Package net.shibboleth.oidc.profile.oauth2.config.impl

Class DefaultOAuth2TokenConfiguration

java.lang.Object

net.shibboleth.shared.component.AbstractInitializableComponent

net.shibboleth.shared.component.AbstractIdentifiedInitializableComponent

net.shibboleth.shared.component.AbstractIdentifiableInitializableComponent

net.shibboleth.profile.config.AbstractProfileConfiguration

net.shibboleth.profile.config.AbstractConditionalProfileConfiguration

net.shibboleth.idp.profile.config.AbstractInterceptorAwareProfileConfiguration

net.shibboleth.oidc.profile.oauth2.config.impl.AbstractOAuth2InterceptorAwareProfileConfiguration

net.shibboleth.oidc.profile.oauth2.config.impl.AbstractOAuth2ClientAuthenticableProfileConfiguration

net.shibboleth.oidc.profile.oauth2.config.impl.AbstractOAuth2FlowAwareProfileConfiguration

net.shibboleth.oidc.profile.config.impl.AbstractOIDCSSOConfiguration

net.shibboleth.oidc.profile.oauth2.config.impl.DefaultOAuth2TokenConfiguration

All Implemented Interfaces:

AuthenticationProfileConfiguration, InterceptorAwareProfileConfiguration, OIDCFlowAwareProfileConfiguration, OIDCIDTokenProducingProfileConfiguration, OIDCProfileConfiguration, OIDCSSOProfileConfiguration, OIDCSSOProviderConfiguration, OIDCSSORelyingPartyConfiguration, OAuth2AccessTokenProducingProfileConfiguration, OAuth2ClientAuthenticableClientProfileConfiguration, OAuth2ClientAuthenticableProfileConfiguration, OAuth2DPoPProofValidatingProfileConfiguration, OAuth2FlowAwareProfileConfiguration, OAuth2InterceptorAwareProfileConfiguration, OAuth2ProfileConfiguration, OAuth2RefreshTokenProducingProfileConfiguration, OAuth2ScopeValidatingProfileConfiguration, OAuth2TokenConfiguration, OAuth2TokenEncryptionProfileConfiguration, AttributeResolvingProfileConfiguration, ConditionalProfileConfiguration, OverriddenIssuerProfileConfiguration, ProfileConfiguration, Component, DestructableComponent, IdentifiableComponent, IdentifiedComponent, InitializableComponent

public class DefaultOAuth2TokenConfiguration
extends AbstractOIDCSSOConfiguration
implements OAuth2TokenConfiguration

Implementation of an OIDC-aware OAuth 2 token endpoint profile configuration.

Field Summary

Fields

Modifier and Type	Field	Description
private Predicate<ProfileRequestContext>	enforceRefreshTokenRotationPredicate	Whether always revoke the refresh_token after it's used.
private Function<ProfileRequestContext,Set<String>>	grantTypesLookupStrategy	Enabled grant types.
private Predicate<ProfileRequestContext>	issueIdTokenViaRefreshTokenPredicate	Whether issue id_token when refresh_token is used.
private Predicate<ProfileRequestContext>	limitInitialAccessTokenToSelfPredicate	Whether initial access token audience is solely to self (i.e.
static final String	PROFILE_COUNTER	OAuth2 token profile counter name.
private Function<ProfileRequestContext,BiFunction<ProfileRequestContext,Map<String,Object>,Map<String,Object>>>	refreshTokenClaimsSetManipulationStrategyLookupStrategy	Lookup function to supply strategy bi-function for manipulating refresh token claims set.

Fields inherited from interface net.shibboleth.oidc.profile.oauth2.config.OAuth2TokenConfiguration

PROFILE_ID

Fields inherited from interface net.shibboleth.oidc.profile.config.OIDCSSOProfileConfiguration

PROFILE_ID

Fields inherited from interface net.shibboleth.profile.config.ProfileConfiguration

DEFAULT_DISALLOWED_FEATURES

Constructor Summary

Constructors

Constructor	Description
DefaultOAuth2TokenConfiguration()	Constructor.
DefaultOAuth2TokenConfiguration(String profileId)	Creates a new configuration instance.

