Package net.shibboleth.oidc.security.jwt.claims.impl

Class AudienceClaimsValidator

java.lang.Object
net.shibboleth.shared.component.AbstractInitializableComponent
net.shibboleth.shared.component.AbstractIdentifiedInitializableComponent
net.shibboleth.shared.component.AbstractIdentifiableInitializableComponent
net.shibboleth.oidc.jwt.claims.AbstractClaimsValidator
net.shibboleth.oidc.security.jwt.claims.impl.AudienceClaimsValidator
All Implemented Interfaces:
ClaimsValidator, Component, DestructableComponent, IdentifiableComponent, IdentifiedComponent, InitializableComponent
Direct Known Subclasses:
AuthenticationAudienceClaimsValidator
@ThreadSafeAfterInit public class AudienceClaimsValidator extends AbstractClaimsValidator
Verifies the Audience (aud) claim contains the appropriate value. The audience is determined at runtime using an appropriate strategy.

  • Field Details

    • audienceLookupStrategy

      @NonnullAfterInit private BiFunction<ProfileRequestContext,JWTClaimsSet,String> audienceLookupStrategy
      Strategy to find the audience value from the context.

    • additionalAudiencesLookupStrategy

      @Nonnull private BiFunction<ProfileRequestContext,JWTClaimsSet,Set<String>> additionalAudiencesLookupStrategy
      A strategy to lookup a list of additional audiences expected in the 'aud' claim. If they are not found, the token is rejected.

    • allowMissing

      private boolean allowMissing
      Allow a missing aud claim.

    • extraAudienceValidation

      private boolean extraAudienceValidation
      If enabled, any extra audience must be contained in the List returned from the additionalAudiencesLookupStrategy. Defaults to false.

  • Constructor Details

    • AudienceClaimsValidator

      public AudienceClaimsValidator()
      Constructor.

  • Method Details

    • doInitialize

      protected void doInitialize() throws ComponentInitializationException
      Overrides:
      doInitialize in class AbstractIdentifiedInitializableComponent
      Throws:
      ComponentInitializationException

    • setAudienceLookupStrategy

      public void setAudienceLookupStrategy(@Nonnull BiFunction<ProfileRequestContext,JWTClaimsSet,String> strategy)
      Set the audience lookup strategy.
      Parameters:
      strategy - the strategy.

    • setAdditionalAudiencesLookupStrategy

      public void setAdditionalAudiencesLookupStrategy(@Nonnull BiFunction<ProfileRequestContext,JWTClaimsSet,Set<String>> strategy)
      Set the strategy used to lookup the list of additional audiences to find in the 'aud' claim.
      Parameters:
      strategy - the strategy
      Since:
      2.2.0

    • setAllowMissing

      public void setAllowMissing(boolean flag)
      Set whether a missing 'aud' claim is valid or not.

      Defaults to false.

      Parameters:
      flag - flag to set
      Since:
      2.1.0

    • setExtraAudienceValidation

      public void setExtraAudienceValidation(boolean flag)
      Set whether to enable extra audience validation.

      Defaults to false.

      Parameters:
      flag - the flag to set
      Since:
      2.2.0

    • resolveAcceptedAudiences

      @Nonnull @NotEmpty protected Set<String> resolveAcceptedAudiences(@Nonnull JWTClaimsSet claims, @Nonnull ProfileRequestContext context) throws JWTValidationException
      Resolve the set of accepted audiences. This method is mostly a hook for classes extending this validator: in this case it simply returns the resolved single accepted audience in the set.
      Parameters:
      claims - the claims fed for the audience lookup strategy
      context - the profile request context fed for the audience lookup strategy
      Returns:
      the set containing the accepted audience claim
      Throws:
      JWTValidationException - if the audience value could not be resolved via lookup strategy

    • doValidate

      protected void doValidate(@Nonnull JWTClaimsSet claims, @Nonnull ProfileRequestContext context) throws JWTValidationException
      Perform validation of the given claims supported by the supplied context.
      Specified by:
      doValidate in class AbstractClaimsValidator
      Parameters:
      claims - the claims to validate.
      context - the profile request context.
      Throws:
      JWTValidationException - when validation is unsuccessful due to a failed attempt