Package net.shibboleth.oidc.profile.messaging.handler.impl

Class AddPKCECodeVerifierAndChallenge

java.lang.Object

net.shibboleth.shared.component.AbstractInitializableComponent

org.opensaml.messaging.handler.AbstractMessageHandler

net.shibboleth.oidc.profile.messaging.handler.impl.AbstractAuthenticationRequestParameterValueMessageHandler<PKCEOptions>

net.shibboleth.oidc.profile.messaging.handler.impl.AddPKCECodeVerifierAndChallenge

All Implemented Interfaces:

Component, DestructableComponent, InitializableComponent, MessageHandler

public class AddPKCECodeVerifierAndChallenge
extends AbstractAuthenticationRequestParameterValueMessageHandler<PKCEOptions>

Create an OAuth 2.0 PCKE code_verifier to use in the token request, and derives a code_challenge for immediate use in the authorization request.

Field Summary

Fields

Modifier and Type	Field	Description
private final org.slf4j.Logger	log	Logger.

Fields inherited from class net.shibboleth.oidc.profile.messaging.handler.impl.AbstractAuthenticationRequestParameterValueMessageHandler

PRC_LOOKUP

Constructor Summary

Constructors

Constructor	Description
AddPKCECodeVerifierAndChallenge()	Constructor.

Method Summary

Modifier and Type	Method	Description
private String	computeCodeChallenge(String codeVerifier, OAuthAuthorizationRequest.CodeChallengeMethod method)	Compute the code_challenge from the code_verifier.
protected void	doInvoke(MessageContext messageContext)
private static String	generateCodeVerifier(Integer length)	Generates a code_verifier for use during Proof Key for Code Exchange.

Methods inherited from class net.shibboleth.oidc.profile.messaging.handler.impl.AbstractAuthenticationRequestParameterValueMessageHandler

doPreInvoke, getAuthenticationRequest, getParameterValue, getProviderMetadata, setAuthenticationRequestLookupStrategy, setParameterValueLookupStrategy, setProviderMetadataLookupStrategy

Methods inherited from class org.opensaml.messaging.handler.AbstractMessageHandler

doPostInvoke, doPostInvoke, getActivationCondition, getLogPrefix, invoke, isPreInvokeCalled, setActivationCondition

Methods inherited from class net.shibboleth.shared.component.AbstractInitializableComponent

checkComponentActive, checkSetterPreconditions, destroy, doDestroy, doInitialize, ifDestroyedThrowDestroyedComponentException, ifInitializedThrowUnmodifiabledComponentException, ifNotInitializedThrowUninitializedComponentException, initialize, isDestroyed, isInitialized

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Methods inherited from interface net.shibboleth.shared.component.InitializableComponent

initialize, isInitialized

Field Details

log

@Nonnull
private final org.slf4j.Logger log

Logger.

Constructor Details

AddPKCECodeVerifierAndChallenge

public AddPKCECodeVerifierAndChallenge()

Constructor.

Method Details

doInvoke

protected void doInvoke(@Nonnull
 MessageContext messageContext)
                 throws MessageHandlerException

Specified by:

doInvoke in class AbstractMessageHandler

Throws:

MessageHandlerException

generateCodeVerifier

@Nonnull
private static String generateCodeVerifier(@Nonnull
 Integer length)
                                    throws MessageHandlerException

Generates a code_verifier for use during Proof Key for Code Exchange. The generated bytes are base64 URL encoded before they are returned.

Parameters:

length - the byte length of the code_verifier. Must be at least 32 bytes long (RFC7636 section 7.1).

Returns:

the base64 URL encoded coder_verifier value.

Throws:

MessageHandlerException - if there is an error generating the verifier.

computeCodeChallenge

@Nonnull
@NotEmpty
private String computeCodeChallenge(@Nonnull @NotEmpty
 String codeVerifier,
 @Nonnull
 OAuthAuthorizationRequest.CodeChallengeMethod method)
                             throws MessageHandlerException

Compute the code_challenge from the code_verifier. If the OAuthAuthorizationRequest.CodeChallengeMethod.PLAIN method is used, the codeVerifier is returned directly. If the OAuthAuthorizationRequest.CodeChallengeMethod.S256 method is used, the bytes of the codeVerifier are SHA-256 hashed and base 64 URL encoded before being returned.

Parameters:

codeVerifier - the code_verifier to compute the code_challenge from

method - the code_challenge_method

Returns:

the computed code_challenge

Throws:

MessageHandlerException - on error computing the code_challenge