Package net.shibboleth.oidc.profile.config.impl

Class AbstractOIDCSSOConfiguration

java.lang.Object
net.shibboleth.shared.component.AbstractInitializableComponent
net.shibboleth.shared.component.AbstractIdentifiedInitializableComponent
net.shibboleth.shared.component.AbstractIdentifiableInitializableComponent
net.shibboleth.profile.config.AbstractProfileConfiguration
net.shibboleth.profile.config.AbstractConditionalProfileConfiguration
net.shibboleth.idp.profile.config.AbstractInterceptorAwareProfileConfiguration
net.shibboleth.oidc.profile.oauth2.config.impl.AbstractOAuth2InterceptorAwareProfileConfiguration
net.shibboleth.oidc.profile.oauth2.config.impl.AbstractOAuth2ClientAuthenticableProfileConfiguration
net.shibboleth.oidc.profile.oauth2.config.impl.AbstractOAuth2FlowAwareProfileConfiguration
net.shibboleth.oidc.profile.config.impl.AbstractOIDCSSOConfiguration
All Implemented Interfaces:
AuthenticationProfileConfiguration, InterceptorAwareProfileConfiguration, OIDCFlowAwareProfileConfiguration, OIDCIDTokenProducingProfileConfiguration, OIDCProfileConfiguration, OIDCSSOProfileConfiguration, OIDCSSOProviderConfiguration, OIDCSSORelyingPartyConfiguration, OAuth2AccessTokenProducingProfileConfiguration, OAuth2ClientAuthenticableClientProfileConfiguration, OAuth2ClientAuthenticableProfileConfiguration, OAuth2DPoPProofValidatingProfileConfiguration, OAuth2FlowAwareProfileConfiguration, OAuth2InterceptorAwareProfileConfiguration, OAuth2ProfileConfiguration, OAuth2RefreshTokenProducingProfileConfiguration, OAuth2ScopeValidatingProfileConfiguration, OAuth2TokenEncryptionProfileConfiguration, AttributeResolvingProfileConfiguration, ConditionalProfileConfiguration, OverriddenIssuerProfileConfiguration, ProfileConfiguration, Component, DestructableComponent, IdentifiableComponent, IdentifiedComponent, InitializableComponent
Direct Known Subclasses:
DefaultOAuth2TokenConfiguration, DefaultOIDCAuthorizationConfiguration
public abstract class AbstractOIDCSSOConfiguration extends AbstractOAuth2FlowAwareProfileConfiguration implements OIDCSSORelyingPartyConfiguration, OIDCSSOProviderConfiguration
Base class for profiles that support OIDC's concept of SSO, which spans multiple endpoints.

  • Field Details

  • Constructor Details

    • AbstractOIDCSSOConfiguration

      public AbstractOIDCSSOConfiguration(@Nonnull @NotEmpty String profileId)
      Creates a new configuration instance.
      Parameters:
      profileId - Unique profile identifier.

  • Method Details

    • getIssuer

      @Nullable @NotEmpty public String getIssuer(@Nullable ProfileRequestContext profileRequestContext)
      Specified by:
      getIssuer in interface OverriddenIssuerProfileConfiguration

    • setIssuer

      public void setIssuer(@Nullable @NotEmpty String issuer)
      Set overridden issuer value.
      Parameters:
      issuer - issuer value

    • setIssuerLookupStrategy

      public void setIssuerLookupStrategy(@Nonnull Function<ProfileRequestContext,String> strategy)
      Sets lookup strategy for overridden issuer value.
      Parameters:
      strategy - lookup strategy

    • isResolveAttributes

      public boolean isResolveAttributes(@Nullable ProfileRequestContext profileRequestContext)
      Specified by:
      isResolveAttributes in interface AttributeResolvingProfileConfiguration

    • setResolveAttributes

      public void setResolveAttributes(boolean flag)
      Set whether attributes should be resolved during the profile.
      Parameters:
      flag - flag to set

    • setResolveAttributesPredicate

      public void setResolveAttributesPredicate(@Nonnull Predicate<ProfileRequestContext> condition)
      Set a condition to determine whether attributes should be resolved during the profile.
      Parameters:
      condition - condition to set

