Package net.shibboleth.sp.oidc.profile.impl

Class InitializeOAuth2ClientAuthenticationMethodHandler

java.lang.Object
net.shibboleth.shared.component.AbstractInitializableComponent
org.opensaml.messaging.handler.AbstractMessageHandler
net.shibboleth.sp.oidc.profile.impl.InitializeOAuth2ClientAuthenticationMethodHandler
All Implemented Interfaces:
net.shibboleth.shared.component.Component, net.shibboleth.shared.component.DestructableComponent, net.shibboleth.shared.component.InitializableComponent, org.opensaml.messaging.handler.MessageHandler
public class InitializeOAuth2ClientAuthenticationMethodHandler extends org.opensaml.messaging.handler.AbstractMessageHandler
An action that resolves the Client Authentication method for the chosen OpenID Provider (issuer) from the profile configuration, and adds it to the OAuth2ClientAuthenticationContext.

If a JWT client authentication type, the security parameters context is used to create a signed JWT client assertion.

Event:
EventIds.PROCEED_EVENT_ID, IdPEventIds.INVALID_PROFILE_CONFIG, EventIds.INVALID_PROFILE_CTX, IdPEventIds.INVALID_RELYING_PARTY_CONFIG
Postcondition:
Add the ClientAuthenticationMethod to the OAuth2ClientAuthenticationContext TODO split the logic out into commons to share for RP and Proxy

  • Field Summary

    Fields
    Modifier and Type
    Field
    Description
    private String
    clientAuthMethod
    The stashed client authentication method to use.
    private net.shibboleth.oidc.security.credential.ClientSecretCredential
    clientCredential
    The stashed client_secret to use if required.
    private String
    clientId
    The stashed client identifier for this request.
    private Function<org.opensaml.profile.context.ProfileRequestContext,String>
    issuerLookupStrategy
    Strategy used to obtain the request issuer value.
    private net.shibboleth.oidc.security.jose.context.SecurityParametersContext
    jwtBearerClientAuthSecurityParameters
    Stashed security parameters context for JWT Bearer Token client authentication methods.
    private Duration
    jwtBearerExpiryOffset
    The offset to add to the 'exp' claim time for JWT client authentication methods.
    private final org.slf4j.Logger
    log
    Class logger.
    private net.shibboleth.oidc.authn.context.OAuth2ClientAuthenticationContext
    oauth2ClientAuthenticationContext
    The stashed OAuth2 client authentication context.
    private Function<org.opensaml.messaging.context.MessageContext,net.shibboleth.oidc.authn.context.OAuth2ClientAuthenticationContext>
    oauth2ClientAuthenticationContextLookupStrategy
    The strategy used to lookup or create the OAuth2ClientAuthenticationContext for storing the client authentication.
    private Function<org.opensaml.messaging.context.MessageContext,net.shibboleth.oidc.profile.messaging.context.OIDCPeerEntityContext>
    oidcPeerEntityContextLookupStrategy
    Strategy to resolve the OIDC entity context class.
    private net.shibboleth.oidc.profile.messaging.context.OIDCPeerEntityContext
    peerEntityContext
    The stashed peer entity context.
    private static final org.opensaml.profile.context.navigate.ParentProfileRequestContextLookup<org.opensaml.messaging.context.MessageContext>
    PRC_LOOKUP
    Lookup function for parent ProfileRequestContext.
    private net.shibboleth.oidc.profile.config.OIDCAuthenticationRelyingPartyProfileConfiguration
    profileConfiguration
    Applicable stashed profile configuration.
    private com.nimbusds.openid.connect.sdk.op.OIDCProviderMetadata
    providerMetadata
    The stashed provider metadata.
    private Function<org.opensaml.messaging.context.MessageContext,net.shibboleth.oidc.metadata.context.OIDCProviderMetadataContext>
    providerMetadataLookupStrategy
    Lookup strategy to locate the OP metadata to use.
    private Function<org.opensaml.profile.context.ProfileRequestContext,net.shibboleth.profile.context.RelyingPartyContext>
    relyingPartyContextLookupStrategy
    Lookup function for relying party context.
    private Function<org.opensaml.messaging.context.MessageContext,net.shibboleth.oidc.security.jose.context.SecurityParametersContext>
    securityParametersContextLookupStrategy
    Strategy used to look up the SecurityParametersContext to set the parameters for.

