Package net.shibboleth.sp.oidc.profile.impl

Class ExtractOIDCClaims

java.lang.Object
net.shibboleth.shared.component.AbstractInitializableComponent
org.opensaml.profile.action.AbstractProfileAction
org.opensaml.profile.action.AbstractConditionalProfileAction
net.shibboleth.idp.profile.AbstractProfileAction
net.shibboleth.sp.profile.AbstractAgentRequestAction
net.shibboleth.sp.profile.AbstractAgentAction
net.shibboleth.sp.profile.AbstractApplicationAction
net.shibboleth.sp.oidc.profile.impl.ExtractOIDCClaims
All Implemented Interfaces:
net.shibboleth.shared.component.Component, net.shibboleth.shared.component.DestructableComponent, net.shibboleth.shared.component.InitializableComponent, org.opensaml.profile.action.ProfileAction, Aware, MessageSource, MessageSourceAware, Action
public class ExtractOIDCClaims extends net.shibboleth.sp.profile.AbstractApplicationAction
An action that extracts OIDC End-User claims from the combined id_token and UserInfo response claims in the EndUserClaimsContext.

Attributes decoded from the assertion(s) are in an unfiltered state and subject to the filtering service. Any other data extracted is stored directly in the filtered set.

There are three supplemental sets: the optional "standard" set extracted from the message, an optional profile config-supplied strategy function, and an optional use of the AttributeResolver associated with the Application.

The final set of attributes is stored back in the AttributeContext for use by later actions.

Event:
EventIds.INVALID_MESSAGE, IdPEventIds.INVALID_RELYING_PARTY_CTX, IdPEventIds.INVALID_PROFILE_CONFIG

  • Field Summary

    Fields
    Modifier and Type
    Field
    Description
    private boolean
    acceptUnfilteredAttributes
    Whether to accept decoded attributes that no filter rules applied to.
    private net.shibboleth.idp.attribute.context.AttributeContext
    attributeContext
    Context for externally supplied inbound attributes.
    private Function<org.opensaml.profile.context.ProfileRequestContext,net.shibboleth.idp.attribute.context.AttributeContext>
    attributeContextCreationStrategy
    Strategy used to create AttributeContext to hold results.
    private net.shibboleth.oidc.profile.context.EndUserClaimsContext
    endUserClaimsContext
    Context containing the claims(s) to process.
    private Function<org.opensaml.profile.context.ProfileRequestContext,net.shibboleth.oidc.profile.context.EndUserClaimsContext>
    endUserClaimsContextLookupStrategy
    Strategy used to look up EndUserClaimsContext to operate on.
    private Function<org.opensaml.profile.context.ProfileRequestContext,String>
    issuerLookupStrategy
    Function used to obtain the issuer ID.
    private final org.slf4j.Logger
    log
    Class logger.
    private net.shibboleth.oidc.profile.config.OIDCSSORelyingPartyConfigurationEx
    profileConfiguration
    Store off profile config.
    private Function<org.opensaml.profile.context.ProfileRequestContext,net.shibboleth.profile.context.RelyingPartyContext>
    relyingPartyContextLookupStrategy
    Strategy used to look up a RelyingPartyContext for configuration options.
    private Function<org.opensaml.profile.context.ProfileRequestContext,String>
    requesterLookupStrategy
    Function used to obtain the requester ID.
    private Function<net.shibboleth.oidc.profile.context.EndUserClaimsContext,Collection<net.shibboleth.idp.attribute.IdPAttribute>>
    standardExtractionStrategy
    Strategy for pulling out "standard" data from the id_token.
    private com.nimbusds.jwt.JWTClaimsSet
    unprocessedIdTokenClaims
    The set of id_token claims before they are processed.

  • Constructor Summary

    Constructors
    Constructor
    Description
    ExtractOIDCClaims()
    Constructor.