    • isEncryptionOptional

      public boolean isEncryptionOptional(@Nullable ProfileRequestContext profileRequestContext)
      Get whether encryption is optional in the face of a missing key, etc.
      Specified by:
      isEncryptionOptional in interface OAuth2TokenEncryptionProfileConfiguration
      Parameters:
      profileRequestContext - current profile request context
      Returns:
      true iff encryption is optional

    • setEncryptionOptional

      public void setEncryptionOptional(boolean flag)
      Set whether encryption is optional in the face of a missing key, etc.
      Parameters:
      flag - flag to set

    • setEncryptionOptionalPredicate

      public void setEncryptionOptionalPredicate(@Nonnull Predicate<ProfileRequestContext> condition)
      Set a condition to determine whether encryption is optional in the face of a missing key, etc.
      Parameters:
      condition - condition to set

    • isForcePKCE

      public boolean isForcePKCE(@Nullable ProfileRequestContext profileRequestContext)
      Get whether client is required to use PKCE.
      Specified by:
      isForcePKCE in interface OIDCSSOProfileConfiguration
      Parameters:
      profileRequestContext - profile request context
      Returns:
      whether client is required to use PKCE

    • setForcePKCE

      public void setForcePKCE(boolean flag)
      Set whether client is required to use PKCE.
      Parameters:
      flag - flag to set

    • setForcePKCEPredicate

      public void setForcePKCEPredicate(@Nonnull Predicate<ProfileRequestContext> condition)
      Set condition for whether client is required to use PKCE.
      Parameters:
      condition - condition to set

    • isAllowPKCEPlain

      public boolean isAllowPKCEPlain(@Nullable ProfileRequestContext profileRequestContext)
      Get whether client is allowed to use PKCE code challenge method plain.
      Specified by:
      isAllowPKCEPlain in interface OIDCSSOProfileConfiguration
      Parameters:
      profileRequestContext - profile request context
      Returns:
      whether client is allowed to use PKCE code challenge method plain

    • setAllowPKCEPlain

      public void setAllowPKCEPlain(boolean flag)
      Set whether client is allowed to use PKCE code challenge method plain.
      Parameters:
      flag - flag to set

    • setAllowPKCEPlainPredicate

      public void setAllowPKCEPlainPredicate(@Nonnull Predicate<ProfileRequestContext> condition)
      Set condition for whether client is allowed to use PKCE code challenge method plain.
      Parameters:
      condition - condition to set

    • getIDTokenLifetime

      @Positive @Nonnull public Duration getIDTokenLifetime(@Nullable ProfileRequestContext profileRequestContext)
      Get ID token lifetime.

      Defaults to 1 hour.

      Specified by:
      getIDTokenLifetime in interface OIDCIDTokenProducingProfileConfiguration
      Parameters:
      profileRequestContext - profile request context
      Returns:
      ID token lifetime

    • setIDTokenLifetime

      public void setIDTokenLifetime(@Positive @Nonnull Duration lifetime)
      Set the lifetime of an id token.
      Parameters:
      lifetime - lifetime of an id token in milliseconds

    • setIDTokenLifetimeLookupStrategy

      public void setIDTokenLifetimeLookupStrategy(@Nonnull Function<ProfileRequestContext,Duration> strategy)
      Set a lookup strategy for the ID token lifetime.
      Parameters:
      strategy - lookup strategy

    • getAccessTokenType

      @Nullable @NotEmpty public String getAccessTokenType(@Nullable ProfileRequestContext profileRequestContext)
      Get access token type.
      Specified by:
      getAccessTokenType in interface OAuth2AccessTokenProducingProfileConfiguration
      Parameters:
      profileRequestContext - profile request context
      Returns:
      access token type, or null for unspecified/opaque

    • setAccessTokenType

      public void setAccessTokenType(@Nullable @NotEmpty String type)
      Set access token type.
      Parameters:
      type - token type, or null for unspecified/opaque
      Since:
      2.1.0

    • setAccessTokenTypeLookupStrategy

      public void setAccessTokenTypeLookupStrategy(@Nonnull Function<ProfileRequestContext,String> strategy)
      Set lookup strategy for access token type.
      Parameters:
      strategy - lookup strategy
      Since:
      2.1.0

    • getAccessTokenLifetime

      @Positive @Nonnull public Duration getAccessTokenLifetime(@Nullable ProfileRequestContext profileRequestContext)
      Get access token lifetime.

