Package net.shibboleth.idp.plugin.authn.oidc.rp.impl

Class BuildRequestObject

    • Field Detail

      • log

        @Nonnull
private final org.slf4j.Logger log
        Class logger.

      • providerMetadataLookupStrategy

        @Nonnull
private Function<ProfileRequestContext,​net.shibboleth.oidc.metadata.context.OIDCProviderMetadataContext> providerMetadataLookupStrategy
        Lookup strategy to locate the OpenID Provider metadata to use.

      • relyingPartyContextLookupStrategy

        @Nonnull
private Function<ProfileRequestContext,​net.shibboleth.idp.profile.context.RelyingPartyContext> relyingPartyContextLookupStrategy
        Lookup function for relying party context.

      • claimsSetIsValidPredicate

        @Nonnull
private Predicate<com.nimbusds.openid.connect.sdk.claims.ClaimsSet> claimsSetIsValidPredicate
        A hook to allow additional checking of the request object claims after it is built.

      • requestObjectToBeSignedPredicate

        @Nonnull
private Predicate<ProfileRequestContext> requestObjectToBeSignedPredicate
        Is the request object going to be signed? if so the 'iss' and 'aud' claims will be set. Defaults to always true, as it is permissible that both 'iss' and 'aud' claim can exist in plain request objects.

      • authnRequest

        @Nullable
private net.shibboleth.oidc.profile.core.OIDCAuthenticationRequest authnRequest
        OIDC authentication request built by the IdP.

      • providerMetadata

        @Nullable
private com.nimbusds.openid.connect.sdk.op.OIDCProviderMetadata providerMetadata
        OpenID Provider metadata .

    • Constructor Detail

      • BuildRequestObject

        public BuildRequestObject()
        Constructor.

    • Method Detail

      • setRelyingPartyContextLookupStrategy

        public void setRelyingPartyContextLookupStrategy​(@Nonnull
                                                 Function<ProfileRequestContext,​net.shibboleth.idp.profile.context.RelyingPartyContext> strategy)
        Set the strategy used to locate the RelyingPartyContext associated with a given ProfileRequestContext.
        Parameters:
        strategy - lookup strategy

      • setProviderMetadataLookupStrategy

        public void setProviderMetadataLookupStrategy​(@Nonnull
                                              Function<ProfileRequestContext,​net.shibboleth.oidc.metadata.context.OIDCProviderMetadataContext> strategy)
        Set the lookup strategy to locate the OpenID providers metadata.
        Parameters:
        strategy - the strategy.

      • setClaimsSetIsValidPredicate

        public void setClaimsSetIsValidPredicate​(@Nullable
                                         Predicate<com.nimbusds.openid.connect.sdk.claims.ClaimsSet> predicate)
        Set a hook that allows the built request object to be validated before it is used. This is run in addition too, but before, the built in validation taken from the specification. If this returns false, the built in validation is not run, and validation fails.
        Parameters:
        predicate - the hook to run

      • setRequestObjectToBeSignedPredicate

        public void setRequestObjectToBeSignedPredicate​(@Nullable
                                                Predicate<ProfileRequestContext> predicate)
        Set a predicate to determine if the request object will be 'eventually' signed. If so, the 'iss' and 'aud' claims will be set into the request object.
        Parameters:
        predicate - the predicate

      • doPreExecute

        protected boolean doPreExecute​(@Nonnull
                               ProfileRequestContext profileRequestContext,
                               @Nonnull
                               net.shibboleth.idp.authn.context.AuthenticationContext authenticationContext)
        Overrides:
        doPreExecute in class net.shibboleth.idp.authn.AbstractAuthenticationAction

      • doExecute

        protected void doExecute​(@Nonnull
                         ProfileRequestContext profileRequestContext,
                         @Nonnull
                         net.shibboleth.idp.authn.context.AuthenticationContext authenticationContext)
        Overrides:
        doExecute in class net.shibboleth.idp.authn.AbstractAuthenticationAction

      • setClaimIfPresent

        private void setClaimIfPresent​(@Nonnull
                               com.nimbusds.openid.connect.sdk.claims.ClaimsSet claims,
                               @Nonnull
                               String claimName,
                               @Nullable
                               Object claim)
        Set the claim onto the claims set if not null. Calls toString on each value, assuming it will produce the correct value.
        Parameters:
        claims - the claims set
        claimName - the claim name
        claim - the claim

      • validateRequestObject

        private boolean validateRequestObject​(@Nonnull
                                      ProfileRequestContext profileRequestContext,
                                      @Nonnull
                                      com.nimbusds.openid.connect.sdk.claims.ClaimsSet requestObjectClaims)
        Ensure the request object is valid by assessing the claims are correct.
        Parameters:
        profileRequestContext - the profile request context
        requestObjectClaims - the claims of the request object
        Returns:
        true if the request object claims are valid, false otherwise