Package net.shibboleth.oidc.profile.oauth2.config.impl

Class AbstractOAuth2ClientAuthenticableProfileConfiguration

java.lang.Object
net.shibboleth.shared.component.AbstractInitializableComponent
net.shibboleth.shared.component.AbstractIdentifiedInitializableComponent
net.shibboleth.shared.component.AbstractIdentifiableInitializableComponent
net.shibboleth.profile.config.AbstractProfileConfiguration
net.shibboleth.profile.config.AbstractConditionalProfileConfiguration
net.shibboleth.idp.profile.config.AbstractInterceptorAwareProfileConfiguration
net.shibboleth.oidc.profile.oauth2.config.impl.AbstractOAuth2InterceptorAwareProfileConfiguration
net.shibboleth.oidc.profile.oauth2.config.impl.AbstractOAuth2ClientAuthenticableProfileConfiguration
All Implemented Interfaces:
AuthenticationProfileConfiguration, InterceptorAwareProfileConfiguration, OAuth2ClientAuthenticableClientProfileConfiguration, OAuth2ClientAuthenticableProfileConfiguration, OAuth2DPoPProofValidatingProfileConfiguration, OAuth2InterceptorAwareProfileConfiguration, OAuth2ProfileConfiguration, ConditionalProfileConfiguration, ProfileConfiguration, Component, DestructableComponent, IdentifiableComponent, IdentifiedComponent, InitializableComponent
Direct Known Subclasses:
AbstractOAuth2FlowAwareProfileConfiguration, AbstractOAuth2TokenValidatingConfiguration
public abstract class AbstractOAuth2ClientAuthenticableProfileConfiguration extends AbstractOAuth2InterceptorAwareProfileConfiguration implements OAuth2ClientAuthenticableProfileConfiguration, OAuth2ClientAuthenticableClientProfileConfiguration
Base class for OAuth profile configurations that support OAuth-defined client authentication methods.

  • Field Details

  • Constructor Details

    • AbstractOAuth2ClientAuthenticableProfileConfiguration

      protected AbstractOAuth2ClientAuthenticableProfileConfiguration(@Nonnull @NotEmpty String profileId)
      Constructor.
      Parameters:
      profileId - Unique profile identifier

  • Method Details

    • getTokenEndpointAuthMethods

      @Nonnull @NonnullElements @NotLive @Unmodifiable public Set<String> getTokenEndpointAuthMethods(@Nullable ProfileRequestContext profileRequestContext)
      Get the enabled token endpoint authentication methods.
      Specified by:
      getTokenEndpointAuthMethods in interface OAuth2ClientAuthenticableProfileConfiguration
      Parameters:
      profileRequestContext - profile request context
      Returns:
      enabled token endpoint authentication methods

    • setTokenEndpointAuthMethods

      public void setTokenEndpointAuthMethods(@Nonnull @NonnullElements Collection<String> methods)
      Set the enabled token endpoint authentication methods.
      Parameters:
      methods - What to set.

    • setTokenEndpointAuthMethodsLookupStrategy

      public void setTokenEndpointAuthMethodsLookupStrategy(@Nonnull Function<ProfileRequestContext,Set<String>> strategy)
      Set a lookup strategy for the enabled token endpoint authentication methods.
      Parameters:
      strategy - lookup strategy

    • getTokenEndpointAuthMethod

      @Nullable public String getTokenEndpointAuthMethod(@Nullable ProfileRequestContext profileRequestContext)
      Get the token endpoint authentication method to use with an OpenID Provider.
      Specified by:
      getTokenEndpointAuthMethod in interface OAuth2ClientAuthenticableClientProfileConfiguration
      Parameters:
      profileRequestContext - the profile request context
      Returns:
      the token endpoint authentication method to use.