      Defaults to 10 minutes.

      Specified by:
      getAccessTokenLifetime in interface OAuth2AccessTokenProducingProfileConfiguration
      Parameters:
      profileRequestContext - profile request context
      Returns:
      access token lifetime

    • setAccessTokenLifetime

      public void setAccessTokenLifetime(@Positive @Nonnull Duration lifetime)
      Set the lifetime of an access token.
      Parameters:
      lifetime - lifetime of an access token in milliseconds

    • setAccessTokenLifetimeLookupStrategy

      public void setAccessTokenLifetimeLookupStrategy(@Nullable Function<ProfileRequestContext,Duration> strategy)
      Set a lookup strategy for the access token lifetime.
      Parameters:
      strategy - lookup strategy

    • getRefreshTokenTimeout

      @Nonnull @Positive public Duration getRefreshTokenTimeout(@Nullable ProfileRequestContext profileRequestContext)
      Get refresh token timeout. The expiration of a single refresh token is calculated based on this value.

      Defaults to 2 hours.

      Specified by:
      getRefreshTokenTimeout in interface OAuth2RefreshTokenProducingProfileConfiguration
      Parameters:
      profileRequestContext - profile request context
      Returns:
      refresh token timeout

    • setRefreshTokenTimeout

      public void setRefreshTokenTimeout(@Nonnull @Positive Duration timeout)
      Set the timeout of refresh token.
      Parameters:
      timeout - timeout of an refresh token
      Since:
      2.2.0

    • setRefreshTokenTimeoutLookupStrategy

      public void setRefreshTokenTimeoutLookupStrategy(@Nullable Function<ProfileRequestContext,Duration> strategy)
      Set a lookup strategy for the refresh token timeout.
      Parameters:
      strategy - lookup strategy
      Since:
      2.2.0

    • getRefreshTokenChainLifetime

      @Nonnull @Positive public Duration getRefreshTokenChainLifetime(@Nullable ProfileRequestContext profileRequestContext)
      Get refresh token chain lifetime. The expiration of a single refresh token is calculated based on this value.

      Defaults to 2 hours.

      Specified by:
      getRefreshTokenChainLifetime in interface OAuth2RefreshTokenProducingProfileConfiguration
      Parameters:
      profileRequestContext - profile request context
      Returns:
      refresh token timeout

    • setRefreshTokenChainLifetime

      public void setRefreshTokenChainLifetime(@Nonnull @Positive Duration lifetime)
      Set the lifetime of refresh token chain.
      Parameters:
      lifetime - lifetime of a refresh token chain
      Since:
      2.2.0

    • setRefreshTokenChainLifetimeLookupStrategy

      public void setRefreshTokenChainLifetimeLookupStrategy(@Nullable Function<ProfileRequestContext,Duration> strategy)
      Set a lookup strategy for the refresh token chain lifetime.
      Parameters:
      strategy - lookup strategy
      Since:
      2.2.0

    • getRefreshTokenType

      @Nullable @NotEmpty public String getRefreshTokenType(@Nullable ProfileRequestContext profileRequestContext)
      Get refresh token type.
      Specified by:
      getRefreshTokenType in interface OAuth2RefreshTokenProducingProfileConfiguration
      Parameters:
      profileRequestContext - profile request context
      Returns:
      refresh token type, or null for unspecified/opaque

    • setRefreshTokenType

      public void setRefreshTokenType(@Nullable @NotEmpty String type)
      Set refresh token type.
      Parameters:
      type - token type, or null for unspecified/opaque
      Since:
      3.1.0

    • setRefreshTokenTypeLookupStrategy

      public void setRefreshTokenTypeLookupStrategy(@Nonnull Function<ProfileRequestContext,String> strategy)
      Set lookup strategy for token token type.
      Parameters:
      strategy - lookup strategy
      Since:
      3.1.0

    • getAdditionalAudiencesForIdToken

      @Nonnull @NonnullElements @NotLive public Set<String> getAdditionalAudiencesForIdToken(@Nullable ProfileRequestContext profileRequestContext)
      Get the set of audiences, in addition to the relying party(ies) to which the IdP is issuing the ID Token, with which the token may be shared.
      Specified by:
      getAdditionalAudiencesForIdToken in interface OIDCIDTokenProducingProfileConfiguration
      Parameters:
      profileRequestContext - profile request context
      Returns:
      the additional audiences

