Package net.shibboleth.oidc.security.credential.impl

Class ClientInformationCredentialResolver

java.lang.Object
org.opensaml.security.credential.impl.AbstractCredentialResolver
org.opensaml.security.credential.impl.AbstractCriteriaFilteringCredentialResolver
net.shibboleth.oidc.security.credential.impl.BasicJOSEObjectCredentialResolver
net.shibboleth.oidc.security.credential.impl.AbstractClientInformationCredentialResolver
net.shibboleth.oidc.security.credential.impl.ClientInformationCredentialResolver
All Implemented Interfaces:
JOSEObjectCredentialResolver, Component, InitializableComponent, Resolver<Credential,CriteriaSet>, CredentialResolver
public class ClientInformationCredentialResolver extends AbstractClientInformationCredentialResolver
A JOSEObjectCredentialResolver that resolves credentials from the jwks or contents of jwks_uri of a ClientInformation. If the information contains client secret, it's converted into a BasicJWKCredential. Further filtering of credentials is provided by the AbstractCriteriaFilteringCredentialResolver parent class.

Note, only RSA or EC keys are resolved as these are the only key types which should be exposed in public JWKS documents.

  • Field Details

    • log

      @Nonnull private final org.slf4j.Logger log
      Class logger.

    • remoteJwkSetCache

      @Nonnull private final RemoteJwkSetCache remoteJwkSetCache
      The cache for remote JWK key sets.

    • keyFetchInterval

      @Nonnull @Positive private final Duration keyFetchInterval
      The remote key refresh interval. Default value: 30 minutes.

  • Constructor Details

    • ClientInformationCredentialResolver

      public ClientInformationCredentialResolver(@Nonnull @ParameterName(name="remoteJwkSetCache") RemoteJwkSetCache jwkSetCache)
      Constructor.
      Parameters:
      jwkSetCache - The cache for remote JWK key sets.

    • ClientInformationCredentialResolver

      public ClientInformationCredentialResolver(@Nonnull @ParameterName(name="remoteJwkSetCache") RemoteJwkSetCache jwkSetCache, @Nonnull @Positive @ParameterName(name="keyFetchInterval") Duration interval)
      Constructor.
      Parameters:
      jwkSetCache - The cache for remote JWK key sets.
      interval - The remote key refresh interval

  • Method Details

    • resolveFromSource

      @Nonnull protected Iterable<Credential> resolveFromSource(@Nullable CriteriaSet criteriaSet) throws ResolverException
      Overrides:
      resolveFromSource in class BasicJOSEObjectCredentialResolver
      Throws:
      ResolverException

    • resolveFromMetadata

      @Nonnull protected Collection<Credential> resolveFromMetadata(@Nonnull CriteriaSet criteriaSet, @Nonnull com.nimbusds.openid.connect.sdk.rp.OIDCClientInformation information)
      Fetch the remote JWK Set from the jwk_uri in the RP/Client metadata. Convert each JWK into a Credential and return. Only supports EC (key agreement) and RSA (key encryption) keys. If the client information contains client secret, it's converted into a BasicJWKCredential.
      Parameters:
      criteriaSet - the criteria set
      information - the RP/Client information
      Returns:
      a collection of credentials combined of client secret and keys from the key set (if any).