Package net.shibboleth.oidc.security.impl

Class CheckClientJWTSignatureAlgorithmHandler

java.lang.Object

net.shibboleth.shared.component.AbstractInitializableComponent

org.opensaml.messaging.handler.AbstractMessageHandler

net.shibboleth.oidc.security.impl.CheckClientJWTSignatureAlgorithmHandler

All Implemented Interfaces:

Component, DestructableComponent, InitializableComponent, MessageHandler

public class CheckClientJWTSignatureAlgorithmHandler
extends AbstractMessageHandler

A MessageHandler that uses a OIDCClientInformation to verify the signature of a signed JWT uses expected algorithm.

Field Summary

Fields

Modifier and Type	Field	Description
private Function<MessageContext,OIDCClientInformation>	clientInformationLookupStrategy	Function that looks up client information from the given message context.
private String	defaultAlgorithmValue	The default algorithm value used if lookup strategy returned null.
private Function<MessageContext,SignedJWT>	jwtTokenLookupStrategy	Function that looks up a signed JWT token from the given message context to validate .
private final org.slf4j.Logger	log	Logger.
private Function<OIDCClientInformation,String>	signatureAlgorithmLookupStrategy	A lookup function for the signature algorithm in the client metadata.
private SignedJWT	signedJwt	The extracted signed JWT that is to be validated.

Constructor Summary

Constructors

Constructor	Description
CheckClientJWTSignatureAlgorithmHandler()

Method Summary

Modifier and Type	Method	Description
protected void	doInitialize()
protected void	doInvoke(MessageContext messageContext)
protected boolean	doPreInvoke(MessageContext messageContext)
protected String	getExpectedAlgorithm(OIDCClientInformation clientInformation)	Fetches the expected signature algorithm from the OIDCClientInformation.
void	setClientInformationLookupStrategy(Function<MessageContext,OIDCClientInformation> strategy)	Set the lookup strategy to locate the client information.
void	setDefaultAlgorithmValue(String value)	Set the default algorithm value used if lookup strategy returned null.
void	setJwtTokenLookupStrategy(Function<MessageContext,SignedJWT> strategy)	Set the strategy used to look up a SignedJWT.
void	setSignatureAlgorithmLookupStrategy(Function<OIDCClientInformation,String> strategy)	Set the strategy used to look up the signature algorithm in the client metadata.

Methods inherited from class org.opensaml.messaging.handler.AbstractMessageHandler

doPostInvoke, doPostInvoke, getActivationCondition, getLogPrefix, invoke, isPreInvokeCalled, setActivationCondition

Methods inherited from class net.shibboleth.shared.component.AbstractInitializableComponent

checkComponentActive, checkSetterPreconditions, destroy, doDestroy, ifDestroyedThrowDestroyedComponentException, ifInitializedThrowUnmodifiabledComponentException, ifNotInitializedThrowUninitializedComponentException, initialize, isDestroyed, isInitialized

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Methods inherited from interface net.shibboleth.shared.component.InitializableComponent

initialize, isInitialized

Field Details

log

@Nonnull
private final org.slf4j.Logger log

Logger.

jwtTokenLookupStrategy

@NonnullAfterInit
private Function<MessageContext,SignedJWT> jwtTokenLookupStrategy

Function that looks up a signed JWT token from the given message context to validate .

clientInformationLookupStrategy

@NonnullAfterInit
private Function<MessageContext,OIDCClientInformation> clientInformationLookupStrategy

Function that looks up client information from the given message context. Can return null if not used.

signatureAlgorithmLookupStrategy

@NonnullAfterInit
private Function<OIDCClientInformation,String> signatureAlgorithmLookupStrategy

A lookup function for the signature algorithm in the client metadata.

signedJwt

@NonnullBeforeExec
private SignedJWT signedJwt

The extracted signed JWT that is to be validated.

defaultAlgorithmValue

@Nullable
private String defaultAlgorithmValue

The default algorithm value used if lookup strategy returned null.

Constructor Details

CheckClientJWTSignatureAlgorithmHandler

public CheckClientJWTSignatureAlgorithmHandler()

Method Details

setJwtTokenLookupStrategy

public void setJwtTokenLookupStrategy(@Nonnull
 Function<MessageContext,SignedJWT> strategy)

Set the strategy used to look up a SignedJWT.

Parameters:

strategy - lookup strategy

setClientInformationLookupStrategy

public void setClientInformationLookupStrategy(@Nonnull
 Function<MessageContext,OIDCClientInformation> strategy)

Set the lookup strategy to locate the client information.

Parameters:

strategy - the strategy.

setSignatureAlgorithmLookupStrategy

public void setSignatureAlgorithmLookupStrategy(@Nonnull
 Function<OIDCClientInformation,String> strategy)

Set the strategy used to look up the signature algorithm in the client metadata.

Parameters:

strategy - lookup strategy

setDefaultAlgorithmValue

public void setDefaultAlgorithmValue(@Nullable
 String value)

Set the default algorithm value used if lookup strategy returned null.

Parameters:

value - default value

doInitialize

protected void doInitialize()
                     throws ComponentInitializationException

Overrides:

doInitialize in class AbstractInitializableComponent

Throws:

ComponentInitializationException

doPreInvoke

protected boolean doPreInvoke(@Nonnull
 MessageContext messageContext)
                       throws MessageHandlerException

Overrides:

doPreInvoke in class AbstractMessageHandler

Throws:

MessageHandlerException

doInvoke

protected void doInvoke(@Nonnull
 MessageContext messageContext)
                 throws MessageHandlerException

Specified by:

doInvoke in class AbstractMessageHandler

Throws:

MessageHandlerException

getExpectedAlgorithm

@Nullable
protected String getExpectedAlgorithm(@Nullable
 OIDCClientInformation clientInformation)

Fetches the expected signature algorithm from the OIDCClientInformation.

Parameters:

clientInformation - the client information/metadata.

Returns:

the expected algorithm value.