Package net.shibboleth.oidc.profile.oauth2.config.impl

Class DefaultOAuth2TokenAudienceConfiguration

java.lang.Object
net.shibboleth.shared.component.AbstractInitializableComponent
net.shibboleth.shared.component.AbstractIdentifiedInitializableComponent
net.shibboleth.shared.component.AbstractIdentifiableInitializableComponent
net.shibboleth.profile.config.AbstractProfileConfiguration
net.shibboleth.profile.config.AbstractConditionalProfileConfiguration
net.shibboleth.idp.profile.config.AbstractInterceptorAwareProfileConfiguration
net.shibboleth.oidc.profile.oauth2.config.impl.AbstractOAuth2InterceptorAwareProfileConfiguration
net.shibboleth.oidc.profile.oauth2.config.impl.DefaultOAuth2TokenAudienceConfiguration
All Implemented Interfaces:
InterceptorAwareProfileConfiguration, OIDCProfileConfiguration, OAuth2AccessTokenProducingProfileConfiguration, OAuth2InterceptorAwareProfileConfiguration, OAuth2ProfileConfiguration, OAuth2ResourceIndicatingProfileConfiguration, OAuth2TokenAudienceConfiguration, OAuth2TokenEncryptionProfileConfiguration, AttributeResolvingProfileConfiguration, ConditionalProfileConfiguration, OverriddenIssuerProfileConfiguration, ProfileConfiguration, Component, DestructableComponent, IdentifiableComponent, IdentifiedComponent, InitializableComponent
public class DefaultOAuth2TokenAudienceConfiguration extends AbstractOAuth2InterceptorAwareProfileConfiguration implements OAuth2TokenAudienceConfiguration
Implementation of an OAuth 2.0 token "audience" profile configuration.

  • Field Details

  • Constructor Details

    • DefaultOAuth2TokenAudienceConfiguration

      public DefaultOAuth2TokenAudienceConfiguration()
      Constructor.

    • DefaultOAuth2TokenAudienceConfiguration

      public DefaultOAuth2TokenAudienceConfiguration(@Nonnull @NotEmpty String profileId)
      Creates a new configuration instance.
      Parameters:
      profileId - Unique profile identifier.

  • Method Details

    • getIssuer

      @Nullable @NotEmpty public String getIssuer(@Nullable ProfileRequestContext profileRequestContext)
      Specified by:
      getIssuer in interface OverriddenIssuerProfileConfiguration

    • setIssuer

      public void setIssuer(@Nullable @NotEmpty String issuer)
      Set overridden issuer value.
      Parameters:
      issuer - issuer value

    • setIssuerLookupStrategy

      public void setIssuerLookupStrategy(@Nonnull Function<ProfileRequestContext,String> strategy)
      Sets lookup strategy for overridden issuer value.
      Parameters:
      strategy - lookup strategy

    • isResolveAttributes

      public boolean isResolveAttributes(@Nullable ProfileRequestContext profileRequestContext)
      Specified by:
      isResolveAttributes in interface AttributeResolvingProfileConfiguration

    • setResolveAttributes

      public void setResolveAttributes(boolean flag)
      Set whether attributes should be resolved during the profile.
      Parameters:
      flag - flag to set

    • setResolveAttributesPredicate

      public void setResolveAttributesPredicate(@Nonnull Predicate<ProfileRequestContext> condition)
      Set a condition to determine whether attributes should be resolved during the profile.
      Parameters:
      condition - condition to set

    • isEncryptionOptional

      public boolean isEncryptionOptional(@Nullable ProfileRequestContext profileRequestContext)
      Get whether encryption is optional in the face of a missing key, etc.
      Specified by:
      isEncryptionOptional in interface OAuth2TokenEncryptionProfileConfiguration
      Parameters:
      profileRequestContext - current profile request context
      Returns:
      true iff encryption is optional

    • setEncryptionOptional

      public void setEncryptionOptional(boolean flag)
      Set whether encryption is optional in the face of a missing key, etc.
      Parameters:
      flag - flag to set

    • setEncryptionOptionalPredicate

      public void setEncryptionOptionalPredicate(@Nonnull Predicate<ProfileRequestContext> condition)
      Set a condition to determine whether encryption is optional in the face of a missing key, etc.
      Parameters:
      condition - condition to set

    • getAccessTokenType

      @Nullable @NotEmpty public String getAccessTokenType(@Nullable ProfileRequestContext profileRequestContext)
      Get access token type.
      Specified by:
      getAccessTokenType in interface OAuth2AccessTokenProducingProfileConfiguration
      Parameters:
      profileRequestContext - profile request context
      Returns:
      access token type, or null for unspecified/opaque

    • setAccessTokenType

      public void setAccessTokenType(@Nullable @NotEmpty String type)
      Set access token type.
      Parameters:
      type - token type, or null for unspecified/opaque

    • setAccessTokenTypeLookupStrategy

      public void setAccessTokenTypeLookupStrategy(@Nonnull Function<ProfileRequestContext,String> strategy)
      Set lookup strategy for access token type.
      Parameters:
      strategy - lookup strategy

    • getAccessTokenLifetime

      @Positive @Nonnull public Duration getAccessTokenLifetime(@Nullable ProfileRequestContext profileRequestContext)
      Get access token lifetime.

