Package net.shibboleth.oidc.profile.oauth2.config.impl

Class AbstractOAuth2ClientAuthenticableProfileConfiguration

java.lang.Object

net.shibboleth.shared.component.AbstractInitializableComponent

net.shibboleth.shared.component.AbstractIdentifiedInitializableComponent

net.shibboleth.shared.component.AbstractIdentifiableInitializableComponent

net.shibboleth.profile.config.AbstractProfileConfiguration

net.shibboleth.profile.config.AbstractConditionalProfileConfiguration

net.shibboleth.idp.profile.config.AbstractInterceptorAwareProfileConfiguration

net.shibboleth.oidc.profile.oauth2.config.impl.AbstractOAuth2InterceptorAwareProfileConfiguration

net.shibboleth.oidc.profile.oauth2.config.impl.AbstractOAuth2ClientAuthenticableProfileConfiguration

All Implemented Interfaces:

AuthenticationProfileConfiguration, InterceptorAwareProfileConfiguration, OAuth2ClientAuthenticableClientProfileConfiguration, OAuth2ClientAuthenticableProfileConfiguration, OAuth2DPoPProofValidatingProfileConfiguration, OAuth2InterceptorAwareProfileConfiguration, OAuth2ProfileConfiguration, ConditionalProfileConfiguration, ProfileConfiguration, Component, DestructableComponent, IdentifiableComponent, IdentifiedComponent, InitializableComponent

Direct Known Subclasses:

AbstractOAuth2FlowAwareProfileConfiguration, AbstractOAuth2TokenValidatingConfiguration

public abstract class AbstractOAuth2ClientAuthenticableProfileConfiguration
extends AbstractOAuth2InterceptorAwareProfileConfiguration
implements OAuth2ClientAuthenticableProfileConfiguration, OAuth2ClientAuthenticableClientProfileConfiguration

Base class for OAuth profile configurations that support OAuth-defined client authentication methods.

Field Summary

Fields

Modifier and Type	Field	Description
private Function<ProfileRequestContext,Set<String>>	authenticationFlowsLookupStrategy	Lookup function to supply authentication flows.
private Function<ProfileRequestContext,ClaimsValidator>	claimsValidatorLookupStrategy	Validation of JWT claims for subset of client auth methods.
private Function<ProfileRequestContext,ClientSecretCredential>	clientCredentialLookupStrategy	Lookup function to retrieve a client credential from the given profile request context.
private Function<ProfileRequestContext,String>	clientIdLookupStrategy	Lookup function to retrieve the client_id from the given profile request context.
private Function<ProfileRequestContext,Collection<Principal>>	defaultAuthenticationContextsLookupStrategy	Lookup function to supply default authentication methods.
private Function<ProfileRequestContext,ClaimsValidator>	dpopProofClaimsValidatorLookupStrategy	Validation of JWT claims for DPoP proofs.
private Function<ProfileRequestContext,Function<ProfileRequestContext,String>>	dpopProofNonceGeneratorLookupStrategy	Lookup function to retrieve nonce generator for DPoP proofs.
private Function<ProfileRequestContext,SignatureValidationConfiguration>	dpopSignatureValidationConfigurationLookupStrategy	Validation of JWT signature of DPoP proofs.
private Predicate<ProfileRequestContext>	forceAuthnPredicate	Whether to mandate forced authentication for the request.
private Function<ProfileRequestContext,Collection<String>>	postAuthenticationFlowsLookupStrategy	Lookup function to supply post authentication flows.
private Function<ProfileRequestContext,Integer>	proxyCountLookupStrategy	Lookup function to supply proxyCount property.
private Predicate<ProfileRequestContext>	requireDpopProofPredicate	Whether client is required to include DPoP Proof JWT in API request.
private Function<ProfileRequestContext,String>	tokenEndpointAuthMethodLookupStrategy	The token endpoint authentication method to use with an upstream OpenID Provider.
private Function<ProfileRequestContext,Set<String>>	tokenEndpointAuthMethodsLookupStrategy	Enabled token endpoint authentication methods.
private Function<ProfileRequestContext,Map<String,UnregisteredClientPolicy>>	unregisteredClientPolicyLookupStrategy	Lookup function to retrieve the policy for validating claims of an unregistered client.

