Package net.shibboleth.sp.oidc.profile.impl

Class BuildRequestObject

java.lang.Object
net.shibboleth.shared.component.AbstractInitializableComponent
org.opensaml.profile.action.AbstractProfileAction
org.opensaml.profile.action.AbstractConditionalProfileAction
net.shibboleth.idp.profile.AbstractProfileAction
net.shibboleth.sp.oidc.profile.impl.BuildRequestObject
All Implemented Interfaces:
net.shibboleth.shared.component.Component, net.shibboleth.shared.component.DestructableComponent, net.shibboleth.shared.component.InitializableComponent, org.opensaml.profile.action.ProfileAction, Aware, MessageSource, MessageSourceAware, Action
public class BuildRequestObject extends net.shibboleth.idp.profile.AbstractProfileAction
Action that creates a Request Object JWT, and sets it to the work context OIDCAuthenticationRequest located under InOutOperationContext.getOutboundMessageContext().

Note, some parameters are set downstream in the flow before the request object is signed and or encrypted. These parameters are only available at that stage e.g. state.

Event:
EventIds.PROCEED_EVENT_ID, EventIds.INVALID_MSG_CTX, EventIds.INVALID_PROFILE_CTX, AuthnEventIds.INVALID_AUTHN_CTX
Precondition:
ProfileRequestContext.getOutboundMessageContext().getMessage() 
 instance of OIDCAuthenticationRequest.class
Postcondition:
Add a JWT request object to the in-flight authentication request

  • Field Summary

    Fields
    Modifier and Type
    Field
    Description
    private net.shibboleth.oidc.profile.core.OIDCAuthenticationRequest
    authnRequest
    OIDC authentication request built by the IdP.
    private Predicate<com.nimbusds.openid.connect.sdk.claims.ClaimsSet>
    claimsSetIsValidPredicate
    A hook to allow additional checking of the request object claims after it is built.
    private BiConsumer<org.opensaml.profile.context.ProfileRequestContext,com.nimbusds.openid.connect.sdk.claims.ClaimsSet>
    customClaimsStrategy
    A strategy hook to add custom claims to the claims set.
    private final org.slf4j.Logger
    log
    Class logger.
    private com.nimbusds.openid.connect.sdk.op.OIDCProviderMetadata
    providerMetadata
    OpenID Provider metadata .
    private Function<org.opensaml.profile.context.ProfileRequestContext,net.shibboleth.oidc.metadata.context.OIDCProviderMetadataContext>
    providerMetadataLookupStrategy
    Lookup strategy to locate the OpenID Provider metadata to use.
    private Predicate<org.opensaml.profile.context.ProfileRequestContext>
    requestObjectToBeSignedPredicate
    Is the request object going to be signed? if so the 'iss' and 'aud' claims will be set.

  • Constructor Summary

    Constructors
    Constructor
    Description
    BuildRequestObject()
    Constructor.

  • Method Summary

    Modifier and Type
    Method
    Description
    protected void
    doExecute(org.opensaml.profile.context.ProfileRequestContext profileRequestContext)
    protected boolean
    doPreExecute(org.opensaml.profile.context.ProfileRequestContext profileRequestContext)
     
    private void
    setClaimIfPresent(com.nimbusds.openid.connect.sdk.claims.ClaimsSet claims, String claimName, Object claim)
    Set the claim onto the claims set if not null.
    void
    setClaimsSetIsValidPredicate(Predicate<com.nimbusds.openid.connect.sdk.claims.ClaimsSet> predicate)
    Set a hook that allows the built request object to be validated before it is used.
    void
    setCustomClaimsStrategy(BiConsumer<org.opensaml.profile.context.ProfileRequestContext,com.nimbusds.openid.connect.sdk.claims.ClaimsSet> strategy)
    Set a bi-consumer hook to add custom claims to the request object.
    void
    setProviderMetadataLookupStrategy(Function<org.opensaml.profile.context.ProfileRequestContext,net.shibboleth.oidc.metadata.context.OIDCProviderMetadataContext> strategy)
    Set the lookup strategy to locate the OpenID providers metadata.
    void
    setRequestObjectToBeSignedPredicate(Predicate<org.opensaml.profile.context.ProfileRequestContext> predicate)
    Set a predicate to determine if the request object will be 'eventually' signed.
    private boolean
    validateRequestObject(org.opensaml.profile.context.ProfileRequestContext profileRequestContext, com.nimbusds.openid.connect.sdk.claims.ClaimsSet requestObjectClaims)
    Ensure the request object is valid by assessing the claims are correct.

