Package net.shibboleth.oidc.security.impl

Class ClientInformationJWTTrustEngine

java.lang.Object

net.shibboleth.oidc.security.impl.BaseSignedJWTTrustEngine<Iterable<Credential>>

net.shibboleth.oidc.security.impl.ExplicitKeySignedJWTTrustEngine

net.shibboleth.oidc.security.impl.ClientInformationJWTTrustEngine

All Implemented Interfaces:

TrustedCredentialTrustEngine<SignedJWT>, TrustEngine<SignedJWT>

public class ClientInformationJWTTrustEngine
extends ExplicitKeySignedJWTTrustEngine
implements TrustedCredentialTrustEngine<SignedJWT>

An implementation of SignatureTrustEngine which evaluates the validity and trustworthiness of JWT signatures.

This extends ExplicitKeySignedJWTTrustEngine by adding a configurable lookup strategy for the signature algorithm that must be used in the incoming token. Also a default value can be set if the function returns no value. If neither function is returning value nor the default value is set, then any signature accepted by the parent class is accepted.

Since:

2.2.0

Field Summary

Fields

Modifier and Type	Field	Description
private final String	defaultAlgorithmValue	The default algorithm value used if lookup strategy returned null.
private final org.slf4j.Logger	log	Class logger.
private final Function<OIDCClientInformation,String>	signatureAlgorithmLookupStrategy	A lookup function for the signature algorithm in the client metadata.

Constructor Summary

Constructors

Constructor	Description
ClientInformationJWTTrustEngine(CredentialResolver resolver, JOSEObjectCredentialResolver joseObjectResolver, Function<OIDCClientInformation,String> strategy, String defaultValue)	Constructor.

Method Summary

Modifier and Type	Method	Description
protected boolean	doValidate(SignedJWT signedJWT, CriteriaSet trustBasisCriteria)	Validate the signed JWT using the supplied trust criteria.
protected String	getExpectedAlgorithm(ClientInformationCriterion criterion)	Fetches the expected signature algorithm from the OIDCClientInformation.

Methods inherited from class net.shibboleth.oidc.security.impl.ExplicitKeySignedJWTTrustEngine

evaluateTrust, getCredentialResolver

Methods inherited from class net.shibboleth.oidc.security.impl.BaseSignedJWTTrustEngine

checkParams, resolveTokenCredentials, validate, validate, verifySignature

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Methods inherited from interface org.opensaml.security.trust.TrustedCredentialTrustEngine

getCredentialResolver

Methods inherited from interface org.opensaml.security.trust.TrustEngine

validate

Field Details

log

@Nonnull
private final org.slf4j.Logger log

Class logger.

signatureAlgorithmLookupStrategy

@Nonnull
private final Function<OIDCClientInformation,String> signatureAlgorithmLookupStrategy

A lookup function for the signature algorithm in the client metadata.

defaultAlgorithmValue

@Nullable
private final String defaultAlgorithmValue

The default algorithm value used if lookup strategy returned null.

Constructor Details

ClientInformationJWTTrustEngine

public ClientInformationJWTTrustEngine(@Nonnull @ParameterName(name="resolver")
 CredentialResolver resolver,
 @Nonnull @ParameterName(name="JOSEObjectResolver")
 JOSEObjectCredentialResolver joseObjectResolver,
 @Nonnull @ParameterName(name="signatureAlgorithmLookupStrategy")
 Function<OIDCClientInformation,String> strategy,
 @Nullable @ParameterName(name="defaultAlgorithmValue")
 String defaultValue)

Constructor.

Parameters:

resolver - credential resolver used to resolve trusted credentials.

joseObjectResolver - resolver which resolve credentials from the headers of a JOSEObject instance.

strategy - lookup strategy for the signature algorithm in the client metadata.

defaultValue - the default signature algorithm value.

Method Details

doValidate

protected boolean doValidate(@Nonnull
 SignedJWT signedJWT,
 @Nonnull
 CriteriaSet trustBasisCriteria)
                      throws SecurityException

Validate the signed JWT using the supplied trust criteria.

Overrides:

doValidate in class ExplicitKeySignedJWTTrustEngine

Parameters:

signedJWT - the signed JWT to validate

trustBasisCriteria - criteria used to describe and/or resolve the information which serves as the basis for trust evaluation

Returns:

true if signature is valid and trusted, false otherwise

Throws:

SecurityException - if there is a fatal error evaluating the signature

getExpectedAlgorithm

@Nullable
protected String getExpectedAlgorithm(@Nonnull
 ClientInformationCriterion criterion)

Fetches the expected signature algorithm from the OIDCClientInformation.

Parameters:

criterion - criterion containing the client information/metadata.

Returns:

the expected algorithm value.