Package net.shibboleth.oidc.security.credential.impl

Class LocalJOSEObjectCredentialResolver

java.lang.Object
org.opensaml.security.credential.impl.AbstractCredentialResolver
org.opensaml.security.credential.impl.AbstractCriteriaFilteringCredentialResolver
net.shibboleth.oidc.security.credential.impl.BasicJOSEObjectCredentialResolver
net.shibboleth.oidc.security.credential.impl.LocalJOSEObjectCredentialResolver
All Implemented Interfaces:
JOSEObjectCredentialResolver, Resolver<Credential,CriteriaSet>, CredentialResolver
public class LocalJOSEObjectCredentialResolver extends BasicJOSEObjectCredentialResolver
A simple specialization of BasicJOSEObjectCredentialResolver which is capable of resolving local credentials from a supplied CredentialResolver which manages local credentials.

The local credential resolver supplied should manage and return credentials which contain either a secret (symmetric) key or the private key half of a key pair.

A typical use case for this class would be as a resolver of decryption keys, such as is needed by JWETokenDecrypter}.

Resolution proceeds as follows:

  1. Any credential resolved via the standard BasicJOSEObjectCredentialResolver resolution process which is a local credential (contains private key) will be removed from the effective set of credentials to be returned.
  2. If a credential so removed contained a public key, that key will be used as a resolution criteria input to the local credential resolver (along with the keyID 'kid' if one exists in the JOSE headers). Any local credentials so resolved will be added to the set to be returned.
  3. Similarly, the keyID 'kid' from the JOSE headers will also be used as resolution criteria for local credentials and the resultant credentials added to the set to be returned providing they do not share the same private and public key pair as one already resolved - avoiding key duplication in the result.
Adds either 'kid' or 'public key' to the criteria set sent to the local credential resolver for resolution.
Since:
2.2.0

  • Field Details

    • log

      @Nonnull private final org.slf4j.Logger log
      Class logger.

    • localCredResolver

      @Nonnull private final JOSEObjectCredentialResolver localCredResolver
      The resolver which is used to resolve local credentials.

  • Constructor Details

    • LocalJOSEObjectCredentialResolver

      public LocalJOSEObjectCredentialResolver(@Nonnull @ParameterName(name="localCredentialResolver") JOSEObjectCredentialResolver localCredentialResolver)
      Constructor.
      Parameters:
      localCredentialResolver - resolver of local credentials

  • Method Details

    • getLocalCredentialResolver

      @Nonnull public CredentialResolver getLocalCredentialResolver()
      Get the resolver for local credentials. The credentials managed and returned by this resolver should all contain either a secret (symmetric) or private key.
      Returns:
      resolver of local credentials

    • postProcess

      protected void postProcess(@Nullable CriteriaSet criteriaSet, @Nonnull JOSEObject joseObject, @Nonnull List<Credential> credentials) throws ResolverException
      Description copied from class: BasicJOSEObjectCredentialResolver
      Hook for subclasses to do post-processing of the credential set after all JOSE header keys have been processed.

      For example, the previously resolved credentials might be used to index into a store of local credentials, where the index is a key name or the public half of a key pair extracted from the headers.

      Overrides:
      postProcess in class BasicJOSEObjectCredentialResolver
      Parameters:
      criteriaSet - the credential criteria used to resolve credentials
      joseObject - the extracted JOSE object
      credentials - the list which will store the resolved credentials
      Throws:
      ResolverException - thrown if there is an error during processing

    • resolveLocalCredentialsByCriteria

      @Nonnull @NonnullElements @Live private List<Credential> resolveLocalCredentialsByCriteria(CriteriaSet criteriaSet) throws ResolverException
      Resolve credentials using the localCredResolver and the supplied criteria.
      Parameters:
      criteriaSet - the criterion to pass to the credential resolver
      Returns:
      collection of local credentials identified by the criteria
      Throws:
      ResolverException - thrown if there is a problem resolving credentials from the local credential resolver

    • resolveKeyIdFromJoseHeader

      @Nullable private String resolveKeyIdFromJoseHeader(@Nullable Header header)
      Return the KeyId from either a JWSHeader or a JWEHeader. Returns null if not found.
      Parameters:
      header - the JOSE header to find a kid from
      Returns:
      the keyId or null

    • isLocalCredential

      protected boolean isLocalCredential(@Nonnull Credential credential)
      Determine whether the credential is a local credential. A local credential will have either a private key or a secret (symmetric) key.
      Parameters:
      credential - the credential to evaluate
      Returns:
      true if the credential has either a private or secret key, false otherwise