Package net.shibboleth.oidc.profile.config.impl

Class DefaultOIDCLogoutConfiguration

java.lang.Object
net.shibboleth.shared.component.AbstractInitializableComponent
net.shibboleth.shared.component.AbstractIdentifiedInitializableComponent
net.shibboleth.shared.component.AbstractIdentifiableInitializableComponent
net.shibboleth.profile.config.AbstractProfileConfiguration
net.shibboleth.profile.config.AbstractConditionalProfileConfiguration
net.shibboleth.idp.profile.config.AbstractInterceptorAwareProfileConfiguration
net.shibboleth.oidc.profile.oauth2.config.impl.AbstractOAuth2InterceptorAwareProfileConfiguration
net.shibboleth.oidc.profile.config.impl.DefaultOIDCLogoutConfiguration
All Implemented Interfaces:
InterceptorAwareProfileConfiguration, OIDCLogoutProfileConfiguration, OIDCProfileConfiguration, OAuth2InterceptorAwareProfileConfiguration, OAuth2ProfileConfiguration, OAuth2TokenEncryptionProfileConfiguration, ConditionalProfileConfiguration, OverriddenIssuerProfileConfiguration, ProfileConfiguration, Component, DestructableComponent, IdentifiableComponent, IdentifiedComponent, InitializableComponent
public class DefaultOIDCLogoutConfiguration extends AbstractOAuth2InterceptorAwareProfileConfiguration implements OIDCLogoutProfileConfiguration, OverriddenIssuerProfileConfiguration
Implementation of a profile configuration for the OpenID Connect logout.
Since:
3.1.0

  • Field Details

    • PROFILE_COUNTER

      @Nonnull @NotEmpty public static final String PROFILE_COUNTER
      OIDC Back-Channel Logout profile counter name.
      See Also:

    • issuerLookupStrategy

      @Nonnull private Function<ProfileRequestContext,String> issuerLookupStrategy
      Lookup function to override issuer value.

    • encryptionOptionalPredicate

      @Nonnull private Predicate<ProfileRequestContext> encryptionOptionalPredicate
      Whether encryption is optional in the face of no key, etc.

    • preferFrontChannelPredicate

      @Nonnull private Predicate<ProfileRequestContext> preferFrontChannelPredicate
      Whether encryption is optional in the face of no key, etc.

    • frontChannelSuccessPredicate

      @Nonnull private Predicate<ProfileRequestContext> frontChannelSuccessPredicate
      Whether to consider front-channel logout propagation successful.

    • revokeTokensPredicate

      @Nonnull private Predicate<ProfileRequestContext> revokeTokensPredicate
      Whether to revoke the tokens related to the session to be logged out.

    • requireIdTokenHintPredicate

      @Nonnull private Predicate<ProfileRequestContext> requireIdTokenHintPredicate
      Whether to require the use of id_token_hint in RP-initiated logout parameters.

    • logoutHintMatchingStrategyLookupStrategy

      @Nonnull private Function<ProfileRequestContext,BiPredicate<String,SPSession>> logoutHintMatchingStrategyLookupStrategy
      Lookup function to the RP-initiated logout's logout_hint parameter.

    • httpRequestMethodLookupStrategy

      @Nonnull private Function<ProfileRequestContext,String> httpRequestMethodLookupStrategy
      Which HTTP method should be used to issue OIDC logout requests. Supported values are POST and GET. The default is GET.

    • customPostLogoutRedirectUriValidationStrategyLookupStrategy

      @Nonnull private Function<ProfileRequestContext,BiPredicate<URI,ProfileRequestContext>> customPostLogoutRedirectUriValidationStrategyLookupStrategy
      Lookup function to supply strategy bi-predicate for custom valdation of post logout redirect URI in the request.

    • ignoreInvalidPostLogoutRedirectUriPredicate

      @Nonnull private Predicate<ProfileRequestContext> ignoreInvalidPostLogoutRedirectUriPredicate
      Whether to ignore invalid post logout redirect URI in RP-initiated logout parameters.

    • logoutHintClaimLookupStrategy

      @Nonnull private Function<ProfileRequestContext,String> logoutHintClaimLookupStrategy
      Lookup function to find the name of the claim from which to set the logout_hint. Typically the claim will be contained inside the ID Token.