Fields inherited from interface net.shibboleth.profile.config.ProfileConfiguration

DEFAULT_DISALLOWED_FEATURES

Constructor Summary

Constructors

Modifier	Constructor	Description
protected	AbstractOAuth2ClientAuthenticableProfileConfiguration(String profileId)	Constructor.

Method Summary

Modifier and Type	Method	Description
Set<String>	getAuthenticationFlows(ProfileRequestContext profileRequestContext)
ClaimsValidator	getClaimsValidator(ProfileRequestContext profileRequestContext)	Get the ClaimsValidator to apply to JWT-based client authentication.
ClientSecretCredential	getClientCredential(ProfileRequestContext profileRequestContext)	Get the client credential for the given context.
String	getClientId(ProfileRequestContext profileRequestContext)	Get the client_id appropriate for the given context.
List<Principal>	getDefaultAuthenticationMethods(ProfileRequestContext profileRequestContext)
ClaimsValidator	getDpopProofClaimsValidator(ProfileRequestContext profileRequestContext)	Get the ClaimsValidator to apply to DPoP Proof JWTs being validated by this profile.
Function<ProfileRequestContext,String>	getDpopProofNonceGenerator(ProfileRequestContext profileRequestContext)	Get the Function to create nonces to be used with DPoP Proof JWTs.
SignatureValidationConfiguration	getDpopProofSignatureValidationConfiguration(ProfileRequestContext profileRequestContext)	Get the SignatureValidationConfiguration to be used for DPoP Proof JWT signature validation.
List<String>	getPostAuthenticationFlows(ProfileRequestContext profileRequestContext)
Integer	getProxyCount(ProfileRequestContext profileRequestContext)
String	getTokenEndpointAuthMethod(ProfileRequestContext profileRequestContext)	Get the token endpoint authentication method to use with an OpenID Provider.
Set<String>	getTokenEndpointAuthMethods(ProfileRequestContext profileRequestContext)	Get the enabled token endpoint authentication methods.
Map<String,UnregisteredClientPolicy>	getUnregisteredClientPolicy(ProfileRequestContext profileRequestContext)	Get the policy for validating unregistered clients.
boolean	isForceAuthn(ProfileRequestContext profileRequestContext)
boolean	isRequireDpopProof(ProfileRequestContext profileRequestContext)	Get whether client is required to include DPoP Proof JWT in request.
void	setAuthenticationFlows(Collection<String> flows)	Set the authentication flows to use.
void	setAuthenticationFlowsLookupStrategy(Function<ProfileRequestContext,Set<String>> strategy)	Set a lookup strategy for the authentication flows to use.
void	setClaimsValidator(ClaimsValidator validator)	Set the ClaimsValidator to apply to JWT-based client authentication.
void	setClaimsValidatorLookupStrategy(Function<ProfileRequestContext,ClaimsValidator> strategy)	Set a lookup strategy for the ClaimsValidator to apply to JWT-based client authentication.
void	setClientCredential(ClientSecretCredential clientCredential)	Set a fixed client credential to use no matter what the context/request.
void	setClientCredentialLookupStrategy(Function<ProfileRequestContext,ClientSecretCredential> strategy)	Set the client credential lookup strategy.
void	setClientId(String clientId)	Set a fixed client_id to use no matter what the context/request.
void	setClientIdLookupStrategy(Function<ProfileRequestContext,String> strategy)	Set the strategy to locate a client_id.
void	setDefaultAuthenticationMethods(Collection<Principal> contexts)	Set the default authentication contexts to use, expressed as custom principals.