  • Constructor Summary

    Constructors
    Constructor
    Description
    InitializeOAuth2ClientAuthenticationMethodHandler()
    Constructor.

  • Method Summary

    Modifier and Type
    Method
    Description
    private com.nimbusds.jwt.SignedJWT
    buildClientAuthenticationJwt(org.opensaml.messaging.context.MessageContext messageContext)
    Build a signed JWT bearer token for client authentication using the populated security parameters.
    private com.nimbusds.jwt.JWTClaimsSet
    buildClientAuthenticationJwtClaims(org.opensaml.messaging.context.MessageContext messageContext)
    Build the claim values required for a client authentication bearer JWT.
    protected void
    doInvoke(org.opensaml.messaging.context.MessageContext messageContext)
     
    protected boolean
    doPreInvoke(org.opensaml.messaging.context.MessageContext messageContext)
    void
    setIssuerLookupStrategy(Function<org.opensaml.profile.context.ProfileRequestContext,String> strategy)
    Set the strategy used to locate the issuer value to use.
    void
    setJwtBearerExpiryOffset(Duration expiry)
    Set the JWT expiry time offset for appropriate client authentication methods.
    void
    setOAuth2ClientAuthenticationContextLookupStrategy(Function<org.opensaml.messaging.context.MessageContext,net.shibboleth.oidc.authn.context.OAuth2ClientAuthenticationContext> strgy)
    Set the strategy to lookup the OAuth2ClientAuthenticationContext from the MessageContext.
    void
    setOidcPeerEntityContextLookupStrategy(Function<org.opensaml.messaging.context.MessageContext,net.shibboleth.oidc.profile.messaging.context.OIDCPeerEntityContext> strategy)
    Set the lookup strategy to find the OIDCPeerEntityContext.
    void
    setProviderMetadataLookupStrategy(Function<org.opensaml.messaging.context.MessageContext,net.shibboleth.oidc.metadata.context.OIDCProviderMetadataContext> strategy)
    Set the lookup strategy to locate the OpenID providers metadata.
    void
    setRelyingPartyContextLookupStrategy(Function<org.opensaml.profile.context.ProfileRequestContext,net.shibboleth.profile.context.RelyingPartyContext> strategy)
    Set lookup strategy for relying party context.
    void
    setSecurityParametersContextLookupStrategy(Function<org.opensaml.messaging.context.MessageContext,net.shibboleth.oidc.security.jose.context.SecurityParametersContext> strategy)
    Set the strategy used to look up the SecurityParametersContext.
    private void
    verifySuitableClientSecretJWTSecurityContext()
    Check the populated security context is using the correct algorithm family for client_secret_jwt client authentication.
    private void
    verifySuitablePrivateKetJWTSecurityContext()
    Check the populated security context is using the correct algorithm family for private_key_jwt client authentication.

    Methods inherited from class org.opensaml.messaging.handler.AbstractMessageHandler

    doPostInvoke, doPostInvoke, getActivationCondition, getLogPrefix, invoke, isPreInvokeCalled, setActivationCondition

    Methods inherited from class net.shibboleth.shared.component.AbstractInitializableComponent

    checkComponentActive, checkSetterPreconditions, destroy, doDestroy, doInitialize, ifDestroyedThrowDestroyedComponentException, ifInitializedThrowUnmodifiabledComponentException, ifNotInitializedThrowUninitializedComponentException, initialize, isDestroyed, isInitialized

    Methods inherited from class java.lang.Object

    clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

    Methods inherited from interface net.shibboleth.shared.component.InitializableComponent

    initialize, isInitialized

  • Field Details

    • PRC_LOOKUP

      @Nonnull private static final org.opensaml.profile.context.navigate.ParentProfileRequestContextLookup<org.opensaml.messaging.context.MessageContext> PRC_LOOKUP
      Lookup function for parent ProfileRequestContext.

    • log

      @Nonnull private final org.slf4j.Logger log
      Class logger.

    • oauth2ClientAuthenticationContextLookupStrategy

      @Nonnull private Function<org.opensaml.messaging.context.MessageContext,net.shibboleth.oidc.authn.context.OAuth2ClientAuthenticationContext> oauth2ClientAuthenticationContextLookupStrategy
      The strategy used to lookup or create the OAuth2ClientAuthenticationContext for storing the client authentication.

