Package net.shibboleth.oidc.profile.oauth2.config.impl

Class AbstractOAuth2ClientAuthenticableProfileConfiguration

java.lang.Object

net.shibboleth.shared.component.AbstractInitializableComponent

net.shibboleth.shared.component.AbstractIdentifiedInitializableComponent

net.shibboleth.shared.component.AbstractIdentifiableInitializableComponent

net.shibboleth.profile.config.AbstractProfileConfiguration

net.shibboleth.profile.config.AbstractConditionalProfileConfiguration

net.shibboleth.idp.profile.config.AbstractInterceptorAwareProfileConfiguration

net.shibboleth.oidc.profile.oauth2.config.impl.AbstractOAuth2ClientAuthenticableProfileConfiguration

All Implemented Interfaces:

AuthenticationProfileConfiguration, InterceptorAwareProfileConfiguration, OAuth2ClientAuthenticableClientProfileConfiguration, OAuth2ClientAuthenticableProfileConfiguration, OAuth2ProfileConfiguration, ConditionalProfileConfiguration, ProfileConfiguration, Component, DestructableComponent, IdentifiableComponent, IdentifiedComponent, InitializableComponent

Direct Known Subclasses:

AbstractOAuth2FlowAwareProfileConfiguration, AbstractOAuth2TokenValidatingConfiguration

public abstract class AbstractOAuth2ClientAuthenticableProfileConfiguration
extends AbstractInterceptorAwareProfileConfiguration
implements OAuth2ClientAuthenticableProfileConfiguration, OAuth2ClientAuthenticableClientProfileConfiguration

Base class for OAuth profile configurations that support OAuth-defined client authentication methods.

Field Summary

Fields

Modifier and Type	Field	Description
private Function<ProfileRequestContext,Set<String>>	authenticationFlowsLookupStrategy	Lookup function to supply authentication flows.
private Function<ProfileRequestContext,ClaimsValidator>	claimsValidatorLookupStrategy	Validation of JWT claims for subset of client auth methods.
private Function<ProfileRequestContext,ClientSecretCredential>	clientCredentialLookupStrategy	Lookup function to retrieve a client credential from the given profile request context.
private Function<ProfileRequestContext,String>	clientIdLookupStrategy	Lookup function to retrieve the client_id from the given profile request context.
private Function<ProfileRequestContext,Collection<Principal>>	defaultAuthenticationContextsLookupStrategy	Lookup function to supply default authentication methods.
private Predicate<ProfileRequestContext>	forceAuthnPredicate	Whether to mandate forced authentication for the request.
private Function<ProfileRequestContext,Collection<String>>	postAuthenticationFlowsLookupStrategy	Lookup function to supply post authentication flows.
private Function<ProfileRequestContext,Integer>	proxyCountLookupStrategy	Lookup function to supply proxyCount property.
private Function<ProfileRequestContext,String>	tokenEndpointAuthMethodLookupStrategy	The token endpoint authentication method to use with an upstream OpenID Provider.
private Function<ProfileRequestContext,Set<String>>	tokenEndpointAuthMethodsLookupStrategy	Enabled token endpoint authentication methods.
private Function<ProfileRequestContext,Map<String,UnregisteredClientPolicy>>	unregisteredClientPolicyLookupStrategy	Lookup function to retrieve the policy for validating claims of an unregistered client.

Fields inherited from interface net.shibboleth.profile.config.ProfileConfiguration

DEFAULT_DISALLOWED_FEATURES

Constructor Summary

Constructors

Modifier	Constructor	Description
protected	AbstractOAuth2ClientAuthenticableProfileConfiguration(String profileId)	Constructor.

