Package net.shibboleth.oidc.security.jwt.claims.impl

Class AuthenticationTimeClaimsValidator

java.lang.Object
net.shibboleth.shared.component.AbstractInitializableComponent
net.shibboleth.shared.component.AbstractIdentifiedInitializableComponent
net.shibboleth.shared.component.AbstractIdentifiableInitializableComponent
net.shibboleth.oidc.jwt.claims.AbstractClaimsValidator
net.shibboleth.oidc.security.jwt.claims.impl.AuthenticationTimeClaimsValidator
All Implemented Interfaces:
ClaimsValidator, Component, DestructableComponent, IdentifiableComponent, IdentifiedComponent, InitializableComponent
@ThreadSafeAfterInit public class AuthenticationTimeClaimsValidator extends AbstractClaimsValidator
Verifies the auth_time (when the End-User authentication took place):
  1. If the authnLifetimeLookup returns 0 seconds (e.g. max_age=0), assume the 'forced authentication' semantic, and check the auth_time is after the authentication request time.
  2. Or, if the authnLifetimeLookup returns a value >0, check the authentication occurred within a valid expiration window.

A predicate determines if the auth_time was requested e.g. was explicitly requested, or the max_age claim was set. Defaults to true.

  • Field Details

    • log

      @Nonnull private final org.slf4j.Logger log
      Class logger.

    • authnLifetimeLookupStrategy

      @Nonnull private Function<ProfileRequestContext,Duration> authnLifetimeLookupStrategy
      Lookup strategy to find the amount of time for which a token is valid after if it was first issued. (Default value: 60 seconds)

    • authnRequestTimeLookupStrategy

      @Nonnull private Function<ProfileRequestContext,Instant> authnRequestTimeLookupStrategy
      Lookup strategy to find the time at which the authentication request was made. Defaults to now minus the clockskew.

    • clockSkew

      @Nonnull private Duration clockSkew
      Positive clock skew adjustment to consider when checking auth_time is not in the future or has expired. (Default value: 60 seconds).

    • requested

      @Nonnull private Predicate<ProfileRequestContext> requested
      Has the auth_time been requested, either explicitly or from the max_age parameter? Defaults to true.

  • Constructor Details

    • AuthenticationTimeClaimsValidator

      public AuthenticationTimeClaimsValidator()
      Constructor.

  • Method Details

    • setClockSkew

      public void setClockSkew(@Nonnull Duration skew)
      Set the clock skew.
      Parameters:
      skew - clock skew to set

    • setAuthnRequestTimeLookupStrategy

      public void setAuthnRequestTimeLookupStrategy(@Nonnull Function<ProfileRequestContext,Instant> strategy)
      Set the lookup strategy to find out when the authentication request (if any) was made.
      Parameters:
      strategy - the strategy
      Since:
      2.2.0

    • setRequested

      @Deprecated(forRemoval=true, since="2.2.0") public void setRequested(@Nonnull Predicate<ProfileRequestContext> isRequested)
      Deprecated, for removal: This API element is subject to removal in a future version.
      use the activation condition in the base class instead.
      Has the auth_time been request e.g. explicitly, or by using the max_age parameter.
      Parameters:
      isRequested - has auth_time been requested.

    • setAuthnLifetime

      public void setAuthnLifetime(@Nonnull Duration lifetime)
      Sets the amount of time for which a token is valid from when the original authentication took place.
      Parameters:
      lifetime - amount of time for which a token is valid

    • setAuthnLifetimeLookupStrategy

      public void setAuthnLifetimeLookupStrategy(@Nonnull Function<ProfileRequestContext,Duration> strategy)
      Set the lookup strategy used to locate the amount of time for which a token is valid from when the original authentication took place.
      Parameters:
      strategy - the strategy
      Since:
      2.2.0

    • doValidate

      public void doValidate(@Nonnull JWTClaimsSet claimsSet, @Nonnull ProfileRequestContext context) throws JWTValidationException
      Description copied from class: AbstractClaimsValidator
      Perform validation of the given claims supported by the supplied context.
      Specified by:
      doValidate in class AbstractClaimsValidator
      Parameters:
      claimsSet - the claims to validate.
      context - the profile request context.
      Throws:
      JWTValidationException - when validation is unsuccessful due to a failed attempt