Package net.shibboleth.oidc.security.credential.impl

Class BasicJOSEObjectCredentialResolver

java.lang.Object
org.opensaml.security.credential.impl.AbstractCredentialResolver
org.opensaml.security.credential.impl.AbstractCriteriaFilteringCredentialResolver
net.shibboleth.oidc.security.credential.impl.BasicJOSEObjectCredentialResolver
All Implemented Interfaces:
JOSEObjectCredentialResolver, Resolver<Credential,CriteriaSet>, CredentialResolver
Direct Known Subclasses:
AbstractClientInformationCredentialResolver, ClientSecretCriterionCredentialResolver, CollectionJOSEObjectCredentialResolver, LocalJOSEObjectCredentialResolver, ProviderMetadataCredentialResolver
public class BasicJOSEObjectCredentialResolver extends AbstractCriteriaFilteringCredentialResolver implements JOSEObjectCredentialResolver
A basic implementation of JOSEObjectCredentialResolver. Resolves credentials from JOSE Headers.

  • Field Details

    • log

      @Nonnull private final org.slf4j.Logger log
      Logger.

  • Constructor Details

    • BasicJOSEObjectCredentialResolver

      public BasicJOSEObjectCredentialResolver()

  • Method Details

    • resolveFromSource

      @Nonnull @NonnullElements protected Iterable<Credential> resolveFromSource(@Nullable CriteriaSet criteriaSet) throws ResolverException
      Specified by:
      resolveFromSource in class AbstractCriteriaFilteringCredentialResolver
      Throws:
      ResolverException

    • postProcess

      protected void postProcess(@Nullable CriteriaSet criteriaSet, @Nonnull JOSEObject joseObject, @Nonnull List<Credential> credentials) throws ResolverException
      Hook for subclasses to do post-processing of the credential set after all JOSE header keys have been processed.

      For example, the previously resolved credentials might be used to index into a store of local credentials, where the index is a key name or the public half of a key pair extracted from the headers.

      Parameters:
      criteriaSet - the credential criteria used to resolve credentials
      joseObject - the extracted JOSE object
      credentials - the list which will store the resolved credentials
      Throws:
      ResolverException - thrown if there is an error during processing

    • processJWSHeader

      @Nonnull @NonnullElements protected List<Credential> processJWSHeader(@Nonnull JWSHeader jwsHeader)
      Process credentials indicated by a JWS header.
      Parameters:
      jwsHeader - the JWS header to process
      Returns:
      the list of credentials specified by the JWS header

    • processJWEHeader

      @Nonnull @NonnullElements protected List<Credential> processJWEHeader(@Nonnull JWEHeader jweHeader)
      Process JWE header into a list of credentials.
      Parameters:
      jweHeader - header object
      Returns:
      list of credentials.

    • buildJWKCredential

      @Nullable protected BasicJWKCredential buildJWKCredential(@Nonnull JWK jwk, @Nullable String headerKid)
      Build JWK credential.
      Parameters:
      jwk - JWK to wrap
      headerKid - KID header
      Returns:
      the credential

    • extractKeyIdFromCriteria

      @Nullable protected String extractKeyIdFromCriteria(@Nonnull CriteriaSet criteriaSet)
      Extract a KeyId from the criteria set if one exists. If not, return null.
      Parameters:
      criteriaSet - the criteria set to pull the keyId from
      Returns:
      a KeyId if one exists, null otherwise

    • populateCredentialsFromKeySet

      protected void populateCredentialsFromKeySet(@Nonnull JWKSet keySet, @Nonnull Collection<Credential> credentials)
      Convert the RSA and EC keys from the given JWKSet into the collection of credentials.
      Parameters:
      keySet - the keyset containing RSA/EC keys to convert
      credentials - the target collection to include the converted credentials

    • deriveClientSecretCredential

      @Nullable protected Credential deriveClientSecretCredential(@Nonnull ClientSecretCredential secretCred, @Nonnull CriteriaSet criteriaSet) throws ResolverException
      Use the usage type and algorithm information in the criteria to build a suitable signing or encryption credential.

      Only supports symmetric key encryption algorithms. Request for asymmetric key encryption algorithms are ignored.

      Parameters:
      secretCred - the raw client_secret credential
      criteriaSet - the criteria set used to find algorithm details for encryption keys
      Returns:
      a suitable credential, or null.
      Throws:
      ResolverException - if there is an error deriving the key