Package net.shibboleth.oidc.security.impl

Class BaseJWTSignatureSecurityHandler

java.lang.Object

net.shibboleth.shared.component.AbstractInitializableComponent

org.opensaml.messaging.handler.AbstractMessageHandler

org.opensaml.security.messaging.impl.BaseTrustEngineSecurityHandler<com.nimbusds.jwt.SignedJWT>

net.shibboleth.oidc.security.impl.BaseJWTSignatureSecurityHandler

All Implemented Interfaces:

Component, DestructableComponent, InitializableComponent, MessageHandler

Direct Known Subclasses:

JWTMessageSignatureSecurityHandler

public abstract class BaseJWTSignatureSecurityHandler
extends BaseTrustEngineSecurityHandler<com.nimbusds.jwt.SignedJWT>

Base class for security message handlers which evaluate a JWT signature with a signature trust engine.

Criterion are constructed from the following sources:

1. (Optional) Provider metadata.
2. (Optional) Client information.
3. (Optional) Client secret credentials.
4. (Required) The SecurityParametersContext.

Since:

2.2.0

Field Summary

Fields

Modifier and Type	Field	Description
private com.nimbusds.openid.connect.sdk.rp.OIDCClientInformation	clientInformation	The client information found from the lookup strategy.
private Function<MessageContext,com.nimbusds.openid.connect.sdk.rp.OIDCClientInformation>	clientInformationLookupStrategy	Function that looks up client information from the given message context.
private final org.slf4j.Logger	log	Class logger.
private OIDCPeerEntityContext	peerContext	The context representing the OIDC peer entity.
private static final ParentProfileRequestContextLookup<MessageContext>	PRC_LOOKUP	Lookup function for parent ProfileRequestContext.
private OAuth2ClientAuthenticableClientProfileConfiguration	profileConfiguration	Applicable stashed profile configuration appropriate for OAuth clients.
private com.nimbusds.openid.connect.sdk.op.OIDCProviderMetadata	providerMetadata	The provider metadata found from the lookup strategy.
private Function<MessageContext,com.nimbusds.openid.connect.sdk.op.OIDCProviderMetadata>	providerMetadataLookupStrategy	Function that looks up provider metadata from the given message context.
private Function<ProfileRequestContext,RelyingPartyContext>	relyingPartyContextLookupStrategy	Lookup function for relying party context.
private Function<MessageContext,SecurityParametersContext>	securityParametersContextLookupStrategy	Strategy used to look up the SecurityParametersContext.

Constructor Summary

Constructors

Modifier	Constructor	Description
protected	BaseJWTSignatureSecurityHandler()	Constructor.

Method Summary

Modifier and Type	Method	Description
protected <T> Function<MessageContext,T>	adapt(Function<ProfileRequestContext,T> function)	Adapt a ProfileRequestContext function to a MessageContext function via composing with a lookup function.
protected CriteriaSet	buildCriteriaSet(String entityID, MessageContext messageContext)
protected boolean	doPreInvoke(MessageContext messageContext)
protected OIDCPeerEntityContext	getOIDCPeerEntityContext()	Get the OIDCPeerEntityContext associated with the message.
protected TrustEngine<com.nimbusds.jwt.SignedJWT>	resolveTrustEngine(MessageContext messageContext)
void	setClientInformationLookupStrategy(Function<MessageContext,com.nimbusds.openid.connect.sdk.rp.OIDCClientInformation> strategy)	Set the lookup strategy to locate the client information.
void	setProviderMetadataLookupStrategy(Function<MessageContext,com.nimbusds.openid.connect.sdk.op.OIDCProviderMetadata> strategy)	Set the lookup strategy to locate the OpenID providers metadata.
void	setRelyingPartyContextLookupStrategy(Function<ProfileRequestContext,RelyingPartyContext> strategy)	Set lookup strategy for relying party context.
void	setSecurityParametersContextLookupStrategy(Function<MessageContext,SecurityParametersContext> strategy)	Set the strategy used to look up the SecurityParametersContext to set the parameters for.

Methods inherited from class org.opensaml.security.messaging.impl.BaseTrustEngineSecurityHandler

evaluate, evaluate, getTrustEngine

Methods inherited from class org.opensaml.messaging.handler.AbstractMessageHandler

doInvoke, doPostInvoke, doPostInvoke, getActivationCondition, getLogPrefix, invoke, isPreInvokeCalled, setActivationCondition

Methods inherited from class net.shibboleth.shared.component.AbstractInitializableComponent

checkComponentActive, checkSetterPreconditions, destroy, doDestroy, doInitialize, ifDestroyedThrowDestroyedComponentException, ifInitializedThrowUnmodifiabledComponentException, ifNotInitializedThrowUninitializedComponentException, initialize, isDestroyed, isInitialized

