Package net.shibboleth.oidc.security.impl

Class BaseJWTSignatureSecurityHandler

java.lang.Object

net.shibboleth.utilities.java.support.component.AbstractInitializableComponent

org.opensaml.messaging.handler.AbstractMessageHandler

org.opensaml.security.messaging.impl.BaseTrustEngineSecurityHandler<com.nimbusds.jwt.SignedJWT>

net.shibboleth.oidc.security.impl.BaseJWTSignatureSecurityHandler

All Implemented Interfaces:

Component, DestructableComponent, InitializableComponent, MessageHandler

Direct Known Subclasses:

JWTMessageSignatureSecurityHandler

public abstract class BaseJWTSignatureSecurityHandler
extends BaseTrustEngineSecurityHandler<com.nimbusds.jwt.SignedJWT>

Base class for security message handlers which evaluate a JWT signature with a signature trust engine.

Criterion are constructed from the following sources:

1. (Optional) Provider metadata.
2. (Optional) Client information.
3. (Optional) Client secret credentials.
4. (Required) The SecurityParametersContext.

Since:

2.2.0

Field Summary

Fields

Modifier and Type	Field	Description
private com.nimbusds.openid.connect.sdk.rp.OIDCClientInformation	clientInformation	The client information found from the lookup strategy.
private Function<MessageContext,com.nimbusds.openid.connect.sdk.rp.OIDCClientInformation>	clientInformationLookupStrategy	Function that looks up client information from the given message context.
private org.slf4j.Logger	log	Class logger.
private OIDCPeerEntityContext	peerContext	The context representing the OIDC peer entity.
private static ParentProfileRequestContextLookup<MessageContext>	PRC_LOOKUP	Lookup function for parent ProfileRequestContext.
private OAuth2ClientAuthenticableClientProfileConfiguration	profileConfiguration	Applicable stashed profile configuration appropriate for OAuth clients.
private com.nimbusds.openid.connect.sdk.op.OIDCProviderMetadata	providerMetadata	The provider metadata found from the lookup strategy.
private Function<MessageContext,com.nimbusds.openid.connect.sdk.op.OIDCProviderMetadata>	providerMetadataLookupStrategy	Function that looks up provider metadata from the given message context.
private Function<ProfileRequestContext,RelyingPartyContext>	relyingPartyContextLookupStrategy	Lookup function for relying party context.
private Function<MessageContext,SecurityParametersContext>	securityParametersContextLookupStrategy	Strategy used to look up the SecurityParametersContext.

Constructor Summary

Constructors

Modifier	Constructor	Description
protected	BaseJWTSignatureSecurityHandler()	Constructor.

Method Summary

Modifier and Type	Method	Description
protected <T> Function<MessageContext,T>	adapt(Function<ProfileRequestContext,T> function)	Adapt a ProfileRequestContext function to a MessageContext function via composing with a lookup function.
protected CriteriaSet	buildCriteriaSet(String entityID, MessageContext messageContext)
protected boolean	doPreInvoke(MessageContext messageContext)
protected OIDCPeerEntityContext	getOIDCPeerEntityContext()	Get the OIDCPeerEntityContext associated with the message.
protected TrustEngine<com.nimbusds.jwt.SignedJWT>	resolveTrustEngine(MessageContext messageContext)
void	setClientInformationLookupStrategy(Function<MessageContext,com.nimbusds.openid.connect.sdk.rp.OIDCClientInformation> strategy)	Set the lookup strategy to locate the client information.
void	setProviderMetadataLookupStrategy(Function<MessageContext,com.nimbusds.openid.connect.sdk.op.OIDCProviderMetadata> strategy)	Set the lookup strategy to locate the OpenID providers metadata.
void	setRelyingPartyContextLookupStrategy(Function<ProfileRequestContext,RelyingPartyContext> strategy)	Set lookup strategy for relying party context.
void	setSecurityParametersContextLookupStrategy(Function<MessageContext,SecurityParametersContext> strategy)	Set the strategy used to look up the SecurityParametersContext to set the parameters for.