  • Method Summary

    Modifier and Type
    Method
    Description
    private void
    decodeAttribute(net.shibboleth.idp.attribute.transcoding.AttributeTranscoderRegistry registry, org.opensaml.profile.context.ProfileRequestContext profileRequestContext, net.minidev.json.JSONObject input, Multimap<String,net.shibboleth.idp.attribute.IdPAttribute> results)
    Access the registry of transcoding rules to transform (decode) the input claims to IdP Attributes.
    protected void
    doExecute(org.opensaml.profile.context.ProfileRequestContext profileRequestContext)
    protected boolean
    doPreExecute(org.opensaml.profile.context.ProfileRequestContext profileRequestContext)
    private void
    filterAttributes(org.opensaml.profile.context.ProfileRequestContext profileRequestContext)
    Check for inbound attributes and apply filtering.
    private void
    populateFilterContext(org.opensaml.profile.context.ProfileRequestContext profileRequestContext, net.shibboleth.idp.attribute.filter.context.AttributeFilterContext filterContext)
    Fill in the filter context data.
    private void
    processAttributes(org.opensaml.profile.context.ProfileRequestContext profileRequestContext)
    Process the inbound OIDC Claims.
    private Collection<net.shibboleth.idp.attribute.IdPAttribute>
    resolveAttributes(org.opensaml.profile.context.ProfileRequestContext profileRequestContext)
    Perform internal attribute resolution using the Application-associated AttributeResolver service.
    void
    setAcceptUnfilteredAttributes(boolean flag)
    Set whether to accept decoded IdPAttribute objects pulled from the assertions if no filtering rule applied to them.
    void
    setAttributeContextCreationStrategy(Function<org.opensaml.profile.context.ProfileRequestContext,net.shibboleth.idp.attribute.context.AttributeContext> strategy)
    Set the strategy used to create the AttributeContext to hold results.
    void
    setEndUserClaimsContextLookupStrategy(Function<org.opensaml.profile.context.ProfileRequestContext,net.shibboleth.oidc.profile.context.EndUserClaimsContext> strategy)
    Set the strategy used to lookup a EndUserClaimsContext.
    void
    setIssuerLookupStrategy(Function<org.opensaml.profile.context.ProfileRequestContext,String> strategy)
    Set the strategy used to locate the attribute issuer ID for filtering.
    void
    setRelyingPartyContextLookupStrategy(Function<org.opensaml.profile.context.ProfileRequestContext,net.shibboleth.profile.context.RelyingPartyContext> strategy)
    Set the strategy used to return the RelyingPartyContext for configuration options.
    void
    setRequesterLookupStrategy(Function<org.opensaml.profile.context.ProfileRequestContext,String> strategy)
    Set the strategy used to locate the attribute requester ID for filtering.
    void
    setStandardExtractionStrategy(Function<net.shibboleth.oidc.profile.context.EndUserClaimsContext,Collection<net.shibboleth.idp.attribute.IdPAttribute>> strategy)
    Set the strategy function to call for "standard" attribute extraction, if enabled.

    Methods inherited from class net.shibboleth.sp.profile.AbstractApplicationAction

    ensureApplication, getApplication

    Methods inherited from class net.shibboleth.sp.profile.AbstractAgentAction

    ensureAgent, getAgent

    Methods inherited from class net.shibboleth.sp.profile.AbstractAgentRequestAction

    ensureAgentRequestContext, getAgentRequestContext, setAgentRequestContextLookupStrategy

    Methods inherited from class net.shibboleth.idp.profile.AbstractProfileAction

    doExecute, execute, getBean, getBean, getMessage, getMessage, getMessage, getParameter, getParameter, getProfileContextLookupStrategy, getRequestContext, getResult, setMessageSource, setProfileContextLookupStrategy

    Methods inherited from class org.opensaml.profile.action.AbstractConditionalProfileAction

    getActivationCondition, setActivationCondition

    Methods inherited from class org.opensaml.profile.action.AbstractProfileAction

    doPostExecute, doPostExecute, ensureHttpServletRequest, ensureHttpServletResponse, execute, getHttpServletRequest, getHttpServletRequestSupplier, getHttpServletResponse, getHttpServletResponseSupplier, getLogPrefix, isPreExecuteCalled, setHttpServletRequestSupplier, setHttpServletResponseSupplier

