Package net.shibboleth.oidc.security.impl

Class CheckClientJWTSignatureAlgorithmHandler

java.lang.Object
net.shibboleth.shared.component.AbstractInitializableComponent
org.opensaml.messaging.handler.AbstractMessageHandler
net.shibboleth.oidc.security.impl.CheckClientJWTSignatureAlgorithmHandler
All Implemented Interfaces:
Component, DestructableComponent, InitializableComponent, MessageHandler
public class CheckClientJWTSignatureAlgorithmHandler extends AbstractMessageHandler
A MessageHandler that uses a OIDCClientInformation to verify the signature of a signed JWT uses expected algorithm.

  • Field Details

    • log

      @Nonnull private final org.slf4j.Logger log
      Logger.

    • jwtTokenLookupStrategy

      @NonnullAfterInit private Function<MessageContext,com.nimbusds.jwt.SignedJWT> jwtTokenLookupStrategy
      Function that looks up a signed JWT token from the given message context to validate .

    • clientInformationLookupStrategy

      @NonnullAfterInit private Function<MessageContext,com.nimbusds.openid.connect.sdk.rp.OIDCClientInformation> clientInformationLookupStrategy
      Function that looks up client information from the given message context. Can return null if not used.

    • signatureAlgorithmLookupStrategy

      @NonnullAfterInit private Function<com.nimbusds.openid.connect.sdk.rp.OIDCClientInformation,String> signatureAlgorithmLookupStrategy
      A lookup function for the signature algorithm in the client metadata.

    • signedJwt

      @NonnullBeforeExec private com.nimbusds.jwt.SignedJWT signedJwt
      The extracted signed JWT that is to be validated.

    • defaultAlgorithmValue

      @Nullable private String defaultAlgorithmValue
      The default algorithm value used if lookup strategy returned null.

  • Constructor Details

    • CheckClientJWTSignatureAlgorithmHandler

      public CheckClientJWTSignatureAlgorithmHandler()

  • Method Details

    • setJwtTokenLookupStrategy

      public void setJwtTokenLookupStrategy(@Nonnull Function<MessageContext,com.nimbusds.jwt.SignedJWT> strategy)
      Set the strategy used to look up a SignedJWT.
      Parameters:
      strategy - lookup strategy

    • setClientInformationLookupStrategy

      public void setClientInformationLookupStrategy(@Nonnull Function<MessageContext,com.nimbusds.openid.connect.sdk.rp.OIDCClientInformation> strategy)
      Set the lookup strategy to locate the client information.
      Parameters:
      strategy - the strategy.

    • setSignatureAlgorithmLookupStrategy

      public void setSignatureAlgorithmLookupStrategy(@Nonnull Function<com.nimbusds.openid.connect.sdk.rp.OIDCClientInformation,String> strategy)
      Set the strategy used to look up the signature algorithm in the client metadata.
      Parameters:
      strategy - lookup strategy

    • setDefaultAlgorithmValue

      public void setDefaultAlgorithmValue(@Nullable String value)
      Set the default algorithm value used if lookup strategy returned null.
      Parameters:
      value - default value

    • doInitialize

      protected void doInitialize() throws ComponentInitializationException
      Overrides:
      doInitialize in class AbstractInitializableComponent
      Throws:
      ComponentInitializationException

    • doPreInvoke

      protected boolean doPreInvoke(@Nonnull MessageContext messageContext) throws MessageHandlerException
      Overrides:
      doPreInvoke in class AbstractMessageHandler
      Throws:
      MessageHandlerException

    • doInvoke

      protected void doInvoke(@Nonnull MessageContext messageContext) throws MessageHandlerException
      Specified by:
      doInvoke in class AbstractMessageHandler
      Throws:
      MessageHandlerException

    • getExpectedAlgorithm

      @Nullable protected String getExpectedAlgorithm(@Nullable com.nimbusds.openid.connect.sdk.rp.OIDCClientInformation clientInformation)
      Fetches the expected signature algorithm from the OIDCClientInformation.
      Parameters:
      clientInformation - the client information/metadata.
      Returns:
      the expected algorithm value.