Package net.shibboleth.oidc.profile.oauth2.config.impl

Class DefaultOAuth2TokenAudienceConfiguration

java.lang.Object

net.shibboleth.shared.component.AbstractInitializableComponent

net.shibboleth.shared.component.AbstractIdentifiedInitializableComponent

net.shibboleth.shared.component.AbstractIdentifiableInitializableComponent

net.shibboleth.profile.config.AbstractProfileConfiguration

net.shibboleth.profile.config.AbstractConditionalProfileConfiguration

net.shibboleth.idp.profile.config.AbstractInterceptorAwareProfileConfiguration

net.shibboleth.oidc.profile.oauth2.config.impl.AbstractOAuth2InterceptorAwareProfileConfiguration

net.shibboleth.oidc.profile.oauth2.config.impl.DefaultOAuth2TokenAudienceConfiguration

All Implemented Interfaces:

InterceptorAwareProfileConfiguration, OIDCProfileConfiguration, OAuth2AccessTokenProducingProfileConfiguration, OAuth2InterceptorAwareProfileConfiguration, OAuth2ProfileConfiguration, OAuth2TokenAudienceConfiguration, OAuth2TokenEncryptionProfileConfiguration, AttributeResolvingProfileConfiguration, ConditionalProfileConfiguration, OverriddenIssuerProfileConfiguration, ProfileConfiguration, Component, DestructableComponent, IdentifiableComponent, IdentifiedComponent, InitializableComponent

public class DefaultOAuth2TokenAudienceConfiguration
extends AbstractOAuth2InterceptorAwareProfileConfiguration
implements OAuth2TokenAudienceConfiguration

Implementation of an OAuth 2.0 token "audience" profile configuration.

Field Summary

Fields

Modifier and Type	Field	Description
private Function<ProfileRequestContext,BiFunction<ProfileRequestContext,Map<String,Object>,Map<String,Object>>>	accessTokenClaimsSetManipulationStrategyLookupStrategy	Lookup function to supply strategy bi-function for manipulating access token claims set.
private Function<ProfileRequestContext,Duration>	accessTokenLifetimeLookupStrategy	Lookup function to supply access token lifetime.
private Function<ProfileRequestContext,String>	accessTokenTypeLookupStrategy	Lookup functioon to supply access token type.
private Predicate<ProfileRequestContext>	alwaysIssueBearerAccessTokenPredicate	Whether the access token to be issued is always a bearer access token.
private Predicate<ProfileRequestContext>	encryptionOptionalPredicate	Whether encryption is optional in the face of no key, etc.
private Function<ProfileRequestContext,String>	issuerLookupStrategy	Lookup function to override issuer value.
private Predicate<ProfileRequestContext>	resolveAttributesPredicate	Whether attributes should be resolved in the course of the profile.

Fields inherited from interface net.shibboleth.oidc.profile.oauth2.config.OAuth2TokenAudienceConfiguration

PROFILE_ID, PROTOCOL_URI

Fields inherited from interface net.shibboleth.profile.config.ProfileConfiguration

DEFAULT_DISALLOWED_FEATURES

Constructor Summary

Constructors

Constructor	Description
DefaultOAuth2TokenAudienceConfiguration()	Constructor.
DefaultOAuth2TokenAudienceConfiguration(String profileId)	Creates a new configuration instance.

