Package net.shibboleth.sp.oidc.profile.impl

Class ValidateUserInfoJSONObjectClaims

java.lang.Object
net.shibboleth.shared.component.AbstractInitializableComponent
org.opensaml.profile.action.AbstractProfileAction
org.opensaml.profile.action.AbstractConditionalProfileAction
net.shibboleth.idp.profile.AbstractProfileAction
net.shibboleth.sp.oidc.profile.impl.ValidateUserInfoJSONObjectClaims
All Implemented Interfaces:
net.shibboleth.shared.component.Component, net.shibboleth.shared.component.DestructableComponent, net.shibboleth.shared.component.InitializableComponent, org.opensaml.profile.action.ProfileAction, Aware, MessageSource, MessageSourceAware, Action
public class ValidateUserInfoJSONObjectClaims extends net.shibboleth.idp.profile.AbstractProfileAction
Validate a successful UserInfo JSON Object Response according to section 5.3.2 of OpenID Connect Core 1.0.
Event:
EventIds.PROCEED_EVENT_ID, OidcEventIds.INVALID_USERINFO_CLAIMS, EventIds.INVALID_PROFILE_CTX
Precondition:
ProfileRequestContext.getSubcontext(AuthenticationContext.class, false) != null

  • Field Summary

    Fields
    Modifier and Type
    Field
    Description
    private com.nimbusds.jwt.JWTClaimsSet
    idTokenClaims
    The stashed id_token claims.
    private final org.slf4j.Logger
    log
    Class logger.
    private Function<org.opensaml.profile.context.ProfileRequestContext,net.shibboleth.oidc.profile.context.AccessTokenResponseContext>
    tokenResponseContextLookupStrategy
    Strategy used to look up the AccessTokenResponseContext.
    private com.nimbusds.openid.connect.sdk.UserInfoSuccessResponse
    userInfo
    The stashed user info response.
    private net.shibboleth.oidc.profile.context.UserInfoResponseContext
    userInfoCtx
    The stashed user info response context.
    private Function<org.opensaml.profile.context.ProfileRequestContext,net.shibboleth.oidc.profile.context.UserInfoResponseContext>
    userInfoResponseContextLookupStrategy
    Strategy used to look up the UserInfoResponseContext.

  • Constructor Summary

    Constructors
    Constructor
    Description
    ValidateUserInfoJSONObjectClaims()
    Constructor.

  • Method Summary

    Modifier and Type
    Method
    Description
    protected void
    doExecute(org.opensaml.profile.context.ProfileRequestContext profileRequestContext)
     
    protected boolean
    doPreExecute(org.opensaml.profile.context.ProfileRequestContext profileRequestContext)
     
    private com.nimbusds.openid.connect.sdk.claims.ClaimsSet
    resolveClaimsSet(com.nimbusds.openid.connect.sdk.UserInfoResponse response)
    Resolve the UserInfo claims from the user info response.
    void
    setTokenResponseContextLookupStrategy(Function<org.opensaml.profile.context.ProfileRequestContext,net.shibboleth.oidc.profile.context.AccessTokenResponseContext> strategy)
    Set the strategy used to look up a AccessTokenResponseContext.
    void
    setUserInfoResponseContextLookupStrategy(Function<org.opensaml.profile.context.ProfileRequestContext,net.shibboleth.oidc.profile.context.UserInfoResponseContext> strategy)
    Set the strategy used to look up a UserInfoResponseContext.