Method Summary

Modifier and Type	Method	Description
Set<String>	getAuthenticationFlows(ProfileRequestContext profileRequestContext)
ClaimsValidator	getClaimsValidator(ProfileRequestContext profileRequestContext)	Get the ClaimsValidator to apply to JWT-based client authentication.
ClientSecretCredential	getClientCredential(ProfileRequestContext profileRequestContext)	Get the client credential for the given context.
String	getClientId(ProfileRequestContext profileRequestContext)	Get the client_id appropriate for the given context.
List<Principal>	getDefaultAuthenticationMethods(ProfileRequestContext profileRequestContext)
List<String>	getPostAuthenticationFlows(ProfileRequestContext profileRequestContext)
Integer	getProxyCount(ProfileRequestContext profileRequestContext)
String	getTokenEndpointAuthMethod(ProfileRequestContext profileRequestContext)	Get the token endpoint authentication method to use with an OpenID Provider.
Set<String>	getTokenEndpointAuthMethods(ProfileRequestContext profileRequestContext)	Get the enabled token endpoint authentication methods.
Map<String,UnregisteredClientPolicy>	getUnregisteredClientPolicy(ProfileRequestContext profileRequestContext)	Get the policy for validating unregistered clients.
boolean	isForceAuthn(ProfileRequestContext profileRequestContext)
void	setAuthenticationFlows(Collection<String> flows)	Set the authentication flows to use.
void	setAuthenticationFlowsLookupStrategy(Function<ProfileRequestContext,Set<String>> strategy)	Set a lookup strategy for the authentication flows to use.
void	setClaimsValidator(ClaimsValidator validator)	Set the ClaimsValidator to apply to JWT-based client authentication.
void	setClaimsValidatorLookupStrategy(Function<ProfileRequestContext,ClaimsValidator> strategy)	Set a lookup strategy for the ClaimsValidator to apply to JWT-based client authentication.
void	setClientCredential(ClientSecretCredential clientCredential)	Set a fixed client credential to use no matter what the context/request.
void	setClientCredentialLookupStrategy(Function<ProfileRequestContext,ClientSecretCredential> strategy)	Set the client credential lookup strategy.
void	setClientId(String clientId)	Set a fixed client_id to use no matter what the context/request.
void	setClientIdLookupStrategy(Function<ProfileRequestContext,String> strategy)	Set the strategy to locate a client_id.
void	setDefaultAuthenticationMethods(Collection<Principal> contexts)	Set the default authentication contexts to use, expressed as custom principals.
void	setDefaultAuthenticationMethodsLookupStrategy(Function<ProfileRequestContext,Collection<Principal>> strategy)	Set a lookup strategy for the authentication contexts to use, expressed as custom principals.
void	setForceAuthn(boolean flag)	Set whether a fresh user presence proof should be required for this request.
void	setForceAuthnPredicate(Predicate<ProfileRequestContext> condition)	Set a condition to determine whether a fresh user presence proof should be required for this request.
void	setPostAuthenticationFlows(Collection<String> flows)	Set the ordered collection of post-authentication interceptor flows to enable.
void	setPostAuthenticationFlowsLookupStrategy(Function<ProfileRequestContext,Collection<String>> strategy)	Set a lookup strategy for the post-authentication interceptor flows to enable.
void	setProxyCount(Integer count)	Sets the maximum number of times an assertion may be proxied outbound and/or the maximum number of hops between the relying party and a proxied authentication authority inbound.
void	setProxyCountLookupStrategy(Function<ProfileRequestContext,Integer> strategy)	Set a lookup strategy for the maximum number of times an assertion may be proxied outbound and/or the maximum number of hops between the relying party and a proxied authentication authority inbound.
void	setTokenEndpointAuthMethod(String method)	Set the enabled token endpoint authentication method to use with an upstream OpenID Provider.
void	setTokenEndpointAuthMethodLookupStrategy(Function<ProfileRequestContext,String> strategy)	Set a lookup strategy to find the enabled token endpoint authentication method to use with an upstream OpenID Provider.
void	setTokenEndpointAuthMethods(Collection<String> methods)	Set the enabled token endpoint authentication methods.
void	setTokenEndpointAuthMethodsLookupStrategy(Function<ProfileRequestContext,Set<String>> strategy)	Set a lookup strategy for the enabled token endpoint authentication methods.
void	setUnregisteredClientPolicy(Map<String,UnregisteredClientPolicy> policy)	Sets the policy for validating unregistered clients.
void	setUnregisteredClientPolicyLookupStrategy(Function<ProfileRequestContext,Map<String,UnregisteredClientPolicy>> strategy)	Set a lookup strategy for the policy for validating unregistered clients.

Methods inherited from class net.shibboleth.idp.profile.config.AbstractInterceptorAwareProfileConfiguration

getInboundInterceptorFlows, getOutboundInterceptorFlows, setInboundInterceptorFlows, setInboundInterceptorFlowsLookupStrategy, setOutboundInterceptorFlows, setOutboundInterceptorFlowsLookupStrategy

Methods inherited from class net.shibboleth.profile.config.AbstractConditionalProfileConfiguration

getActivationCondition, setActivationCondition

Methods inherited from class net.shibboleth.profile.config.AbstractProfileConfiguration

equals, getDisallowedFeatures, getSecurityConfiguration, hashCode, isFeatureDisallowed, setDisallowedFeatures, setDisallowedFeaturesLookupStrategy, setSecurityConfiguration, setSecurityConfigurationLookupStrategy