    • oauth2ClientAuthenticationContext

      @NonnullBeforeExec private net.shibboleth.oidc.authn.context.OAuth2ClientAuthenticationContext oauth2ClientAuthenticationContext
      The stashed OAuth2 client authentication context.

    • providerMetadataLookupStrategy

      @Nonnull private Function<org.opensaml.messaging.context.MessageContext,net.shibboleth.oidc.metadata.context.OIDCProviderMetadataContext> providerMetadataLookupStrategy
      Lookup strategy to locate the OP metadata to use.

    • relyingPartyContextLookupStrategy

      @Nonnull private Function<org.opensaml.profile.context.ProfileRequestContext,net.shibboleth.profile.context.RelyingPartyContext> relyingPartyContextLookupStrategy
      Lookup function for relying party context.

    • oidcPeerEntityContextLookupStrategy

      @Nonnull private Function<org.opensaml.messaging.context.MessageContext,net.shibboleth.oidc.profile.messaging.context.OIDCPeerEntityContext> oidcPeerEntityContextLookupStrategy
      Strategy to resolve the OIDC entity context class.

    • profileConfiguration

      @NonnullBeforeExec private net.shibboleth.oidc.profile.config.OIDCAuthenticationRelyingPartyProfileConfiguration profileConfiguration
      Applicable stashed profile configuration.

    • securityParametersContextLookupStrategy

      @Nonnull private Function<org.opensaml.messaging.context.MessageContext,net.shibboleth.oidc.security.jose.context.SecurityParametersContext> securityParametersContextLookupStrategy
      Strategy used to look up the SecurityParametersContext to set the parameters for.

    • issuerLookupStrategy

      @Nonnull private Function<org.opensaml.profile.context.ProfileRequestContext,String> issuerLookupStrategy
      Strategy used to obtain the request issuer value.

    • jwtBearerExpiryOffset

      @Nonnull private Duration jwtBearerExpiryOffset
      The offset to add to the 'exp' claim time for JWT client authentication methods. Default is 30 seconds.

    • jwtBearerClientAuthSecurityParameters

      @Nullable private net.shibboleth.oidc.security.jose.context.SecurityParametersContext jwtBearerClientAuthSecurityParameters
      Stashed security parameters context for JWT Bearer Token client authentication methods. Can be null if those client authentication methods are not used.

    • providerMetadata

      @NonnullBeforeExec private com.nimbusds.openid.connect.sdk.op.OIDCProviderMetadata providerMetadata
      The stashed provider metadata.

    • clientCredential

      @Nullable private net.shibboleth.oidc.security.credential.ClientSecretCredential clientCredential
      The stashed client_secret to use if required.

    • clientAuthMethod

      @Nullable private String clientAuthMethod
      The stashed client authentication method to use.

    • clientId

      @Nullable private String clientId
      The stashed client identifier for this request.

    • peerEntityContext

      @Nullable private net.shibboleth.oidc.profile.messaging.context.OIDCPeerEntityContext peerEntityContext
      The stashed peer entity context.

  • Constructor Details

    • InitializeOAuth2ClientAuthenticationMethodHandler

      public InitializeOAuth2ClientAuthenticationMethodHandler()
      Constructor.

  • Method Details

    • setOidcPeerEntityContextLookupStrategy

      public void setOidcPeerEntityContextLookupStrategy(Function<org.opensaml.messaging.context.MessageContext,net.shibboleth.oidc.profile.messaging.context.OIDCPeerEntityContext> strategy)
      Set the lookup strategy to find the OIDCPeerEntityContext.
      Parameters:
      strategy - the strategy to set.

    • setJwtBearerExpiryOffset

      public void setJwtBearerExpiryOffset(@Nonnull Duration expiry)
      Set the JWT expiry time offset for appropriate client authentication methods.
      Parameters:
      expiry - the JWT 'exp' claim offset

    • setProviderMetadataLookupStrategy

      public void setProviderMetadataLookupStrategy(@Nonnull Function<org.opensaml.messaging.context.MessageContext,net.shibboleth.oidc.metadata.context.OIDCProviderMetadataContext> strategy)
      Set the lookup strategy to locate the OpenID providers metadata.
      Parameters:
      strategy - the strategy.