    • setTokenEndpointAuthMethod

      public void setTokenEndpointAuthMethod(@Nonnull @NonnullElements String method)
      Set the enabled token endpoint authentication method to use with an upstream OpenID Provider.
      Parameters:
      method - the token endpoint authentication method to set.
      Since:
      2.2.0

    • setTokenEndpointAuthMethodLookupStrategy

      public void setTokenEndpointAuthMethodLookupStrategy(@Nonnull Function<ProfileRequestContext,String> strategy)
      Set a lookup strategy to find the enabled token endpoint authentication method to use with an upstream OpenID Provider.
      Parameters:
      strategy - lookup strategy
      Since:
      2.2.0

    • getClaimsValidator

      @Nullable public ClaimsValidator getClaimsValidator(@Nullable ProfileRequestContext profileRequestContext)
      Get the ClaimsValidator to apply to JWT-based client authentication.
      Specified by:
      getClaimsValidator in interface OAuth2ClientAuthenticableProfileConfiguration
      Parameters:
      profileRequestContext - current profile request context
      Returns:
      the validator to use
      Since:
      3.1.0

    • setClaimsValidator

      public void setClaimsValidator(@Nullable ClaimsValidator validator)
      Set the ClaimsValidator to apply to JWT-based client authentication.
      Parameters:
      validator - validator to use
      Since:
      3.1.0

    • setClaimsValidatorLookupStrategy

      public void setClaimsValidatorLookupStrategy(@Nonnull Function<ProfileRequestContext,ClaimsValidator> strategy)
      Set a lookup strategy for the ClaimsValidator to apply to JWT-based client authentication.
      Parameters:
      strategy - lookup strategy
      Since:
      3.1.0

    • isForceAuthn

      public boolean isForceAuthn(@Nullable ProfileRequestContext profileRequestContext)
      Specified by:
      isForceAuthn in interface AuthenticationProfileConfiguration

    • setForceAuthn

      public void setForceAuthn(boolean flag)
      Set whether a fresh user presence proof should be required for this request.
      Parameters:
      flag - flag to set

    • setForceAuthnPredicate

      public void setForceAuthnPredicate(@Nonnull Predicate<ProfileRequestContext> condition)
      Set a condition to determine whether a fresh user presence proof should be required for this request.
      Parameters:
      condition - condition to set

    • getProxyCount

      @Nullable public Integer getProxyCount(@Nullable ProfileRequestContext profileRequestContext)
      Specified by:
      getProxyCount in interface AuthenticationProfileConfiguration

    • setProxyCount

      public void setProxyCount(@Nullable @NonNegative Integer count)
      Sets the maximum number of times an assertion may be proxied outbound and/or the maximum number of hops between the relying party and a proxied authentication authority inbound.
      Parameters:
      count - proxy count

    • setProxyCountLookupStrategy

      public void setProxyCountLookupStrategy(@Nonnull Function<ProfileRequestContext,Integer> strategy)
      Set a lookup strategy for the maximum number of times an assertion may be proxied outbound and/or the maximum number of hops between the relying party and a proxied authentication authority inbound.
      Parameters:
      strategy - lookup strategy

    • getAuthenticationFlows

      @Deprecated(since="3.3.1", forRemoval=true) @Nonnull @NonnullElements @NotLive @Unmodifiable public Set<String> getAuthenticationFlows(@Nullable ProfileRequestContext profileRequestContext)
      Deprecated, for removal: This API element is subject to removal in a future version.
      Specified by:
      getAuthenticationFlows in interface AuthenticationProfileConfiguration

    • setAuthenticationFlows

      @Deprecated(since="3.3.1", forRemoval=true) public void setAuthenticationFlows(@Nullable @NonnullElements Collection<String> flows)
      Deprecated, for removal: This API element is subject to removal in a future version.
      Set the authentication flows to use.
      Parameters:
      flows - flow identifiers to use

    • setAuthenticationFlowsLookupStrategy

      @Deprecated(since="3.3.1", forRemoval=true) public void setAuthenticationFlowsLookupStrategy(@Nonnull Function<ProfileRequestContext,Set<String>> strategy)
      Deprecated, for removal: This API element is subject to removal in a future version.
      Set a lookup strategy for the authentication flows to use.
      Parameters:
      strategy - lookup strategy

    • getPostAuthenticationFlows

      @Nonnull @NonnullElements @NotLive @Unmodifiable public List<String> getPostAuthenticationFlows(@Nullable ProfileRequestContext profileRequestContext)
      Specified by:
      getPostAuthenticationFlows in interface AuthenticationProfileConfiguration