Methods inherited from class net.shibboleth.shared.component.AbstractIdentifiableInitializableComponent

setId

Methods inherited from class net.shibboleth.shared.component.AbstractIdentifiedInitializableComponent

doInitialize, ensureId, getId, ifDestroyedThrowDestroyedComponentException, ifInitializedThrowUnmodifiabledComponentException, ifNotInitializedThrowUninitializedComponentException

Methods inherited from class net.shibboleth.shared.component.AbstractInitializableComponent

checkComponentActive, checkSetterPreconditions, destroy, doDestroy, initialize, isDestroyed, isInitialized

Methods inherited from class java.lang.Object

clone, finalize, getClass, notify, notifyAll, toString, wait, wait, wait

Methods inherited from interface net.shibboleth.idp.authn.config.AuthenticationProfileConfiguration

isLocal

Methods inherited from interface net.shibboleth.profile.config.ConditionalProfileConfiguration

getActivationCondition

Methods inherited from interface net.shibboleth.shared.component.IdentifiedComponent

getId

Methods inherited from interface net.shibboleth.profile.config.ProfileConfiguration

getDisallowedFeatures, getSecurityConfiguration, isFeatureDisallowed

Field Details

tokenEndpointAuthMethodsLookupStrategy

@Nonnull
private Function<ProfileRequestContext,Set<String>> tokenEndpointAuthMethodsLookupStrategy

Enabled token endpoint authentication methods.

tokenEndpointAuthMethodLookupStrategy

@Nonnull
private Function<ProfileRequestContext,String> tokenEndpointAuthMethodLookupStrategy

The token endpoint authentication method to use with an upstream OpenID Provider.

claimsValidatorLookupStrategy

@Nonnull
private Function<ProfileRequestContext,ClaimsValidator> claimsValidatorLookupStrategy

Validation of JWT claims for subset of client auth methods.

forceAuthnPredicate

@Nonnull
private Predicate<ProfileRequestContext> forceAuthnPredicate

Whether to mandate forced authentication for the request.

proxyCountLookupStrategy

@Nonnull
private Function<ProfileRequestContext,Integer> proxyCountLookupStrategy

Lookup function to supply proxyCount property.

defaultAuthenticationContextsLookupStrategy

@Nonnull
private Function<ProfileRequestContext,Collection<Principal>> defaultAuthenticationContextsLookupStrategy

Lookup function to supply default authentication methods.

authenticationFlowsLookupStrategy

@Nonnull
private Function<ProfileRequestContext,Set<String>> authenticationFlowsLookupStrategy

Lookup function to supply authentication flows.

postAuthenticationFlowsLookupStrategy

@Nonnull
private Function<ProfileRequestContext,Collection<String>> postAuthenticationFlowsLookupStrategy

Lookup function to supply post authentication flows.

clientCredentialLookupStrategy

@Nonnull
private Function<ProfileRequestContext,ClientSecretCredential> clientCredentialLookupStrategy

Lookup function to retrieve a client credential from the given profile request context.

clientIdLookupStrategy

@Nonnull
private Function<ProfileRequestContext,String> clientIdLookupStrategy

Lookup function to retrieve the client_id from the given profile request context.

unregisteredClientPolicyLookupStrategy

@Nonnull
private Function<ProfileRequestContext,Map<String,UnregisteredClientPolicy>> unregisteredClientPolicyLookupStrategy

Lookup function to retrieve the policy for validating claims of an unregistered client.

Constructor Details

AbstractOAuth2ClientAuthenticableProfileConfiguration

protected AbstractOAuth2ClientAuthenticableProfileConfiguration(@Nonnull @NotEmpty
 String profileId)

Constructor.

Parameters:

profileId - Unique profile identifier

Method Details

getTokenEndpointAuthMethods

@Nonnull
@NonnullElements
@NotLive
@Unmodifiable
public Set<String> getTokenEndpointAuthMethods(@Nullable
 ProfileRequestContext profileRequestContext)

Get the enabled token endpoint authentication methods.

Specified by:

getTokenEndpointAuthMethods in interface OAuth2ClientAuthenticableProfileConfiguration

Parameters:

profileRequestContext - profile request context

Returns:

enabled token endpoint authentication methods

setTokenEndpointAuthMethods

public void setTokenEndpointAuthMethods(@Nonnull @NonnullElements
 Collection<String> methods)

Set the enabled token endpoint authentication methods.