    • includePostLogoutRedirectUri

      @Nonnull private Predicate<ProfileRequestContext> includePostLogoutRedirectUri
      Whether to include the post_logout_redirect_uri parameter in an RP-Initiated logout request.

  • Constructor Details

    • DefaultOIDCLogoutConfiguration

      public DefaultOIDCLogoutConfiguration()
      Constructor.

    • DefaultOIDCLogoutConfiguration

      public DefaultOIDCLogoutConfiguration(@Nonnull @NotEmpty String profileId)
      Creates a new configuration instance.
      Parameters:
      profileId - Unique profile identifier.

  • Method Details

    • getIssuer

      @Nullable @NotEmpty public String getIssuer(@Nullable ProfileRequestContext profileRequestContext)
      Specified by:
      getIssuer in interface OverriddenIssuerProfileConfiguration

    • setIssuer

      public void setIssuer(@Nullable @NotEmpty String issuer)
      Set overridden issuer value.
      Parameters:
      issuer - issuer value

    • setIssuerLookupStrategy

      public void setIssuerLookupStrategy(@Nonnull Function<ProfileRequestContext,String> strategy)
      Sets lookup strategy for overridden issuer value.
      Parameters:
      strategy - lookup strategy

    • isEncryptionOptional

      public boolean isEncryptionOptional(@Nullable ProfileRequestContext profileRequestContext)
      Description copied from interface: OAuth2TokenEncryptionProfileConfiguration
      Get whether encryption is optional in the face of a missing key, etc.
      Specified by:
      isEncryptionOptional in interface OAuth2TokenEncryptionProfileConfiguration
      Parameters:
      profileRequestContext - current profile request context
      Returns:
      true iff encryption is optional

    • setEncryptionOptional

      public void setEncryptionOptional(boolean flag)
      Set whether encryption is optional in the face of a missing key, etc.
      Parameters:
      flag - flag to set

    • setEncryptionOptionalPredicate

      public void setEncryptionOptionalPredicate(@Nonnull Predicate<ProfileRequestContext> condition)
      Set a condition to determine whether encryption is optional in the face of a missing key, etc.
      Parameters:
      condition - condition to set

    • isPreferFrontChannel

      public boolean isPreferFrontChannel(@Nullable ProfileRequestContext profileRequestContext)
      Description copied from interface: OIDCLogoutProfileConfiguration
      Get whether to prefer front-channel if both are defined for the RP.
      Specified by:
      isPreferFrontChannel in interface OIDCLogoutProfileConfiguration
      Parameters:
      profileRequestContext - current profile request context
      Returns:
      true iff front-channel is to be preferred

    • setPreferFrontChannel

      public void setPreferFrontChannel(boolean flag)
      Set whether to prefer front-channel if both are defined for the RP.
      Parameters:
      flag - flag to set

    • setPreferFrontChannelPredicate

      public void setPreferFrontChannelPredicate(@Nonnull Predicate<ProfileRequestContext> condition)
      Set a condition to determine whether to prefer front-channel if both are defined for the RP.
      Parameters:
      condition - condition to set

    • isFrontChannelSuccess

      public boolean isFrontChannelSuccess(@Nullable ProfileRequestContext profileRequestContext)
      Description copied from interface: OIDCLogoutProfileConfiguration
      Get whether to consider front-channel logout propagation successful.
      Specified by:
      isFrontChannelSuccess in interface OIDCLogoutProfileConfiguration
      Parameters:
      profileRequestContext - current profile request context
      Returns:
      true iff front-channel propagation considered as successful

    • setFrontChannelSuccess

      public void setFrontChannelSuccess(boolean flag)
      Set whether to consider front-channel logout propagation successful.
      Parameters:
      flag - flag to set

    • setFrontChannelSuccessPredicate

      public void setFrontChannelSuccessPredicate(@Nonnull Predicate<ProfileRequestContext> condition)
      Set a condition to determine whether to consider front-channel logout propagation successful.
      Parameters:
      condition - condition to set

    • isRevokeTokens

      public boolean isRevokeTokens(@Nullable ProfileRequestContext profileRequestContext)
      Description copied from interface: OIDCLogoutProfileConfiguration
      Get whether to revoke the tokens related to the session to be logged out.
      Specified by:
      isRevokeTokens in interface OIDCLogoutProfileConfiguration
      Parameters:
      profileRequestContext - current profile request context
      Returns:
      true iff the tokens are to be revoked

