Package net.shibboleth.oidc.profile.config.impl

Class DefaultOIDCAuthorizationConfiguration

java.lang.Object
net.shibboleth.shared.component.AbstractInitializableComponent
net.shibboleth.shared.component.AbstractIdentifiedInitializableComponent
net.shibboleth.shared.component.AbstractIdentifiableInitializableComponent
net.shibboleth.profile.config.AbstractProfileConfiguration
net.shibboleth.profile.config.AbstractConditionalProfileConfiguration
net.shibboleth.idp.profile.config.AbstractInterceptorAwareProfileConfiguration
net.shibboleth.oidc.profile.oauth2.config.impl.AbstractOAuth2InterceptorAwareProfileConfiguration
net.shibboleth.oidc.profile.oauth2.config.impl.AbstractOAuth2ClientAuthenticableProfileConfiguration
net.shibboleth.oidc.profile.oauth2.config.impl.AbstractOAuth2FlowAwareProfileConfiguration
net.shibboleth.oidc.profile.config.impl.AbstractOIDCSSOConfiguration
net.shibboleth.oidc.profile.config.impl.DefaultOIDCAuthorizationConfiguration
All Implemented Interfaces:
AuthenticationProfileConfiguration, InterceptorAwareProfileConfiguration, OIDCAuthenticationProfileConfiguration, OIDCAuthenticationRelyingPartyProfileConfiguration, OIDCAuthorizationConfiguration, OIDCFlowAwareProfileConfiguration, OIDCIDTokenProducingProfileConfiguration, OIDCProfileConfiguration, OIDCSSOProfileConfiguration, OIDCSSOProviderConfiguration, OIDCSSORelyingPartyConfiguration, OAuth2AccessTokenProducingProfileConfiguration, OAuth2AuthorizationCodeProducingProfileConfiguration, OAuth2AuthorizationProfileConfiguration, OAuth2ClientAuthenticableClientProfileConfiguration, OAuth2ClientAuthenticableProfileConfiguration, OAuth2DPoPProofValidatingProfileConfiguration, OAuth2FlowAwareProfileConfiguration, OAuth2InterceptorAwareProfileConfiguration, OAuth2ProfileConfiguration, OAuth2RefreshTokenProducingProfileConfiguration, OAuth2ScopeValidatingProfileConfiguration, OAuth2TokenEncryptionProfileConfiguration, AttributeResolvingProfileConfiguration, ConditionalProfileConfiguration, OverriddenIssuerProfileConfiguration, ProfileConfiguration, Component, DestructableComponent, IdentifiableComponent, IdentifiedComponent, InitializableComponent
Direct Known Subclasses:
DefaultOAuth2PushedAuthorizationRequestConfiguration
public class DefaultOIDCAuthorizationConfiguration extends AbstractOIDCSSOConfiguration implements OIDCAuthenticationRelyingPartyProfileConfiguration, OIDCAuthorizationConfiguration
Implementation of a profile configuration for the OpenID Connect authorization endpoint.

It is also usable as a Token endpoint configuration if no non-OIDC use cases are needed.

  • Field Details

    • PROFILE_COUNTER

      @Nonnull @NotEmpty public static final String PROFILE_COUNTER
      OIDC authorization profile counter name.
      See Also:

    • acrRequestAlwaysEssentialPredicate

      @Nonnull private Predicate<ProfileRequestContext> acrRequestAlwaysEssentialPredicate
      Whether all acr claim requests should be treated as Essential.

    • encodeConsentInTokensPredicate

      @Nonnull private Predicate<ProfileRequestContext> encodeConsentInTokensPredicate
      Whether to encode consent in authorization code and access/refresh tokens.

    • authorizeCodeLifetimeLookupStrategy

      @Nonnull private Function<ProfileRequestContext,Duration> authorizeCodeLifetimeLookupStrategy
      Lookup function to supply lifetime of authz code.

    • encodedAttributesLookupStrategy

      @Nonnull private Function<ProfileRequestContext,Set<String>> encodedAttributesLookupStrategy
      Lookup function to supply attribute IDs to embed in authorization code or access token.

    • useRequestObjectPredicate

      @Nonnull private Predicate<ProfileRequestContext> useRequestObjectPredicate
      Whether to encode authentication request parameters inside a JWT request object .

    • signRequestObjectPredicate

      @Nonnull private Predicate<ProfileRequestContext> signRequestObjectPredicate
      Predicate used to determine if the generated request object should be signed. Default returns true.

    • encryptRequestObjectPredicate

      @Nonnull private Predicate<ProfileRequestContext> encryptRequestObjectPredicate
      Predicate used to determine if the generated request object should be encrypted. Default returns false.