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Methods inherited from interface net.shibboleth.shared.component.InitializableComponent

initialize, isInitialized

Field Details

PRC_LOOKUP

@Nonnull
private static final ParentProfileRequestContextLookup<MessageContext> PRC_LOOKUP

Lookup function for parent ProfileRequestContext.

log

@Nonnull
private final org.slf4j.Logger log

Class logger.

providerMetadataLookupStrategy

@Nonnull
private Function<MessageContext,com.nimbusds.openid.connect.sdk.op.OIDCProviderMetadata> providerMetadataLookupStrategy

Function that looks up provider metadata from the given message context. Can return null if not used.

clientInformationLookupStrategy

@Nonnull
private Function<MessageContext,com.nimbusds.openid.connect.sdk.rp.OIDCClientInformation> clientInformationLookupStrategy

Function that looks up client information from the given message context. Can return null if not used.

relyingPartyContextLookupStrategy

@Nonnull
private Function<ProfileRequestContext,RelyingPartyContext> relyingPartyContextLookupStrategy

Lookup function for relying party context.

securityParametersContextLookupStrategy

@Nonnull
private Function<MessageContext,SecurityParametersContext> securityParametersContextLookupStrategy

Strategy used to look up the SecurityParametersContext.

profileConfiguration

@Nullable
private OAuth2ClientAuthenticableClientProfileConfiguration profileConfiguration

Applicable stashed profile configuration appropriate for OAuth clients.

peerContext

@Nullable
private OIDCPeerEntityContext peerContext

The context representing the OIDC peer entity.

providerMetadata

@Nullable
private com.nimbusds.openid.connect.sdk.op.OIDCProviderMetadata providerMetadata

The provider metadata found from the lookup strategy.

clientInformation

@Nullable
private com.nimbusds.openid.connect.sdk.rp.OIDCClientInformation clientInformation

The client information found from the lookup strategy.

Constructor Details

BaseJWTSignatureSecurityHandler

protected BaseJWTSignatureSecurityHandler()

Constructor.

Method Details

setSecurityParametersContextLookupStrategy

public void setSecurityParametersContextLookupStrategy(@Nonnull
 Function<MessageContext,SecurityParametersContext> strategy)

Set the strategy used to look up the SecurityParametersContext to set the parameters for.

Parameters:

strategy - lookup strategy

setProviderMetadataLookupStrategy

public void setProviderMetadataLookupStrategy(@Nonnull
 Function<MessageContext,com.nimbusds.openid.connect.sdk.op.OIDCProviderMetadata> strategy)

Set the lookup strategy to locate the OpenID providers metadata.

Parameters:

strategy - the strategy.

setClientInformationLookupStrategy

public void setClientInformationLookupStrategy(@Nonnull
 Function<MessageContext,com.nimbusds.openid.connect.sdk.rp.OIDCClientInformation> strategy)

Set the lookup strategy to locate the client information.

Parameters:

strategy - the strategy.

setRelyingPartyContextLookupStrategy

public void setRelyingPartyContextLookupStrategy(@Nonnull
 Function<ProfileRequestContext,RelyingPartyContext> strategy)

Set lookup strategy for relying party context.

Parameters:

strategy - lookup strategy

getOIDCPeerEntityContext

@Nullable
protected OIDCPeerEntityContext getOIDCPeerEntityContext()

Get the OIDCPeerEntityContext associated with the message.

Returns:

the peer context

resolveTrustEngine

@Nullable
protected TrustEngine<com.nimbusds.jwt.SignedJWT> resolveTrustEngine(@Nonnull
 MessageContext messageContext)

Specified by:

resolveTrustEngine in class BaseTrustEngineSecurityHandler<com.nimbusds.jwt.SignedJWT>

doPreInvoke

protected boolean doPreInvoke(@Nonnull
 MessageContext messageContext)
                       throws MessageHandlerException

Overrides:

doPreInvoke in class BaseTrustEngineSecurityHandler<com.nimbusds.jwt.SignedJWT>

Throws:

MessageHandlerException

buildCriteriaSet

protected CriteriaSet buildCriteriaSet(@Nullable
 String entityID,
 @Nonnull
 MessageContext messageContext)
                                throws MessageHandlerException

Specified by:

buildCriteriaSet in class BaseTrustEngineSecurityHandler<com.nimbusds.jwt.SignedJWT>

Throws:

MessageHandlerException

adapt

@Nonnull
protected <T> Function<MessageContext,T> adapt(@Nonnull
 Function<ProfileRequestContext,T> function)

Adapt a ProfileRequestContext function to a MessageContext function via composing with a lookup function.

Type Parameters:

T - the output type of the functions

Parameters:

function - the profile request context function

Returns:

the message context function