    • setRevokeTokens

      public void setRevokeTokens(boolean flag)
      Set whether to revoke the tokens related to the session to be logged out.
      Parameters:
      flag - flag to set

    • setRevokeTokensPredicate

      public void setRevokeTokensPredicate(@Nonnull Predicate<ProfileRequestContext> condition)
      Set a condition to determine whether to revoke the tokens related to the session to be logged out.
      Parameters:
      condition - condition to set

    • isRequireIdTokenHint

      public boolean isRequireIdTokenHint(@Nullable ProfileRequestContext profileRequestContext)
      Description copied from interface: OIDCLogoutProfileConfiguration
      Get whether to require the use of id_token_hint in an OIDC RP-initiated logout sequence.
      Specified by:
      isRequireIdTokenHint in interface OIDCLogoutProfileConfiguration
      Parameters:
      profileRequestContext - profile request context
      Returns:
      true iff the use of id_token_hint is required

    • setRequireIdTokenHint

      public void setRequireIdTokenHint(boolean flag)
      Set whether to to require the use of id_token_hint in an OIDC RP-initiated logout sequence.
      Parameters:
      flag - flag to set

    • setRequireIdTokenHintPredicate

      public void setRequireIdTokenHintPredicate(@Nonnull Predicate<ProfileRequestContext> condition)
      Set a condition to determine whether to to require the use of id_token_hint in an OIDC RP-initiated logout sequence.
      Parameters:
      condition - condition to set

    • getLogoutHintMatchingStrategy

      @Nullable public BiPredicate<String,SPSession> getLogoutHintMatchingStrategy(@Nullable ProfileRequestContext profileRequestContext)
      Description copied from interface: OIDCLogoutProfileConfiguration
      Get the bi-predicate for matching logout hint to an existing session in an OIDC RP-initiated logout sequence.
      Specified by:
      getLogoutHintMatchingStrategy in interface OIDCLogoutProfileConfiguration
      Parameters:
      profileRequestContext - profile request context
      Returns:
      the bi-predicate for matching logout hint to an existing session.

    • setLogoutHintMatchingStrategy

      public void setLogoutHintMatchingStrategy(@Nonnull BiPredicate<String,SPSession> strategy)
      Set a bi-predicate for matching logout hint to an existing session in an OIDC RP-initiated logout sequence.
      Parameters:
      strategy - bi-predicate to set

    • setLogoutHintMatchingStrategyLookupStrategy

      public void setLogoutHintMatchingStrategyLookupStrategy(@Nonnull Function<ProfileRequestContext,BiPredicate<String,SPSession>> strategy)
      Set a lookup strategy for the bi-predicate for matching logout hint to an existing session in an OIDC RP-initiated logout sequence.
      Parameters:
      strategy - lookup strategy

    • getCustomPostLogoutRedirectUriValidationStrategy

      @Nullable public BiPredicate<URI,ProfileRequestContext> getCustomPostLogoutRedirectUriValidationStrategy(@Nullable ProfileRequestContext profileRequestContext)
      Get the bi-predicate for validating post logout redirect URI in request to the current profile request context state.
      Specified by:
      getCustomPostLogoutRedirectUriValidationStrategy in interface OIDCLogoutProfileConfiguration
      Parameters:
      profileRequestContext - profile request context
      Returns:
      the bi-predicate for validating requested post logout redirect URI

    • setCustomPostLogoutRedirectUriValidationStrategy

      public void setCustomPostLogoutRedirectUriValidationStrategy(@Nullable BiPredicate<URI,ProfileRequestContext> strategy)
      Set the bi-predicate for custom validation of post logout redirect URI in the request. .
      Parameters:
      strategy - bi-predicate for custom validation of post logout redirect URI in the request
      Since:
      3.4.0

    • setCustomPostLogoutRedirectUriValidationStrategyLookupStrategy

      public void setCustomPostLogoutRedirectUriValidationStrategyLookupStrategy(@Nonnull Function<ProfileRequestContext,BiPredicate<URI,ProfileRequestContext>> strategy)
      Set a lookup strategy for the bi-predicate for custom validation of post logout redirect URI in the request.
      Parameters:
      strategy - lookup strategy
      Since:
      3.4.0

