Package net.shibboleth.oidc.profile.config.impl

Class DefaultOIDCUserInfoConfiguration

java.lang.Object

net.shibboleth.shared.component.AbstractInitializableComponent

net.shibboleth.shared.component.AbstractIdentifiedInitializableComponent

net.shibboleth.shared.component.AbstractIdentifiableInitializableComponent

net.shibboleth.profile.config.AbstractProfileConfiguration

net.shibboleth.profile.config.AbstractConditionalProfileConfiguration

net.shibboleth.idp.profile.config.AbstractInterceptorAwareProfileConfiguration

net.shibboleth.oidc.profile.oauth2.config.impl.AbstractOAuth2InterceptorAwareProfileConfiguration

net.shibboleth.oidc.profile.oauth2.config.impl.AbstractOAuth2ClientAuthenticableProfileConfiguration

net.shibboleth.oidc.profile.oauth2.config.impl.AbstractOAuth2TokenValidatingConfiguration

net.shibboleth.oidc.profile.config.impl.DefaultOIDCUserInfoConfiguration

All Implemented Interfaces:

AuthenticationProfileConfiguration, InterceptorAwareProfileConfiguration, OIDCProfileConfiguration, OIDCUserInfoConfiguration, OAuth2ClientAuthenticableClientProfileConfiguration, OAuth2ClientAuthenticableProfileConfiguration, OAuth2DPoPProofValidatingProfileConfiguration, OAuth2InterceptorAwareProfileConfiguration, OAuth2ProfileConfiguration, OAuth2TokenEncryptionProfileConfiguration, OAuth2TokenValidatingProfileConfiguration, AttributeResolvingProfileConfiguration, ConditionalProfileConfiguration, OverriddenIssuerProfileConfiguration, ProfileConfiguration, Component, DestructableComponent, IdentifiableComponent, IdentifiedComponent, InitializableComponent

public class DefaultOIDCUserInfoConfiguration
extends AbstractOAuth2TokenValidatingConfiguration
implements OIDCUserInfoConfiguration

Implementation of a profile configuration for the OpenID Connect core protocol userinfo endpoint.

Field Summary

Fields

Modifier and Type	Field	Description
private Function<ProfileRequestContext,Set<String>>	deniedUserInfoAttributesLookupStrategy	Lookup function to supply attribute IDs to omit from UserInfo token.
private Predicate<ProfileRequestContext>	encryptionOptionalPredicate	Whether encryption is optional in the face of no key, etc.
static final String	PROFILE_COUNTER	OIDC UserInfo profile counter name.
private Predicate<ProfileRequestContext>	resolveAttributesPredicate	Whether attributes should be resolved in the course of the profile.

Fields inherited from interface net.shibboleth.oidc.profile.config.OIDCUserInfoConfiguration

PROFILE_ID, PROTOCOL_URI

Fields inherited from interface net.shibboleth.profile.config.ProfileConfiguration

DEFAULT_DISALLOWED_FEATURES

Constructor Summary

Constructors

Constructor	Description
DefaultOIDCUserInfoConfiguration()	Constructor.
DefaultOIDCUserInfoConfiguration(String profileId)	Creates a new configuration instance.

Method Summary

Modifier and Type	Method	Description
Set<String>	getDeniedUserInfoAttributes(ProfileRequestContext profileRequestContext)	Get the set of attribute IDs which should be omitted from the UserInfo token.
boolean	isEncryptionOptional(ProfileRequestContext profileRequestContext)	Get whether encryption is optional in the face of a missing key, etc.
boolean	isResolveAttributes(ProfileRequestContext profileRequestContext)
void	setDeniedUserInfoAttributes(Collection<String> attributes)	Set the set of attribute IDs which should be omitted from the UserInfo token.
void	setDeniedUserInfoAttributesLookupStrategy(Function<ProfileRequestContext,Set<String>> strategy)	Set a lookup strategy for the set of attribute IDs which should be omitted from the UserInfo token.
void	setEncryptionOptional(boolean flag)	Set whether encryption is optional in the face of a missing key, etc.
void	setEncryptionOptionalPredicate(Predicate<ProfileRequestContext> condition)	Set a condition to determine whether encryption is optional in the face of a missing key, etc.
void	setResolveAttributes(boolean flag)	Set whether attributes should be resolved during the profile.
void	setResolveAttributesPredicate(Predicate<ProfileRequestContext> condition)	Set a condition to determine whether attributes should be resolved during the profile.