    • deniedUserInfoAttributesLookupStrategy

      @Nonnull private Function<ProfileRequestContext,Set<String>> deniedUserInfoAttributesLookupStrategy
      Lookup function to supply attribute IDs to omit from UserInfo token.

    • includeIssuerInResponsePredicate

      @Nonnull private Predicate<ProfileRequestContext> includeIssuerInResponsePredicate
      Whether to include iss parameter in the authentication response.

    • retrieveUserInfoEndpointClaims

      @Nonnull private Predicate<ProfileRequestContext> retrieveUserInfoEndpointClaims
      Whether to make a UserInfo Endpoint request for End-User claims.

    • redirectUriOverrideLookupStrategy

      @Nonnull private Function<ProfileRequestContext,String> redirectUriOverrideLookupStrategy
      An override to specify a specific redirect_uri to use over the normally computed one.

    • responseTypeLookupStrategy

      @Nonnull private Function<ProfileRequestContext,String> responseTypeLookupStrategy
      Lookup function to retrieve the response_type.

    • scopesLookupStrategy

      @Nonnull private Function<ProfileRequestContext,Set<String>> scopesLookupStrategy
      Lookup function to retrieve the scopes requested during authentication.

    • acrTranslationStrategyLookupStrategy

      @Nonnull private Function<ProfileRequestContext,Function<Collection<String>,Collection<Principal>>> acrTranslationStrategyLookupStrategy
      Lookup function to supply the strategy function for translating OIDC ACR claims.

    • amrTranslationStrategyLookupStrategy

      @Nonnull private Function<ProfileRequestContext,Function<Collection<String>,Collection<Principal>>> amrTranslationStrategyLookupStrategy
      Lookup function to supply the strategy function for translating OIDC ACR claims.

    • proxiedAuthnInstantPredicate

      @Nonnull private Predicate<ProfileRequestContext> proxiedAuthnInstantPredicate
      Whether authentication results should carry the proxied auth_time in the id_token.

    • httpRequestMethodLookupStrategy

      @Nonnull private Function<ProfileRequestContext,String> httpRequestMethodLookupStrategy
      Which HTTP method should be used to issue OIDC authentication requests. Supported values are POST and GET. The default is GET.

    • authorizationCodeClaimsSetManipulationStrategyLookupStrategy

      @Nonnull private Function<ProfileRequestContext,BiFunction<ProfileRequestContext,Map<String,Object>,Map<String,Object>>> authorizationCodeClaimsSetManipulationStrategyLookupStrategy
      Lookup function to supply strategy bi-function for manipulating authorization code claims set.

    • maxAuthenticationAgeLookupStrategy

      @Nonnull private Function<ProfileRequestContext,Duration> maxAuthenticationAgeLookupStrategy
      Lookup function to determine the max_age of an authentication request.

    • loginHintLookupStrategy

      @Nonnull private Function<ProfileRequestContext,String> loginHintLookupStrategy
      Lookup function to determine the login_hint of an authentication request.

    • userInfoHttpRequestMethodLookupStrategy

      @Nonnull private Function<ProfileRequestContext,String> userInfoHttpRequestMethodLookupStrategy
      Which HTTP method should be used to issue the UserInfo requests. Supported values are POST and GET. The default is GET.

    • responseModeLookupStrategy

      @Nonnull private Function<ProfileRequestContext,String> responseModeLookupStrategy
      Lookup function to override the default response_mode for a given response_type.

    • tlsServerValidationOnlyPredicate

      @Nonnull private Predicate<ProfileRequestContext> tlsServerValidationOnlyPredicate
      Whether TLS server validation alone is sufficient to verify the id_token (true), or whether the id_token's signature should be validated (false). The default is false, the id_token signature should be validated.

    • displayLookupStrategy

      @Nonnull private Function<ProfileRequestContext,String> displayLookupStrategy
      Lookup function to determine the optional display parameter value of an authentication request.

    • responseModesLookupStrategy

      @Nonnull private Function<ProfileRequestContext,Set<String>> responseModesLookupStrategy
      Lookup function to supply the response_modes that are allowed to be used in authorization request.

    • requireAuthenticationRequestPredicateLookupStrategy

      @Nonnull private Function<ProfileRequestContext,Predicate<ProfileRequestContext>> requireAuthenticationRequestPredicateLookupStrategy
      Whether client is required to use OIDC authentication request vs plain OAuth2 authorization request.

    • requireDpopJktPredicate

      @Nonnull private Predicate<ProfileRequestContext> requireDpopJktPredicate
      Whether client is required to include dpop_jkt in authorization request.

    • requirePushedAuthorizationRequestPredicate

      @Nonnull private Predicate<ProfileRequestContext> requirePushedAuthorizationRequestPredicate
      Whether client is required to use pushed authorization request.

  • Constructor Details

    • DefaultOIDCAuthorizationConfiguration

      public DefaultOIDCAuthorizationConfiguration()
      Constructor.