void	setDefaultAuthenticationMethodsLookupStrategy(Function<ProfileRequestContext,Collection<Principal>> strategy)	Set a lookup strategy for the authentication contexts to use, expressed as custom principals.
void	setDpopProofClaimsValidator(ClaimsValidator validator)	Set the ClaimsValidator to apply to DPoP Proof JWT.
void	setDpopProofClaimsValidatorLookupStrategy(Function<ProfileRequestContext,ClaimsValidator> strategy)	Set a lookup strategy for the ClaimsValidator to apply to DPoP Proof JWT.
void	setDpopProofNonceGenerator(Function<ProfileRequestContext,String> function)	Set the Function to create nonces to be used with DPoP Proof JWTs.
void	setDpopProofNonceGeneratorLookupStrategy(Function<ProfileRequestContext,Function<ProfileRequestContext,String>> strategy)	Set a lookup strategy for the Function to create nonces to be used with DPoP Proof JWTs.
void	setDpopProofSignatureValidationConfiguration(SignatureValidationConfiguration configuration)	Set the SignatureValidationConfiguration to validate the DPoP Proof JWT signatures.
void	setDpopProofSignatureValidationConfigurationLookupStrategy(Function<ProfileRequestContext,SignatureValidationConfiguration> strategy)	Set a lookup strategy for the SignatureValidationConfiguration to validate the DPoP Proof JWT signatures.
void	setForceAuthn(boolean flag)	Set whether a fresh user presence proof should be required for this request.
void	setForceAuthnPredicate(Predicate<ProfileRequestContext> condition)	Set a condition to determine whether a fresh user presence proof should be required for this request.
void	setPostAuthenticationFlows(Collection<String> flows)	Set the ordered collection of post-authentication interceptor flows to enable.
void	setPostAuthenticationFlowsLookupStrategy(Function<ProfileRequestContext,Collection<String>> strategy)	Set a lookup strategy for the post-authentication interceptor flows to enable.
void	setProxyCount(Integer count)	Sets the maximum number of times an assertion may be proxied outbound and/or the maximum number of hops between the relying party and a proxied authentication authority inbound.
void	setProxyCountLookupStrategy(Function<ProfileRequestContext,Integer> strategy)	Set a lookup strategy for the maximum number of times an assertion may be proxied outbound and/or the maximum number of hops between the relying party and a proxied authentication authority inbound.
void	setRequireDpopProof(boolean flag)	Set whether client is required to include DPoP proof in request.
void	setRequireDpopProofPredicate(Predicate<ProfileRequestContext> condition)	Set condition for whether client is required to include DPoP proof in request.
void	setTokenEndpointAuthMethod(String method)	Set the enabled token endpoint authentication method to use with an upstream OpenID Provider.
void	setTokenEndpointAuthMethodLookupStrategy(Function<ProfileRequestContext,String> strategy)	Set a lookup strategy to find the enabled token endpoint authentication method to use with an upstream OpenID Provider.
void	setTokenEndpointAuthMethods(Collection<String> methods)	Set the enabled token endpoint authentication methods.
void	setTokenEndpointAuthMethodsLookupStrategy(Function<ProfileRequestContext,Set<String>> strategy)	Set a lookup strategy for the enabled token endpoint authentication methods.
void	setUnregisteredClientPolicy(Map<String,UnregisteredClientPolicy> policy)	Sets the policy for validating unregistered clients.
void	setUnregisteredClientPolicyLookupStrategy(Function<ProfileRequestContext,Map<String,UnregisteredClientPolicy>> strategy)	Set a lookup strategy for the policy for validating unregistered clients.