      Defaults to 10 minutes.

      Specified by:
      getAccessTokenLifetime in interface OAuth2AccessTokenProducingProfileConfiguration
      Parameters:
      profileRequestContext - profile request context
      Returns:
      access token lifetime

    • setAccessTokenLifetime

      public void setAccessTokenLifetime(@Positive @Nonnull Duration lifetime)
      Set the lifetime of an access token.
      Parameters:
      lifetime - lifetime of an access token in milliseconds

    • setAccessTokenLifetimeLookupStrategy

      public void setAccessTokenLifetimeLookupStrategy(@Nullable Function<ProfileRequestContext,Duration> strategy)
      Set a lookup strategy for the access token lifetime.
      Parameters:
      strategy - lookup strategy

    • getAccessTokenClaimsSetManipulationStrategy

      @Nullable public BiFunction<ProfileRequestContext,Map<String,Object>,Map<String,Object>> getAccessTokenClaimsSetManipulationStrategy(@Nullable ProfileRequestContext profileRequestContext)
      Get the bi-function for manipulating access token claims set.
      Specified by:
      getAccessTokenClaimsSetManipulationStrategy in interface OAuth2AccessTokenProducingProfileConfiguration
      Parameters:
      profileRequestContext - profile request context
      Returns:
      the bi-function for manipulating access token claims set

    • setAccessTokenClaimsSetManipulationStrategy

      public void setAccessTokenClaimsSetManipulationStrategy(@Nullable BiFunction<ProfileRequestContext,Map<String,Object>,Map<String,Object>> strategy)
      Set the bi-function for manipulating access token claims set.
      Parameters:
      strategy - bi-function for manipulating access token claims set
      Since:
      2.2.0

    • setAccessTokenClaimsSetManipulationStrategyLookupStrategy

      public void setAccessTokenClaimsSetManipulationStrategyLookupStrategy(@Nonnull Function<ProfileRequestContext,BiFunction<ProfileRequestContext,Map<String,Object>,Map<String,Object>>> strategy)
      Set a lookup strategy for the bi-function for manipulating access token claims set.
      Parameters:
      strategy - lookup strategy
      Since:
      2.2.0

    • isAlwaysIssueBearerAccessToken

      public boolean isAlwaysIssueBearerAccessToken(@Nullable ProfileRequestContext profileRequestContext)
      Get whether the access token to be issued is always a bearer access token.
      Specified by:
      isAlwaysIssueBearerAccessToken in interface OAuth2AccessTokenProducingProfileConfiguration
      Parameters:
      profileRequestContext - profile request context
      Returns:
      whether the access token to be issued is always a bearer access token

    • setAlwaysIssueBearerAccessToken

      public void setAlwaysIssueBearerAccessToken(boolean flag)
      Set whether the access token to be issued is always a bearer access token.
      Parameters:
      flag - flag to set
      Since:
      3.2.0

    • setAlwaysIssueBearerAccessTokenPredicate

      public void setAlwaysIssueBearerAccessTokenPredicate(@Nonnull Predicate<ProfileRequestContext> condition)
      Set a condition to determine whether the access token to be issued is always a bearer access token.
      Parameters:
      condition - condition to set
      Since:
      3.2.0

    • getResourceIndicators

      @Nonnull public List<String> getResourceIndicators(@Nullable ProfileRequestContext profileRequestContext)
      Get the set of OAuth 2.0 resource indicators associated with the given profile request context that specify the intended audiences of an OAuth 2.0 access token.

      TODO: Default implementation should be removed in 4.0.0

      Specified by:
      getResourceIndicators in interface OAuth2ResourceIndicatingProfileConfiguration
      Parameters:
      profileRequestContext - the profile request context
      Returns:
      the set of resource indicators.

    • setResourceIndicatorsLookupStrategy

      public void setResourceIndicatorsLookupStrategy(@Nonnull Function<ProfileRequestContext,List<String>> strategy)
      Set the lookup strategy used to find the set of OAuth 2.0 resource indicators associated with the given profile request context that specify the intended audiences for an OAuth 2.0 access token.
      Parameters:
      strategy - the strategy to set.
      Since:
      3.4.0

    • setResourceIndicators

      public void setResourceIndicators(@Nullable @NonnullElements List<String> resourceIndicators)
      Set the set of OAuth 2.0 resource indicators that specify the intended audiences for an OAuth 2.0 access token.
      Parameters:
      resourceIndicators - the set of resource indicators.
      Since:
      3.4.0