Methods inherited from class net.shibboleth.oidc.profile.oauth2.config.impl.AbstractOAuth2TokenValidatingConfiguration

getIssuedClaimsValidator, getIssuer, setIssuedClaimsValidator, setIssuedClaimsValidatorLookupStrategy, setIssuer, setIssuerLookupStrategy

Methods inherited from class net.shibboleth.oidc.profile.oauth2.config.impl.AbstractOAuth2ClientAuthenticableProfileConfiguration

getAuthenticationFlows, getClaimsValidator, getClientCredential, getClientId, getDefaultAuthenticationMethods, getDpopProofClaimsValidator, getDpopProofNonceGenerator, getDpopProofSignatureValidationConfiguration, getPostAuthenticationFlows, getProxyCount, getTokenEndpointAuthMethod, getTokenEndpointAuthMethods, getUnregisteredClientPolicy, isForceAuthn, isRequireDpopProof, setAuthenticationFlows, setAuthenticationFlowsLookupStrategy, setClaimsValidator, setClaimsValidatorLookupStrategy, setClientCredential, setClientCredentialLookupStrategy, setClientId, setClientIdLookupStrategy, setDefaultAuthenticationMethods, setDefaultAuthenticationMethodsLookupStrategy, setDpopProofClaimsValidator, setDpopProofClaimsValidatorLookupStrategy, setDpopProofNonceGenerator, setDpopProofNonceGeneratorLookupStrategy, setDpopProofSignatureValidationConfiguration, setDpopProofSignatureValidationConfigurationLookupStrategy, setForceAuthn, setForceAuthnPredicate, setPostAuthenticationFlows, setPostAuthenticationFlowsLookupStrategy, setProxyCount, setProxyCountLookupStrategy, setRequireDpopProof, setRequireDpopProofPredicate, setTokenEndpointAuthMethod, setTokenEndpointAuthMethodLookupStrategy, setTokenEndpointAuthMethods, setTokenEndpointAuthMethodsLookupStrategy, setUnregisteredClientPolicy, setUnregisteredClientPolicyLookupStrategy

Methods inherited from class net.shibboleth.oidc.profile.oauth2.config.impl.AbstractOAuth2InterceptorAwareProfileConfiguration

getMessageHandler, setMessageHandler, setMessageHandlerLookupStrategy

Methods inherited from class net.shibboleth.idp.profile.config.AbstractInterceptorAwareProfileConfiguration

getInboundInterceptorFlows, getOutboundInterceptorFlows, setInboundInterceptorFlows, setInboundInterceptorFlowsLookupStrategy, setOutboundInterceptorFlows, setOutboundInterceptorFlowsLookupStrategy

Methods inherited from class net.shibboleth.profile.config.AbstractConditionalProfileConfiguration

getActivationCondition, setActivationCondition

Methods inherited from class net.shibboleth.profile.config.AbstractProfileConfiguration

equals, getDisallowedFeatures, getSecurityConfiguration, hashCode, isFeatureDisallowed, setDisallowedFeatures, setDisallowedFeaturesLookupStrategy, setSecurityConfiguration, setSecurityConfigurationLookupStrategy

Methods inherited from class net.shibboleth.shared.component.AbstractIdentifiableInitializableComponent

setId

Methods inherited from class net.shibboleth.shared.component.AbstractIdentifiedInitializableComponent

doInitialize, ensureId, getId, ifDestroyedThrowDestroyedComponentException, ifInitializedThrowUnmodifiabledComponentException, ifNotInitializedThrowUninitializedComponentException

Methods inherited from class net.shibboleth.shared.component.AbstractInitializableComponent

checkComponentActive, checkSetterPreconditions, destroy, doDestroy, initialize, isDestroyed, isInitialized

Methods inherited from class java.lang.Object

clone, finalize, getClass, notify, notifyAll, toString, wait, wait, wait

Methods inherited from interface net.shibboleth.idp.authn.config.AuthenticationProfileConfiguration

getAuthenticationFlows, getDefaultAuthenticationMethods, getPostAuthenticationFlows, getProxyCount, isForceAuthn, isLocal

Methods inherited from interface net.shibboleth.profile.config.ConditionalProfileConfiguration

getActivationCondition

Methods inherited from interface net.shibboleth.shared.component.IdentifiedComponent

getId

Methods inherited from interface net.shibboleth.idp.profile.config.InterceptorAwareProfileConfiguration

getInboundInterceptorFlows, getOutboundInterceptorFlows

Methods inherited from interface net.shibboleth.oidc.profile.oauth2.config.OAuth2ClientAuthenticableProfileConfiguration

getClaimsValidator, getTokenEndpointAuthMethods, getUnregisteredClientPolicy

Methods inherited from interface net.shibboleth.oidc.profile.oauth2.config.OAuth2DPoPProofValidatingProfileConfiguration

getDpopProofClaimsValidator, getDpopProofNonceGenerator, getDpopProofSignatureValidationConfiguration, isRequireDpopProof