    • setPostAuthenticationFlows

      public void setPostAuthenticationFlows(@Nullable @NonnullElements Collection<String> flows)
      Set the ordered collection of post-authentication interceptor flows to enable.
      Parameters:
      flows - flow identifiers to enable

    • setPostAuthenticationFlowsLookupStrategy

      public void setPostAuthenticationFlowsLookupStrategy(@Nonnull Function<ProfileRequestContext,Collection<String>> strategy)
      Set a lookup strategy for the post-authentication interceptor flows to enable.
      Parameters:
      strategy - lookup strategy

    • getDefaultAuthenticationMethods

      @Nonnull @NonnullElements @NotLive @Unmodifiable public List<Principal> getDefaultAuthenticationMethods(@Nullable ProfileRequestContext profileRequestContext)
      Specified by:
      getDefaultAuthenticationMethods in interface AuthenticationProfileConfiguration

    • setDefaultAuthenticationMethods

      public void setDefaultAuthenticationMethods(@Nullable @NonnullElements Collection<Principal> contexts)
      Set the default authentication contexts to use, expressed as custom principals.
      Parameters:
      contexts - default authentication contexts to use

    • setDefaultAuthenticationMethodsLookupStrategy

      public void setDefaultAuthenticationMethodsLookupStrategy(@Nonnull Function<ProfileRequestContext,Collection<Principal>> strategy)
      Set a lookup strategy for the authentication contexts to use, expressed as custom principals.
      Parameters:
      strategy - lookup strategy

    • setClientCredentialLookupStrategy

      public void setClientCredentialLookupStrategy(@Nonnull Function<ProfileRequestContext,ClientSecretCredential> strategy)
      Set the client credential lookup strategy.
      Parameters:
      strategy - the strategy to use
      Since:
      2.2.0

    • setClientCredential

      public void setClientCredential(@Nullable ClientSecretCredential clientCredential)
      Set a fixed client credential to use no matter what the context/request.
      Parameters:
      clientCredential - the static client credential to use
      Since:
      2.2.0

    • getClientCredential

      public ClientSecretCredential getClientCredential(@Nullable ProfileRequestContext profileRequestContext)
      Get the client credential for the given context. Typically a client_secret associated with the current client_id.
      Specified by:
      getClientCredential in interface OAuth2ClientAuthenticableClientProfileConfiguration
      Parameters:
      profileRequestContext - the profile request context
      Returns:
      the client credential

    • setClientIdLookupStrategy

      public void setClientIdLookupStrategy(@Nonnull Function<ProfileRequestContext,String> strategy)
      Set the strategy to locate a client_id.
      Parameters:
      strategy - the strategy to use
      Since:
      2.2.0

    • setClientId

      public void setClientId(@Nullable String clientId)
      Set a fixed client_id to use no matter what the context/request.
      Parameters:
      clientId - the static clientId to use
      Since:
      2.2.0

    • getClientId

      @Nullable public String getClientId(@Nullable ProfileRequestContext profileRequestContext)
      Get the client_id appropriate for the given context. Typically that associated with the chosen OpenID Connect Provider.
      Specified by:
      getClientId in interface OAuth2ClientAuthenticableClientProfileConfiguration
      Parameters:
      profileRequestContext - the profile request context
      Returns:
      the client_id

    • getUnregisteredClientPolicy

      @Nonnull @Unmodifiable public Map<String,UnregisteredClientPolicy> getUnregisteredClientPolicy(@Nullable ProfileRequestContext profileRequestContext)
      Get the policy for validating unregistered clients.
      Specified by:
      getUnregisteredClientPolicy in interface OAuth2ClientAuthenticableProfileConfiguration
      Parameters:
      profileRequestContext - profile request context
      Returns:
      the map of policies for validating claims of an unregistered client

    • setUnregisteredClientPolicy

      public void setUnregisteredClientPolicy(@Nullable Map<String,UnregisteredClientPolicy> policy)
      Sets the policy for validating unregistered clients.
      Parameters:
      policy - policy to set
      Since:
      3.0.0

    • setUnregisteredClientPolicyLookupStrategy

      public void setUnregisteredClientPolicyLookupStrategy(@Nonnull Function<ProfileRequestContext,Map<String,UnregisteredClientPolicy>> strategy)
      Set a lookup strategy for the policy for validating unregistered clients.
      Parameters:
      strategy - lookup strategy
      Since:
      3.0.0

