Package net.shibboleth.oidc.profile.config

Interface OIDCSSORelyingPartyConfiguration

All Superinterfaces:
AuthenticationProfileConfiguration, Component, ConditionalProfileConfiguration, IdentifiedComponent, OAuth2ClientAuthenticableClientProfileConfiguration, OAuth2FlowAwareProfileConfiguration, OAuth2ProfileConfiguration, OAuth2TokenEncryptionProfileConfiguration, OIDCFlowAwareProfileConfiguration, OIDCProfileConfiguration, OIDCSSOProfileConfiguration, OverriddenIssuerProfileConfiguration, ProfileConfiguration
All Known Subinterfaces:
OAuth2PushedAuthorizationRequestConfiguration, OIDCAuthenticationRelyingPartyProfileConfiguration, OIDCSSORelyingPartyConfigurationEx
All Known Implementing Classes:
AbstractOIDCSSOConfiguration, DefaultOAuth2PushedAuthorizationRequestConfiguration, DefaultOAuth2TokenConfiguration, DefaultOIDCAuthorizationConfiguration
public interface OIDCSSORelyingPartyConfiguration extends OAuth2TokenEncryptionProfileConfiguration, OverriddenIssuerProfileConfiguration, OIDCFlowAwareProfileConfiguration, OAuth2ClientAuthenticableClientProfileConfiguration, OIDCSSOProfileConfiguration
Profile configuration for an OIDC SSO Client or Relying Party.

  • Method Details

    • getAttributeExtractionStrategy

      @ConfigurationSetting(name="attributeExtractionStrategy") @Nullable default Function<ProfileRequestContext,Collection<IdPAttribute>> getAttributeExtractionStrategy(@Nullable ProfileRequestContext profileRequestContext)
      Get a strategy function to apply to OIDC tokens to extract additional IdPAttribute objects from the data.

      This supplements the built-in behavior that decodes OIDC claims into in the combined id_token and UserInfo tokens.

      TODO: Default implementation should be removed in 4.0.0

      Parameters:
      profileRequestContext - profile request context
      Returns:
      extraction strategy
      Since:
      3.4.0

    • getAttributeResolutionPrincipal

      @ConfigurationSetting(name="attributeResolutionPrincipal") @Nullable default String getAttributeResolutionPrincipal(@Nullable ProfileRequestContext profileRequestContext)
      Get a principal name to feed into attribute resolution if AttributeResolvingProfileConfiguration.isResolveAttributes(ProfileRequestContext) is true.

      TODO: Default implementation should be removed in 4.0.0

      Parameters:
      profileRequestContext - profile request context
      Returns:
      principal name to use during resolution
      Since:
      3.4.0

    • isValidateAcrValue

      @ConfigurationSetting(name="validateAcrValue") default boolean isValidateAcrValue(@Nullable ProfileRequestContext profileRequestContext)
      Should the ACR value in the id_token be validated against those in the authentication request?

      It does not make any determination about whether the requested ACR values were marked as essential or optional in the authentication request; it simply determines whether the validation step should run.

      TODO: Default implementation should be removed in 4.0.0

      Parameters:
      profileRequestContext - the profile request context
      Returns:
      true if the ACR value should be validated, false otherwise.
      Since:
      3.4.0

    • isExtractStandardAttributes

      @ConfigurationSetting(name="extractStandardAttributes") default boolean isExtractStandardAttributes(@Nullable ProfileRequestContext profileRequestContext)
      Get whether to perform extraction of a set of "standard" information from an OIDC id_token.

      This is essentially a built-in extraction strategy that can be supplemented via getAttributeExtractionStrategy(ProfileRequestContext).

      Defaults to "true".

      TODO: Default implementation should be removed in 4.0.0

      Parameters:
      profileRequestContext - profile request context
      Returns:
      whether to perform standard data extraction
      Since:
      3.4.0

    • isCheckAddress

      @ConfigurationSetting(name="checkAddress") default boolean isCheckAddress(@Nullable ProfileRequestContext profileRequestContext)
      Get whether the client address must match between request issuance and response receipt.

      Defaults to "false".

      TODO: Default implementation should be removed in 4.0.0

      Parameters:
      profileRequestContext - current profile request context
      Returns:
      whether to compare addresses
      Since:
      3.4.0