Method Summary

Modifier and Type	Method	Description
Set<String>	getGrantTypes(ProfileRequestContext profileRequestContext)	Get the enabled grant types.
BiFunction<ProfileRequestContext,Map<String,Object>,Map<String,Object>>	getRefreshTokenClaimsSetManipulationStrategy(ProfileRequestContext profileRequestContext)	Get the bi-function for manipulating refresh token claims set.
boolean	isEnforceRefreshTokenRotation(ProfileRequestContext profileRequestContext)	Get whether always revoke the refresh_token after it's used.
boolean	isIssueIdTokenViaRefreshToken(ProfileRequestContext profileRequestContext)	Get whether the id_token is issued when refresh token grant is used.
boolean	isLimitInitialAccessTokenToSelf(ProfileRequestContext profileRequestContext)	Get whether the initial access token audience is solely to self (i.e.
void	setEnforceRefreshTokenRotation(boolean flag)	Set whether always revoke the refresh_token after it's used.
void	setEnforceRefreshTokenRotationPredicate(Predicate<ProfileRequestContext> condition)	Set condition for whether always revoke the refresh_token after it's used.
void	setGrantTypes(Collection<String> types)	Set the enabled grant types.
void	setGrantTypesLookupStrategy(Function<ProfileRequestContext,Set<String>> strategy)	Set a lookup strategy for the enabled grant types.
void	setIssueIdTokenViaRefreshToken(boolean flag)	Set whether the id_token is issued when refresh token grant is used.
void	setIssueIdTokenViaRefreshTokenPredicate(Predicate<ProfileRequestContext> condition)	Set condition for whether the id_token is issued when refresh token grant is used.
void	setLimitInitialAccessTokenToSelf(boolean flag)	Set whether the initial access token audience is solely to self (i.e.
void	setLimitInitialAccessTokenToSelfPredicate(Predicate<ProfileRequestContext> condition)	Set condition for whether initial access token audience is solely to self (i.e.
void	setRefreshTokenClaimsSetManipulationStrategy(BiFunction<ProfileRequestContext,Map<String,Object>,Map<String,Object>> strategy)	Set the bi-function for manipulating refresh token claims set.
void	setRefreshTokenClaimsSetManipulationStrategyLookupStrategy(Function<ProfileRequestContext,BiFunction<ProfileRequestContext,Map<String,Object>,Map<String,Object>>> strategy)	Set a lookup strategy for the bi-function for manipulating refresh token claims set.

Methods inherited from class net.shibboleth.oidc.profile.config.impl.AbstractOIDCSSOConfiguration

getAccessTokenClaimsSetManipulationStrategy, getAccessTokenLifetime, getAccessTokenType, getAdditionalAudiencesForIdToken, getAlwaysIncludedAttributes, getCustomRedirectUriValidationStrategy, getIDTokenLifetime, getIDTokenManipulationStrategy, getIssuer, getRefreshTokenChainLifetime, getRefreshTokenTimeout, getRefreshTokenType, isAllowPKCEPlain, isAlwaysIssueBearerAccessToken, isEncryptionOptional, isForcePKCE, isResolveAttributes, isStrictScopeValidation, setAccessTokenClaimsSetManipulationStrategy, setAccessTokenClaimsSetManipulationStrategyLookupStrategy, setAccessTokenLifetime, setAccessTokenLifetimeLookupStrategy, setAccessTokenType, setAccessTokenTypeLookupStrategy, setAdditionalAudiencesForIdToken, setAdditionalAudiencesForIdTokenLookupStrategy, setAllowPKCEPlain, setAllowPKCEPlainPredicate, setAlwaysIncludedAttributes, setAlwaysIncludedAttributesLookupStrategy, setAlwaysIssueBearerAccessToken, setAlwaysIssueBearerAccessTokenPredicate, setCustomRedirectUriValidationStrategy, setCustomRedirectUriValidationStrategyLookupStrategy, setEncryptionOptional, setEncryptionOptionalPredicate, setForcePKCE, setForcePKCEPredicate, setIDTokenLifetime, setIDTokenLifetimeLookupStrategy, setIDTokenManipulationStrategy, setIDTokenManipulationStrategyLookupStrategy, setIssuer, setIssuerLookupStrategy, setRefreshTokenChainLifetime, setRefreshTokenChainLifetimeLookupStrategy, setRefreshTokenTimeout, setRefreshTokenTimeoutLookupStrategy, setRefreshTokenType, setRefreshTokenTypeLookupStrategy, setResolveAttributes, setResolveAttributesPredicate, setStrictScopeValidation, setStrictScopeValidationPredicate

Methods inherited from class net.shibboleth.oidc.profile.oauth2.config.impl.AbstractOAuth2FlowAwareProfileConfiguration

isAuthorizationCodeFlowEnabled, isHybridFlowEnabled, isImplicitFlowEnabled, isRefreshTokensEnabled, setAuthorizationCodeFlowEnabled, setAuthorizationCodeFlowEnabledPredicate, setHybridFlowEnabled, setHybridFlowEnabledPredicate, setImplicitFlowEnabled, setImplicitFlowEnabledPredicate, setRefreshTokensEnabled, setRefreshTokensEnabledPredicate