Parameters:

methods - What to set.

setTokenEndpointAuthMethodsLookupStrategy

public void setTokenEndpointAuthMethodsLookupStrategy(@Nonnull
 Function<ProfileRequestContext,Set<String>> strategy)

Set a lookup strategy for the enabled token endpoint authentication methods.

Parameters:

strategy - lookup strategy

getTokenEndpointAuthMethod

@Nullable
public String getTokenEndpointAuthMethod(@Nullable
 ProfileRequestContext profileRequestContext)

Get the token endpoint authentication method to use with an OpenID Provider.

Specified by:

getTokenEndpointAuthMethod in interface OAuth2ClientAuthenticableClientProfileConfiguration

Parameters:

profileRequestContext - the profile request context

Returns:

the token endpoint authentication method to use.

setTokenEndpointAuthMethod

public void setTokenEndpointAuthMethod(@Nonnull @NonnullElements
 String method)

Set the enabled token endpoint authentication method to use with an upstream OpenID Provider.

Parameters:

method - the token endpoint authentication method to set.

Since:

2.2.0

setTokenEndpointAuthMethodLookupStrategy

public void setTokenEndpointAuthMethodLookupStrategy(@Nonnull
 Function<ProfileRequestContext,String> strategy)

Set a lookup strategy to find the enabled token endpoint authentication method to use with an upstream OpenID Provider.

Parameters:

strategy - lookup strategy

Since:

2.2.0

getClaimsValidator

@Nullable
public ClaimsValidator getClaimsValidator(@Nullable
 ProfileRequestContext profileRequestContext)

Get the ClaimsValidator to apply to JWT-based client authentication.

Specified by:

getClaimsValidator in interface OAuth2ClientAuthenticableProfileConfiguration

Parameters:

profileRequestContext - current profile request context

Returns:

the validator to use

Since:

3.1.0

setClaimsValidator

public void setClaimsValidator(@Nullable
 ClaimsValidator validator)

Set the ClaimsValidator to apply to JWT-based client authentication.

Parameters:

validator - validator to use

Since:

3.1.0

setClaimsValidatorLookupStrategy

public void setClaimsValidatorLookupStrategy(@Nonnull
 Function<ProfileRequestContext,ClaimsValidator> strategy)

Set a lookup strategy for the ClaimsValidator to apply to JWT-based client authentication.

Parameters:

strategy - lookup strategy

Since:

3.1.0

isForceAuthn

public boolean isForceAuthn(@Nullable
 ProfileRequestContext profileRequestContext)

Specified by:

isForceAuthn in interface AuthenticationProfileConfiguration

setForceAuthn

public void setForceAuthn(boolean flag)

Set whether a fresh user presence proof should be required for this request.

Parameters:

flag - flag to set

setForceAuthnPredicate

public void setForceAuthnPredicate(@Nonnull
 Predicate<ProfileRequestContext> condition)

Set a condition to determine whether a fresh user presence proof should be required for this request.

Parameters:

condition - condition to set

getProxyCount

@Nullable
public Integer getProxyCount(@Nullable
 ProfileRequestContext profileRequestContext)

Specified by:

getProxyCount in interface AuthenticationProfileConfiguration

setProxyCount

public void setProxyCount(@Nullable @NonNegative
 Integer count)

Sets the maximum number of times an assertion may be proxied outbound and/or the maximum number of hops between the relying party and a proxied authentication authority inbound.

Parameters:

count - proxy count

setProxyCountLookupStrategy

public void setProxyCountLookupStrategy(@Nonnull
 Function<ProfileRequestContext,Integer> strategy)

Set a lookup strategy for the maximum number of times an assertion may be proxied outbound and/or the maximum number of hops between the relying party and a proxied authentication authority inbound.

Parameters:

strategy - lookup strategy

getAuthenticationFlows

@Nonnull
@NonnullElements
@NotLive
@Unmodifiable
public Set<String> getAuthenticationFlows(@Nullable
 ProfileRequestContext profileRequestContext)

Specified by:

getAuthenticationFlows in interface AuthenticationProfileConfiguration

setAuthenticationFlows

public void setAuthenticationFlows(@Nullable @NonnullElements
 Collection<String> flows)

Set the authentication flows to use.

Parameters:

flows - flow identifiers to use

setAuthenticationFlowsLookupStrategy

public void setAuthenticationFlowsLookupStrategy(@Nonnull
 Function<ProfileRequestContext,Set<String>> strategy)

Set a lookup strategy for the authentication flows to use.

