Package net.shibboleth.sp.oidc.profile.impl

Class PrepareAgentResponse

java.lang.Object
net.shibboleth.shared.component.AbstractInitializableComponent
org.opensaml.profile.action.AbstractProfileAction
org.opensaml.profile.action.AbstractConditionalProfileAction
net.shibboleth.idp.profile.AbstractProfileAction
net.shibboleth.sp.profile.AbstractAgentRequestAction
net.shibboleth.sp.profile.AbstractAgentAction
net.shibboleth.sp.profile.AbstractApplicationAction
net.shibboleth.sp.profile.AbstractTokenConsumerResponseAction
net.shibboleth.sp.oidc.profile.impl.PrepareAgentResponse
All Implemented Interfaces:
net.shibboleth.shared.component.Component, net.shibboleth.shared.component.DestructableComponent, net.shibboleth.shared.component.InitializableComponent, org.opensaml.profile.action.ProfileAction, Aware, MessageSource, MessageSourceAware, Action
public class PrepareAgentResponse extends net.shibboleth.sp.profile.AbstractTokenConsumerResponseAction
OIDC-specific subclass of a token consumer response action.

Extracts the access token and refresh token from the AccessTokenResponseContext and stores them in the session data return to the agent. These tokens can later be retrieved by the agent when needed—for example, to refresh user profile information via the UserInfo endpoint. The access token is used if it is still valid; otherwise, the refresh token is used to obtain a new access token.

If a DataSealer is supplied, the tokens will be sealed before they are added to the session. Tokens are sensitive so a data sealer is strongly recommended.

If the data sealer fails to seal a token, that token (and its associated data) will simply not be included in the session data.

  • Field Summary

    Fields
    Modifier and Type
    Field
    Description
    static final String
    ACCESS_TOKEN_PARAM
    Parameter for accessing the access_token from opaque data.
    private Function<org.opensaml.profile.context.ProfileRequestContext,net.shibboleth.oidc.profile.context.AccessTokenResponseContext>
    accessTokenResponseContextLookupStrategy
    Strategy used to look up the AccessTokenResponseContext .
    private net.shibboleth.shared.security.DataSealer
    dataSealer
    Optional data sealer to use.
    static final String
    EXPIRES_IN_PARAM
    Parameter for accessing the expires_in from opaque data.
    static final String
    ID_TOKEN_PARAM
    Parameter for accessing the id_token from opaque data.
    static final String
    ISSUED_TOKEN_TYPE_PARAM
    Parameter for accessing the issued_token_type from opaque data.
    private final org.slf4j.Logger
    log
    Class logger.
    static final String
    REFRESH_TOKEN_PARAM
    Parameter for accessing the refresh_token from opaque data.
    static final String
    SCOPE_PARAM
    Parameter for accessing the scope from opaque data.
    static final String
    TOKEN_STRUCTURE
    Structure name for all tokens.
    static final String
    TOKEN_TYPE_PARAM
    Parameter for accessing the token_type from opaque data.
    private net.shibboleth.oidc.profile.context.AccessTokenResponseContext
    tokenResponseContext
    The stashed token response context.

  • Constructor Summary

    Constructors
    Constructor
    Description
    PrepareAgentResponse()
    Constructor.

  • Method Summary

    Modifier and Type
    Method
    Description
    private String
    conditionallySeal(String token)
    If the data sealer is configured, use it to seal the token value.
    protected boolean
    doPreExecute(org.opensaml.profile.context.ProfileRequestContext profileRequestContext)
    protected net.shibboleth.sp.ddf.DDF
    getSessionData(org.opensaml.profile.context.ProfileRequestContext profileRequestContext)
    void
    setAccessTokenResponseContextLookupStrategy(Function<org.opensaml.profile.context.ProfileRequestContext,net.shibboleth.oidc.profile.context.AccessTokenResponseContext> strategy)
    Set the strategy used to look up a AccessTokenResponseContext.
    void
    setDataSealer(net.shibboleth.shared.security.DataSealer sealer)
    Sets DataSealer to use.

    Methods inherited from class net.shibboleth.sp.profile.AbstractTokenConsumerResponseAction

    doExecute, getSessionNotOnOrAfter, setAttributeContextLookupStrategy, setStateDataContextLookupStrategy

    Methods inherited from class net.shibboleth.sp.profile.AbstractApplicationAction

    ensureApplication, getApplication

    Methods inherited from class net.shibboleth.sp.profile.AbstractAgentAction

    ensureAgent, getAgent

    Methods inherited from class net.shibboleth.sp.profile.AbstractAgentRequestAction

    ensureAgentRequestContext, getAgentRequestContext, setAgentRequestContextLookupStrategy

    Methods inherited from class net.shibboleth.idp.profile.AbstractProfileAction

    doExecute, execute, getBean, getBean, getMessage, getMessage, getMessage, getParameter, getParameter, getProfileContextLookupStrategy, getRequestContext, getResult, setMessageSource, setProfileContextLookupStrategy