Methods inherited from class net.shibboleth.oidc.profile.oauth2.config.impl.AbstractOAuth2ClientAuthenticableProfileConfiguration

getAuthenticationFlows, getClaimsValidator, getClientCredential, getClientId, getDefaultAuthenticationMethods, getDpopProofClaimsValidator, getDpopProofNonceGenerator, getDpopProofSignatureValidationConfiguration, getPostAuthenticationFlows, getProxyCount, getTokenEndpointAuthMethod, getTokenEndpointAuthMethods, getUnregisteredClientPolicy, isForceAuthn, isRequireDpopProof, setAuthenticationFlows, setAuthenticationFlowsLookupStrategy, setClaimsValidator, setClaimsValidatorLookupStrategy, setClientCredential, setClientCredentialLookupStrategy, setClientId, setClientIdLookupStrategy, setDefaultAuthenticationMethods, setDefaultAuthenticationMethodsLookupStrategy, setDpopProofClaimsValidator, setDpopProofClaimsValidatorLookupStrategy, setDpopProofNonceGenerator, setDpopProofNonceGeneratorLookupStrategy, setDpopProofSignatureValidationConfiguration, setDpopProofSignatureValidationConfigurationLookupStrategy, setForceAuthn, setForceAuthnPredicate, setPostAuthenticationFlows, setPostAuthenticationFlowsLookupStrategy, setProxyCount, setProxyCountLookupStrategy, setRequireDpopProof, setRequireDpopProofPredicate, setTokenEndpointAuthMethod, setTokenEndpointAuthMethodLookupStrategy, setTokenEndpointAuthMethods, setTokenEndpointAuthMethodsLookupStrategy, setUnregisteredClientPolicy, setUnregisteredClientPolicyLookupStrategy

Methods inherited from class net.shibboleth.oidc.profile.oauth2.config.impl.AbstractOAuth2InterceptorAwareProfileConfiguration

getMessageHandler, setMessageHandler, setMessageHandlerLookupStrategy

Methods inherited from class net.shibboleth.idp.profile.config.AbstractInterceptorAwareProfileConfiguration

getInboundInterceptorFlows, getOutboundInterceptorFlows, setInboundInterceptorFlows, setInboundInterceptorFlowsLookupStrategy, setOutboundInterceptorFlows, setOutboundInterceptorFlowsLookupStrategy

Methods inherited from class net.shibboleth.profile.config.AbstractConditionalProfileConfiguration

getActivationCondition, setActivationCondition

Methods inherited from class net.shibboleth.profile.config.AbstractProfileConfiguration

equals, getDisallowedFeatures, getSecurityConfiguration, hashCode, isFeatureDisallowed, setDisallowedFeatures, setDisallowedFeaturesLookupStrategy, setSecurityConfiguration, setSecurityConfigurationLookupStrategy

Methods inherited from class net.shibboleth.shared.component.AbstractIdentifiableInitializableComponent

setId

Methods inherited from class net.shibboleth.shared.component.AbstractIdentifiedInitializableComponent

doInitialize, ensureId, getId, ifDestroyedThrowDestroyedComponentException, ifInitializedThrowUnmodifiabledComponentException, ifNotInitializedThrowUninitializedComponentException

Methods inherited from class net.shibboleth.shared.component.AbstractInitializableComponent

checkComponentActive, checkSetterPreconditions, destroy, doDestroy, initialize, isDestroyed, isInitialized

Methods inherited from class java.lang.Object

clone, finalize, getClass, notify, notifyAll, toString, wait, wait, wait

Methods inherited from interface net.shibboleth.profile.config.AttributeResolvingProfileConfiguration

isResolveAttributes

Methods inherited from interface net.shibboleth.idp.authn.config.AuthenticationProfileConfiguration

getAuthenticationFlows, getDefaultAuthenticationMethods, getPostAuthenticationFlows, getProxyCount, isForceAuthn, isLocal

Methods inherited from interface net.shibboleth.profile.config.ConditionalProfileConfiguration

getActivationCondition

Methods inherited from interface net.shibboleth.shared.component.IdentifiedComponent

getId

Methods inherited from interface net.shibboleth.idp.profile.config.InterceptorAwareProfileConfiguration

getInboundInterceptorFlows, getOutboundInterceptorFlows

Methods inherited from interface net.shibboleth.oidc.profile.oauth2.config.OAuth2AccessTokenProducingProfileConfiguration

getAccessTokenClaimsSetManipulationStrategy, getAccessTokenLifetime, getAccessTokenType, isAlwaysIssueBearerAccessToken

