Package net.shibboleth.oidc.security.impl

Class DecryptJWE

java.lang.Object

net.shibboleth.shared.component.AbstractInitializableComponent

org.opensaml.profile.action.AbstractProfileAction

org.opensaml.profile.action.AbstractConditionalProfileAction

net.shibboleth.idp.profile.AbstractProfileAction

net.shibboleth.oidc.security.impl.DecryptJWE

All Implemented Interfaces:

Component, DestructableComponent, InitializableComponent, ProfileAction, Aware, MessageSource, MessageSourceAware, Action

public class DecryptJWE
extends AbstractProfileAction

Decrypt the located JWE using the decryption parameters stored in the security context.

Event:

EventIds.PROCEED_EVENT_ID, EventIds.INVALID_SEC_CFG, OidcEventIds.INVALID_TOKEN

Postcondition:

Decrypt a JWT and add it back to via an update strategy.

Field Summary

Fields

Modifier and Type	Field	Description
private JWETokenDecrypter	decrypter	The decryption object.
private com.nimbusds.jwt.EncryptedJWT	encryptedJwt	The extracted encrypted JWT that is to be validated.
private String	errorEventId	Event identifier to publish in the case of decryption errors.
private Function<ProfileRequestContext,com.nimbusds.jwt.EncryptedJWT>	jwtTokenLookupStrategy	Function that looks up a signed JWT token from the given message context to validate.
private BiConsumer<ProfileRequestContext,com.nimbusds.jwt.JWT>	jwtUpdateStrategy	A consumer that sets the JWT produced from this decryption operation back into the profile request context.
private final org.slf4j.Logger	log	Class logger.
private Function<ProfileRequestContext,SecurityParametersContext>	securityParamsLookupStrategy	Strategy used to locate the SecurityParametersContext.

Constructor Summary

Constructors

Constructor	Description
DecryptJWE()	Constructor.

Method Summary

Modifier and Type	Method	Description
protected void	doExecute(ProfileRequestContext profileRequestContext)
protected void	doInitialize()
protected boolean	doPreExecute(ProfileRequestContext profileRequestContext)
private void	logJWT(com.nimbusds.jwt.JWT jwt)	Log (on trace) the JWT.
void	setErrorEventId(String id)	Sets the event identifier to publish in the case of decryption errors.
void	setJwtTokenLookupStrategy(Function<ProfileRequestContext,com.nimbusds.jwt.EncryptedJWT> strategy)	Set the strategy used to look up a encrypted JWT token.
void	setJwtUpdateStrategy(BiConsumer<ProfileRequestContext,com.nimbusds.jwt.JWT> strategy)	Set the strategy used to update the profile request context with the JWT produced as a result of this decryption operation.
void	setSecurityParametersContextLookupStrategy(Function<ProfileRequestContext,SecurityParametersContext> strategy)	Set the strategy used to locate the SecurityParametersContext associated with a given ProfileRequestContext.

Methods inherited from class net.shibboleth.idp.profile.AbstractProfileAction

doExecute, execute, getBean, getBean, getMessage, getMessage, getMessage, getParameter, getParameter, getProfileContextLookupStrategy, getRequestContext, getResult, setMessageSource, setProfileContextLookupStrategy

Methods inherited from class org.opensaml.profile.action.AbstractConditionalProfileAction

getActivationCondition, setActivationCondition

Methods inherited from class org.opensaml.profile.action.AbstractProfileAction

doPostExecute, doPostExecute, ensureHttpServletRequest, ensureHttpServletResponse, execute, getHttpServletRequest, getHttpServletRequestSupplier, getHttpServletResponse, getHttpServletResponseSupplier, getLogPrefix, isPreExecuteCalled, setHttpServletRequestSupplier, setHttpServletResponseSupplier

Methods inherited from class net.shibboleth.shared.component.AbstractInitializableComponent

checkComponentActive, checkSetterPreconditions, destroy, doDestroy, ifDestroyedThrowDestroyedComponentException, ifInitializedThrowUnmodifiabledComponentException, ifNotInitializedThrowUninitializedComponentException, initialize, isDestroyed, isInitialized

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Methods inherited from interface net.shibboleth.shared.component.InitializableComponent

initialize, isInitialized

Field Details

log

@Nonnull
private final org.slf4j.Logger log

Class logger.

jwtTokenLookupStrategy

@NonnullAfterInit
private Function<ProfileRequestContext,com.nimbusds.jwt.EncryptedJWT> jwtTokenLookupStrategy

Function that looks up a signed JWT token from the given message context to validate.

jwtUpdateStrategy

@NonnullAfterInit
private BiConsumer<ProfileRequestContext,com.nimbusds.jwt.JWT> jwtUpdateStrategy

A consumer that sets the JWT produced from this decryption operation back into the profile request context.

errorEventId

@Nonnull
private String errorEventId

Event identifier to publish in the case of decryption errors.

encryptedJwt

@NonnullBeforeExec
private com.nimbusds.jwt.EncryptedJWT encryptedJwt

The extracted encrypted JWT that is to be validated.

decrypter

@NonnullBeforeExec
private JWETokenDecrypter decrypter

The decryption object.

securityParamsLookupStrategy

@Nonnull
private Function<ProfileRequestContext,SecurityParametersContext> securityParamsLookupStrategy

Strategy used to locate the SecurityParametersContext.

Constructor Details

DecryptJWE

public DecryptJWE()

Constructor.

Method Details

setSecurityParametersContextLookupStrategy

public void setSecurityParametersContextLookupStrategy(@Nonnull
 Function<ProfileRequestContext,SecurityParametersContext> strategy)

Set the strategy used to locate the SecurityParametersContext associated with a given ProfileRequestContext.

Parameters:

strategy - strategy used to locate the SecurityParametersContext associated with a given ProfileRequestContext

setJwtUpdateStrategy

public void setJwtUpdateStrategy(@Nonnull
 BiConsumer<ProfileRequestContext,com.nimbusds.jwt.JWT> strategy)

Set the strategy used to update the profile request context with the JWT produced as a result of this decryption operation.

Parameters:

strategy - the strategy

setJwtTokenLookupStrategy

public void setJwtTokenLookupStrategy(@Nonnull
 Function<ProfileRequestContext,com.nimbusds.jwt.EncryptedJWT> strategy)

Set the strategy used to look up a encrypted JWT token.

Parameters:

strategy - lookup strategy

setErrorEventId

public void setErrorEventId(@Nonnull
 String id)

Sets the event identifier to publish in the case of decryption errors.

Parameters:

id - the identifier to set

doInitialize

protected void doInitialize()
                     throws ComponentInitializationException

Overrides:

doInitialize in class AbstractInitializableComponent

Throws:

ComponentInitializationException

doPreExecute

protected boolean doPreExecute(@Nonnull
 ProfileRequestContext profileRequestContext)

Overrides:

doPreExecute in class AbstractConditionalProfileAction

doExecute

protected void doExecute(@Nonnull
 ProfileRequestContext profileRequestContext)

Overrides:

doExecute in class AbstractProfileAction

logJWT

private void logJWT(@Nonnull
 com.nimbusds.jwt.JWT jwt)

Log (on trace) the JWT.

Parameters:

jwt - the JWT to log.