    Methods inherited from class org.opensaml.profile.action.AbstractConditionalProfileAction

    getActivationCondition, setActivationCondition

    Methods inherited from class org.opensaml.profile.action.AbstractProfileAction

    doPostExecute, doPostExecute, ensureHttpServletRequest, ensureHttpServletResponse, execute, getHttpServletRequest, getHttpServletRequestSupplier, getHttpServletResponse, getHttpServletResponseSupplier, getLogPrefix, isPreExecuteCalled, setHttpServletRequestSupplier, setHttpServletResponseSupplier

    Methods inherited from class net.shibboleth.shared.component.AbstractInitializableComponent

    checkComponentActive, checkSetterPreconditions, destroy, doDestroy, doInitialize, ifDestroyedThrowDestroyedComponentException, ifInitializedThrowUnmodifiabledComponentException, ifNotInitializedThrowUninitializedComponentException, initialize, isDestroyed, isInitialized

    Methods inherited from class java.lang.Object

    clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

    Methods inherited from interface net.shibboleth.shared.component.InitializableComponent

    initialize, isInitialized

  • Field Details

    • TOKEN_STRUCTURE

      @Nonnull @NotEmpty public static final String TOKEN_STRUCTURE
      Structure name for all tokens.
      See Also:

    • ACCESS_TOKEN_PARAM

      @Nonnull @NotEmpty public static final String ACCESS_TOKEN_PARAM
      Parameter for accessing the access_token from opaque data.
      See Also:

    • REFRESH_TOKEN_PARAM

      @Nonnull @NotEmpty public static final String REFRESH_TOKEN_PARAM
      Parameter for accessing the refresh_token from opaque data.
      See Also:

    • ID_TOKEN_PARAM

      @Nonnull @NotEmpty public static final String ID_TOKEN_PARAM
      Parameter for accessing the id_token from opaque data.
      See Also:

    • TOKEN_TYPE_PARAM

      @Nonnull @NotEmpty public static final String TOKEN_TYPE_PARAM
      Parameter for accessing the token_type from opaque data.
      See Also:

    • EXPIRES_IN_PARAM

      @Nonnull @NotEmpty public static final String EXPIRES_IN_PARAM
      Parameter for accessing the expires_in from opaque data.
      See Also:

    • SCOPE_PARAM

      @Nonnull @NotEmpty public static final String SCOPE_PARAM
      Parameter for accessing the scope from opaque data.
      See Also:

    • ISSUED_TOKEN_TYPE_PARAM

      @Nonnull @NotEmpty public static final String ISSUED_TOKEN_TYPE_PARAM
      Parameter for accessing the issued_token_type from opaque data.
      See Also:

    • log

      @Nonnull private final org.slf4j.Logger log
      Class logger.

    • accessTokenResponseContextLookupStrategy

      @Nonnull private Function<org.opensaml.profile.context.ProfileRequestContext,net.shibboleth.oidc.profile.context.AccessTokenResponseContext> accessTokenResponseContextLookupStrategy
      Strategy used to look up the AccessTokenResponseContext .

    • tokenResponseContext

      @NonnullBeforeExec private net.shibboleth.oidc.profile.context.AccessTokenResponseContext tokenResponseContext
      The stashed token response context.

    • dataSealer

      @Nullable private net.shibboleth.shared.security.DataSealer dataSealer
      Optional data sealer to use.

  • Constructor Details

    • PrepareAgentResponse

      public PrepareAgentResponse()
      Constructor.

  • Method Details

    • setDataSealer

      public void setDataSealer(@Nullable net.shibboleth.shared.security.DataSealer sealer)
      Sets DataSealer to use.
      Parameters:
      sealer - data sealer

    • setAccessTokenResponseContextLookupStrategy

      public void setAccessTokenResponseContextLookupStrategy(@Nonnull Function<org.opensaml.profile.context.ProfileRequestContext,net.shibboleth.oidc.profile.context.AccessTokenResponseContext> strategy)
      Set the strategy used to look up a AccessTokenResponseContext.
      Parameters:
      strategy - lookup strategy

    • doPreExecute

      protected boolean doPreExecute(@Nonnull org.opensaml.profile.context.ProfileRequestContext profileRequestContext)
      Overrides:
      doPreExecute in class net.shibboleth.sp.profile.AbstractTokenConsumerResponseAction

    • getSessionData

      protected net.shibboleth.sp.ddf.DDF getSessionData(@Nonnull org.opensaml.profile.context.ProfileRequestContext profileRequestContext)
      Specified by:
      getSessionData in class net.shibboleth.sp.profile.AbstractTokenConsumerResponseAction

    • conditionallySeal

      @Nonnull private String conditionallySeal(@Nonnull @NotEmpty String token) throws net.shibboleth.shared.security.DataSealerException
      If the data sealer is configured, use it to seal the token value. If configured, failure to seal a token results in an exception being thrown. If a sealer is not configured, the token is passed back untouched.
      Parameters:
      token - the token to seal or pass through
      Returns:
      the sealed token, or the original token passed-through
      Throws:
      net.shibboleth.shared.security.DataSealerException - if sealing fails