    • isIgnoreInvalidPostLogoutRedirectUri

      public boolean isIgnoreInvalidPostLogoutRedirectUri(@Nullable ProfileRequestContext profileRequestContext)
      Description copied from interface: OIDCLogoutProfileConfiguration
      Get whether to ignore invalid post logout redirect URI in the request.
      Specified by:
      isIgnoreInvalidPostLogoutRedirectUri in interface OIDCLogoutProfileConfiguration
      Parameters:
      profileRequestContext - profile request context
      Returns:
      true if an invalid post logout redirect URI is to be ignored

    • setIgnoreInvalidPostLogoutRedirectUri

      public void setIgnoreInvalidPostLogoutRedirectUri(boolean flag)
      Set whether to ignore an invalid post logout redirect URI in an OIDC RP-initiated logout sequence.
      Parameters:
      flag - flag to set
      Since:
      3.4.0

    • setIgnoreInvalidPostLogoutRedirectUriPredicate

      public void setIgnoreInvalidPostLogoutRedirectUriPredicate(@Nonnull Predicate<ProfileRequestContext> condition)
      Set a condition to determine whether to ignore an invalid post logout redirect URI in an OIDC RP-initiated logout sequence.
      Parameters:
      condition - condition to set
      Since:
      3.4.0

    • setHttpRequestMethodLookupStrategy

      public void setHttpRequestMethodLookupStrategy(@Nonnull Function<ProfileRequestContext,String> strategy)
      Set a lookup strategy to determine the HTTP request method for an authentication request.
      Parameters:
      strategy - the strategy to set.
      Since:
      3.4.0

    • getHttpRequestMethod

      public OAuth2AuthorizationProfileConfiguration.HttpRequestMethod getHttpRequestMethod(@Nullable ProfileRequestContext profileRequestContext)
      Get the HTTP request method for an RP-Initiated logout request.
      Specified by:
      getHttpRequestMethod in interface OIDCLogoutProfileConfiguration
      Parameters:
      profileRequestContext - profile request context
      Returns:
      the HTTP request method TODO: remove the default in version 4.0.0

    • setLogoutHintClaimLookupStrategy

      public void setLogoutHintClaimLookupStrategy(@Nonnull Function<ProfileRequestContext,String> strategy)
      Set the lookup strategy to determine which claim (by name) should be extracted and set into the logout_hint parameter.
      Parameters:
      strategy - The strategy to set.
      Since:
      3.4.0

    • setLogoutHintClaim

      public void setLogoutHintClaim(@Nonnull @NotEmpty String name)
      Set the name of the claim that should be extracted and set into the logout_hint parameter. parameter.
      Parameters:
      name - The claim name to set.
      Since:
      3.4.0

    • getLogoutHintClaim

      public String getLogoutHintClaim(ProfileRequestContext profileRequestContext)
      Get the ID Token claim whose value should be used as the logout_hint parameter in an RP-Initiated Logout request.
      Specified by:
      getLogoutHintClaim in interface OIDCLogoutProfileConfiguration
      Parameters:
      profileRequestContext - profile request context
      Returns:
      the claim name, or null if no logout_hint should be supplied TODO: remove the default implementation in version 4.0.0

    • setIncludePostLogoutRedirectUri

      public void setIncludePostLogoutRedirectUri(@Nonnull Predicate<ProfileRequestContext> condition)
      Set the predicate to determine if the post_logout_redirect_uri parameter be included in an RP-Initiated logout request.
      Parameters:
      condition - The condition to set.
      Since:
      3.4.0

    • setIncludePostLogoutRedirectUri

      public void setIncludePostLogoutRedirectUri(boolean flag)
      Set whether to determine if the post_logout_redirect_uri parameter be included in an RP-Initiated logout request.
      Parameters:
      flag - The flag to set.
      Since:
      3.4.0

    • isIncludePostLogoutRedirectUri

      public boolean isIncludePostLogoutRedirectUri(ProfileRequestContext profileRequestContext)
      Get whether post_logout_redirect_uri is included in an OIDC RP-Initiated logout request.
      Specified by:
      isIncludePostLogoutRedirectUri in interface OIDCLogoutProfileConfiguration
      Parameters:
      profileRequestContext - profile request context
      Returns:
      true if the post_logout_redirect_uri parameter should be included in the request, false otherwise. TODO: remove the default implementation in version 4.0.0