Methods inherited from class net.shibboleth.oidc.profile.oauth2.config.impl.AbstractOAuth2InterceptorAwareProfileConfiguration

getMessageHandler, setMessageHandler, setMessageHandlerLookupStrategy

Methods inherited from class net.shibboleth.idp.profile.config.AbstractInterceptorAwareProfileConfiguration

getInboundInterceptorFlows, getOutboundInterceptorFlows, setInboundInterceptorFlows, setInboundInterceptorFlowsLookupStrategy, setOutboundInterceptorFlows, setOutboundInterceptorFlowsLookupStrategy

Methods inherited from class net.shibboleth.profile.config.AbstractConditionalProfileConfiguration

getActivationCondition, setActivationCondition

Methods inherited from class net.shibboleth.profile.config.AbstractProfileConfiguration

equals, getDisallowedFeatures, getSecurityConfiguration, hashCode, isFeatureDisallowed, setDisallowedFeatures, setDisallowedFeaturesLookupStrategy, setSecurityConfiguration, setSecurityConfigurationLookupStrategy

Methods inherited from class net.shibboleth.shared.component.AbstractIdentifiableInitializableComponent

setId

Methods inherited from class net.shibboleth.shared.component.AbstractIdentifiedInitializableComponent

doInitialize, ensureId, getId, ifDestroyedThrowDestroyedComponentException, ifInitializedThrowUnmodifiabledComponentException, ifNotInitializedThrowUninitializedComponentException

Methods inherited from class net.shibboleth.shared.component.AbstractInitializableComponent

checkComponentActive, checkSetterPreconditions, destroy, doDestroy, initialize, isDestroyed, isInitialized

Methods inherited from class java.lang.Object

clone, finalize, getClass, notify, notifyAll, toString, wait, wait, wait

Methods inherited from interface net.shibboleth.idp.authn.config.AuthenticationProfileConfiguration

isLocal

Methods inherited from interface net.shibboleth.profile.config.ConditionalProfileConfiguration

getActivationCondition

Methods inherited from interface net.shibboleth.shared.component.IdentifiedComponent

getId

Methods inherited from interface net.shibboleth.idp.profile.config.InterceptorAwareProfileConfiguration

getInboundInterceptorFlows, getOutboundInterceptorFlows

Methods inherited from interface net.shibboleth.profile.config.ProfileConfiguration

getDisallowedFeatures, getSecurityConfiguration, isFeatureDisallowed

Field Details

tokenEndpointAuthMethodsLookupStrategy

@Nonnull
private Function<ProfileRequestContext,Set<String>> tokenEndpointAuthMethodsLookupStrategy

Enabled token endpoint authentication methods.

tokenEndpointAuthMethodLookupStrategy

@Nonnull
private Function<ProfileRequestContext,String> tokenEndpointAuthMethodLookupStrategy

The token endpoint authentication method to use with an upstream OpenID Provider.

claimsValidatorLookupStrategy

@Nonnull
private Function<ProfileRequestContext,ClaimsValidator> claimsValidatorLookupStrategy

Validation of JWT claims for subset of client auth methods.

forceAuthnPredicate

@Nonnull
private Predicate<ProfileRequestContext> forceAuthnPredicate

Whether to mandate forced authentication for the request.

proxyCountLookupStrategy

@Nonnull
private Function<ProfileRequestContext,Integer> proxyCountLookupStrategy

Lookup function to supply proxyCount property.

defaultAuthenticationContextsLookupStrategy

@Nonnull
private Function<ProfileRequestContext,Collection<Principal>> defaultAuthenticationContextsLookupStrategy

Lookup function to supply default authentication methods.

authenticationFlowsLookupStrategy

@Nonnull
private Function<ProfileRequestContext,Set<String>> authenticationFlowsLookupStrategy

Lookup function to supply authentication flows.

postAuthenticationFlowsLookupStrategy

@Nonnull
private Function<ProfileRequestContext,Collection<String>> postAuthenticationFlowsLookupStrategy

Lookup function to supply post authentication flows.

clientCredentialLookupStrategy

@Nonnull
private Function<ProfileRequestContext,ClientSecretCredential> clientCredentialLookupStrategy

Lookup function to retrieve a client credential from the given profile request context.