    • setSecurityParametersContextLookupStrategy

      public void setSecurityParametersContextLookupStrategy(@Nonnull Function<org.opensaml.messaging.context.MessageContext,net.shibboleth.oidc.security.jose.context.SecurityParametersContext> strategy)
      Set the strategy used to look up the SecurityParametersContext.
      Parameters:
      strategy - lookup strategy

    • setRelyingPartyContextLookupStrategy

      public void setRelyingPartyContextLookupStrategy(@Nonnull Function<org.opensaml.profile.context.ProfileRequestContext,net.shibboleth.profile.context.RelyingPartyContext> strategy)
      Set lookup strategy for relying party context.
      Parameters:
      strategy - lookup strategy

    • setOAuth2ClientAuthenticationContextLookupStrategy

      public void setOAuth2ClientAuthenticationContextLookupStrategy(@Nonnull Function<org.opensaml.messaging.context.MessageContext,net.shibboleth.oidc.authn.context.OAuth2ClientAuthenticationContext> strgy)
      Set the strategy to lookup the OAuth2ClientAuthenticationContext from the MessageContext.
      Parameters:
      strgy - the strategy.

    • setIssuerLookupStrategy

      public void setIssuerLookupStrategy(@Nonnull Function<org.opensaml.profile.context.ProfileRequestContext,String> strategy)
      Set the strategy used to locate the issuer value to use.
      Parameters:
      strategy - lookup strategy

    • doPreInvoke

      protected boolean doPreInvoke(@Nonnull org.opensaml.messaging.context.MessageContext messageContext) throws org.opensaml.messaging.handler.MessageHandlerException
      Overrides:
      doPreInvoke in class org.opensaml.messaging.handler.AbstractMessageHandler
      Throws:
      org.opensaml.messaging.handler.MessageHandlerException

    • doInvoke

      protected void doInvoke(org.opensaml.messaging.context.MessageContext messageContext) throws org.opensaml.messaging.handler.MessageHandlerException
      Specified by:
      doInvoke in class org.opensaml.messaging.handler.AbstractMessageHandler
      Throws:
      org.opensaml.messaging.handler.MessageHandlerException

    • verifySuitableClientSecretJWTSecurityContext

      private void verifySuitableClientSecretJWTSecurityContext() throws org.opensaml.messaging.handler.MessageHandlerException
      Check the populated security context is using the correct algorithm family for client_secret_jwt client authentication.
      Throws:
      org.opensaml.messaging.handler.MessageHandlerException - if the wrong algorithm family is specified in the security context

    • verifySuitablePrivateKetJWTSecurityContext

      private void verifySuitablePrivateKetJWTSecurityContext() throws org.opensaml.messaging.handler.MessageHandlerException
      Check the populated security context is using the correct algorithm family for private_key_jwt client authentication.
      Throws:
      org.opensaml.messaging.handler.MessageHandlerException - if the wrong algorithm family is specified in the security context

    • buildClientAuthenticationJwtClaims

      @Nonnull private com.nimbusds.jwt.JWTClaimsSet buildClientAuthenticationJwtClaims(@Nonnull org.opensaml.messaging.context.MessageContext messageContext) throws org.opensaml.messaging.handler.MessageHandlerException
      Build the claim values required for a client authentication bearer JWT. The audience is either set to the issuer identifier of the OP if OAuth2ClientAuthenticableClientProfileConfiguration.isUseTargetedEndpointAsJWTAudience(ProfileRequestContext) is false, or the token endpoint URL if true.
      Parameters:
      messageContext - the message context
      Returns:
      the constructed JWT claims set
      Throws:
      org.opensaml.messaging.handler.MessageHandlerException - on error constructing the JWT

    • buildClientAuthenticationJwt

      @Nonnull private com.nimbusds.jwt.SignedJWT buildClientAuthenticationJwt(@Nonnull org.opensaml.messaging.context.MessageContext messageContext) throws org.opensaml.messaging.handler.MessageHandlerException
      Build a signed JWT bearer token for client authentication using the populated security parameters. Relies on the correct 'alg' and credential existing in the security context ahead of time for the correct SignedJWT to be returned e.g. for either client_secret_jwt or private_key_jwt.
      Parameters:
      messageContext - the message context
      Returns:
      a signed JWT bearer token, or throws an exception if there was an error during construction
      Throws:
      org.opensaml.messaging.handler.MessageHandlerException - on error constructing the JWT