Methods inherited from interface net.shibboleth.oidc.profile.oauth2.config.OAuth2ClientAuthenticableClientProfileConfiguration

getClientCredential, getClientId, getTokenEndpointAuthMethod

Methods inherited from interface net.shibboleth.oidc.profile.oauth2.config.OAuth2ClientAuthenticableProfileConfiguration

getClaimsValidator, getTokenEndpointAuthMethods, getUnregisteredClientPolicy

Methods inherited from interface net.shibboleth.oidc.profile.oauth2.config.OAuth2DPoPProofValidatingProfileConfiguration

getDpopProofClaimsValidator, getDpopProofNonceGenerator, getDpopProofSignatureValidationConfiguration, isRequireDpopProof

Methods inherited from interface net.shibboleth.oidc.profile.oauth2.config.OAuth2FlowAwareProfileConfiguration

isAuthorizationCodeFlowEnabled, isImplicitFlowEnabled, isRefreshTokensEnabled

Methods inherited from interface net.shibboleth.oidc.profile.oauth2.config.OAuth2RefreshTokenProducingProfileConfiguration

getRefreshTokenChainLifetime, getRefreshTokenTimeout, getRefreshTokenType

Methods inherited from interface net.shibboleth.oidc.profile.oauth2.config.OAuth2ScopeValidatingProfileConfiguration

isStrictScopeValidation

Methods inherited from interface net.shibboleth.oidc.profile.oauth2.config.OAuth2TokenEncryptionProfileConfiguration

isEncryptionOptional

Methods inherited from interface net.shibboleth.oidc.profile.config.OIDCFlowAwareProfileConfiguration

isHybridFlowEnabled

Methods inherited from interface net.shibboleth.oidc.profile.config.OIDCIDTokenProducingProfileConfiguration

getAdditionalAudiencesForIdToken, getAlwaysIncludedAttributes, getIDTokenLifetime, getIDTokenManipulationStrategy

Methods inherited from interface net.shibboleth.oidc.profile.config.OIDCSSOProfileConfiguration

getCustomRedirectUriValidationStrategy, isAllowPKCEPlain, isForcePKCE

Methods inherited from interface net.shibboleth.profile.config.ProfileConfiguration

getDisallowedFeatures, getSecurityConfiguration, isFeatureDisallowed

Field Details

PROFILE_COUNTER

@Nonnull
@NotEmpty
public static final String PROFILE_COUNTER

OAuth2 token profile counter name.

See Also:

• Constant Field Values

grantTypesLookupStrategy

@Nonnull
private Function<ProfileRequestContext,Set<String>> grantTypesLookupStrategy

Enabled grant types.

refreshTokenClaimsSetManipulationStrategyLookupStrategy

@Nonnull
private Function<ProfileRequestContext,BiFunction<ProfileRequestContext,Map<String,Object>,Map<String,Object>>> refreshTokenClaimsSetManipulationStrategyLookupStrategy

Lookup function to supply strategy bi-function for manipulating refresh token claims set.

enforceRefreshTokenRotationPredicate

@Nonnull
private Predicate<ProfileRequestContext> enforceRefreshTokenRotationPredicate

Whether always revoke the refresh_token after it's used.

issueIdTokenViaRefreshTokenPredicate

@Nonnull
private Predicate<ProfileRequestContext> issueIdTokenViaRefreshTokenPredicate

Whether issue id_token when refresh_token is used.

limitInitialAccessTokenToSelfPredicate

@Nonnull
private Predicate<ProfileRequestContext> limitInitialAccessTokenToSelfPredicate

Whether initial access token audience is solely to self (i.e. UserInfo) use.

Constructor Details

DefaultOAuth2TokenConfiguration

public DefaultOAuth2TokenConfiguration()

Constructor.

DefaultOAuth2TokenConfiguration

public DefaultOAuth2TokenConfiguration(@Nonnull @NotEmpty
 String profileId)

Creates a new configuration instance.

Parameters:

profileId - unique profile identifier

Method Details

getGrantTypes

@Nonnull
@NonnullElements
@NotLive
@Unmodifiable
public Set<String> getGrantTypes(@Nullable
 ProfileRequestContext profileRequestContext)

Description copied from interface: OAuth2TokenConfiguration

Get the enabled grant types.

Specified by:

getGrantTypes in interface OAuth2TokenConfiguration

Parameters:

profileRequestContext - profile request context

Returns:

enabled grant types

setGrantTypes

public void setGrantTypes(@Nonnull @NonnullElements
 Collection<String> types)

Set the enabled grant types.

