Package net.shibboleth.oidc.profile.impl

Class PopulateJWTEncryptionParameters

java.lang.Object

net.shibboleth.shared.component.AbstractInitializableComponent

org.opensaml.profile.action.AbstractProfileAction

org.opensaml.profile.action.AbstractConditionalProfileAction

net.shibboleth.idp.profile.AbstractProfileAction

net.shibboleth.oidc.profile.impl.PopulateJWTEncryptionParameters

All Implemented Interfaces:

Component, DestructableComponent, InitializableComponent, ProfileAction, Aware, MessageSource, MessageSourceAware, Action

public class PopulateJWTEncryptionParameters
extends AbstractProfileAction

Action that resolves and populates EncryptionParameters on an SecurityParametersContext created/accessed via a lookup function, by default on a child of the outbound message context.

The resolution process is contingent on the active profile configuration requesting encryption.

The default, per-RelyingParty, and default per-profile EncryptionConfiguration objects are input to the resolution process, along with the relying party's client metadata, any static credentials configured on the relying party, and the OpenID Provider metadata (which in most cases will be the source of the eventual encryption key)

Since:

2.2.0

Event:

EventIds.PROCEED_EVENT_ID, EventIds.INVALID_PROFILE_CTX, EventIds.INVALID_SEC_CFG

Postcondition:

set the encryption parameters onto the security parameters context

Field Summary

Fields

Modifier and Type	Field	Description
private Function<ProfileRequestContext,List<EncryptionConfiguration>>	configurationLookupStrategy	Strategy used to look up a per-request EncryptionConfiguration list.
private EncryptionParametersResolver	encParamsresolver	Resolver for parameters to store into context.
private SecurityParametersContext	encryptionContext	Context to populate.
private boolean	encryptionOptional	Whether encryption is optional.
private Predicate<ProfileRequestContext>	encryptionOptionalPredicate	Predicate to determine how to proceed if no encryption parameters are resolved.
private String	forFriendlyName	A friendly name to log as the subject of encryption parameter resolution.
private final org.slf4j.Logger	log	Class logger.
private Function<ProfileRequestContext,OIDCMetadataContext>	oidcClientMetadataContextLookupStrategy	Strategy used to look up a OIDC client metadata context.
private Function<ProfileRequestContext,OIDCProviderMetadataContext>	oidcProviderMetadataContextLookupStrategy	Strategy used to look up a OIDC provider metadata context.
private Function<ProfileRequestContext,RelyingPartyContext>	relyingPartyContextLookupStrategy	Lookup function for relying party context.
private Function<ProfileRequestContext,SecurityParametersContext>	securityParametersContextLookupStrategy	Strategy used to look up the SecurityParametersContext to extract parameters from.

Constructor Summary

Constructors

Constructor	Description
PopulateJWTEncryptionParameters()	Constructor.

Method Summary

Modifier and Type	Method	Description
private CriteriaSet	buildCriteriaSet(ProfileRequestContext profileRequestContext, List<EncryptionConfiguration> encryptionConfigurations)	Build the criteria used as input to the EncryptionParametersResolver.
protected void	doExecute(ProfileRequestContext profileRequestContext)
protected void	doInitialize()
protected boolean	doPreExecute(ProfileRequestContext profileRequestContext)
void	setClientMetadataContextLookupStrategy(Function<ProfileRequestContext,OIDCMetadataContext> strategy)	Set lookup strategy for OIDCMetadataContext for input to resolution.
void	setConfigurationLookupStrategy(Function<ProfileRequestContext,List<EncryptionConfiguration>> strategy)	Set the strategy used to look up a per-request EncryptionConfiguration list.
void	setEncryptionOptional(boolean flag)	Sets the boolean condition to apply to determine how to proceed if encryption parameter resolution fails.
void	setEncryptionOptionalPredicate(Predicate<ProfileRequestContext> condition)	Sets the condition to apply to determine how to proceed if encryption parameter resolution fails.
void	setEncryptionParametersResolver(EncryptionParametersResolver newResolver)	Set the encParamsresolver to use for the parameters to store into the context.
void	setForFriendlyName(String name)	Set the friendly name to log as the subject of encryption parameter resolution.
void	setProviderMetadataContextLookupStrategy(Function<ProfileRequestContext,OIDCProviderMetadataContext> strategy)	Set lookup strategy for OIDCProviderMetadataContext for input to resolution.
void	setRelyingPartyContextLookupStrategy(Function<ProfileRequestContext,RelyingPartyContext> strategy)	Set lookup strategy for relying party context.
void	setSecurityParametersContextLookupStrategy(Function<ProfileRequestContext,SecurityParametersContext> strategy)	Set the lookup strategy to locate the security parameters context.

Methods inherited from class net.shibboleth.idp.profile.AbstractProfileAction

doExecute, execute, getBean, getBean, getMessage, getMessage, getMessage, getParameter, getParameter, getProfileContextLookupStrategy, getRequestContext, getResult, setMessageSource, setProfileContextLookupStrategy

Methods inherited from class org.opensaml.profile.action.AbstractConditionalProfileAction

getActivationCondition, setActivationCondition

Methods inherited from class org.opensaml.profile.action.AbstractProfileAction

doPostExecute, doPostExecute, ensureHttpServletRequest, ensureHttpServletResponse, execute, getHttpServletRequest, getHttpServletRequestSupplier, getHttpServletResponse, getHttpServletResponseSupplier, getLogPrefix, isPreExecuteCalled, setHttpServletRequestSupplier, setHttpServletResponseSupplier