    • getDpopProofClaimsValidator

      @Nullable public ClaimsValidator getDpopProofClaimsValidator(@Nullable ProfileRequestContext profileRequestContext)
      Get the ClaimsValidator to apply to DPoP Proof JWTs being validated by this profile.
      Specified by:
      getDpopProofClaimsValidator in interface OAuth2DPoPProofValidatingProfileConfiguration
      Parameters:
      profileRequestContext - current profile request context
      Returns:
      the validator to use

    • setDpopProofClaimsValidator

      public void setDpopProofClaimsValidator(@Nullable ClaimsValidator validator)
      Set the ClaimsValidator to apply to DPoP Proof JWT.
      Parameters:
      validator - validator to use
      Since:
      3.2.0

    • setDpopProofClaimsValidatorLookupStrategy

      public void setDpopProofClaimsValidatorLookupStrategy(@Nonnull Function<ProfileRequestContext,ClaimsValidator> strategy)
      Set a lookup strategy for the ClaimsValidator to apply to DPoP Proof JWT.
      Parameters:
      strategy - lookup strategy
      Since:
      3.2.0

    • getDpopProofSignatureValidationConfiguration

      @Nullable public SignatureValidationConfiguration getDpopProofSignatureValidationConfiguration(@Nullable ProfileRequestContext profileRequestContext)
      Get the SignatureValidationConfiguration to be used for DPoP Proof JWT signature validation.
      Specified by:
      getDpopProofSignatureValidationConfiguration in interface OAuth2DPoPProofValidatingProfileConfiguration
      Parameters:
      profileRequestContext - current profile request context
      Returns:
      the signature validation configuration to use

    • setDpopProofSignatureValidationConfiguration

      public void setDpopProofSignatureValidationConfiguration(@Nullable SignatureValidationConfiguration configuration)
      Set the SignatureValidationConfiguration to validate the DPoP Proof JWT signatures.
      Parameters:
      configuration - configuration to use
      Since:
      3.2.0

    • setDpopProofSignatureValidationConfigurationLookupStrategy

      public void setDpopProofSignatureValidationConfigurationLookupStrategy(@Nonnull Function<ProfileRequestContext,SignatureValidationConfiguration> strategy)
      Set a lookup strategy for the SignatureValidationConfiguration to validate the DPoP Proof JWT signatures.
      Parameters:
      strategy - lookup strategy
      Since:
      3.2.0

    • isRequireDpopProof

      public boolean isRequireDpopProof(@Nullable ProfileRequestContext profileRequestContext)
      Get whether client is required to include DPoP Proof JWT in request.
      Specified by:
      isRequireDpopProof in interface OAuth2DPoPProofValidatingProfileConfiguration
      Parameters:
      profileRequestContext - the profile request context
      Returns:
      whether client is required to include DPoP Proof JWT in request

    • setRequireDpopProof

      public void setRequireDpopProof(boolean flag)
      Set whether client is required to include DPoP proof in request.
      Parameters:
      flag - flag to set
      Since:
      3.2.0

    • setRequireDpopProofPredicate

      public void setRequireDpopProofPredicate(@Nonnull Predicate<ProfileRequestContext> condition)
      Set condition for whether client is required to include DPoP proof in request.
      Parameters:
      condition - condition to set
      Since:
      3.2.0

    • getDpopProofNonceGenerator

      @Nullable public Function<ProfileRequestContext,String> getDpopProofNonceGenerator(@Nullable ProfileRequestContext profileRequestContext)
      Get the Function to create nonces to be used with DPoP Proof JWTs.
      Specified by:
      getDpopProofNonceGenerator in interface OAuth2DPoPProofValidatingProfileConfiguration
      Parameters:
      profileRequestContext - current profile request context
      Returns:
      the nonce generator to use

    • setDpopProofNonceGenerator

      public void setDpopProofNonceGenerator(@Nullable Function<ProfileRequestContext,String> function)
      Set the Function to create nonces to be used with DPoP Proof JWTs.
      Parameters:
      function - generator function to use
      Since:
      3.2.0