    Methods inherited from class net.shibboleth.idp.profile.AbstractProfileAction

    doExecute, execute, getBean, getBean, getMessage, getMessage, getMessage, getParameter, getParameter, getProfileContextLookupStrategy, getRequestContext, getResult, setMessageSource, setProfileContextLookupStrategy

    Methods inherited from class org.opensaml.profile.action.AbstractConditionalProfileAction

    getActivationCondition, setActivationCondition

    Methods inherited from class org.opensaml.profile.action.AbstractProfileAction

    doPostExecute, doPostExecute, ensureHttpServletRequest, ensureHttpServletResponse, execute, getHttpServletRequest, getHttpServletRequestSupplier, getHttpServletResponse, getHttpServletResponseSupplier, getLogPrefix, isPreExecuteCalled, setHttpServletRequestSupplier, setHttpServletResponseSupplier

    Methods inherited from class net.shibboleth.shared.component.AbstractInitializableComponent

    checkComponentActive, checkSetterPreconditions, destroy, doDestroy, doInitialize, ifDestroyedThrowDestroyedComponentException, ifInitializedThrowUnmodifiabledComponentException, ifNotInitializedThrowUninitializedComponentException, initialize, isDestroyed, isInitialized

    Methods inherited from class java.lang.Object

    clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

    Methods inherited from interface net.shibboleth.shared.component.InitializableComponent

    initialize, isInitialized

  • Field Details

    • log

      @Nonnull private final org.slf4j.Logger log
      Class logger.

    • userInfoResponseContextLookupStrategy

      @Nonnull private Function<org.opensaml.profile.context.ProfileRequestContext,net.shibboleth.oidc.profile.context.UserInfoResponseContext> userInfoResponseContextLookupStrategy
      Strategy used to look up the UserInfoResponseContext.

    • tokenResponseContextLookupStrategy

      @Nonnull private Function<org.opensaml.profile.context.ProfileRequestContext,net.shibboleth.oidc.profile.context.AccessTokenResponseContext> tokenResponseContextLookupStrategy
      Strategy used to look up the AccessTokenResponseContext.

    • userInfoCtx

      @NonnullBeforeExec private net.shibboleth.oidc.profile.context.UserInfoResponseContext userInfoCtx
      The stashed user info response context.

    • userInfo

      @NonnullBeforeExec private com.nimbusds.openid.connect.sdk.UserInfoSuccessResponse userInfo
      The stashed user info response.

    • idTokenClaims

      @NonnullBeforeExec private com.nimbusds.jwt.JWTClaimsSet idTokenClaims
      The stashed id_token claims.

  • Constructor Details

    • ValidateUserInfoJSONObjectClaims

      public ValidateUserInfoJSONObjectClaims()
      Constructor.

  • Method Details

    • setTokenResponseContextLookupStrategy

      public void setTokenResponseContextLookupStrategy(@Nonnull Function<org.opensaml.profile.context.ProfileRequestContext,net.shibboleth.oidc.profile.context.AccessTokenResponseContext> strategy)
      Set the strategy used to look up a AccessTokenResponseContext.
      Parameters:
      strategy - lookup strategy

    • setUserInfoResponseContextLookupStrategy

      public void setUserInfoResponseContextLookupStrategy(@Nonnull Function<org.opensaml.profile.context.ProfileRequestContext,net.shibboleth.oidc.profile.context.UserInfoResponseContext> strategy)
      Set the strategy used to look up a UserInfoResponseContext.
      Parameters:
      strategy - lookup strategy

    • doPreExecute

      protected boolean doPreExecute(@Nonnull org.opensaml.profile.context.ProfileRequestContext profileRequestContext)
      Overrides:
      doPreExecute in class org.opensaml.profile.action.AbstractConditionalProfileAction

    • doExecute

      protected void doExecute(@Nonnull org.opensaml.profile.context.ProfileRequestContext profileRequestContext)
      Overrides:
      doExecute in class org.opensaml.profile.action.AbstractProfileAction

    • resolveClaimsSet

      @Nullable private com.nimbusds.openid.connect.sdk.claims.ClaimsSet resolveClaimsSet(@Nonnull com.nimbusds.openid.connect.sdk.UserInfoResponse response)
      Resolve the UserInfo claims from the user info response. If JWT type, extract from the JWT claims. If plain JSON object type, resolve directly from the UserInfo claims set.
      Parameters:
      response - the UserInfo response
      Returns:
      the UserInfo claims. Return null if not found, wrong response type, or there was a parsing exception