clientIdLookupStrategy

@Nonnull
private Function<ProfileRequestContext,String> clientIdLookupStrategy

Lookup function to retrieve the client_id from the given profile request context.

unregisteredClientPolicyLookupStrategy

@Nonnull
private Function<ProfileRequestContext,Map<String,UnregisteredClientPolicy>> unregisteredClientPolicyLookupStrategy

Lookup function to retrieve the policy for validating claims of an unregistered client.

dpopProofClaimsValidatorLookupStrategy

@Nonnull
private Function<ProfileRequestContext,ClaimsValidator> dpopProofClaimsValidatorLookupStrategy

Validation of JWT claims for DPoP proofs.

dpopSignatureValidationConfigurationLookupStrategy

@Nonnull
private Function<ProfileRequestContext,SignatureValidationConfiguration> dpopSignatureValidationConfigurationLookupStrategy

Validation of JWT signature of DPoP proofs.

requireDpopProofPredicate

@Nonnull
private Predicate<ProfileRequestContext> requireDpopProofPredicate

Whether client is required to include DPoP Proof JWT in API request.

dpopProofNonceGeneratorLookupStrategy

@Nonnull
private Function<ProfileRequestContext,Function<ProfileRequestContext,String>> dpopProofNonceGeneratorLookupStrategy

Lookup function to retrieve nonce generator for DPoP proofs.

Constructor Details

AbstractOAuth2ClientAuthenticableProfileConfiguration

protected AbstractOAuth2ClientAuthenticableProfileConfiguration(@Nonnull @NotEmpty
 String profileId)

Constructor.

Parameters:

profileId - Unique profile identifier

Method Details

getTokenEndpointAuthMethods

@Nonnull
@NonnullElements
@NotLive
@Unmodifiable
public Set<String> getTokenEndpointAuthMethods(@Nullable
 ProfileRequestContext profileRequestContext)

Get the enabled token endpoint authentication methods.

Specified by:

getTokenEndpointAuthMethods in interface OAuth2ClientAuthenticableProfileConfiguration

Parameters:

profileRequestContext - profile request context

Returns:

enabled token endpoint authentication methods

setTokenEndpointAuthMethods

public void setTokenEndpointAuthMethods(@Nonnull @NonnullElements
 Collection<String> methods)

Set the enabled token endpoint authentication methods.

Parameters:

methods - What to set.

setTokenEndpointAuthMethodsLookupStrategy

public void setTokenEndpointAuthMethodsLookupStrategy(@Nonnull
 Function<ProfileRequestContext,Set<String>> strategy)

Set a lookup strategy for the enabled token endpoint authentication methods.

Parameters:

strategy - lookup strategy

getTokenEndpointAuthMethod

@Nullable
public String getTokenEndpointAuthMethod(@Nullable
 ProfileRequestContext profileRequestContext)

Get the token endpoint authentication method to use with an OpenID Provider.

Specified by:

getTokenEndpointAuthMethod in interface OAuth2ClientAuthenticableClientProfileConfiguration

Parameters:

profileRequestContext - the profile request context

Returns:

the token endpoint authentication method to use.

setTokenEndpointAuthMethod

public void setTokenEndpointAuthMethod(@Nonnull @NonnullElements
 String method)

Set the enabled token endpoint authentication method to use with an upstream OpenID Provider.

Parameters:

method - the token endpoint authentication method to set.

Since:

2.2.0

setTokenEndpointAuthMethodLookupStrategy

public void setTokenEndpointAuthMethodLookupStrategy(@Nonnull
 Function<ProfileRequestContext,String> strategy)

Set a lookup strategy to find the enabled token endpoint authentication method to use with an upstream OpenID Provider.

Parameters:

strategy - lookup strategy

Since:

2.2.0

getClaimsValidator

@Nullable
public ClaimsValidator getClaimsValidator(@Nullable
 ProfileRequestContext profileRequestContext)

Get the ClaimsValidator to apply to JWT-based client authentication.

