Package net.shibboleth.sp.oidc.profile.impl

Class ProcessEndUserClaims

java.lang.Object
net.shibboleth.shared.component.AbstractInitializableComponent
org.opensaml.profile.action.AbstractProfileAction
org.opensaml.profile.action.AbstractConditionalProfileAction
net.shibboleth.idp.profile.AbstractProfileAction
net.shibboleth.sp.oidc.profile.impl.ProcessEndUserClaims
All Implemented Interfaces:
net.shibboleth.shared.component.Component, net.shibboleth.shared.component.DestructableComponent, net.shibboleth.shared.component.InitializableComponent, org.opensaml.profile.action.ProfileAction, Aware, MessageSource, MessageSourceAware, Action
public class ProcessEndUserClaims extends net.shibboleth.idp.profile.AbstractProfileAction
Process the end-user claims from the id_token and possible UserInfo claims sets.

Sanitized both claims sets using a replaceable strategy. For example, by default to remove standard JWT 'validation' claims that should not be exposed further by the system.

Merge the claims sets together to produce an aggregate claims set. The UserInfo claims can be empty i.e. claims from the UserInfo endpoint were not requested.

Event:
EventIds.PROCEED_EVENT_ID, EventIds.INVALID_PROFILE_CTX
Postcondition:
Add a set of merged and sanatized claims to the EndUserClaimsContext.

  • Field Summary

    Fields
    Modifier and Type
    Field
    Description
    private Function<org.opensaml.profile.context.ProfileRequestContext,net.shibboleth.oidc.profile.context.AccessTokenResponseContext>
    accessTokenResponseContextLookupStrategy
    Strategy used to look up the AccessTokenResponseContext .
    private BinaryOperator<com.nimbusds.openid.connect.sdk.claims.ClaimsSet>
    claimMergingStrategy
    The strategy used to merge UserInfo claims with id_token claims.
    private UnaryOperator<com.nimbusds.openid.connect.sdk.claims.ClaimsSet>
    claimSanitizationStrategy
    The strategy used to sanitize claims in an input claimset.
    private Function<org.opensaml.profile.context.ProfileRequestContext,net.shibboleth.oidc.profile.context.EndUserClaimsContext>
    endUserClaimsContextLookupStrategy
    Strategy used to look up the EndUserClaimsContext to set the parameters for.
    private com.nimbusds.jwt.JWTClaimsSet
    idTokenClaims
    The stashed id_token claims.
    private final org.slf4j.Logger
    log
    Class logger.
    private com.nimbusds.openid.connect.sdk.claims.ClaimsSet
    userInfoClaims
    The stashed UserInfo claims.
    private Function<org.opensaml.profile.context.ProfileRequestContext,net.shibboleth.oidc.profile.context.UserInfoResponseContext>
    userInfoResponseContextLookupStrategy
    Strategy used to look up the UserInfoResponseContext.

  • Constructor Summary

    Constructors
    Constructor
    Description
    ProcessEndUserClaims()
    Constructor.

  • Method Summary

    Modifier and Type
    Method
    Description
    protected void
    doExecute(org.opensaml.profile.context.ProfileRequestContext profileRequestContext)
     
    protected void
    doInitialize()
    protected boolean
    doPreExecute(org.opensaml.profile.context.ProfileRequestContext profileRequestContext)
     
    void
    setAccessTokenResponseContextLookupStrategy(Function<org.opensaml.profile.context.ProfileRequestContext,net.shibboleth.oidc.profile.context.AccessTokenResponseContext> strategy)
    Set the strategy used to look up a AccessTokenResponseContext.
    void
    setClaimMergingStrategy(BinaryOperator<com.nimbusds.openid.connect.sdk.claims.ClaimsSet> strategy)
    Set the strategy used to merge UserInfo claims with id_token claims.
    void
    setClaimSanitizationStrategy(UnaryOperator<com.nimbusds.openid.connect.sdk.claims.ClaimsSet> strategy)
    Set the strategy used to sanitize claims from both the id_token and UserInfo claims set to produce a clean claims set.
    void
    setEnableClaimSanitizationStrategy(boolean enable)
    Set whether to enable claim sanitization.
    void
    setEndUserClaimsContextLookupStrategy(Function<org.opensaml.profile.context.ProfileRequestContext,net.shibboleth.oidc.profile.context.EndUserClaimsContext> strategy)
    Set the strategy used to lookup a EndUserClaimsContext.
    void
    setUserInfoResponseContextLookupStrategy(Function<org.opensaml.profile.context.ProfileRequestContext,net.shibboleth.oidc.profile.context.UserInfoResponseContext> strategy)
    Set the strategy used to look up a UserInfoResponseContext.

    Methods inherited from class net.shibboleth.idp.profile.AbstractProfileAction

    doExecute, execute, getBean, getBean, getMessage, getMessage, getMessage, getParameter, getParameter, getProfileContextLookupStrategy, getRequestContext, getResult, setMessageSource, setProfileContextLookupStrategy

    Methods inherited from class org.opensaml.profile.action.AbstractConditionalProfileAction

    getActivationCondition, setActivationCondition

    Methods inherited from class org.opensaml.profile.action.AbstractProfileAction

    doPostExecute, doPostExecute, ensureHttpServletRequest, ensureHttpServletResponse, execute, getHttpServletRequest, getHttpServletRequestSupplier, getHttpServletResponse, getHttpServletResponseSupplier, getLogPrefix, isPreExecuteCalled, setHttpServletRequestSupplier, setHttpServletResponseSupplier

    Methods inherited from class net.shibboleth.shared.component.AbstractInitializableComponent

    checkComponentActive, checkSetterPreconditions, destroy, doDestroy, ifDestroyedThrowDestroyedComponentException, ifInitializedThrowUnmodifiabledComponentException, ifNotInitializedThrowUninitializedComponentException, initialize, isDestroyed, isInitialized

    Methods inherited from class java.lang.Object

    clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

    Methods inherited from interface net.shibboleth.shared.component.InitializableComponent

    initialize, isInitialized

  • Field Details

    • log

      @Nonnull private final org.slf4j.Logger log
      Class logger.