Methods inherited from interface net.shibboleth.oidc.profile.oauth2.config.OAuth2TokenValidatingProfileConfiguration

getIssuedClaimsValidator

Methods inherited from interface net.shibboleth.profile.config.OverriddenIssuerProfileConfiguration

getIssuer

Methods inherited from interface net.shibboleth.profile.config.ProfileConfiguration

getDisallowedFeatures, getSecurityConfiguration, isFeatureDisallowed

Field Details

PROFILE_COUNTER

@Nonnull
@NotEmpty
public static final String PROFILE_COUNTER

OIDC UserInfo profile counter name.

See Also:

• Constant Field Values

resolveAttributesPredicate

@Nonnull
private Predicate<ProfileRequestContext> resolveAttributesPredicate

Whether attributes should be resolved in the course of the profile.

encryptionOptionalPredicate

@Nonnull
private Predicate<ProfileRequestContext> encryptionOptionalPredicate

Whether encryption is optional in the face of no key, etc.

deniedUserInfoAttributesLookupStrategy

@Nonnull
private Function<ProfileRequestContext,Set<String>> deniedUserInfoAttributesLookupStrategy

Lookup function to supply attribute IDs to omit from UserInfo token.

Constructor Details

DefaultOIDCUserInfoConfiguration

public DefaultOIDCUserInfoConfiguration()

Constructor.

DefaultOIDCUserInfoConfiguration

public DefaultOIDCUserInfoConfiguration(@Nonnull @NotEmpty
 String profileId)

Creates a new configuration instance.

Parameters:

profileId - Unique profile identifier.

Method Details

isResolveAttributes

public boolean isResolveAttributes(@Nullable
 ProfileRequestContext profileRequestContext)

Specified by:

isResolveAttributes in interface AttributeResolvingProfileConfiguration

setResolveAttributes

public void setResolveAttributes(boolean flag)

Set whether attributes should be resolved during the profile.

Parameters:

flag - flag to set

setResolveAttributesPredicate

public void setResolveAttributesPredicate(@Nonnull
 Predicate<ProfileRequestContext> condition)

Set a condition to determine whether attributes should be resolved during the profile.

Parameters:

condition - condition to set

isEncryptionOptional

public boolean isEncryptionOptional(@Nullable
 ProfileRequestContext profileRequestContext)

Description copied from interface: OAuth2TokenEncryptionProfileConfiguration

Get whether encryption is optional in the face of a missing key, etc.

Specified by:

isEncryptionOptional in interface OAuth2TokenEncryptionProfileConfiguration

Parameters:

profileRequestContext - current profile request context

Returns:

true iff encryption is optional

setEncryptionOptional

public void setEncryptionOptional(boolean flag)

Set whether encryption is optional in the face of a missing key, etc.

Parameters:

flag - flag to set

setEncryptionOptionalPredicate

public void setEncryptionOptionalPredicate(@Nonnull
 Predicate<ProfileRequestContext> condition)

Set a condition to determine whether encryption is optional in the face of a missing key, etc.

Parameters:

condition - condition to set

getDeniedUserInfoAttributes

@Nonnull
@NonnullElements
@NotLive
public Set<String> getDeniedUserInfoAttributes(@Nullable
 ProfileRequestContext profileRequestContext)

Description copied from interface: OIDCUserInfoConfiguration

Get the set of attribute IDs which should be omitted from the UserInfo token.

Default behavior is to include all claims, but omiited claims also affect the set that may need to be embedded for recovery into the access/refresh tokens.

Specified by:

getDeniedUserInfoAttributes in interface OIDCUserInfoConfiguration

Parameters:

profileRequestContext - profile request context

Returns:

the attribute IDs to omit from UserInfo token

setDeniedUserInfoAttributes

public void setDeniedUserInfoAttributes(@Nullable @NonnullElements
 Collection<String> attributes)

Set the set of attribute IDs which should be omitted from the UserInfo token.

Default behavior is to include all claims, but omiited claims also affect the set that may need to be embedded for recovery into the access/refresh tokens.

Parameters:

attributes - the attribute IDs to omit from UserInfo token

setDeniedUserInfoAttributesLookupStrategy

public void setDeniedUserInfoAttributesLookupStrategy(@Nonnull
 Function<ProfileRequestContext,Set<String>> strategy)

Set a lookup strategy for the set of attribute IDs which should be omitted from the UserInfo token.

Parameters:

strategy - lookup strategy