Package net.shibboleth.sp.oidc.profile

Class AuthenticationRequestStateData

java.lang.Object
net.shibboleth.sp.state.StateData
net.shibboleth.sp.oidc.profile.AuthenticationRequestStateData
@NotThreadSafe public class AuthenticationRequestStateData extends net.shibboleth.sp.state.StateData
A DTO class that carries OIDC specific authentication request information that needs to be recovered to validate the authentication response. This class is designed for JSON serialization and deserialization for storage.

  • Field Summary

    Fields
    Modifier and Type
    Field
    Description
    private boolean
    authTimeRequired
    Has auth_time been requested and is required inside the id_token? either because the max_age parameter was used, or the claims parameter requested auth_time.
    private Duration
    maxAge
    The optional max authentication age.
    private String
    nonce
    The id_token nonce value.
    private String
    pkceCodeVerifier
    The optional PKCE code verifier.

  • Constructor Summary

    Constructors
    Constructor
    Description
    AuthenticationRequestStateData()
     

  • Method Summary

    Modifier and Type
    Method
    Description
    (package private) static boolean
    determineIsPassive(net.shibboleth.oidc.profile.core.OIDCAuthenticationRequest request)
    Determine if the authentication request is passive by checking if the prompt parameter contains "none".
    boolean
    equals(Object obj)
    static AuthenticationRequestStateData
    from(net.shibboleth.oidc.profile.core.OIDCAuthenticationRequest request, String authenticationAuthority)
    Create an instance of this class from the given authentication request and authentication authority.
    Duration
    getMaxAge()
    Set the maxAge, a null value indicates no maxAge was specified in the authentication request.
    String
    getNonce()
    Get the nonce expected in the id_token response.
    String
    getPkceCodeVerifier()
    Get the PKCE code verifier used to generate the code challenge in the authentication request.
    int
    hashCode()
    boolean
    isAuthTimeRequired()
    Is auth_time required inside the id_token? either because the max_age parameter was used, or the claims parameter requested it.
    (package private) static boolean
    isAuthTimeRequired(net.shibboleth.oidc.profile.core.OIDCAuthenticationRequest request)
    Determine if auth_time is required inside the id_token either because the max_age parameter was used, or the claims parameter requested it as an ESSENTIAL claim.
    AuthenticationRequestStateData
    setAuthTimeRequired(boolean requested)
    Set if auth_time is required inside the id_token either because the max_age parameter was used, or the claims parameter requested it.
    AuthenticationRequestStateData
    setMaxAge(Duration age)
    set the maxAge, a null value indicates no maxAge was specified in the authentication request.
    AuthenticationRequestStateData
    setNonce(String nonceIn)
    Set the nonce expected in the id_token response.
    AuthenticationRequestStateData
    setPkceCodeVerifier(String code)
    Set the PKCE code verifier used to generate the code challenge in the authentication request.
    String
    toString()

    Methods inherited from class net.shibboleth.sp.state.StateData

    decode, encode, getAcrs, getAuthenticationAuthority, getClientAddress, getIssuer, getPassive, getRawResource, getRequestTime, getResource, getResponseLocation, mask, setAcrs, setAuthenticationAuthority, setClientAddress, setIssuer, setPassive, setRawResource, setRequestTime, setResource, setResponseLocation

    Methods inherited from class java.lang.Object

    clone, finalize, getClass, notify, notifyAll, wait, wait, wait

  • Field Details

    • nonce

      @Nullable private String nonce
      The id_token nonce value.

    • pkceCodeVerifier

      @Nullable private String pkceCodeVerifier
      The optional PKCE code verifier.

    • maxAge

      @Nullable private Duration maxAge
      The optional max authentication age.

    • authTimeRequired

      private boolean authTimeRequired
      Has auth_time been requested and is required inside the id_token? either because the max_age parameter was used, or the claims parameter requested auth_time.

  • Constructor Details

    • AuthenticationRequestStateData

      public AuthenticationRequestStateData()

  • Method Details

    • getNonce

      @Nullable public String getNonce()
      Get the nonce expected in the id_token response.
      Returns:
      the nonce

    • setNonce

      @Nonnull public AuthenticationRequestStateData setNonce(@Nullable String nonceIn)
      Set the nonce expected in the id_token response.
      Parameters:
      nonceIn - the nonce to set
      Returns:
      the updated object

    • getPkceCodeVerifier

      @Nullable public String getPkceCodeVerifier()
      Get the PKCE code verifier used to generate the code challenge in the authentication request.
      Returns:
      the PKCE code verifier

    • setPkceCodeVerifier

      @Nonnull public AuthenticationRequestStateData setPkceCodeVerifier(@Nullable String code)
      Set the PKCE code verifier used to generate the code challenge in the authentication request.
      Parameters:
      code - the PKCE code verifier
      Returns:
      the updated object

    • getMaxAge

      public Duration getMaxAge()
      Set the maxAge, a null value indicates no maxAge was specified in the authentication request.
      Returns:
      the maxAge.

    • setMaxAge

      @Nonnull public AuthenticationRequestStateData setMaxAge(@Nullable Duration age)
      set the maxAge, a null value indicates no maxAge was specified in the authentication request.
      Parameters:
      age - The max_age to set.
      Returns:
      the updated object

    • setAuthTimeRequired

      @Nonnull public AuthenticationRequestStateData setAuthTimeRequired(boolean requested)
      Set if auth_time is required inside the id_token either because the max_age parameter was used, or the claims parameter requested it.
      Parameters:
      requested - is the auth_time requested and hence required inside the id_token.
      Returns:
      the updated object

    • isAuthTimeRequired

      public boolean isAuthTimeRequired()
      Is auth_time required inside the id_token? either because the max_age parameter was used, or the claims parameter requested it.
      Returns:
      true if auth_time has been requested and is required inside the id_token, false otherwise.

    • from

      public static AuthenticationRequestStateData from(@Nonnull net.shibboleth.oidc.profile.core.OIDCAuthenticationRequest request, @Nonnull String authenticationAuthority)
      Create an instance of this class from the given authentication request and authentication authority.
      Parameters:
      request - the authentication request
      authenticationAuthority - the expected issuer of the authentication response
      Returns:
      a populated instance of this class

    • determineIsPassive

      static boolean determineIsPassive(@Nonnull net.shibboleth.oidc.profile.core.OIDCAuthenticationRequest request)
      Determine if the authentication request is passive by checking if the prompt parameter contains "none".
      Parameters:
      request - the authentication request
      Returns:
      true if the prompt parameter contains "none", false otherwise.

    • isAuthTimeRequired

      static boolean isAuthTimeRequired(@Nonnull net.shibboleth.oidc.profile.core.OIDCAuthenticationRequest request)
      Determine if auth_time is required inside the id_token either because the max_age parameter was used, or the claims parameter requested it as an ESSENTIAL claim.
      Parameters:
      request - the authentication request
      Returns:
      true if auth_time is required inside the id_token, false otherwise.

    • toString

      public String toString()
      Overrides:
      toString in class net.shibboleth.sp.state.StateData

    • hashCode

      public int hashCode()
      Overrides:
      hashCode in class net.shibboleth.sp.state.StateData

    • equals

      public boolean equals(Object obj)
      Overrides:
      equals in class net.shibboleth.sp.state.StateData