Package net.shibboleth.oidc.security.credential.impl

Class ProviderMetadataCredentialResolver

java.lang.Object

org.opensaml.security.credential.impl.AbstractCredentialResolver

org.opensaml.security.credential.impl.AbstractCriteriaFilteringCredentialResolver

net.shibboleth.oidc.security.credential.impl.BasicJOSEObjectCredentialResolver

net.shibboleth.oidc.security.credential.impl.ProviderMetadataCredentialResolver

All Implemented Interfaces:

JOSEObjectCredentialResolver, Component, InitializableComponent, Resolver<Credential,CriteriaSet>, CredentialResolver

public class ProviderMetadataCredentialResolver
extends BasicJOSEObjectCredentialResolver
implements InitializableComponent

A LocalJOSEObjectCredentialResolver that resolves credentials from the jwks_uri of an OpenID Provider. Further filtering of credentials is provided by the AbstractCriteriaFilteringCredentialResolver parent class.

Note, only RSA or EC keys are resolved as these are the only key types which should be exposed in public JWKS documents.

Field Summary

Fields

Modifier and Type	Field	Description
private boolean	isInitialized	Initialization flag.
private final JWKSetDecoratorManager	jwkSetDecoratorManager	The manager for JWKSet decorators.
private final Duration	keyFetchInterval	The remote key refresh interval.
private final org.slf4j.Logger	log	Class logger.
private final RemoteJwkSetCache	remoteJwkSetCache	The cache for remote JWK key sets.

Constructor Summary

Constructors

Constructor	Description
ProviderMetadataCredentialResolver(RemoteJwkSetCache jwkSetCache)	Constructor.
ProviderMetadataCredentialResolver(RemoteJwkSetCache jwkSetCache, Duration interval)	Constructor.
ProviderMetadataCredentialResolver(RemoteJwkSetCache jwkSetCache, Duration interval, JWKSetDecoratorManager manager)	Constructor.

Method Summary

Modifier and Type	Method	Description
void	initialize()
boolean	isInitialized()
protected Collection<Credential>	resolveFromMetadata(CriteriaSet criteriaSet, com.nimbusds.openid.connect.sdk.op.OIDCProviderMetadata metadata)	Fetch the remote JWK Set from the jwk_uri in the OpenID Provider's metadata.
protected Iterable<Credential>	resolveFromSource(CriteriaSet criteriaSet)

Methods inherited from class net.shibboleth.oidc.security.credential.impl.BasicJOSEObjectCredentialResolver

buildJWKCredential, deriveClientSecretCredential, extractKeyIdFromCriteria, populateCredentialsFromKeySet, postProcess, processJWEHeader, processJWSHeader

Methods inherited from class org.opensaml.security.credential.impl.AbstractCriteriaFilteringCredentialResolver

isSatisfyAllPredicates, resolve, setSatisfyAllPredicates

Methods inherited from class org.opensaml.security.credential.impl.AbstractCredentialResolver

resolveSingle

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Methods inherited from interface net.shibboleth.shared.resolver.Resolver

resolve, resolveSingle

Field Details

log

@Nonnull
private final org.slf4j.Logger log

Class logger.

isInitialized

private boolean isInitialized

Initialization flag.

remoteJwkSetCache

@Nonnull
private final RemoteJwkSetCache remoteJwkSetCache

The cache for remote JWK key sets.

keyFetchInterval

@Positive
private final Duration keyFetchInterval

The remote key refresh interval. Default value: 30 minutes.

jwkSetDecoratorManager

@Nullable
private final JWKSetDecoratorManager jwkSetDecoratorManager

The manager for JWKSet decorators.

Constructor Details

ProviderMetadataCredentialResolver

public ProviderMetadataCredentialResolver(@Nonnull @ParameterName(name="remoteJwkSetCache")
 RemoteJwkSetCache jwkSetCache)

Constructor.

Parameters:

jwkSetCache - The cache for remote JWK key sets.

ProviderMetadataCredentialResolver

public ProviderMetadataCredentialResolver(@Nonnull @ParameterName(name="remoteJwkSetCache")
 RemoteJwkSetCache jwkSetCache,
 @Nonnull @Positive @ParameterName(name="keyFetchInterval")
 Duration interval)

Constructor.

Parameters:

jwkSetCache - The cache for remote JWK key sets.

interval - The remote key refresh interval

ProviderMetadataCredentialResolver

public ProviderMetadataCredentialResolver(@Nonnull @ParameterName(name="remoteJwkSetCache")
 RemoteJwkSetCache jwkSetCache,
 @Nonnull @Positive @ParameterName(name="keyFetchInterval")
 Duration interval,
 @Nullable @ParameterName(name="jwkSetDecoratorManager")
 JWKSetDecoratorManager manager)

Constructor.

Parameters:

jwkSetCache - The cache for remote JWK key sets.

interval - The remote key refresh interval

Method Details

isInitialized

public boolean isInitialized()

Specified by:

isInitialized in interface InitializableComponent

initialize

public void initialize()
                throws ComponentInitializationException

Specified by:

initialize in interface InitializableComponent

Throws:

ComponentInitializationException

resolveFromSource

@Nonnull
protected Iterable<Credential> resolveFromSource(@Nullable
 CriteriaSet criteriaSet)
                                          throws ResolverException

Overrides:

resolveFromSource in class BasicJOSEObjectCredentialResolver

Throws:

ResolverException

resolveFromMetadata

@Nonnull
protected Collection<Credential> resolveFromMetadata(@Nonnull
 CriteriaSet criteriaSet,
 @Nonnull
 com.nimbusds.openid.connect.sdk.op.OIDCProviderMetadata metadata)

Fetch the remote JWK Set from the jwk_uri in the OpenID Provider's metadata. Convert each JWK into a Credential and return. Only supports EC (key agreement) and RSA (key encryption) keys.

If a keyId is passed through in the criteria set, it is used as a parameter to the remote JWK cache. This ensures if the key is not found any cached keyset document, the document is re-fetched irrespective of the cache entry expiry.

Parameters:

criteriaSet - the criteria set

metadata - the OpenID Provider's metadata

Returns:

a collection of credentials that represents EC and RSA keys in the remote JWK Set (if any)