    • setAdditionalAudiencesForIdToken

      public void setAdditionalAudiencesForIdToken(@Nullable @NonnullElements Collection<String> audiences)
      Set the set of audiences, in addition to the relying party(ies) to which the IdP is issuing the ID Token, with which the token may be shared.
      Parameters:
      audiences - the additional audiences

    • setAdditionalAudiencesForIdTokenLookupStrategy

      public void setAdditionalAudiencesForIdTokenLookupStrategy(@Nonnull Function<ProfileRequestContext,Set<String>> strategy)
      Set a lookup strategy for the set of audiences, in addition to the relying party(ies) to which the IdP is issuing the ID Token, with which the token may be shared.
      Parameters:
      strategy - lookup strategy

    • getAlwaysIncludedAttributes

      @Nonnull @NonnullElements @NotLive public Set<String> getAlwaysIncludedAttributes(@Nullable ProfileRequestContext profileRequestContext)
      Get the set of attribute IDs which should be included in the ID token regardless of response_type.

      Default behavior is to include claims only with the implicit id_token type only, while any use of a back-channel relies on the user_info endpoint to get the claims. This setting forces certain attributes to be added to the ID token regardless of flow.

      Specified by:
      getAlwaysIncludedAttributes in interface OIDCIDTokenProducingProfileConfiguration
      Parameters:
      profileRequestContext - profile request context
      Returns:
      the attribute IDs to include in all cases

    • setAlwaysIncludedAttributes

      public void setAlwaysIncludedAttributes(@Nullable @NonnullElements Collection<String> attributes)
      Set the set of attribute IDs which should be included in the ID token regardless of response_type.

      Default behavior is to include claims only with the implicit id_token type only, while any use of a back-channel relies on the user_info endpoint to get the claims. This setting forces certain attributes to be added to the ID token regardless of flow.

      Parameters:
      attributes - the attribute IDs to include in all cases

    • setAlwaysIncludedAttributesLookupStrategy

      public void setAlwaysIncludedAttributesLookupStrategy(@Nonnull Function<ProfileRequestContext,Set<String>> strategy)
      Set a lookup strategy for the attribute IDs which should be included in the ID token regardless of response_type.
      Parameters:
      strategy - lookup strategy

    • getIDTokenManipulationStrategy

      @Nullable public BiFunction<ProfileRequestContext,Map<String,Object>,Map<String,Object>> getIDTokenManipulationStrategy(@Nullable ProfileRequestContext profileRequestContext)
      Get the bi-function for manipulating id_token claims.
      Specified by:
      getIDTokenManipulationStrategy in interface OIDCIDTokenProducingProfileConfiguration
      Parameters:
      profileRequestContext - profile request context
      Returns:
      the bi-function for manipulating id_token claims

    • setIDTokenManipulationStrategy

      public void setIDTokenManipulationStrategy(@Nullable BiFunction<ProfileRequestContext,Map<String,Object>,Map<String,Object>> strategy)
      Set the bi-function for manipulating id_token claims.
      Parameters:
      strategy - bi-function for manipulating id_token claims
      Since:
      2.1.0

    • setIDTokenManipulationStrategyLookupStrategy

      public void setIDTokenManipulationStrategyLookupStrategy(@Nonnull Function<ProfileRequestContext,BiFunction<ProfileRequestContext,Map<String,Object>,Map<String,Object>>> strategy)
      Set a lookup strategy for the bi-function for manipulating id_token claims.
      Parameters:
      strategy - lookup strategy
      Since:
      2.1.0

    • getAccessTokenClaimsSetManipulationStrategy

      @Nullable public BiFunction<ProfileRequestContext,Map<String,Object>,Map<String,Object>> getAccessTokenClaimsSetManipulationStrategy(@Nullable ProfileRequestContext profileRequestContext)
      Get the bi-function for manipulating access token claims set.
      Specified by:
      getAccessTokenClaimsSetManipulationStrategy in interface OAuth2AccessTokenProducingProfileConfiguration
      Parameters:
      profileRequestContext - profile request context
      Returns:
      the bi-function for manipulating access token claims set