    • DefaultOIDCAuthorizationConfiguration

      public DefaultOIDCAuthorizationConfiguration(@Nonnull @NotEmpty String profileId)
      Creates a new configuration instance.
      Parameters:
      profileId - Unique profile identifier.

  • Method Details

    • isAcrRequestAlwaysEssential

      public boolean isAcrRequestAlwaysEssential(@Nullable ProfileRequestContext profileRequestContext)
      Get whether all acr claim requests should be treated as Essential.
      Specified by:
      isAcrRequestAlwaysEssential in interface OIDCAuthorizationConfiguration
      Parameters:
      profileRequestContext - profile request context
      Returns:
      whether all acr claim requests should be treated as Essential

    • setAcrRequestAlwaysEssential

      public void setAcrRequestAlwaysEssential(boolean flag)
      Set whether all acr claim requests should be treated as Essential.
      Parameters:
      flag - flag to set

    • setAcrRequestAlwaysEssentialPredicate

      public void setAcrRequestAlwaysEssentialPredicate(@Nonnull Predicate<ProfileRequestContext> condition)
      Set condition for whether all acr claim requests should be treated as Essential.
      Parameters:
      condition - condition to set

    • isUseRequestObject

      public boolean isUseRequestObject(@Nullable ProfileRequestContext profileRequestContext)
      Should OpenID specific authentication request parameters should be passed in a single, self contained, JWT?
      Specified by:
      isUseRequestObject in interface OIDCAuthenticationProfileConfiguration
      Parameters:
      profileRequestContext - the profile request context
      Returns:
      whether authentication request parameters should be passed in a single, self contained, JWT

    • setUseRequestObject

      public void setUseRequestObject(boolean flag)
      Set whether the authentication request parameters should be passed in a single, self contained, JWT.
      Parameters:
      flag - flag to set

    • setUseRequestObjectPredicate

      public void setUseRequestObjectPredicate(@Nonnull Predicate<ProfileRequestContext> condition)
      Set condition for whether the authentication request parameters should be passed in a single, self contained, JWT.
      Parameters:
      condition - condition to set

    • isEncodeConsentInTokens

      public boolean isEncodeConsentInTokens(@Nullable ProfileRequestContext profileRequestContext)
      Get whether to encode consent in authorization code and access/refresh tokens.
      Specified by:
      isEncodeConsentInTokens in interface OIDCAuthorizationConfiguration
      Parameters:
      profileRequestContext - profile request context
      Returns:
      whether to encode consent in authorization code and access/refresh tokens

    • setEncodeConsentInTokens

      public void setEncodeConsentInTokens(boolean flag)
      Set whether to encode consent in authorization code and access/refresh tokens.
      Parameters:
      flag - flag to set

    • setEncodeConsentInTokensPredicate

      public void setEncodeConsentInTokensPredicate(@Nonnull Predicate<ProfileRequestContext> condition)
      Set condition for whether to encode consent in authorization code and access/refresh tokens.
      Parameters:
      condition - condition to set

    • isRetrieveUserInfoEndpointClaims

      public boolean isRetrieveUserInfoEndpointClaims(@Nonnull ProfileRequestContext profileRequestContext)
      Get whether to make a request to the UserInfo Endpoint to obtain authenticated End-User claims.
      Specified by:
      isRetrieveUserInfoEndpointClaims in interface OIDCAuthenticationRelyingPartyProfileConfiguration
      Parameters:
      profileRequestContext - current profile request context
      Returns:
      whether to make a request to the UserInfo Endpoint

    • setRetrieveUserInfoEndpointClaims

      public void setRetrieveUserInfoEndpointClaims(boolean flag)
      Set whether to make a request to the UserInfo Endpoint to obtain authenticated End-User claims.
      Parameters:
      flag - flag to set
      Since:
      2.2.0

    • setRetrieveUserInfoEndpointClaims

      public void setRetrieveUserInfoEndpointClaims(@Nonnull Predicate<ProfileRequestContext> condition)
      Set condition for whether to make a request to the UserInfo Endpoint to obtain authenticated End-User claims.
      Parameters:
      condition - condition to set
      Since:
      2.2.0

    • isSignRequestObject

      public boolean isSignRequestObject(@Nullable ProfileRequestContext profileRequestContext)
      Should the RequestObject (if configured) be signed?
      Specified by:
      isSignRequestObject in interface OIDCAuthenticationRelyingPartyProfileConfiguration
      Parameters:
      profileRequestContext - the profile request context
      Returns:
      true iff the RequestObject should be signed, false otherwise.

