Package net.shibboleth.oidc.security.credential.impl

Class ClientInformationCredentialResolver

java.lang.Object

org.opensaml.security.credential.impl.AbstractCredentialResolver

org.opensaml.security.credential.impl.AbstractCriteriaFilteringCredentialResolver

net.shibboleth.oidc.security.credential.impl.BasicJOSEObjectCredentialResolver

net.shibboleth.oidc.security.credential.impl.AbstractClientInformationCredentialResolver

net.shibboleth.oidc.security.credential.impl.ClientInformationCredentialResolver

All Implemented Interfaces:

JOSEObjectCredentialResolver, Component, InitializableComponent, Resolver<Credential,CriteriaSet>, CredentialResolver

public class ClientInformationCredentialResolver
extends AbstractClientInformationCredentialResolver

A JOSEObjectCredentialResolver that resolves credentials from the jwks or contents of jwks_uri of a ClientInformation. If the information contains client secret, it's converted into a BasicJWKCredential. Further filtering of credentials is provided by the AbstractCriteriaFilteringCredentialResolver parent class.

Note, only RSA or EC keys are resolved as these are the only key types which should be exposed in public JWKS documents.

Field Summary

Fields

Modifier and Type	Field	Description
private final Duration	keyFetchInterval	The remote key refresh interval.
private final org.slf4j.Logger	log	Class logger.
private final RemoteJwkSetCache	remoteJwkSetCache	The cache for remote JWK key sets.

Constructor Summary

Constructors

Constructor	Description
ClientInformationCredentialResolver(RemoteJwkSetCache jwkSetCache)	Constructor.
ClientInformationCredentialResolver(RemoteJwkSetCache jwkSetCache, Duration interval)	Constructor.

Method Summary

Modifier and Type	Method	Description
protected Collection<Credential>	resolveFromMetadata(CriteriaSet criteriaSet, OIDCClientInformation information)	Fetch the remote JWK Set from the jwk_uri in the RP/Client metadata.
protected Iterable<Credential>	resolveFromSource(CriteriaSet criteriaSet)

Methods inherited from class net.shibboleth.oidc.security.credential.impl.AbstractClientInformationCredentialResolver

initialize, isInitialized, resolveSecretCredentials

Methods inherited from class net.shibboleth.oidc.security.credential.impl.BasicJOSEObjectCredentialResolver

buildJWKCredential, deriveClientSecretCredential, extractKeyIdFromCriteria, populateCredentialsFromKeySet, postProcess, processJWEHeader, processJWSHeader

Methods inherited from class org.opensaml.security.credential.impl.AbstractCriteriaFilteringCredentialResolver

isSatisfyAllPredicates, resolve, setSatisfyAllPredicates

Methods inherited from class org.opensaml.security.credential.impl.AbstractCredentialResolver

resolveSingle

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Methods inherited from interface net.shibboleth.shared.resolver.Resolver

resolve, resolveSingle

Field Details

log

@Nonnull
private final org.slf4j.Logger log

Class logger.

remoteJwkSetCache

@Nonnull
private final RemoteJwkSetCache remoteJwkSetCache

The cache for remote JWK key sets.

keyFetchInterval

@Nonnull
@Positive
private final Duration keyFetchInterval

The remote key refresh interval. Default value: 30 minutes.

Constructor Details

ClientInformationCredentialResolver

public ClientInformationCredentialResolver(@Nonnull @ParameterName(name="remoteJwkSetCache")
 RemoteJwkSetCache jwkSetCache)

Constructor.

Parameters:

jwkSetCache - The cache for remote JWK key sets.

ClientInformationCredentialResolver

public ClientInformationCredentialResolver(@Nonnull @ParameterName(name="remoteJwkSetCache")
 RemoteJwkSetCache jwkSetCache,
 @Nonnull @Positive @ParameterName(name="keyFetchInterval")
 Duration interval)

Constructor.

Parameters:

jwkSetCache - The cache for remote JWK key sets.

interval - The remote key refresh interval

Method Details

resolveFromSource

@Nonnull
protected Iterable<Credential> resolveFromSource(@Nullable
 CriteriaSet criteriaSet)
                                          throws ResolverException

Overrides:

resolveFromSource in class BasicJOSEObjectCredentialResolver

Throws:

ResolverException

resolveFromMetadata

@Nonnull
protected Collection<Credential> resolveFromMetadata(@Nonnull
 CriteriaSet criteriaSet,
 @Nonnull
 OIDCClientInformation information)

Fetch the remote JWK Set from the jwk_uri in the RP/Client metadata. Convert each JWK into a Credential and return. Only supports EC (key agreement) and RSA (key encryption) keys. If the client information contains client secret, it's converted into a BasicJWKCredential.

Parameters:

criteriaSet - the criteria set

information - the RP/Client information

Returns:

a collection of credentials combined of client secret and keys from the key set (if any).