Parameters:

types - types to enable

setGrantTypesLookupStrategy

public void setGrantTypesLookupStrategy(@Nonnull
 Function<ProfileRequestContext,Set<String>> strategy)

Set a lookup strategy for the enabled grant types.

Parameters:

strategy - lookup strategy

getRefreshTokenClaimsSetManipulationStrategy

@Nullable
public BiFunction<ProfileRequestContext,Map<String,Object>,Map<String,Object>> getRefreshTokenClaimsSetManipulationStrategy(@Nullable
 ProfileRequestContext profileRequestContext)

Get the bi-function for manipulating refresh token claims set.

Specified by:

getRefreshTokenClaimsSetManipulationStrategy in interface OAuth2TokenConfiguration

Parameters:

profileRequestContext - profile request context

Returns:

the bi-function for manipulating refresh token claims set

setRefreshTokenClaimsSetManipulationStrategy

public void setRefreshTokenClaimsSetManipulationStrategy(@Nullable
 BiFunction<ProfileRequestContext,Map<String,Object>,Map<String,Object>> strategy)

Set the bi-function for manipulating refresh token claims set.

Parameters:

strategy - bi-function for manipulating refresh token claims set

Since:

2.1.0

setRefreshTokenClaimsSetManipulationStrategyLookupStrategy

public void setRefreshTokenClaimsSetManipulationStrategyLookupStrategy(@Nonnull
 Function<ProfileRequestContext,BiFunction<ProfileRequestContext,Map<String,Object>,Map<String,Object>>> strategy)

Set a lookup strategy for the bi-function for manipulating refresh token claims set.

Parameters:

strategy - lookup strategy

Since:

2.1.0

isEnforceRefreshTokenRotation

public boolean isEnforceRefreshTokenRotation(@Nullable
 ProfileRequestContext profileRequestContext)

Get whether always revoke the refresh_token after it's used.

Specified by:

isEnforceRefreshTokenRotation in interface OAuth2TokenConfiguration

Parameters:

profileRequestContext - profile request context

Returns:

whether always revoke the refresh_token after it's used

setEnforceRefreshTokenRotation

public void setEnforceRefreshTokenRotation(boolean flag)

Set whether always revoke the refresh_token after it's used.

Parameters:

flag - flag to set

Since:

2.1.0

setEnforceRefreshTokenRotationPredicate

public void setEnforceRefreshTokenRotationPredicate(@Nonnull
 Predicate<ProfileRequestContext> condition)

Set condition for whether always revoke the refresh_token after it's used.

Parameters:

condition - condition to set

Since:

2.1.0

isIssueIdTokenViaRefreshToken

public boolean isIssueIdTokenViaRefreshToken(@Nullable
 ProfileRequestContext profileRequestContext)

Get whether the id_token is issued when refresh token grant is used.

Specified by:

isIssueIdTokenViaRefreshToken in interface OAuth2TokenConfiguration

Parameters:

profileRequestContext - profile request context

Returns:

whether id_token is issued when refresh token grant is used

setIssueIdTokenViaRefreshToken

public void setIssueIdTokenViaRefreshToken(boolean flag)

Set whether the id_token is issued when refresh token grant is used.

Parameters:

flag - flag to set

Since:

2.2.0

setIssueIdTokenViaRefreshTokenPredicate

public void setIssueIdTokenViaRefreshTokenPredicate(@Nonnull
 Predicate<ProfileRequestContext> condition)

Set condition for whether the id_token is issued when refresh token grant is used.

Parameters:

condition - condition to set

Since:

2.2.0

isLimitInitialAccessTokenToSelf

public boolean isLimitInitialAccessTokenToSelf(@Nullable
 ProfileRequestContext profileRequestContext)

Get whether the initial access token audience is solely to self (i.e. UserInfo) use.

Specified by:

isLimitInitialAccessTokenToSelf in interface OAuth2TokenConfiguration

Parameters:

profileRequestContext - profile request context

Returns:

whether initial access token audience is solely to self (i.e. UserInfo) use

setLimitInitialAccessTokenToSelf

public void setLimitInitialAccessTokenToSelf(boolean flag)

Set whether the initial access token audience is solely to self (i.e. UserInfo) use.

Parameters:

flag - flag to set

Since:

3.2.0

setLimitInitialAccessTokenToSelfPredicate

public void setLimitInitialAccessTokenToSelfPredicate(@Nonnull
 Predicate<ProfileRequestContext> condition)

Set condition for whether initial access token audience is solely to self (i.e. UserInfo) use.

Parameters:

condition - condition to set

Since:

3.2.0