Package net.shibboleth.oidc.security.jwt.claims.impl

Class AccessTokenHashValidator

java.lang.Object

net.shibboleth.utilities.java.support.component.AbstractInitializableComponent

net.shibboleth.utilities.java.support.component.AbstractIdentifiedInitializableComponent

net.shibboleth.utilities.java.support.component.AbstractIdentifiableInitializableComponent

net.shibboleth.oidc.jwt.claims.AbstractClaimsValidator

net.shibboleth.oidc.security.jwt.claims.impl.AccessTokenHashValidator

All Implemented Interfaces:

ClaimsValidator, Component, DestructableComponent, IdentifiableComponent, IdentifiedComponent, InitializableComponent

public class AccessTokenHashValidator
extends AbstractClaimsValidator

A validator that checks the access_token value matches its encoded at_hash representation in the id_token.

Since:

2.2.0

Field Summary

Fields

Modifier and Type	Field	Description
private Function<ProfileRequestContext,com.nimbusds.oauth2.sdk.token.AccessToken>	accessTokenLookupStrategy	Strategy to find the access_token.
private boolean	allowMissing	Allow a missing at_hash claim.
private Function<ProfileRequestContext,com.nimbusds.jose.JWSHeader>	joseHeaderLookupStrategy	Strategy to find the JOSE headers relating to the id_token the at_hash is taken from.
private org.slf4j.Logger	log	Class logger.

Constructor Summary

Constructors

Constructor	Description
AccessTokenHashValidator()

Method Summary

Modifier and Type	Method	Description
protected void	doInitialize()
protected void	doValidate(com.nimbusds.jwt.JWTClaimsSet claims, ProfileRequestContext context)	Perform validation of the given claims supported by the supplied context.
void	setAccessTokenLookupStrategy(Function<ProfileRequestContext,com.nimbusds.oauth2.sdk.token.AccessToken> strategy)	Set the lookup strategy used to locate the access_token.
void	setAllowMissing(boolean flag)	Set whether a missing 'at_hash' claim is valid or not.
void	setJoseHeaderLookupStrategy(Function<ProfileRequestContext,com.nimbusds.jose.JWSHeader> strategy)	Set the lookup strategy used to locate the JWS header of the id_token.

Methods inherited from class net.shibboleth.oidc.jwt.claims.AbstractClaimsValidator

setActivationCondition, validate

Methods inherited from class net.shibboleth.utilities.java.support.component.AbstractIdentifiableInitializableComponent

setId

Methods inherited from class net.shibboleth.utilities.java.support.component.AbstractIdentifiedInitializableComponent

getId

Methods inherited from class net.shibboleth.utilities.java.support.component.AbstractInitializableComponent

destroy, doDestroy, initialize, isDestroyed, isInitialized

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Methods inherited from interface net.shibboleth.utilities.java.support.component.IdentifiableComponent

setId

Methods inherited from interface net.shibboleth.utilities.java.support.component.IdentifiedComponent

getId

Field Detail

log

@Nonnull
private final org.slf4j.Logger log

Class logger.

accessTokenLookupStrategy

@NonnullAfterInit
private Function<ProfileRequestContext,com.nimbusds.oauth2.sdk.token.AccessToken> accessTokenLookupStrategy

Strategy to find the access_token.

joseHeaderLookupStrategy

@NonnullAfterInit
private Function<ProfileRequestContext,com.nimbusds.jose.JWSHeader> joseHeaderLookupStrategy

Strategy to find the JOSE headers relating to the id_token the at_hash is taken from.

allowMissing

private boolean allowMissing

Allow a missing at_hash claim.

Constructor Detail

AccessTokenHashValidator

public AccessTokenHashValidator()

Method Detail

setAllowMissing

public void setAllowMissing(boolean flag)

Set whether a missing 'at_hash' claim is valid or not.

Defaults to false.

Parameters:

flag - flag to set

setAccessTokenLookupStrategy

public void setAccessTokenLookupStrategy(@Nonnull
                                         Function<ProfileRequestContext,com.nimbusds.oauth2.sdk.token.AccessToken> strategy)

Set the lookup strategy used to locate the access_token.

Parameters:

strategy - the strategy.

setJoseHeaderLookupStrategy

public void setJoseHeaderLookupStrategy(@Nonnull
                                        Function<ProfileRequestContext,com.nimbusds.jose.JWSHeader> strategy)

Set the lookup strategy used to locate the JWS header of the id_token.

Parameters:

strategy - the strategy.

doInitialize

protected void doInitialize()
                     throws ComponentInitializationException

Overrides:

doInitialize in class AbstractIdentifiedInitializableComponent

Throws:

ComponentInitializationException

doValidate

protected void doValidate(@Nonnull
                          com.nimbusds.jwt.JWTClaimsSet claims,
                          @Nonnull
                          ProfileRequestContext context)
                   throws JWTValidationException

Description copied from class: AbstractClaimsValidator

Perform validation of the given claims supported by the supplied context.

Specified by:

doValidate in class AbstractClaimsValidator

Parameters:

claims - the claims to validate.

context - the profile request context.

Throws:

JWTValidationException - when validation is unsuccessful due to a failed attempt