    • userInfoResponseContextLookupStrategy

      @Nonnull private Function<org.opensaml.profile.context.ProfileRequestContext,net.shibboleth.oidc.profile.context.UserInfoResponseContext> userInfoResponseContextLookupStrategy
      Strategy used to look up the UserInfoResponseContext.

    • accessTokenResponseContextLookupStrategy

      @Nonnull private Function<org.opensaml.profile.context.ProfileRequestContext,net.shibboleth.oidc.profile.context.AccessTokenResponseContext> accessTokenResponseContextLookupStrategy
      Strategy used to look up the AccessTokenResponseContext .

    • endUserClaimsContextLookupStrategy

      @Nonnull private Function<org.opensaml.profile.context.ProfileRequestContext,net.shibboleth.oidc.profile.context.EndUserClaimsContext> endUserClaimsContextLookupStrategy
      Strategy used to look up the EndUserClaimsContext to set the parameters for.

    • claimMergingStrategy

      @NonnullAfterInit private BinaryOperator<com.nimbusds.openid.connect.sdk.claims.ClaimsSet> claimMergingStrategy
      The strategy used to merge UserInfo claims with id_token claims.

    • claimSanitizationStrategy

      @NonnullAfterInit private UnaryOperator<com.nimbusds.openid.connect.sdk.claims.ClaimsSet> claimSanitizationStrategy
      The strategy used to sanitize claims in an input claimset. By default, produces a set of claims without the validation claims (e.g. nonce, exp), but leaving the identity, authorization and misc claims.

    • userInfoClaims

      @NonnullBeforeExec private com.nimbusds.openid.connect.sdk.claims.ClaimsSet userInfoClaims
      The stashed UserInfo claims. This is allowably empty if the UserInfo endpoint was not used.

    • idTokenClaims

      @NonnullBeforeExec private com.nimbusds.jwt.JWTClaimsSet idTokenClaims
      The stashed id_token claims. This should never be null or empty once doPreExecute(ProfileRequestContext) has run.

  • Constructor Details

    • ProcessEndUserClaims

      public ProcessEndUserClaims()
      Constructor.

  • Method Details

    • doInitialize

      protected void doInitialize() throws net.shibboleth.shared.component.ComponentInitializationException
      Overrides:
      doInitialize in class net.shibboleth.shared.component.AbstractInitializableComponent
      Throws:
      net.shibboleth.shared.component.ComponentInitializationException

    • setClaimMergingStrategy

      public void setClaimMergingStrategy(@Nonnull BinaryOperator<com.nimbusds.openid.connect.sdk.claims.ClaimsSet> strategy)
      Set the strategy used to merge UserInfo claims with id_token claims.
      Parameters:
      strategy - the strategy to use.

    • setClaimSanitizationStrategy

      public void setClaimSanitizationStrategy(@Nonnull UnaryOperator<com.nimbusds.openid.connect.sdk.claims.ClaimsSet> strategy)
      Set the strategy used to sanitize claims from both the id_token and UserInfo claims set to produce a clean claims set.
      Parameters:
      strategy - the strategy to use.

    • setEnableClaimSanitizationStrategy

      public void setEnableClaimSanitizationStrategy(boolean enable)
      Set whether to enable claim sanitization. If true, whatever claimSanatizationStrategy is set is used. If false, a no-op strategy is created which just returns a new claims set based on the same claims that exist in the input claims set. By default, the input set of claims are added to the result set.
      Parameters:
      enable - enable or disable claims sanitization

    • setEndUserClaimsContextLookupStrategy

      public void setEndUserClaimsContextLookupStrategy(@Nonnull Function<org.opensaml.profile.context.ProfileRequestContext,net.shibboleth.oidc.profile.context.EndUserClaimsContext> strategy)
      Set the strategy used to lookup a EndUserClaimsContext.
      Parameters:
      strategy - the strategy

    • setAccessTokenResponseContextLookupStrategy

      public void setAccessTokenResponseContextLookupStrategy(@Nonnull Function<org.opensaml.profile.context.ProfileRequestContext,net.shibboleth.oidc.profile.context.AccessTokenResponseContext> strategy)
      Set the strategy used to look up a AccessTokenResponseContext.
      Parameters:
      strategy - lookup strategy

    • setUserInfoResponseContextLookupStrategy

      public void setUserInfoResponseContextLookupStrategy(@Nonnull Function<org.opensaml.profile.context.ProfileRequestContext,net.shibboleth.oidc.profile.context.UserInfoResponseContext> strategy)
      Set the strategy used to look up a UserInfoResponseContext.
      Parameters:
      strategy - lookup strategy

    • doPreExecute

      protected boolean doPreExecute(@Nonnull org.opensaml.profile.context.ProfileRequestContext profileRequestContext)
      Overrides:
      doPreExecute in class org.opensaml.profile.action.AbstractConditionalProfileAction

    • doExecute

      protected void doExecute(@Nonnull org.opensaml.profile.context.ProfileRequestContext profileRequestContext)
      Overrides:
      doExecute in class org.opensaml.profile.action.AbstractProfileAction