    • setAccessTokenClaimsSetManipulationStrategy

      public void setAccessTokenClaimsSetManipulationStrategy(@Nullable BiFunction<ProfileRequestContext,Map<String,Object>,Map<String,Object>> strategy)
      Set the bi-function for manipulating access token claims set.
      Parameters:
      strategy - bi-function for manipulating access token claims set
      Since:
      2.1.0

    • setAccessTokenClaimsSetManipulationStrategyLookupStrategy

      public void setAccessTokenClaimsSetManipulationStrategyLookupStrategy(@Nonnull Function<ProfileRequestContext,BiFunction<ProfileRequestContext,Map<String,Object>,Map<String,Object>>> strategy)
      Set a lookup strategy for the bi-function for manipulating access token claims set.
      Parameters:
      strategy - lookup strategy
      Since:
      2.1.0

    • getCustomRedirectUriValidationStrategy

      @Nullable public BiPredicate<URI,ProfileRequestContext> getCustomRedirectUriValidationStrategy(@Nullable ProfileRequestContext profileRequestContext)
      Get the bi-predicate for validating redirect URI in request to the current profile request context state.
      Specified by:
      getCustomRedirectUriValidationStrategy in interface OIDCSSOProfileConfiguration
      Parameters:
      profileRequestContext - profile request context
      Returns:
      the bi-predicate for validating requested redirect URI

    • setCustomRedirectUriValidationStrategy

      public void setCustomRedirectUriValidationStrategy(@Nullable BiPredicate<URI,ProfileRequestContext> strategy)
      Set the bi-predicate for custom validation of redirect URI in the request. .
      Parameters:
      strategy - bi-predicate for custom validation of redirect URI in the request
      Since:
      3.2.0

    • setCustomRedirectUriValidationStrategyLookupStrategy

      public void setCustomRedirectUriValidationStrategyLookupStrategy(@Nonnull Function<ProfileRequestContext,BiPredicate<URI,ProfileRequestContext>> strategy)
      Set a lookup strategy for the bi-predicate for custom validation of redirect URI in the request.
      Parameters:
      strategy - lookup strategy
      Since:
      3.2.0

    • isAlwaysIssueBearerAccessToken

      public boolean isAlwaysIssueBearerAccessToken(@Nullable ProfileRequestContext profileRequestContext)
      Get whether the access token to be issued is always a bearer access token.
      Specified by:
      isAlwaysIssueBearerAccessToken in interface OAuth2AccessTokenProducingProfileConfiguration
      Parameters:
      profileRequestContext - profile request context
      Returns:
      whether the access token to be issued is always a bearer access token

    • setAlwaysIssueBearerAccessToken

      public void setAlwaysIssueBearerAccessToken(boolean flag)
      Set whether the access token to be issued is always a bearer access token.
      Parameters:
      flag - flag to set
      Since:
      3.2.0

    • setAlwaysIssueBearerAccessTokenPredicate

      public void setAlwaysIssueBearerAccessTokenPredicate(@Nonnull Predicate<ProfileRequestContext> condition)
      Set a condition to determine whether the access token to be issued is always a bearer access token.
      Parameters:
      condition - condition to set
      Since:
      3.2.0

    • isStrictScopeValidation

      public boolean isStrictScopeValidation(@Nullable ProfileRequestContext profileRequestContext)
      Get whether scope validation is strict, i.e. request for unallowed scopes is an error.
      Specified by:
      isStrictScopeValidation in interface OAuth2ScopeValidatingProfileConfiguration
      Parameters:
      profileRequestContext - the profile request context
      Returns:
      whether scope validation is strict

    • setStrictScopeValidation

      public void setStrictScopeValidation(boolean flag)
      Set whether scope validation is strict, i.e. request for unallowed scopes is an error.
      Parameters:
      flag - flag to set
      Since:
      3.2.0

    • setStrictScopeValidationPredicate

      public void setStrictScopeValidationPredicate(@Nonnull Predicate<ProfileRequestContext> condition)
      Set a condition to determine whether scope validation is strict, i.e. request for unallowed scopes is an error.
      Parameters:
      condition - condition to set
      Since:
      3.2.0