Method Summary

Modifier and Type	Method	Description
BiFunction<ProfileRequestContext,Map<String,Object>,Map<String,Object>>	getAccessTokenClaimsSetManipulationStrategy(ProfileRequestContext profileRequestContext)	Get the bi-function for manipulating access token claims set.
Duration	getAccessTokenLifetime(ProfileRequestContext profileRequestContext)	Get access token lifetime.
String	getAccessTokenType(ProfileRequestContext profileRequestContext)	Get access token type.
String	getIssuer(ProfileRequestContext profileRequestContext)
boolean	isAlwaysIssueBearerAccessToken(ProfileRequestContext profileRequestContext)	Get whether the access token to be issued is always a bearer access token.
boolean	isEncryptionOptional(ProfileRequestContext profileRequestContext)	Get whether encryption is optional in the face of a missing key, etc.
boolean	isResolveAttributes(ProfileRequestContext profileRequestContext)
void	setAccessTokenClaimsSetManipulationStrategy(BiFunction<ProfileRequestContext,Map<String,Object>,Map<String,Object>> strategy)	Set the bi-function for manipulating access token claims set.
void	setAccessTokenClaimsSetManipulationStrategyLookupStrategy(Function<ProfileRequestContext,BiFunction<ProfileRequestContext,Map<String,Object>,Map<String,Object>>> strategy)	Set a lookup strategy for the bi-function for manipulating access token claims set.
void	setAccessTokenLifetime(Duration lifetime)	Set the lifetime of an access token.
void	setAccessTokenLifetimeLookupStrategy(Function<ProfileRequestContext,Duration> strategy)	Set a lookup strategy for the access token lifetime.
void	setAccessTokenType(String type)	Set access token type.
void	setAccessTokenTypeLookupStrategy(Function<ProfileRequestContext,String> strategy)	Set lookup strategy for access token type.
void	setAlwaysIssueBearerAccessToken(boolean flag)	Set whether the access token to be issued is always a bearer access token.
void	setAlwaysIssueBearerAccessTokenPredicate(Predicate<ProfileRequestContext> condition)	Set a condition to determine whether the access token to be issued is always a bearer access token.
void	setEncryptionOptional(boolean flag)	Set whether encryption is optional in the face of a missing key, etc.
void	setEncryptionOptionalPredicate(Predicate<ProfileRequestContext> condition)	Set a condition to determine whether encryption is optional in the face of a missing key, etc.
void	setIssuer(String issuer)	Set overridden issuer value.
void	setIssuerLookupStrategy(Function<ProfileRequestContext,String> strategy)	Sets lookup strategy for overridden issuer value.
void	setResolveAttributes(boolean flag)	Set whether attributes should be resolved during the profile.
void	setResolveAttributesPredicate(Predicate<ProfileRequestContext> condition)	Set a condition to determine whether attributes should be resolved during the profile.

Methods inherited from class net.shibboleth.oidc.profile.oauth2.config.impl.AbstractOAuth2InterceptorAwareProfileConfiguration

getMessageHandler, setMessageHandler, setMessageHandlerLookupStrategy

Methods inherited from class net.shibboleth.idp.profile.config.AbstractInterceptorAwareProfileConfiguration

getInboundInterceptorFlows, getOutboundInterceptorFlows, setInboundInterceptorFlows, setInboundInterceptorFlowsLookupStrategy, setOutboundInterceptorFlows, setOutboundInterceptorFlowsLookupStrategy

Methods inherited from class net.shibboleth.profile.config.AbstractConditionalProfileConfiguration

getActivationCondition, setActivationCondition

Methods inherited from class net.shibboleth.profile.config.AbstractProfileConfiguration

equals, getDisallowedFeatures, getSecurityConfiguration, hashCode, isFeatureDisallowed, setDisallowedFeatures, setDisallowedFeaturesLookupStrategy, setSecurityConfiguration, setSecurityConfigurationLookupStrategy

Methods inherited from class net.shibboleth.shared.component.AbstractIdentifiableInitializableComponent

setId

Methods inherited from class net.shibboleth.shared.component.AbstractIdentifiedInitializableComponent

doInitialize, ensureId, getId, ifDestroyedThrowDestroyedComponentException, ifInitializedThrowUnmodifiabledComponentException, ifNotInitializedThrowUninitializedComponentException

Methods inherited from class net.shibboleth.shared.component.AbstractInitializableComponent

checkComponentActive, checkSetterPreconditions, destroy, doDestroy, initialize, isDestroyed, isInitialized