    Methods inherited from class net.shibboleth.shared.component.AbstractInitializableComponent

    checkComponentActive, checkSetterPreconditions, destroy, doDestroy, doInitialize, ifDestroyedThrowDestroyedComponentException, ifInitializedThrowUnmodifiabledComponentException, ifNotInitializedThrowUninitializedComponentException, initialize, isDestroyed, isInitialized

    Methods inherited from class java.lang.Object

    clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

    Methods inherited from interface net.shibboleth.shared.component.InitializableComponent

    initialize, isInitialized

  • Field Details

    • log

      @Nonnull private final org.slf4j.Logger log
      Class logger.

    • endUserClaimsContextLookupStrategy

      @Nonnull private Function<org.opensaml.profile.context.ProfileRequestContext,net.shibboleth.oidc.profile.context.EndUserClaimsContext> endUserClaimsContextLookupStrategy
      Strategy used to look up EndUserClaimsContext to operate on.

    • relyingPartyContextLookupStrategy

      @Nonnull private Function<org.opensaml.profile.context.ProfileRequestContext,net.shibboleth.profile.context.RelyingPartyContext> relyingPartyContextLookupStrategy
      Strategy used to look up a RelyingPartyContext for configuration options.

    • attributeContextCreationStrategy

      @Nonnull private Function<org.opensaml.profile.context.ProfileRequestContext,net.shibboleth.idp.attribute.context.AttributeContext> attributeContextCreationStrategy
      Strategy used to create AttributeContext to hold results.

    • standardExtractionStrategy

      @Nullable private Function<net.shibboleth.oidc.profile.context.EndUserClaimsContext,Collection<net.shibboleth.idp.attribute.IdPAttribute>> standardExtractionStrategy
      Strategy for pulling out "standard" data from the id_token.

    • endUserClaimsContext

      @NonnullBeforeExec private net.shibboleth.oidc.profile.context.EndUserClaimsContext endUserClaimsContext
      Context containing the claims(s) to process.

    • attributeContext

      @NonnullBeforeExec private net.shibboleth.idp.attribute.context.AttributeContext attributeContext
      Context for externally supplied inbound attributes.

    • profileConfiguration

      @NonnullBeforeExec private net.shibboleth.oidc.profile.config.OIDCSSORelyingPartyConfigurationEx profileConfiguration
      Store off profile config.

    • unprocessedIdTokenClaims

      @NonnullBeforeExec private com.nimbusds.jwt.JWTClaimsSet unprocessedIdTokenClaims
      The set of id_token claims before they are processed.

    • issuerLookupStrategy

      @Nonnull private Function<org.opensaml.profile.context.ProfileRequestContext,String> issuerLookupStrategy
      Function used to obtain the issuer ID.

    • requesterLookupStrategy

      @Nonnull private Function<org.opensaml.profile.context.ProfileRequestContext,String> requesterLookupStrategy
      Function used to obtain the requester ID.

    • acceptUnfilteredAttributes

      private boolean acceptUnfilteredAttributes
      Whether to accept decoded attributes that no filter rules applied to.

  • Constructor Details

    • ExtractOIDCClaims

      public ExtractOIDCClaims()
      Constructor.

  • Method Details

    • setRelyingPartyContextLookupStrategy

      public void setRelyingPartyContextLookupStrategy(@Nonnull Function<org.opensaml.profile.context.ProfileRequestContext,net.shibboleth.profile.context.RelyingPartyContext> strategy)
      Set the strategy used to return the RelyingPartyContext for configuration options.
      Parameters:
      strategy - lookup strategy

    • setEndUserClaimsContextLookupStrategy

      public void setEndUserClaimsContextLookupStrategy(@Nonnull Function<org.opensaml.profile.context.ProfileRequestContext,net.shibboleth.oidc.profile.context.EndUserClaimsContext> strategy)
      Set the strategy used to lookup a EndUserClaimsContext.
      Parameters:
      strategy - the strategy

