> strategy)
        Set the lookup strategy to determine the scopes to use for authentication requests.
        Parameters:
        strategy - the strategy to use
        Since:
        2.2.0

      • setScopes

        public void setScopes​(@Nullable @NonnullElements
                      Set<String> scopes)
        Set the scopes to use for authentication requests.
        Parameters:
        scopes - the scopes
        Since:
        2.2.0

      • setAuthenticationMethodsReferencesTranslationStrategyLookupStrategy

        public void setAuthenticationMethodsReferencesTranslationStrategyLookupStrategy​(@Nonnull
                                                                                Function<ProfileRequestContext,​Function<Collection<String>,​Collection<Principal>>> strategy)
        Set the lookup function to locate the Authentication Methods References strategy used to translate between an inbound proxied OIDC AMR into an appropriate set of custom Principal objects to populate the subject.
        Parameters:
        strategy - translation function
        Since:
        2.2.0

      • setAuthenticationContextClassReferenceTranslationStrategyLookupStrategy

        public void setAuthenticationContextClassReferenceTranslationStrategyLookupStrategy​(@Nullable
                                                                                    Function<ProfileRequestContext,​Function<Collection<String>,​Collection<Principal>>> strategy)
        Set the lookup function to locate the Authentication Context Class Reference strategy used to translate between an inbound proxied OIDC ACR into an appropriate set of custom Principal objects to populate the subject.
        Parameters:
        strategy - translation function
        Since:
        2.2.0

      • setProxiedAuthnInstant

        public void setProxiedAuthnInstant​(boolean flag)
        Sets whether authentication results produced by use of this profile should carry the proxied assertion's auth_time from the id_token, rather than the current time.
        Parameters:
        flag - flag to set
        Since:
        2.2.0

      • setMaxAuthenticationAge

        public void setMaxAuthenticationAge​(@Positive @Nonnull
                                    Duration age)
        Set the max authentication age.
        Parameters:
        age - the max authentication age
        Since:
        2.2.0

      • setMaxAuthenticationAgeLookupStrategy

        public void setMaxAuthenticationAgeLookupStrategy​(@Nonnull
                                                  Function<ProfileRequestContext,​Duration> strategy)
        Set a lookup strategy for the max authentication age.
        Parameters:
        strategy - lookup strategy
        Since:
        2.2.0

      • setLoginHintLookupStrategy

        public void setLoginHintLookupStrategy​(@Nonnull
                                       Function<ProfileRequestContext,​String> strategy)
        Set the lookup strategy for setting the login_hint.
        Parameters:
        strategy - lookup strategy
        Since:
        2.2.0

      • setLoginHint

        public void setLoginHint​(String fixedLoginHint)
        Set a fixed login_hint. Will apply to all requests.
        Parameters:
        fixedLoginHint - the login_hint
        Since:
        2.2.0

      • setUserInfoHttpRequestMethodLookupStrategy

        public void setUserInfoHttpRequestMethodLookupStrategy​(@Nonnull
                                                       Function<ProfileRequestContext,​String> strategy)
        Set a lookup strategy to determine the HTTP request method for an UserInfo request.
        Parameters:
        strategy - the strategy to set.
        Since:
        2.2.0

      • setResponseModeLookupStrategy

        public void setResponseModeLookupStrategy​(@Nonnull
                                          Function<ProfileRequestContext,​String> strategy)
        Set the lookup strategy to determine the response_mode for authorization requests.
        Parameters:
        strategy - the strategy to use
        Since:
        2.2.0

      • setResponseMode

        public void setResponseMode​(@Nonnull
                            String responseMode)
        Set the response_mode to use for authorization requests.
        Parameters:
        responseMode - the response_mode to use
        Since:
        2.2.0

      • setTlsServerValidationSufficient

        public void setTlsServerValidationSufficient​(boolean flag)
        Set whether TLS server validation alone is sufficient to verify the id_token (true), or whether the id_token's signature should be validated (false).
        Parameters:
        flag - flag to set
        Since:
        2.2.0

      • setTlsServerValidationSufficient

        public void setTlsServerValidationSufficient​(@Nonnull
                                             Predicate<ProfileRequestContext> condition)
        Set the predicate to determine whether TLS server validation alone is sufficient to verify the id_token (true), or whether the id_token's signature should be validated (false).
        Parameters:
        condition - condition to set
        Since:
        2.2.0