Specified by:

getClaimsValidator in interface OAuth2ClientAuthenticableProfileConfiguration

Parameters:

profileRequestContext - current profile request context

Returns:

the validator to use

Since:

3.1.0

setClaimsValidator

public void setClaimsValidator(@Nullable
 ClaimsValidator validator)

Set the ClaimsValidator to apply to JWT-based client authentication.

Parameters:

validator - validator to use

Since:

3.1.0

setClaimsValidatorLookupStrategy

public void setClaimsValidatorLookupStrategy(@Nonnull
 Function<ProfileRequestContext,ClaimsValidator> strategy)

Set a lookup strategy for the ClaimsValidator to apply to JWT-based client authentication.

Parameters:

strategy - lookup strategy

Since:

3.1.0

isForceAuthn

public boolean isForceAuthn(@Nullable
 ProfileRequestContext profileRequestContext)

Specified by:

isForceAuthn in interface AuthenticationProfileConfiguration

setForceAuthn

public void setForceAuthn(boolean flag)

Set whether a fresh user presence proof should be required for this request.

Parameters:

flag - flag to set

setForceAuthnPredicate

public void setForceAuthnPredicate(@Nonnull
 Predicate<ProfileRequestContext> condition)

Set a condition to determine whether a fresh user presence proof should be required for this request.

Parameters:

condition - condition to set

getProxyCount

@Nullable
public Integer getProxyCount(@Nullable
 ProfileRequestContext profileRequestContext)

Specified by:

getProxyCount in interface AuthenticationProfileConfiguration

setProxyCount

public void setProxyCount(@Nullable @NonNegative
 Integer count)

Sets the maximum number of times an assertion may be proxied outbound and/or the maximum number of hops between the relying party and a proxied authentication authority inbound.

Parameters:

count - proxy count

setProxyCountLookupStrategy

public void setProxyCountLookupStrategy(@Nonnull
 Function<ProfileRequestContext,Integer> strategy)

Set a lookup strategy for the maximum number of times an assertion may be proxied outbound and/or the maximum number of hops between the relying party and a proxied authentication authority inbound.

Parameters:

strategy - lookup strategy

getAuthenticationFlows

@Nonnull
@NonnullElements
@NotLive
@Unmodifiable
public Set<String> getAuthenticationFlows(@Nullable
 ProfileRequestContext profileRequestContext)

Specified by:

getAuthenticationFlows in interface AuthenticationProfileConfiguration

setAuthenticationFlows

public void setAuthenticationFlows(@Nullable @NonnullElements
 Collection<String> flows)

Set the authentication flows to use.

Parameters:

flows - flow identifiers to use

setAuthenticationFlowsLookupStrategy

public void setAuthenticationFlowsLookupStrategy(@Nonnull
 Function<ProfileRequestContext,Set<String>> strategy)

Set a lookup strategy for the authentication flows to use.

Parameters:

strategy - lookup strategy

getPostAuthenticationFlows

@Nonnull
@NonnullElements
@NotLive
@Unmodifiable
public List<String> getPostAuthenticationFlows(@Nullable
 ProfileRequestContext profileRequestContext)

Specified by:

getPostAuthenticationFlows in interface AuthenticationProfileConfiguration

setPostAuthenticationFlows

public void setPostAuthenticationFlows(@Nullable @NonnullElements
 Collection<String> flows)

Set the ordered collection of post-authentication interceptor flows to enable.

Parameters:

flows - flow identifiers to enable

setPostAuthenticationFlowsLookupStrategy

public void setPostAuthenticationFlowsLookupStrategy(@Nonnull
 Function<ProfileRequestContext,Collection<String>> strategy)

Set a lookup strategy for the post-authentication interceptor flows to enable.