    • setSignRequestObject

      public void setSignRequestObject(boolean flag)
      Set whether the RequestObject should be signed.
      Parameters:
      flag - flag to set
      Since:
      2.2.0

    • setSignRequestObjectPredicate

      public void setSignRequestObjectPredicate(Predicate<ProfileRequestContext> condition)
      Set the predicate to determine if the RequestObject should be signed.
      Parameters:
      condition - the condition
      Since:
      2.2.0

    • isEncryptRequestObject

      public boolean isEncryptRequestObject(@Nullable ProfileRequestContext profileRequestContext)
      Should the RequestObject (if configured) be encrypted?
      Specified by:
      isEncryptRequestObject in interface OIDCAuthenticationRelyingPartyProfileConfiguration
      Parameters:
      profileRequestContext - the profile request context
      Returns:
      true iff the RequestObject should be encrypted, false otherwise.

    • setEncryptRequestObject

      public void setEncryptRequestObject(boolean flag)
      Set whether the RequestObject should be encrypted.
      Parameters:
      flag - flag to set
      Since:
      2.2.0

    • setEncryptRequestObjectPredicate

      public void setEncryptRequestObjectPredicate(Predicate<ProfileRequestContext> condition)
      Set the predicate to determine if the RequestObject should be encrypted.
      Parameters:
      condition - the condition
      Since:
      2.2.0

    • setRedirectUriOverrideLookupStrategy

      public void setRedirectUriOverrideLookupStrategy(@Nonnull Function<ProfileRequestContext,String> strategy)
      Set the redirect_uri lookup strategy used to locate an overridden redirect.
      Parameters:
      strategy - the strategy to use.
      Since:
      2.2.0

    • setRedirectUriOverride

      public void setRedirectUriOverride(@Nullable String uri)
      Set the override redirect_uri.
      Parameters:
      uri - the redirect_uri
      Since:
      2.2.0

    • getRedirectUriOverride

      public String getRedirectUriOverride(@Nullable ProfileRequestContext profileRequestContext)
      Get the redirect_uri override if set.
      Specified by:
      getRedirectUriOverride in interface OIDCAuthenticationRelyingPartyProfileConfiguration
      Parameters:
      profileRequestContext - profile request context
      Returns:
      the redirect_uri override

    • getAuthorizeCodeLifetime

      @Positive @Nonnull public Duration getAuthorizeCodeLifetime(@Nullable ProfileRequestContext profileRequestContext)
      Get authz code lifetime.

      Defaults to 5 minutes.

      Specified by:
      getAuthorizeCodeLifetime in interface OAuth2AuthorizationCodeProducingProfileConfiguration
      Parameters:
      profileRequestContext - profile request context
      Returns:
      authz code lifetime

    • setAuthorizeCodeLifetime

      public void setAuthorizeCodeLifetime(@Positive @Nonnull Duration lifetime)
      Set the lifetime of authz code.
      Parameters:
      lifetime - lifetime of authz code

    • setAuthorizeCodeLifetimeLookupStrategy

      public void setAuthorizeCodeLifetimeLookupStrategy(@Nonnull Function<ProfileRequestContext,Duration> strategy)
      Set a lookup strategy for the authz code lifetime.
      Parameters:
      strategy - lookup strategy

    • setHttpRequestMethodLookupStrategy

      public void setHttpRequestMethodLookupStrategy(@Nonnull Function<ProfileRequestContext,String> strategy)
      Set a lookup strategy to determine the HTTP request method for an authentication request.
      Parameters:
      strategy - the strategy to set.

    • setHttpRequestMethod

      public void setHttpRequestMethod(@Nullable OAuth2AuthorizationProfileConfiguration.HttpRequestMethod method)
      Set the HTTP request method for an authentication request.
      Parameters:
      method - the HTTP method to set, either POST or GET.

    • getHttpRequestMethod

      public OAuth2AuthorizationProfileConfiguration.HttpRequestMethod getHttpRequestMethod(@Nullable ProfileRequestContext profileRequestContext)
      Get the HTTP request method for an authentication request.
      Specified by:
      getHttpRequestMethod in interface OAuth2AuthorizationProfileConfiguration
      Parameters:
      profileRequestContext - profile request context
      Returns:
      the HTTP request method

    • getEncodedAttributes

      @Nonnull @NonnullElements @NotLive public Set<String> getEncodedAttributes(@Nullable ProfileRequestContext profileRequestContext)
      Get the set of attribute IDs which should be encoded in encrypted form into the authorization code and/or access/refresh tokens to enable recovery on the back-channel.
      Specified by:
      getEncodedAttributes in interface OIDCAuthorizationConfiguration
      Parameters:
      profileRequestContext - profile request context
      Returns:
      the attribute IDs to encode

    • setEncodedAttributes

      public void setEncodedAttributes(@Nullable @NonnullElements Collection<String> attributes)
      Set the set of attribute IDs which should be encoded in encrypted form into the authorization code and/or access/refresh tokens to enable recovery on the back-channel.
      Parameters:
      attributes - the attribute IDs to encode