Methods inherited from class org.opensaml.security.messaging.impl.BaseTrustEngineSecurityHandler

evaluate, evaluate, getTrustEngine

Methods inherited from class org.opensaml.messaging.handler.AbstractMessageHandler

doInvoke, doPostInvoke, doPostInvoke, getActivationCondition, getLogPrefix, invoke, setActivationCondition

Methods inherited from class net.shibboleth.utilities.java.support.component.AbstractInitializableComponent

destroy, doDestroy, doInitialize, initialize, isDestroyed, isInitialized

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Methods inherited from interface net.shibboleth.utilities.java.support.component.InitializableComponent

initialize, isInitialized

Field Detail

PRC_LOOKUP

@Nonnull
private static final ParentProfileRequestContextLookup<MessageContext> PRC_LOOKUP

Lookup function for parent ProfileRequestContext.

log

@Nonnull
private final org.slf4j.Logger log

Class logger.

providerMetadataLookupStrategy

@Nonnull
private Function<MessageContext,com.nimbusds.openid.connect.sdk.op.OIDCProviderMetadata> providerMetadataLookupStrategy

Function that looks up provider metadata from the given message context. Can return null if not used.

clientInformationLookupStrategy

@Nonnull
private Function<MessageContext,com.nimbusds.openid.connect.sdk.rp.OIDCClientInformation> clientInformationLookupStrategy

Function that looks up client information from the given message context. Can return null if not used.

relyingPartyContextLookupStrategy

@Nonnull
private Function<ProfileRequestContext,RelyingPartyContext> relyingPartyContextLookupStrategy

Lookup function for relying party context.

securityParametersContextLookupStrategy

@Nonnull
private Function<MessageContext,SecurityParametersContext> securityParametersContextLookupStrategy

Strategy used to look up the SecurityParametersContext.

profileConfiguration

@Nullable
private OAuth2ClientAuthenticableClientProfileConfiguration profileConfiguration

Applicable stashed profile configuration appropriate for OAuth clients.

peerContext

@Nullable
private OIDCPeerEntityContext peerContext

The context representing the OIDC peer entity.

providerMetadata

@Nullable
private com.nimbusds.openid.connect.sdk.op.OIDCProviderMetadata providerMetadata

The provider metadata found from the lookup strategy.

clientInformation

@Nullable
private com.nimbusds.openid.connect.sdk.rp.OIDCClientInformation clientInformation

The client information found from the lookup strategy.

Constructor Detail

BaseJWTSignatureSecurityHandler

protected BaseJWTSignatureSecurityHandler()

Constructor.

Method Detail

setSecurityParametersContextLookupStrategy

public void setSecurityParametersContextLookupStrategy(@Nonnull
                                                       Function<MessageContext,SecurityParametersContext> strategy)

Set the strategy used to look up the SecurityParametersContext to set the parameters for.

Parameters:

strategy - lookup strategy

setProviderMetadataLookupStrategy

public void setProviderMetadataLookupStrategy(@Nonnull
                                              Function<MessageContext,com.nimbusds.openid.connect.sdk.op.OIDCProviderMetadata> strategy)

Set the lookup strategy to locate the OpenID providers metadata.

Parameters:

strategy - the strategy.

setClientInformationLookupStrategy

public void setClientInformationLookupStrategy(@Nonnull
                                               Function<MessageContext,com.nimbusds.openid.connect.sdk.rp.OIDCClientInformation> strategy)

Set the lookup strategy to locate the client information.

Parameters:

strategy - the strategy.

setRelyingPartyContextLookupStrategy

public void setRelyingPartyContextLookupStrategy(@Nonnull
                                                 Function<ProfileRequestContext,RelyingPartyContext> strategy)

Set lookup strategy for relying party context.

Parameters:

strategy - lookup strategy

getOIDCPeerEntityContext

@Nullable
protected OIDCPeerEntityContext getOIDCPeerEntityContext()

Get the OIDCPeerEntityContext associated with the message.

Returns:

the peer context

resolveTrustEngine

@Nullable
protected TrustEngine<com.nimbusds.jwt.SignedJWT> resolveTrustEngine(MessageContext messageContext)

Specified by:

resolveTrustEngine in class BaseTrustEngineSecurityHandler<com.nimbusds.jwt.SignedJWT>

doPreInvoke

protected boolean doPreInvoke(@Nonnull
                              MessageContext messageContext)
                       throws MessageHandlerException

Overrides:

doPreInvoke in class BaseTrustEngineSecurityHandler<com.nimbusds.jwt.SignedJWT>

Throws:

MessageHandlerException

buildCriteriaSet

protected CriteriaSet buildCriteriaSet(@Nullable
                                       String entityID,
                                       @Nonnull
                                       MessageContext messageContext)
                                throws MessageHandlerException

Specified by:

buildCriteriaSet in class BaseTrustEngineSecurityHandler<com.nimbusds.jwt.SignedJWT>

Throws:

MessageHandlerException

adapt

@Nullable
protected <T> Function<MessageContext,T> adapt(@Nullable
                                                     Function<ProfileRequestContext,T> function)

Adapt a ProfileRequestContext function to a MessageContext function via composing with a lookup function.

Type Parameters:

T - the output type of the functions

Parameters:

function - the profile request context function

Returns:

the message context function