Methods inherited from class java.lang.Object

clone, finalize, getClass, notify, notifyAll, toString, wait, wait, wait

Methods inherited from interface net.shibboleth.profile.config.ConditionalProfileConfiguration

getActivationCondition

Methods inherited from interface net.shibboleth.shared.component.IdentifiedComponent

getId

Methods inherited from interface net.shibboleth.idp.profile.config.InterceptorAwareProfileConfiguration

getInboundInterceptorFlows, getOutboundInterceptorFlows

Methods inherited from interface net.shibboleth.profile.config.ProfileConfiguration

getDisallowedFeatures, getSecurityConfiguration, isFeatureDisallowed

Field Details

issuerLookupStrategy

@Nonnull
private Function<ProfileRequestContext,String> issuerLookupStrategy

Lookup function to override issuer value.

resolveAttributesPredicate

@Nonnull
private Predicate<ProfileRequestContext> resolveAttributesPredicate

Whether attributes should be resolved in the course of the profile.

encryptionOptionalPredicate

@Nonnull
private Predicate<ProfileRequestContext> encryptionOptionalPredicate

Whether encryption is optional in the face of no key, etc.

accessTokenTypeLookupStrategy

@Nonnull
private Function<ProfileRequestContext,String> accessTokenTypeLookupStrategy

Lookup functioon to supply access token type.

accessTokenLifetimeLookupStrategy

@Nonnull
private Function<ProfileRequestContext,Duration> accessTokenLifetimeLookupStrategy

Lookup function to supply access token lifetime.

accessTokenClaimsSetManipulationStrategyLookupStrategy

@Nonnull
private Function<ProfileRequestContext,BiFunction<ProfileRequestContext,Map<String,Object>,Map<String,Object>>> accessTokenClaimsSetManipulationStrategyLookupStrategy

Lookup function to supply strategy bi-function for manipulating access token claims set.

alwaysIssueBearerAccessTokenPredicate

@Nonnull
private Predicate<ProfileRequestContext> alwaysIssueBearerAccessTokenPredicate

Whether the access token to be issued is always a bearer access token.

Constructor Details

DefaultOAuth2TokenAudienceConfiguration

public DefaultOAuth2TokenAudienceConfiguration()

Constructor.

DefaultOAuth2TokenAudienceConfiguration

public DefaultOAuth2TokenAudienceConfiguration(@Nonnull @NotEmpty
 String profileId)

Creates a new configuration instance.

Parameters:

profileId - Unique profile identifier.

Method Details

getIssuer

@Nullable
@NotEmpty
public String getIssuer(@Nullable
 ProfileRequestContext profileRequestContext)

Specified by:

getIssuer in interface OverriddenIssuerProfileConfiguration

setIssuer

public void setIssuer(@Nullable @NotEmpty
 String issuer)

Set overridden issuer value.

Parameters:

issuer - issuer value

setIssuerLookupStrategy

public void setIssuerLookupStrategy(@Nonnull
 Function<ProfileRequestContext,String> strategy)

Sets lookup strategy for overridden issuer value.

Parameters:

strategy - lookup strategy

isResolveAttributes

public boolean isResolveAttributes(@Nullable
 ProfileRequestContext profileRequestContext)

Specified by:

isResolveAttributes in interface AttributeResolvingProfileConfiguration

setResolveAttributes

public void setResolveAttributes(boolean flag)

Set whether attributes should be resolved during the profile.

Parameters:

flag - flag to set

setResolveAttributesPredicate

public void setResolveAttributesPredicate(@Nonnull
 Predicate<ProfileRequestContext> condition)

Set a condition to determine whether attributes should be resolved during the profile.

Parameters:

condition - condition to set

isEncryptionOptional

public boolean isEncryptionOptional(@Nullable
 ProfileRequestContext profileRequestContext)

Get whether encryption is optional in the face of a missing key, etc.

Specified by:

isEncryptionOptional in interface OAuth2TokenEncryptionProfileConfiguration

Parameters:

profileRequestContext - current profile request context

Returns:

true iff encryption is optional

setEncryptionOptional

public void setEncryptionOptional(boolean flag)

Set whether encryption is optional in the face of a missing key, etc.

Parameters:

flag - flag to set

setEncryptionOptionalPredicate

public void setEncryptionOptionalPredicate(@Nonnull
 Predicate<ProfileRequestContext> condition)

Set a condition to determine whether encryption is optional in the face of a missing key, etc.

