Package net.shibboleth.oidc.security.impl

Class CheckClientJWTDecryptionConfiguration

java.lang.Object
net.shibboleth.shared.component.AbstractInitializableComponent
org.opensaml.profile.action.AbstractProfileAction
org.opensaml.profile.action.AbstractConditionalProfileAction
net.shibboleth.idp.profile.AbstractProfileAction
net.shibboleth.oidc.security.impl.CheckClientJWTDecryptionConfiguration
All Implemented Interfaces:
Component, DestructableComponent, InitializableComponent, ProfileAction, Aware, MessageSource, MessageSourceAware, Action
public class CheckClientJWTDecryptionConfiguration extends AbstractProfileAction
An action that uses a OIDCClientInformation to verify the encryption parameters of an incoming encrypted JWT are compliant with configuration in the client metadata.

  • Field Details

    • log

      @Nonnull private final org.slf4j.Logger log
      Logger.

    • jwtTokenLookupStrategy

      @NonnullAfterInit private Function<ProfileRequestContext,com.nimbusds.jwt.JWT> jwtTokenLookupStrategy
      Function that looks up an encrypted JWT token from the given profile context to validate .

    • encryptionOptionalPredicate

      @NonnullAfterInit private Predicate<ProfileRequestContext> encryptionOptionalPredicate
      Predicate to determine how to proceed if JWT token was not encrypted.

    • clientInformationLookupStrategy

      @NonnullAfterInit private Function<ProfileRequestContext,com.nimbusds.openid.connect.sdk.rp.OIDCClientInformation> clientInformationLookupStrategy
      Function that looks up client information from the given profile context.

    • dataEncryptionAlgorithmLookupStrategy

      @NonnullAfterInit private Function<com.nimbusds.openid.connect.sdk.rp.OIDCClientInformation,String> dataEncryptionAlgorithmLookupStrategy
      A lookup function for the data encryption algorithm in the client metadata.

    • keyTransportEncryptionAlgorithmLookupStrategy

      @NonnullAfterInit private Function<com.nimbusds.openid.connect.sdk.rp.OIDCClientInformation,String> keyTransportEncryptionAlgorithmLookupStrategy
      A lookup function for the key transport algorithm in the client metadata.

    • errorEventId

      @NonnullAfterInit private String errorEventId
      Event identifier to publish if token parameters are not compliant with the configuration.

    • encryptedJwt

      @NonnullBeforeExec private com.nimbusds.jwt.EncryptedJWT encryptedJwt
      The extracted encrypted JWT that is to be processed.

    • encryptionOptional

      private boolean encryptionOptional
      Whether encryption is optional.

  • Constructor Details

    • CheckClientJWTDecryptionConfiguration

      public CheckClientJWTDecryptionConfiguration()

  • Method Details

    • setJwtTokenLookupStrategy

      public void setJwtTokenLookupStrategy(@Nonnull Function<ProfileRequestContext,com.nimbusds.jwt.JWT> strategy)
      Set the strategy used to look up a JWT.
      Parameters:
      strategy - lookup strategy

    • setClientInformationLookupStrategy

      public void setClientInformationLookupStrategy(@Nonnull Function<ProfileRequestContext,com.nimbusds.openid.connect.sdk.rp.OIDCClientInformation> strategy)
      Set the lookup strategy to locate the client information.
      Parameters:
      strategy - the strategy.

    • setDataEncryptionAlgorithmLookupStrategy

      public void setDataEncryptionAlgorithmLookupStrategy(@Nonnull Function<com.nimbusds.openid.connect.sdk.rp.OIDCClientInformation,String> strategy)
      Set the strategy used to look up the data encryption algorithm in the client metadata.
      Parameters:
      strategy - lookup strategy

    • setKeyTransportEncryptionAlgorithmLookupStrategy

      public void setKeyTransportEncryptionAlgorithmLookupStrategy(@Nonnull Function<com.nimbusds.openid.connect.sdk.rp.OIDCClientInformation,String> strategy)
      Set the strategy used to look up the data encryption algorithm in the client metadata.
      Parameters:
      strategy - lookup strategy

    • setEncryptionOptionalPredicate

      public void setEncryptionOptionalPredicate(@Nonnull Predicate<ProfileRequestContext> condition)
      Sets the condition to apply to determine how to proceed if encryption parameter resolution fails.
      Parameters:
      condition - condition to set

    • setErrorEventId

      public void setErrorEventId(@Nonnull String id)
      Sets the event identifier to publish if token parameters are not compliant with the configuration.
      Parameters:
      id - the identifier to set

    • doInitialize

      protected void doInitialize() throws ComponentInitializationException
      Overrides:
      doInitialize in class AbstractInitializableComponent
      Throws:
      ComponentInitializationException

    • doPreExecute

      protected boolean doPreExecute(@Nonnull ProfileRequestContext profileRequestContext)
      Overrides:
      doPreExecute in class AbstractConditionalProfileAction

    • doExecute

      protected void doExecute(@Nonnull ProfileRequestContext profileRequestContext)
      Overrides:
      doExecute in class AbstractProfileAction