    • setEncodedAttributesLookupStrategy

      public void setEncodedAttributesLookupStrategy(@Nonnull Function<ProfileRequestContext,Set<String>> strategy)
      Set a lookup strategy for the attribute IDs which should be encoded in encrypted form into the authorization code and/or access/refresh tokens to enable recovery on the back-channel.
      Parameters:
      strategy - lookup strategy

    • getDeniedUserInfoAttributes

      @Nonnull @NonnullElements @NotLive public Set<String> getDeniedUserInfoAttributes(@Nullable ProfileRequestContext profileRequestContext)
      Get the set of attribute IDs which should be omitted from the UserInfo token.

      Default behavior is to include all claims, but omiited claims also affect the set that may need to be embedded for recovery into the access/refresh tokens.

      Specified by:
      getDeniedUserInfoAttributes in interface OIDCAuthorizationConfiguration
      Parameters:
      profileRequestContext - profile request context
      Returns:
      the attribute IDs to omit from UserInfo token

    • setDeniedUserInfoAttributes

      public void setDeniedUserInfoAttributes(@Nullable @NonnullElements Collection<String> attributes)
      Set the set of attribute IDs which should be omitted from the UserInfo token.

      Default behavior is to include all claims, but omiited claims also affect the set that may need to be embedded for recovery into the access/refresh tokens.

      Parameters:
      attributes - the attribute IDs to omit from UserInfo token

    • setDeniedUserInfoAttributesLookupStrategy

      public void setDeniedUserInfoAttributesLookupStrategy(@Nonnull Function<ProfileRequestContext,Set<String>> strategy)
      Set a lookup strategy for the set of attribute IDs which should be omitted from the UserInfo token.
      Parameters:
      strategy - lookup strategy

    • isIncludeIssuerInResponse

      public boolean isIncludeIssuerInResponse(@Nullable ProfileRequestContext profileRequestContext)
      Get whether to include iss parameter in the authentication response.
      Specified by:
      isIncludeIssuerInResponse in interface OIDCAuthorizationConfiguration
      Parameters:
      profileRequestContext - profile request context
      Returns:
      whether to include iss parameter in the authentication response

    • setIncludeIssuerInResponse

      public void setIncludeIssuerInResponse(boolean flag)
      Set whether to include iss parameter in the authentication response.
      Parameters:
      flag - flag to set
      Since:
      2.1.0

    • setIncludeIssuerInResponsePredicate

      public void setIncludeIssuerInResponsePredicate(@Nonnull Predicate<ProfileRequestContext> condition)
      Set condition for whether to include iss parameter in the authentication response.
      Parameters:
      condition - condition to set
      Since:
      2.1.0

    • setResponseTypeLookupStrategy

      public void setResponseTypeLookupStrategy(@Nonnull Function<ProfileRequestContext,String> strategy)
      Set the lookup strategy to determine the response_type for authentication requests.
      Parameters:
      strategy - the strategy to use
      Since:
      2.2.0

    • setResponseType

      public void setResponseType(@Nullable String responseType)
      Set the response_type to use for authentication requests.
      Parameters:
      responseType - the response_type to use
      Since:
      2.2.0

    • getResponseType

      public String getResponseType(@Nullable ProfileRequestContext profileRequestContext)
      Get the response_type to use for authorization requests.
      Specified by:
      getResponseType in interface OAuth2AuthorizationProfileConfiguration
      Parameters:
      profileRequestContext - the profile request context
      Returns:
      the response_type

    • getAuthorizationCodeClaimsSetManipulationStrategy

      @Nullable public BiFunction<ProfileRequestContext,Map<String,Object>,Map<String,Object>> getAuthorizationCodeClaimsSetManipulationStrategy(@Nullable ProfileRequestContext profileRequestContext)
      Get the bi-function for manipulating authorization code claims set.
      Specified by:
      getAuthorizationCodeClaimsSetManipulationStrategy in interface OAuth2AuthorizationCodeProducingProfileConfiguration
      Parameters:
      profileRequestContext - profile request context
      Returns:
      the bi-function for manipulating authorization code claims set

    • setAuthorizationCodeClaimsSetManipulationStrategy

      public void setAuthorizationCodeClaimsSetManipulationStrategy(@Nullable BiFunction<ProfileRequestContext,Map<String,Object>,Map<String,Object>> strategy)
      Set the bi-function for manipulating authorization code claims set.
      Parameters:
      strategy - bi-function for manipulating authorization code claims set
      Since:
      2.1.0