    Methods inherited from class net.shibboleth.idp.profile.AbstractProfileAction

    doExecute, execute, getBean, getBean, getMessage, getMessage, getMessage, getParameter, getParameter, getProfileContextLookupStrategy, getRequestContext, getResult, setMessageSource, setProfileContextLookupStrategy

    Methods inherited from class org.opensaml.profile.action.AbstractConditionalProfileAction

    getActivationCondition, setActivationCondition

    Methods inherited from class org.opensaml.profile.action.AbstractProfileAction

    doPostExecute, doPostExecute, ensureHttpServletRequest, ensureHttpServletResponse, execute, getHttpServletRequest, getHttpServletRequestSupplier, getHttpServletResponse, getHttpServletResponseSupplier, getLogPrefix, isPreExecuteCalled, setHttpServletRequestSupplier, setHttpServletResponseSupplier

    Methods inherited from class net.shibboleth.shared.component.AbstractInitializableComponent

    checkComponentActive, checkSetterPreconditions, destroy, doDestroy, doInitialize, ifDestroyedThrowDestroyedComponentException, ifInitializedThrowUnmodifiabledComponentException, ifNotInitializedThrowUninitializedComponentException, initialize, isDestroyed, isInitialized

    Methods inherited from class java.lang.Object

    clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

    Methods inherited from interface net.shibboleth.shared.component.InitializableComponent

    initialize, isInitialized

  • Field Details

    • log

      @Nonnull private final org.slf4j.Logger log
      Class logger.

    • providerMetadataLookupStrategy

      @Nonnull private Function<org.opensaml.profile.context.ProfileRequestContext,net.shibboleth.oidc.metadata.context.OIDCProviderMetadataContext> providerMetadataLookupStrategy
      Lookup strategy to locate the OpenID Provider metadata to use.

    • claimsSetIsValidPredicate

      @Nonnull private Predicate<com.nimbusds.openid.connect.sdk.claims.ClaimsSet> claimsSetIsValidPredicate
      A hook to allow additional checking of the request object claims after it is built.

    • customClaimsStrategy

      @Nonnull private BiConsumer<org.opensaml.profile.context.ProfileRequestContext,com.nimbusds.openid.connect.sdk.claims.ClaimsSet> customClaimsStrategy
      A strategy hook to add custom claims to the claims set.

    • requestObjectToBeSignedPredicate

      @Nonnull private Predicate<org.opensaml.profile.context.ProfileRequestContext> requestObjectToBeSignedPredicate
      Is the request object going to be signed? if so the 'iss' and 'aud' claims will be set. Defaults to always true, as it is permissible that both 'iss' and 'aud' claim can exist in plain request objects.

    • authnRequest

      @NonnullBeforeExec private net.shibboleth.oidc.profile.core.OIDCAuthenticationRequest authnRequest
      OIDC authentication request built by the IdP.

    • providerMetadata

      @NonnullBeforeExec private com.nimbusds.openid.connect.sdk.op.OIDCProviderMetadata providerMetadata
      OpenID Provider metadata .

  • Constructor Details

    • BuildRequestObject

      public BuildRequestObject()
      Constructor.

  • Method Details

    • setCustomClaimsStrategy

      public void setCustomClaimsStrategy(@Nullable BiConsumer<org.opensaml.profile.context.ProfileRequestContext,com.nimbusds.openid.connect.sdk.claims.ClaimsSet> strategy)
      Set a bi-consumer hook to add custom claims to the request object.
      Parameters:
      strategy - The custom claims strategy to set.

    • setProviderMetadataLookupStrategy

      public void setProviderMetadataLookupStrategy(@Nonnull Function<org.opensaml.profile.context.ProfileRequestContext,net.shibboleth.oidc.metadata.context.OIDCProviderMetadataContext> strategy)
      Set the lookup strategy to locate the OpenID providers metadata.
      Parameters:
      strategy - the strategy.

    • setClaimsSetIsValidPredicate

      public void setClaimsSetIsValidPredicate(@Nullable Predicate<com.nimbusds.openid.connect.sdk.claims.ClaimsSet> predicate)
      Set a hook that allows the built request object to be validated before it is used. This is run in addition too, but before, the built in validation taken from the specification. If this returns false, the built in validation is not run, and validation fails.
      Parameters:
      predicate - the hook to run

    • setRequestObjectToBeSignedPredicate

      public void setRequestObjectToBeSignedPredicate(@Nullable Predicate<org.opensaml.profile.context.ProfileRequestContext> predicate)
      Set a predicate to determine if the request object will be 'eventually' signed. If so, the 'iss' and 'aud' claims will be set into the request object.
      Parameters:
      predicate - the predicate

    • doPreExecute

      protected boolean doPreExecute(@Nonnull org.opensaml.profile.context.ProfileRequestContext profileRequestContext)
      Overrides:
      doPreExecute in class org.opensaml.profile.action.AbstractConditionalProfileAction

    • doExecute

      protected void doExecute(@Nonnull org.opensaml.profile.context.ProfileRequestContext profileRequestContext)
      Overrides:
      doExecute in class org.opensaml.profile.action.AbstractProfileAction

    • setClaimIfPresent

      private void setClaimIfPresent(@Nonnull com.nimbusds.openid.connect.sdk.claims.ClaimsSet claims, @Nonnull String claimName, @Nullable Object claim)
      Set the claim onto the claims set if not null. Calls toString on each value, assuming it will produce the correct value.
      Parameters:
      claims - the claims set
      claimName - the claim name
      claim - the claim

    • validateRequestObject

      private boolean validateRequestObject(@Nonnull org.opensaml.profile.context.ProfileRequestContext profileRequestContext, @Nonnull com.nimbusds.openid.connect.sdk.claims.ClaimsSet requestObjectClaims)
      Ensure the request object is valid by assessing the claims are correct.
      Parameters:
      profileRequestContext - the profile request context
      requestObjectClaims - the claims of the request object
      Returns:
      true if the request object claims are valid, false otherwise