Parameters:

strategy - lookup strategy

getDefaultAuthenticationMethods

@Nonnull
@NonnullElements
@NotLive
@Unmodifiable
public List<Principal> getDefaultAuthenticationMethods(@Nullable
 ProfileRequestContext profileRequestContext)

Specified by:

getDefaultAuthenticationMethods in interface AuthenticationProfileConfiguration

setDefaultAuthenticationMethods

public void setDefaultAuthenticationMethods(@Nullable @NonnullElements
 Collection<Principal> contexts)

Set the default authentication contexts to use, expressed as custom principals.

Parameters:

contexts - default authentication contexts to use

setDefaultAuthenticationMethodsLookupStrategy

public void setDefaultAuthenticationMethodsLookupStrategy(@Nonnull
 Function<ProfileRequestContext,Collection<Principal>> strategy)

Set a lookup strategy for the authentication contexts to use, expressed as custom principals.

Parameters:

strategy - lookup strategy

setClientCredentialLookupStrategy

public void setClientCredentialLookupStrategy(@Nonnull
 Function<ProfileRequestContext,ClientSecretCredential> strategy)

Set the client credential lookup strategy.

Parameters:

strategy - the strategy to use

Since:

2.2.0

setClientCredential

public void setClientCredential(@Nullable
 ClientSecretCredential clientCredential)

Set a fixed client credential to use no matter what the context/request.

Parameters:

clientCredential - the static client credential to use

Since:

2.2.0

getClientCredential

public ClientSecretCredential getClientCredential(@Nullable
 ProfileRequestContext profileRequestContext)

Get the client credential for the given context. Typically a client_secret associated with the current client_id.

Specified by:

getClientCredential in interface OAuth2ClientAuthenticableClientProfileConfiguration

Parameters:

profileRequestContext - the profile request context

Returns:

the client credential

setClientIdLookupStrategy

public void setClientIdLookupStrategy(@Nonnull
 Function<ProfileRequestContext,String> strategy)

Set the strategy to locate a client_id.

Parameters:

strategy - the strategy to use

Since:

2.2.0

setClientId

public void setClientId(@Nullable
 String clientId)

Set a fixed client_id to use no matter what the context/request.

Parameters:

clientId - the static clientId to use

Since:

2.2.0

getClientId

@Nullable
public String getClientId(@Nullable
 ProfileRequestContext profileRequestContext)

Get the client_id appropriate for the given context. Typically that associated with the chosen OpenID Connect Provider.

Specified by:

getClientId in interface OAuth2ClientAuthenticableClientProfileConfiguration

Parameters:

profileRequestContext - the profile request context

Returns:

the client_id

getUnregisteredClientPolicy

@Nonnull
@Unmodifiable
public Map<String,UnregisteredClientPolicy> getUnregisteredClientPolicy(@Nullable
 ProfileRequestContext profileRequestContext)

Get the policy for validating unregistered clients.

Specified by:

getUnregisteredClientPolicy in interface OAuth2ClientAuthenticableProfileConfiguration

Parameters:

profileRequestContext - profile request context

Returns:

the map of policies for validating claims of an unregistered client

setUnregisteredClientPolicy

public void setUnregisteredClientPolicy(@Nullable
 Map<String,UnregisteredClientPolicy> policy)

Sets the policy for validating unregistered clients.

Parameters:

policy - policy to set

Since:

3.0.0

setUnregisteredClientPolicyLookupStrategy

public void setUnregisteredClientPolicyLookupStrategy(@Nonnull
 Function<ProfileRequestContext,Map<String,UnregisteredClientPolicy>> strategy)

Set a lookup strategy for the policy for validating unregistered clients.

Parameters:

strategy - lookup strategy

Since:

3.0.0

getDpopProofClaimsValidator

@Nullable
public ClaimsValidator getDpopProofClaimsValidator(@Nullable
 ProfileRequestContext profileRequestContext)

Get the ClaimsValidator to apply to DPoP Proof JWTs being validated by this profile.