Parameters:

condition - condition to set

getAccessTokenType

@Nullable
@NotEmpty
public String getAccessTokenType(@Nullable
 ProfileRequestContext profileRequestContext)

Get access token type.

Specified by:

getAccessTokenType in interface OAuth2AccessTokenProducingProfileConfiguration

Parameters:

profileRequestContext - profile request context

Returns:

access token type, or null for unspecified/opaque

setAccessTokenType

public void setAccessTokenType(@Nullable @NotEmpty
 String type)

Set access token type.

Parameters:

type - token type, or null for unspecified/opaque

setAccessTokenTypeLookupStrategy

public void setAccessTokenTypeLookupStrategy(@Nonnull
 Function<ProfileRequestContext,String> strategy)

Set lookup strategy for access token type.

Parameters:

strategy - lookup strategy

getAccessTokenLifetime

@Positive
@Nonnull
public Duration getAccessTokenLifetime(@Nullable
 ProfileRequestContext profileRequestContext)

Get access token lifetime.

Defaults to 10 minutes.

Specified by:

getAccessTokenLifetime in interface OAuth2AccessTokenProducingProfileConfiguration

Parameters:

profileRequestContext - profile request context

Returns:

access token lifetime

setAccessTokenLifetime

public void setAccessTokenLifetime(@Positive @Nonnull
 Duration lifetime)

Set the lifetime of an access token.

Parameters:

lifetime - lifetime of an access token in milliseconds

setAccessTokenLifetimeLookupStrategy

public void setAccessTokenLifetimeLookupStrategy(@Nullable
 Function<ProfileRequestContext,Duration> strategy)

Set a lookup strategy for the access token lifetime.

Parameters:

strategy - lookup strategy

getAccessTokenClaimsSetManipulationStrategy

@Nullable
public BiFunction<ProfileRequestContext,Map<String,Object>,Map<String,Object>> getAccessTokenClaimsSetManipulationStrategy(@Nullable
 ProfileRequestContext profileRequestContext)

Get the bi-function for manipulating access token claims set.

Specified by:

getAccessTokenClaimsSetManipulationStrategy in interface OAuth2AccessTokenProducingProfileConfiguration

Parameters:

profileRequestContext - profile request context

Returns:

the bi-function for manipulating access token claims set

setAccessTokenClaimsSetManipulationStrategy

public void setAccessTokenClaimsSetManipulationStrategy(@Nullable
 BiFunction<ProfileRequestContext,Map<String,Object>,Map<String,Object>> strategy)

Set the bi-function for manipulating access token claims set.

Parameters:

strategy - bi-function for manipulating access token claims set

Since:

2.2.0

setAccessTokenClaimsSetManipulationStrategyLookupStrategy

public void setAccessTokenClaimsSetManipulationStrategyLookupStrategy(@Nonnull
 Function<ProfileRequestContext,BiFunction<ProfileRequestContext,Map<String,Object>,Map<String,Object>>> strategy)

Set a lookup strategy for the bi-function for manipulating access token claims set.

Parameters:

strategy - lookup strategy

Since:

2.2.0

isAlwaysIssueBearerAccessToken

public boolean isAlwaysIssueBearerAccessToken(@Nullable
 ProfileRequestContext profileRequestContext)

Get whether the access token to be issued is always a bearer access token.

Specified by:

isAlwaysIssueBearerAccessToken in interface OAuth2AccessTokenProducingProfileConfiguration

Parameters:

profileRequestContext - profile request context

Returns:

whether the access token to be issued is always a bearer access token

setAlwaysIssueBearerAccessToken

public void setAlwaysIssueBearerAccessToken(boolean flag)

Set whether the access token to be issued is always a bearer access token.

Parameters:

flag - flag to set

Since:

3.2.0

setAlwaysIssueBearerAccessTokenPredicate

public void setAlwaysIssueBearerAccessTokenPredicate(@Nonnull
 Predicate<ProfileRequestContext> condition)

Set a condition to determine whether the access token to be issued is always a bearer access token.

Parameters:

condition - condition to set

Since:

3.2.0