    • setAttributeContextCreationStrategy

      public void setAttributeContextCreationStrategy(@Nonnull Function<org.opensaml.profile.context.ProfileRequestContext,net.shibboleth.idp.attribute.context.AttributeContext> strategy)
      Set the strategy used to create the AttributeContext to hold results.
      Parameters:
      strategy - creation strategy

    • setRequesterLookupStrategy

      public void setRequesterLookupStrategy(@Nonnull Function<org.opensaml.profile.context.ProfileRequestContext,String> strategy)
      Set the strategy used to locate the attribute requester ID for filtering.
      Parameters:
      strategy - lookup strategy

    • setIssuerLookupStrategy

      public void setIssuerLookupStrategy(@Nonnull Function<org.opensaml.profile.context.ProfileRequestContext,String> strategy)
      Set the strategy used to locate the attribute issuer ID for filtering.
      Parameters:
      strategy - lookup strategy

    • setAcceptUnfilteredAttributes

      public void setAcceptUnfilteredAttributes(boolean flag)
      Set whether to accept decoded IdPAttribute objects pulled from the assertions if no filtering rule applied to them.

      This is a variant of the original SP's "wildcard" rule support to allow non-enumerated attributes to be accepted.

      Parameters:
      flag - the flag to set

    • setStandardExtractionStrategy

      public void setStandardExtractionStrategy(@Nullable Function<net.shibboleth.oidc.profile.context.EndUserClaimsContext,Collection<net.shibboleth.idp.attribute.IdPAttribute>> strategy)
      Set the strategy function to call for "standard" attribute extraction, if enabled.
      Parameters:
      strategy - strategy function

    • doPreExecute

      protected boolean doPreExecute(@Nonnull org.opensaml.profile.context.ProfileRequestContext profileRequestContext)
      Overrides:
      doPreExecute in class net.shibboleth.sp.profile.AbstractApplicationAction

    • doExecute

      protected void doExecute(@Nonnull org.opensaml.profile.context.ProfileRequestContext profileRequestContext)
      Overrides:
      doExecute in class org.opensaml.profile.action.AbstractProfileAction

    • resolveAttributes

      @Nullable private Collection<net.shibboleth.idp.attribute.IdPAttribute> resolveAttributes(@Nonnull org.opensaml.profile.context.ProfileRequestContext profileRequestContext)
      Perform internal attribute resolution using the Application-associated AttributeResolver service.
      Parameters:
      profileRequestContext - profile request context
      Returns:
      resolved attributes

    • processAttributes

      private void processAttributes(@Nonnull org.opensaml.profile.context.ProfileRequestContext profileRequestContext)
      Process the inbound OIDC Claims.
      Parameters:
      profileRequestContext - current profile request context

    • filterAttributes

      private void filterAttributes(@Nonnull org.opensaml.profile.context.ProfileRequestContext profileRequestContext)
      Check for inbound attributes and apply filtering.
      Parameters:
      profileRequestContext - current profile request context

    • populateFilterContext

      private void populateFilterContext(@Nonnull org.opensaml.profile.context.ProfileRequestContext profileRequestContext, @Nonnull net.shibboleth.idp.attribute.filter.context.AttributeFilterContext filterContext)
      Fill in the filter context data.
      Parameters:
      profileRequestContext - current profile request context
      filterContext - context to populate

    • decodeAttribute

      private void decodeAttribute(@Nonnull net.shibboleth.idp.attribute.transcoding.AttributeTranscoderRegistry registry, @Nonnull org.opensaml.profile.context.ProfileRequestContext profileRequestContext, @Nonnull net.minidev.json.JSONObject input, @Nonnull @NonnullElements @Live Multimap<String,net.shibboleth.idp.attribute.IdPAttribute> results) throws net.shibboleth.idp.attribute.AttributeDecodingException
      Access the registry of transcoding rules to transform (decode) the input claims to IdP Attributes.
      Parameters:
      registry - registry of transcoding rules
      profileRequestContext - current profile request context
      input - input attribute
      results - collection to add results to
      Throws:
      net.shibboleth.idp.attribute.AttributeDecodingException - if a non-ignorable error occurs