Parameters:

strategy - lookup strategy

getPostAuthenticationFlows

@Nonnull
@NonnullElements
@NotLive
@Unmodifiable
public List<String> getPostAuthenticationFlows(@Nullable
 ProfileRequestContext profileRequestContext)

Specified by:

getPostAuthenticationFlows in interface AuthenticationProfileConfiguration

setPostAuthenticationFlows

public void setPostAuthenticationFlows(@Nullable @NonnullElements
 Collection<String> flows)

Set the ordered collection of post-authentication interceptor flows to enable.

Parameters:

flows - flow identifiers to enable

setPostAuthenticationFlowsLookupStrategy

public void setPostAuthenticationFlowsLookupStrategy(@Nonnull
 Function<ProfileRequestContext,Collection<String>> strategy)

Set a lookup strategy for the post-authentication interceptor flows to enable.

Parameters:

strategy - lookup strategy

getDefaultAuthenticationMethods

@Nonnull
@NonnullElements
@NotLive
@Unmodifiable
public List<Principal> getDefaultAuthenticationMethods(@Nullable
 ProfileRequestContext profileRequestContext)

Specified by:

getDefaultAuthenticationMethods in interface AuthenticationProfileConfiguration

setDefaultAuthenticationMethods

public void setDefaultAuthenticationMethods(@Nullable @NonnullElements
 Collection<Principal> contexts)

Set the default authentication contexts to use, expressed as custom principals.

Parameters:

contexts - default authentication contexts to use

setDefaultAuthenticationMethodsLookupStrategy

public void setDefaultAuthenticationMethodsLookupStrategy(@Nonnull
 Function<ProfileRequestContext,Collection<Principal>> strategy)

Set a lookup strategy for the authentication contexts to use, expressed as custom principals.

Parameters:

strategy - lookup strategy

setClientCredentialLookupStrategy

public void setClientCredentialLookupStrategy(@Nonnull
 Function<ProfileRequestContext,ClientSecretCredential> strategy)

Set the client credential lookup strategy.

Parameters:

strategy - the strategy to use

Since:

2.2.0

setClientCredential

public void setClientCredential(@Nullable
 ClientSecretCredential clientCredential)

Set a fixed client credential to use no matter what the context/request.

Parameters:

clientCredential - the static client credential to use

Since:

2.2.0

getClientCredential

public ClientSecretCredential getClientCredential(@Nullable
 ProfileRequestContext profileRequestContext)

Get the client credential for the given context. Typically a client_secret associated with the current client_id.

Specified by:

getClientCredential in interface OAuth2ClientAuthenticableClientProfileConfiguration

Parameters:

profileRequestContext - the profile request context

Returns:

the client credential

setClientIdLookupStrategy

public void setClientIdLookupStrategy(@Nonnull
 Function<ProfileRequestContext,String> strategy)

Set the strategy to locate a client_id.

Parameters:

strategy - the strategy to use

Since:

2.2.0

setClientId

public void setClientId(@Nullable
 String clientId)

Set a fixed client_id to use no matter what the context/request.

Parameters:

clientId - the static clientId to use

Since:

2.2.0

getClientId

@Nullable
public String getClientId(@Nullable
 ProfileRequestContext profileRequestContext)

Get the client_id appropriate for the given context. Typically that associated with the chosen OpenID Connect Provider.

Specified by:

getClientId in interface OAuth2ClientAuthenticableClientProfileConfiguration

Parameters:

profileRequestContext - the profile request context

Returns:

the client_id

getUnregisteredClientPolicy

@Nonnull
@Unmodifiable
public Map<String,UnregisteredClientPolicy> getUnregisteredClientPolicy(@Nullable
 ProfileRequestContext profileRequestContext)

Get the policy for validating unregistered clients.

Specified by:

getUnregisteredClientPolicy in interface OAuth2ClientAuthenticableProfileConfiguration

Parameters:

profileRequestContext - profile request context

Returns:

the map of policies for validating claims of an unregistered client

setUnregisteredClientPolicy

public void setUnregisteredClientPolicy(@Nullable
 Map<String,UnregisteredClientPolicy> policy)

Sets the policy for validating unregistered clients.

Parameters:

policy - policy to set

Since:

3.0.0

setUnregisteredClientPolicyLookupStrategy

public void setUnregisteredClientPolicyLookupStrategy(@Nonnull
 Function<ProfileRequestContext,Map<String,UnregisteredClientPolicy>> strategy)

Set a lookup strategy for the policy for validating unregistered clients.

Parameters:

strategy - lookup strategy

Since:

3.0.0