Methods inherited from class net.shibboleth.shared.component.AbstractInitializableComponent

checkComponentActive, checkSetterPreconditions, destroy, doDestroy, ifDestroyedThrowDestroyedComponentException, ifInitializedThrowUnmodifiabledComponentException, ifNotInitializedThrowUninitializedComponentException, initialize, isDestroyed, isInitialized

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Methods inherited from interface net.shibboleth.shared.component.InitializableComponent

initialize, isInitialized

Field Details

log

@Nonnull
private final org.slf4j.Logger log

Class logger.

forFriendlyName

@Nonnull
private String forFriendlyName

A friendly name to log as the subject of encryption parameter resolution.

encryptionOptionalPredicate

@Nonnull
private Predicate<ProfileRequestContext> encryptionOptionalPredicate

Predicate to determine how to proceed if no encryption parameters are resolved.

securityParametersContextLookupStrategy

@Nonnull
private Function<ProfileRequestContext,SecurityParametersContext> securityParametersContextLookupStrategy

Strategy used to look up the SecurityParametersContext to extract parameters from.

configurationLookupStrategy

@NonnullAfterInit
private Function<ProfileRequestContext,List<EncryptionConfiguration>> configurationLookupStrategy

Strategy used to look up a per-request EncryptionConfiguration list.

encParamsresolver

@NonnullAfterInit
private EncryptionParametersResolver encParamsresolver

Resolver for parameters to store into context.

oidcClientMetadataContextLookupStrategy

@Nullable
private Function<ProfileRequestContext,OIDCMetadataContext> oidcClientMetadataContextLookupStrategy

Strategy used to look up a OIDC client metadata context.

oidcProviderMetadataContextLookupStrategy

@Nullable
private Function<ProfileRequestContext,OIDCProviderMetadataContext> oidcProviderMetadataContextLookupStrategy

Strategy used to look up a OIDC provider metadata context.

relyingPartyContextLookupStrategy

@Nonnull
private Function<ProfileRequestContext,RelyingPartyContext> relyingPartyContextLookupStrategy

Lookup function for relying party context.

encryptionOptional

private boolean encryptionOptional

Whether encryption is optional.

encryptionContext

private SecurityParametersContext encryptionContext

Context to populate.

Constructor Details

PopulateJWTEncryptionParameters

public PopulateJWTEncryptionParameters()

Constructor.

Method Details

setRelyingPartyContextLookupStrategy

public void setRelyingPartyContextLookupStrategy(@Nonnull
 Function<ProfileRequestContext,RelyingPartyContext> strategy)

Set lookup strategy for relying party context.

Parameters:

strategy - lookup strategy

setSecurityParametersContextLookupStrategy

public void setSecurityParametersContextLookupStrategy(Function<ProfileRequestContext,SecurityParametersContext> strategy)

Set the lookup strategy to locate the security parameters context.

Parameters:

strategy - the lookup strategy

setClientMetadataContextLookupStrategy

public void setClientMetadataContextLookupStrategy(@Nullable
 Function<ProfileRequestContext,OIDCMetadataContext> strategy)

Set lookup strategy for OIDCMetadataContext for input to resolution.

Parameters:

strategy - lookup strategy

setProviderMetadataContextLookupStrategy

public void setProviderMetadataContextLookupStrategy(@Nullable
 Function<ProfileRequestContext,OIDCProviderMetadataContext> strategy)

Set lookup strategy for OIDCProviderMetadataContext for input to resolution.

Parameters:

strategy - lookup strategy

setForFriendlyName

public void setForFriendlyName(@Nonnull @NotEmpty
 String name)

Set the friendly name to log as the subject of encryption parameter resolution.

Parameters:

name - the friendly name

setConfigurationLookupStrategy

public void setConfigurationLookupStrategy(@Nonnull
 Function<ProfileRequestContext,List<EncryptionConfiguration>> strategy)

Set the strategy used to look up a per-request EncryptionConfiguration list.

Parameters:

strategy - lookup strategy

setEncryptionParametersResolver

public void setEncryptionParametersResolver(@Nonnull
 EncryptionParametersResolver newResolver)

Set the encParamsresolver to use for the parameters to store into the context.

Parameters:

newResolver - encParamsresolver to use

setEncryptionOptionalPredicate

public void setEncryptionOptionalPredicate(@Nonnull
 Predicate<ProfileRequestContext> condition)

Sets the condition to apply to determine how to proceed if encryption parameter resolution fails.

Parameters:

condition - condition to set

setEncryptionOptional

public void setEncryptionOptional(boolean flag)

Sets the boolean condition to apply to determine how to proceed if encryption parameter resolution fails.

Parameters:

flag - the flag to set

doInitialize

protected void doInitialize()
                     throws ComponentInitializationException

Overrides:

doInitialize in class AbstractInitializableComponent

Throws:

ComponentInitializationException

doPreExecute

protected boolean doPreExecute(@Nonnull
 ProfileRequestContext profileRequestContext)

Overrides:

doPreExecute in class AbstractConditionalProfileAction

doExecute

protected void doExecute(@Nonnull
 ProfileRequestContext profileRequestContext)

Overrides:

doExecute in class AbstractProfileAction

buildCriteriaSet

@Nonnull
private CriteriaSet buildCriteriaSet(@Nonnull
 ProfileRequestContext profileRequestContext,
 @Nonnull
 List<EncryptionConfiguration> encryptionConfigurations)

Build the criteria used as input to the EncryptionParametersResolver.

Parameters:

profileRequestContext - current profile request context

encryptionConfigurations - active configurations

Returns:

the criteria set to use