    • setAuthorizationCodeClaimsSetManipulationStrategyLookupStrategy

      public void setAuthorizationCodeClaimsSetManipulationStrategyLookupStrategy(@Nonnull Function<ProfileRequestContext,BiFunction<ProfileRequestContext,Map<String,Object>,Map<String,Object>>> strategy)
      Set a lookup strategy for the bi-function for manipulating authorization code claims set.
      Parameters:
      strategy - lookup strategy
      Since:
      2.1.0

    • setScopesLookupStrategy

      public void setScopesLookupStrategy(@Nonnull Function<ProfileRequestContext,Set<String>> strategy)
      Set the lookup strategy to determine the scopes to use for authentication requests.
      Parameters:
      strategy - the strategy to use
      Since:
      2.2.0

    • setScopes

      public void setScopes(@Nullable @NonnullElements Set<String> scopes)
      Set the scopes to use for authentication requests.
      Parameters:
      scopes - the scopes
      Since:
      2.2.0

    • getScopes

      @Nullable public Set<String> getScopes(@Nullable ProfileRequestContext profileRequestContext)
      Get the scopes to use in authentication requests.
      Specified by:
      getScopes in interface OAuth2AuthorizationProfileConfiguration
      Parameters:
      profileRequestContext - the profile request context
      Returns:
      the scopes

    • setAuthenticationMethodsReferencesTranslationStrategyLookupStrategy

      public void setAuthenticationMethodsReferencesTranslationStrategyLookupStrategy(@Nonnull Function<ProfileRequestContext,Function<Collection<String>,Collection<Principal>>> strategy)
      Set the lookup function to locate the Authentication Methods References strategy used to translate between an inbound proxied OIDC AMR into an appropriate set of custom Principal objects to populate the subject.
      Parameters:
      strategy - translation function
      Since:
      2.2.0

    • getAuthenticationMethodsReferencesTranslationStrategy

      @Nullable public Function<Collection<String>,Collection<Principal>> getAuthenticationMethodsReferencesTranslationStrategy(@Nullable ProfileRequestContext prc)
      Get the function used to translate AMRs in the id_token into an appropriate set of custom Principal objects to populate into the subject.
      Specified by:
      getAuthenticationMethodsReferencesTranslationStrategy in interface OIDCAuthenticationProfileConfiguration
      Parameters:
      prc - current profile request context
      Returns:
      translation function

    • setAuthenticationContextClassReferenceTranslationStrategyLookupStrategy

      public void setAuthenticationContextClassReferenceTranslationStrategyLookupStrategy(@Nullable Function<ProfileRequestContext,Function<Collection<String>,Collection<Principal>>> strategy)
      Set the lookup function to locate the Authentication Context Class Reference strategy used to translate between an inbound proxied OIDC ACR into an appropriate set of custom Principal objects to populate the subject.
      Parameters:
      strategy - translation function
      Since:
      2.2.0

    • getAuthenticationContextClassReferenceTranslationStrategy

      @Nullable public Function<Collection<String>,Collection<Principal>> getAuthenticationContextClassReferenceTranslationStrategy(@Nullable ProfileRequestContext prc)
      Get the function used to translate ACRs in the id_token into an appropriate set of custom Principal objects to populate into the subject.
      Specified by:
      getAuthenticationContextClassReferenceTranslationStrategy in interface OIDCAuthenticationProfileConfiguration
      Parameters:
      prc - current profile request context
      Returns:
      translation function

    • isProxiedAuthnInstant

      public boolean isProxiedAuthnInstant(@Nullable ProfileRequestContext profileRequestContext)
      Gets whether authentication results produced by use of this profile should carry the proxied assertion's auth_time from the id_token, rather than the current time.

      Defaults to true.

      Specified by:
      isProxiedAuthnInstant in interface OIDCAuthenticationRelyingPartyProfileConfiguration
      Parameters:
      profileRequestContext - current profile request context
      Returns:
      whether to proxy across the inbound auth_time

    • setProxiedAuthnInstant

      public void setProxiedAuthnInstant(boolean flag)
      Sets whether authentication results produced by use of this profile should carry the proxied assertion's auth_time from the id_token, rather than the current time.
      Parameters:
      flag - flag to set
      Since:
      2.2.0

    • getMaxAuthenticationAge

      @Nullable public Duration getMaxAuthenticationAge(@Nullable ProfileRequestContext profileRequestContext)
      Get the max authentication age.
      Specified by:
      getMaxAuthenticationAge in interface OIDCAuthenticationProfileConfiguration
      Parameters:
      profileRequestContext - profile request context
      Returns:
      max authentication age

    • setMaxAuthenticationAge

      public void setMaxAuthenticationAge(@Positive @Nonnull Duration age)
      Set the max authentication age.
      Parameters:
      age - the max authentication age
      Since:
      2.2.0