Specified by:

getDpopProofClaimsValidator in interface OAuth2DPoPProofValidatingProfileConfiguration

Parameters:

profileRequestContext - current profile request context

Returns:

the validator to use

setDpopProofClaimsValidator

public void setDpopProofClaimsValidator(@Nullable
 ClaimsValidator validator)

Set the ClaimsValidator to apply to DPoP Proof JWT.

Parameters:

validator - validator to use

Since:

3.2.0

setDpopProofClaimsValidatorLookupStrategy

public void setDpopProofClaimsValidatorLookupStrategy(@Nonnull
 Function<ProfileRequestContext,ClaimsValidator> strategy)

Set a lookup strategy for the ClaimsValidator to apply to DPoP Proof JWT.

Parameters:

strategy - lookup strategy

Since:

3.2.0

getDpopProofSignatureValidationConfiguration

@Nullable
public SignatureValidationConfiguration getDpopProofSignatureValidationConfiguration(@Nullable
 ProfileRequestContext profileRequestContext)

Get the SignatureValidationConfiguration to be used for DPoP Proof JWT signature validation.

Specified by:

getDpopProofSignatureValidationConfiguration in interface OAuth2DPoPProofValidatingProfileConfiguration

Parameters:

profileRequestContext - current profile request context

Returns:

the signature validation configuration to use

setDpopProofSignatureValidationConfiguration

public void setDpopProofSignatureValidationConfiguration(@Nullable
 SignatureValidationConfiguration configuration)

Set the SignatureValidationConfiguration to validate the DPoP Proof JWT signatures.

Parameters:

configuration - configuration to use

Since:

3.2.0

setDpopProofSignatureValidationConfigurationLookupStrategy

public void setDpopProofSignatureValidationConfigurationLookupStrategy(@Nonnull
 Function<ProfileRequestContext,SignatureValidationConfiguration> strategy)

Set a lookup strategy for the SignatureValidationConfiguration to validate the DPoP Proof JWT signatures.

Parameters:

strategy - lookup strategy

Since:

3.2.0

isRequireDpopProof

public boolean isRequireDpopProof(@Nullable
 ProfileRequestContext profileRequestContext)

Get whether client is required to include DPoP Proof JWT in request.

Specified by:

isRequireDpopProof in interface OAuth2DPoPProofValidatingProfileConfiguration

Parameters:

profileRequestContext - the profile request context

Returns:

whether client is required to include DPoP Proof JWT in request

setRequireDpopProof

public void setRequireDpopProof(boolean flag)

Set whether client is required to include DPoP proof in request.

Parameters:

flag - flag to set

Since:

3.2.0

setRequireDpopProofPredicate

public void setRequireDpopProofPredicate(@Nonnull
 Predicate<ProfileRequestContext> condition)

Set condition for whether client is required to include DPoP proof in request.

Parameters:

condition - condition to set

Since:

3.2.0

getDpopProofNonceGenerator

@Nullable
public Function<ProfileRequestContext,String> getDpopProofNonceGenerator(@Nullable
 ProfileRequestContext profileRequestContext)

Get the Function to create nonces to be used with DPoP Proof JWTs.

Specified by:

getDpopProofNonceGenerator in interface OAuth2DPoPProofValidatingProfileConfiguration

Parameters:

profileRequestContext - current profile request context

Returns:

the nonce generator to use

setDpopProofNonceGenerator

public void setDpopProofNonceGenerator(@Nullable
 Function<ProfileRequestContext,String> function)

Set the Function to create nonces to be used with DPoP Proof JWTs.

Parameters:

function - generator function to use

Since:

3.2.0

setDpopProofNonceGeneratorLookupStrategy

public void setDpopProofNonceGeneratorLookupStrategy(@Nonnull
 Function<ProfileRequestContext,Function<ProfileRequestContext,String>> strategy)

Set a lookup strategy for the Function to create nonces to be used with DPoP Proof JWTs.

Parameters:

strategy - lookup strategy

Since:

3.2.0