Package net.shibboleth.oidc.security.credential.impl

Class ClientInformationCredentialResolver

java.lang.Object

org.opensaml.security.credential.impl.AbstractCredentialResolver

org.opensaml.security.credential.impl.AbstractCriteriaFilteringCredentialResolver

net.shibboleth.oidc.security.credential.impl.BasicJOSEObjectCredentialResolver

net.shibboleth.oidc.security.credential.impl.ClientInformationCredentialResolver

All Implemented Interfaces:

JOSEObjectCredentialResolver, Component, InitializableComponent, Resolver<Credential,CriteriaSet>, CredentialResolver

public class ClientInformationCredentialResolver
extends BasicJOSEObjectCredentialResolver
implements InitializableComponent

A JOSEObjectCredentialResolver that resolves credentials from the jwks or contents of jwks_uri of a ClientInformation. If the information contains client secret, it's converted into a BasicJWKCredential. Further filtering of credentials is provided by the AbstractCriteriaFilteringCredentialResolver parent class.

Note, only RSA or EC keys are resolved as these are the only key types which should be exposed in public JWKS documents.

Field Summary

Fields

Modifier and Type	Field	Description
private boolean	isInitialized	Initialization flag.
private final Duration	keyFetchInterval	The remote key refresh interval.
private final org.slf4j.Logger	log	Class logger.
private final RemoteJwkSetCache	remoteJwkSetCache	The cache for remote JWK key sets.

Constructor Summary

Constructors

Constructor	Description
ClientInformationCredentialResolver(RemoteJwkSetCache jwkSetCache)	Constructor.
ClientInformationCredentialResolver(RemoteJwkSetCache jwkSetCache, Duration interval)	Constructor.

Method Summary

Modifier and Type	Method	Description
void	initialize()
boolean	isInitialized()
protected Collection<Credential>	resolveFromMetadata(CriteriaSet criteriaSet, com.nimbusds.openid.connect.sdk.rp.OIDCClientInformation information)	Fetch the remote JWK Set from the jwk_uri in the RP/Client metadata.
protected Iterable<Credential>	resolveFromSource(CriteriaSet criteriaSet)

Methods inherited from class net.shibboleth.oidc.security.credential.impl.BasicJOSEObjectCredentialResolver

buildJWKCredential, deriveClientSecretCredential, extractKeyIdFromCriteria, populateCredentialsFromKeySet, postProcess, processJWEHeader, processJWSHeader

Methods inherited from class org.opensaml.security.credential.impl.AbstractCriteriaFilteringCredentialResolver

isSatisfyAllPredicates, resolve, setSatisfyAllPredicates

Methods inherited from class org.opensaml.security.credential.impl.AbstractCredentialResolver

resolveSingle

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Methods inherited from interface net.shibboleth.shared.resolver.Resolver

resolve, resolveSingle

Field Details

log

@Nonnull
private final org.slf4j.Logger log

Class logger.

isInitialized

private boolean isInitialized

Initialization flag.

remoteJwkSetCache

@Nonnull
private final RemoteJwkSetCache remoteJwkSetCache

The cache for remote JWK key sets.

keyFetchInterval

@Positive
private final Duration keyFetchInterval

The remote key refresh interval. Default value: 30 minutes.

Constructor Details

ClientInformationCredentialResolver

public ClientInformationCredentialResolver(@Nonnull @ParameterName(name="remoteJwkSetCache")
 RemoteJwkSetCache jwkSetCache)

Constructor.

Parameters:

jwkSetCache - The cache for remote JWK key sets.

ClientInformationCredentialResolver

public ClientInformationCredentialResolver(@Nonnull @ParameterName(name="remoteJwkSetCache")
 RemoteJwkSetCache jwkSetCache,
 @Nonnull @Positive @ParameterName(name="keyFetchInterval")
 Duration interval)

Constructor.

Parameters:

jwkSetCache - The cache for remote JWK key sets.

interval - The remote key refresh interval

Method Details

isInitialized

public boolean isInitialized()

Specified by:

isInitialized in interface InitializableComponent

initialize

public void initialize()
                throws ComponentInitializationException

Specified by:

initialize in interface InitializableComponent

Throws:

ComponentInitializationException

resolveFromSource

protected Iterable<Credential> resolveFromSource(@Nonnull
 CriteriaSet criteriaSet)
                                          throws ResolverException

Overrides:

resolveFromSource in class BasicJOSEObjectCredentialResolver

Throws:

ResolverException

resolveFromMetadata

@Nonnull
protected Collection<Credential> resolveFromMetadata(@Nonnull
 CriteriaSet criteriaSet,
 @Nonnull
 com.nimbusds.openid.connect.sdk.rp.OIDCClientInformation information)

Fetch the remote JWK Set from the jwk_uri in the RP/Client metadata. Convert each JWK into a Credential and return. Only supports EC (key agreement) and RSA (key encryption) keys. If the client information contains client secret, it's converted into a BasicJWKCredential.

Parameters:

criteriaSet - the criteria set

information - the RP/Client information

Returns:

a collection of credentials combined of client secret and keys from the key set (if any).