    • setDpopProofNonceGeneratorLookupStrategy

      public void setDpopProofNonceGeneratorLookupStrategy(@Nonnull Function<ProfileRequestContext,Function<ProfileRequestContext,String>> strategy)
      Set a lookup strategy for the Function to create nonces to be used with DPoP Proof JWTs.
      Parameters:
      strategy - lookup strategy
      Since:
      3.2.0

    • isUseTargetedEndpointAsJWTAudience

      public boolean isUseTargetedEndpointAsJWTAudience(@Nullable ProfileRequestContext profileRequestContext)
      Should the audience claim of a JWT be targeted to a specific endpoint of the recipient? The targeted audience would be specific to the context in which the JWT is used. For example, the token endpoint URL in a JWT client assertion.
      Specified by:
      isUseTargetedEndpointAsJWTAudience in interface OAuth2ClientAuthenticableClientProfileConfiguration
      Parameters:
      profileRequestContext - the profile request context
      Returns:
      true if the audience claim should use a targeted endpoint of the recipient, false if the audience value must be the issuer identifier of the recipient

    • setUseTargetedEndpointAsJWTAudiencePredicate

      public void setUseTargetedEndpointAsJWTAudiencePredicate(@Nonnull Predicate<ProfileRequestContext> condition)
      Set a condition to determine if the audience claim of a JWT should be targeted to a specific endpoint of the recipient? The endpoint value used will differ depending on the context in which the predicate is used. If the condition returns false, the audience value must be fixed to the issuer identifier of the recipient.
      Parameters:
      condition - condition to set.
      Since:
      3.3.0

    • setUseTargetedEndpointAsJWTAudience

      public void setUseTargetedEndpointAsJWTAudience(boolean flag)
      Set a flag to determine if the audience claim of a JWT should be targeted to a specific endpoint of the recipient? The endpoint value used will differ depending on the context in which the predicate is used. If the condition returns false, the audience value must be fixed to the issuer identifier of the recipient.
      Parameters:
      flag - the flag to set
      Since:
      3.3.0

    • getClientAuthenticationJWTType

      @Nullable public String getClientAuthenticationJWTType(@Nullable ProfileRequestContext profileRequestContext)
      Get the 'typ' header parameter value for a client authentication JWT.
      Specified by:
      getClientAuthenticationJWTType in interface OAuth2ClientAuthenticableClientProfileConfiguration
      Parameters:
      profileRequestContext - the profile request context
      Returns:
      the 'typ' header parameter value for a client authentication JWT.

    • setClientAuthenticationJWTTypeLookupStrategy

      public void setClientAuthenticationJWTTypeLookupStrategy(@Nonnull Function<ProfileRequestContext,String> strategy)
      Set a lookup strategy to determine the 'typ' header parameter value for a client authentication JWT.
      Parameters:
      strategy - lookup strategy
      Since:
      3.3.0

    • setClientAuthenticationJWTType

      public void setClientAuthenticationJWTType(@Nullable String type)
      Set the 'typ' header parameter value for a client authentication JWT.
      Parameters:
      type - the 'typ' header value to set
      Since:
      3.3.0

    • isRequireSingleJWTAudience

      public boolean isRequireSingleJWTAudience(@Nullable ProfileRequestContext profileRequestContext)
      Get whether single audience value is required in the JWT audience claim. Otherwise the claim can be a list of values.
      Specified by:
      isRequireSingleJWTAudience in interface OAuth2ClientAuthenticableClientProfileConfiguration
      Parameters:
      profileRequestContext - the profile request context
      Returns:
      true if single audience value is required, false if multiple values are allowed

    • setRequireSingleJWTAudiencePredicate

      public void setRequireSingleJWTAudiencePredicate(@Nonnull Predicate<ProfileRequestContext> condition)
      Set a condition whether single audience value is required in the JWT audience claim. Otherwise the claim can be a list of values.
      Parameters:
      condition - condition to set.
      Since:
      3.3.0

    • setRequireSingleJWTAudience

      public void setRequireSingleJWTAudience(boolean flag)
      Set a flag whether single audience value is required in the JWT audience claim. Otherwise the claim can be a list of values.
      Parameters:
      flag - the flag to set
      Since:
      3.3.0