    • setMaxAuthenticationAgeLookupStrategy

      public void setMaxAuthenticationAgeLookupStrategy(@Nonnull Function<ProfileRequestContext,Duration> strategy)
      Set a lookup strategy for the max authentication age.
      Parameters:
      strategy - lookup strategy
      Since:
      2.2.0

    • setLoginHintLookupStrategy

      public void setLoginHintLookupStrategy(@Nonnull Function<ProfileRequestContext,String> strategy)
      Set the lookup strategy for setting the login_hint.
      Parameters:
      strategy - lookup strategy
      Since:
      2.2.0

    • setLoginHint

      public void setLoginHint(@Nonnull @NotEmpty String fixedLoginHint)
      Set a fixed login_hint. Will apply to all requests.
      Parameters:
      fixedLoginHint - the login_hint
      Since:
      2.2.0

    • getLoginHint

      @Nullable public String getLoginHint(@Nullable ProfileRequestContext profileRequestContext)
      Get the login_hint to use.
      Specified by:
      getLoginHint in interface OIDCAuthenticationProfileConfiguration
      Parameters:
      profileRequestContext - profile request context
      Returns:
      the login_hint to use

    • setUserInfoHttpRequestMethodLookupStrategy

      public void setUserInfoHttpRequestMethodLookupStrategy(@Nonnull Function<ProfileRequestContext,String> strategy)
      Set a lookup strategy to determine the HTTP request method for an UserInfo request.
      Parameters:
      strategy - the strategy to set.
      Since:
      2.2.0

    • setUserInfoHttpRequestMethod

      public void setUserInfoHttpRequestMethod(@Nullable OAuth2AuthorizationProfileConfiguration.HttpRequestMethod method)
      Set the HTTP request method for an UserInfo request.
      Parameters:
      method - the HTTP method to set, either POST or GET.
      Since:
      2.2.0

    • getUserInfoHttpRequestMethod

      @Nullable public OAuth2AuthorizationProfileConfiguration.HttpRequestMethod getUserInfoHttpRequestMethod(@Nullable ProfileRequestContext profileRequestContext)
      Get the HTTP request method for the UserInfo request. Both GET and POST are supported.
      Specified by:
      getUserInfoHttpRequestMethod in interface OIDCAuthenticationRelyingPartyProfileConfiguration
      Parameters:
      profileRequestContext - current profile request context
      Returns:
      the UserInfo HTTP request method

    • setResponseModeLookupStrategy

      public void setResponseModeLookupStrategy(@Nonnull Function<ProfileRequestContext,String> strategy)
      Set the lookup strategy to determine the response_mode for authorization requests.
      Parameters:
      strategy - the strategy to use
      Since:
      2.2.0

    • setResponseMode

      public void setResponseMode(@Nonnull String responseMode)
      Set the response_mode to use for authorization requests.
      Parameters:
      responseMode - the response_mode to use
      Since:
      2.2.0

    • getResponseMode

      public String getResponseMode(@Nullable ProfileRequestContext profileRequestContext)
      Get the response_mode to use for authorization requests.
      Specified by:
      getResponseMode in interface OAuth2AuthorizationProfileConfiguration
      Parameters:
      profileRequestContext - the profile request context
      Returns:
      the response_mode

    • setTlsServerValidationSufficient

      public void setTlsServerValidationSufficient(boolean flag)
      Set whether TLS server validation alone is sufficient to verify the id_token (true), or whether the id_token's signature should be validated (false).
      Parameters:
      flag - flag to set
      Since:
      2.2.0

    • setTlsServerValidationSufficient

      public void setTlsServerValidationSufficient(@Nonnull Predicate<ProfileRequestContext> condition)
      Set the predicate to determine whether TLS server validation alone is sufficient to verify the id_token (true), or whether the id_token's signature should be validated (false).
      Parameters:
      condition - condition to set
      Since:
      2.2.0

    • isTlsServerValidationSufficient

      public boolean isTlsServerValidationSufficient(@Nullable ProfileRequestContext profileRequestContext)
      Is TLS server validation of the token endpoint sufficient to verify an id_token without checking the id_token signature.
      Specified by:
      isTlsServerValidationSufficient in interface OIDCAuthenticationRelyingPartyProfileConfiguration
      Parameters:
      profileRequestContext - profile request context
      Returns:
      true if TLS server validation is required to verify the id_token. False if the token signature should be validated.

    • setDisplay

      public void setDisplay(@Nullable String display)
      Set the display parameter value to use.
      Parameters:
      display - the display parameter value
      Since:
      3.1.0

    • setDisplayLookupStrategy

      public void setDisplayLookupStrategy(@Nonnull Function<ProfileRequestContext,String> strategy)
      Set the lookup strategy to determine the display parameter value for authorization requests.
      Parameters:
      strategy - the strategy to use
      Since:
      3.1.0

    • getDisplay

      public String getDisplay(@Nullable ProfileRequestContext profileRequestContext)
      Get the display parameter to use.
      Specified by:
      getDisplay in interface OIDCAuthenticationProfileConfiguration
      Parameters:
      profileRequestContext - profile request context
      Returns:
      the display parameter value

    • getResponseModes

      @Nonnull @NonnullElements @NotLive public Set<String> getResponseModes(@Nullable ProfileRequestContext profileRequestContext)
      Get the response_modes that are allowed to be used in authorization requests.
      Specified by:
      getResponseModes in interface OAuth2AuthorizationProfileConfiguration
      Parameters:
      profileRequestContext - the profile request context
      Returns:
      the response_mode

    • setResponseModes

      public void setResponseModes(@Nullable @NonnullElements Collection<String> responseModes)
      Set the set of response modes that are allowed to be used in authorization request.
      Parameters:
      responseModes - the allowed response modes
      Since:
      3.1.0

    • setResponseModesLookupStrategy

      public void setResponseModesLookupStrategy(@Nonnull Function<ProfileRequestContext,Set<String>> strategy)
      Set a lookup strategy for the set of response modes that are allowed to be used in authorization request.
      Parameters:
      strategy - lookup strategy
      Since:
      3.1.0

    • isRequireAuthenticationRequest

      public boolean isRequireAuthenticationRequest(@Nullable ProfileRequestContext profileRequestContext)
      Get whether client is required to use OIDC authentication request vs plain OAuth2 authorization request.
      Specified by:
      isRequireAuthenticationRequest in interface OAuth2AuthorizationProfileConfiguration
      Parameters:
      profileRequestContext - profile request context
      Returns:
      whether client is required to use OIDC authentication request vs plain OAuth2 authorization request

    • setRequireAuthenticationRequest

      public void setRequireAuthenticationRequest(boolean flag)
      Set whether client is required to use OIDC authentication request vs plain OAuth2 authorization request.
      Parameters:
      flag - flag to set
      Since:
      3.1.0

    • setRequireAuthenticationRequestPredicate

      public void setRequireAuthenticationRequestPredicate(@Nonnull Predicate<ProfileRequestContext> condition)
      Set condition for whether client is required to use OIDC authentication request vs plain OAuth2 authorization request.
      Parameters:
      condition - condition to set
      Since:
      3.1.0

    • setRequireAuthenticationRequestPredicateLookupStrategy

      public void setRequireAuthenticationRequestPredicateLookupStrategy(@Nonnull Function<ProfileRequestContext,Predicate<ProfileRequestContext>> strategy)
      Set the lookup strategy to determine whether client is required to use OIDC authentication request vs plain OAuth2 authorization request.
      Parameters:
      strategy - the strategy to use
      Since:
      3.1.0

    • isRequireDpopJkt

      public boolean isRequireDpopJkt(@Nullable ProfileRequestContext profileRequestContext)
      Get whether client is required to include jkt parameter in authorization requests.
      Specified by:
      isRequireDpopJkt in interface OAuth2AuthorizationProfileConfiguration
      Parameters:
      profileRequestContext - the profile request context
      Returns:
      whether client is required to include jkt parameter in authorization requests

    • setRequireDpopJkt

      public void setRequireDpopJkt(boolean flag)
      Set whether client is required to include dpop_jkt in authorization request.
      Parameters:
      flag - flag to set
      Since:
      3.2.0

    • setRequireDpopJktPredicate

      public void setRequireDpopJktPredicate(@Nonnull Predicate<ProfileRequestContext> condition)
      Set condition for whether client is required to include dpop_jkt in authorization request.
      Parameters:
      condition - condition to set
      Since:
      3.2.0

    • isRequirePushedAuthorizationRequest

      public boolean isRequirePushedAuthorizationRequest(@Nullable ProfileRequestContext profileRequestContext)
      Get whether client is required to use pushed authorization requests. If enabled, then the client needs to call pushed authorization endpoint before authorization endpoint in order to fetch the request_uri to be included in the authorization request.
      Specified by:
      isRequirePushedAuthorizationRequest in interface OAuth2AuthorizationProfileConfiguration
      Parameters:
      profileRequestContext - the profile request context
      Returns:
      whether client is required to use pushed authorization requests.

    • setRequirePushedAuthorizationRequest

      public void setRequirePushedAuthorizationRequest(boolean flag)
      Set whether client is required to use pushed authorization request.
      Parameters:
      flag - flag to set
      Since:
      3.2.0

    • setRequirePushedAuthorizationRequestPredicate

      public void setRequirePushedAuthorizationRequestPredicate(@Nonnull Predicate<ProfileRequestContext> condition)
      Set condition for whether client is required to use pushed authorization request.
      Parameters:
      condition - condition to set
      Since:
      3.2.0