Package net.shibboleth.idp.plugin.authn.oidc.rp.impl

Class RelyingPartyProxySigningParametersResolver

java.lang.Object

org.opensaml.xmlsec.impl.AbstractSecurityParametersResolver<net.shibboleth.oidc.security.jose.SignatureSigningParameters>

net.shibboleth.oidc.security.jose.impl.BasicSignatureSigningParametersResolver

net.shibboleth.idp.plugin.authn.oidc.rp.impl.RelyingPartyProxySigningParametersResolver

All Implemented Interfaces:

net.shibboleth.oidc.security.jose.SignatureSigningParametersResolver, Resolver<net.shibboleth.oidc.security.jose.SignatureSigningParameters,CriteriaSet>

public class RelyingPartyProxySigningParametersResolver
extends net.shibboleth.oidc.security.jose.impl.BasicSignatureSigningParametersResolver

A specialization of BasicSignatureSigningParametersResolver which supports selecting signing credentials from client_secret credential criterion (e.g. from the relying party configuration) in addition to the configured signing credentials inside the signing configuration (determined by the superclass).

The OpenID Providers's metadata is also used to filter for those algorithms supported by the OP in addition to those supported by the security configuration.

*

In addition to the Criterion inputs documented in BasicSignatureSigningParametersResolver, the following inputs are also supported:

• ClientSecretCredentialCriterion - optional
• ProviderMetadataCriterion - required

Field Summary

Fields

Modifier and Type	Field	Description
private org.slf4j.Logger	log	Logger.
private Function<com.nimbusds.openid.connect.sdk.op.OIDCProviderMetadata,List<String>>	providerMetadataAlgorithmLookupStrategy	A strategy to pull out the correct set of supported algorithms from the OIDCProviderMetadata.

Constructor Summary

Constructors

Constructor	Description
RelyingPartyProxySigningParametersResolver()	Constructor.

Method Summary

Modifier and Type	Method	Description
private List<com.nimbusds.jose.JWSAlgorithm>	convertSupportAlgorithmsToJwkAlgorithms(List<String> algos)	Convert the algorithms represented as strings, into Nimbus Algorithms for later comparison.
private com.nimbusds.jose.JWSAlgorithm	credentialSupportsSigningAlgorithm(Credential credential, com.nimbusds.jose.JWSAlgorithm supportedAlgorithm)	Check the credential supports the algorithm input.
private boolean	curveMatchesESAlgorithm(com.nimbusds.jose.jwk.Curve curve, com.nimbusds.jose.JWSAlgorithm algorithm)	Helper to match ECKey curve to JWS algorithm ES256, ES384 and ES512.
private List<String>	filterForProviderSupportedAlgorithms(CriteriaSet criteria, List<String> algorithms)	Filter the set of algorithms against the set supported by the OpenID Provider.
protected void	resolveAndPopulateCredentialAndSignatureAlgorithm(net.shibboleth.oidc.security.jose.SignatureSigningParameters params, CriteriaSet criteria, Predicate<String> includeExcludePredicate)
void	setProviderMetadataAlgorithmLookupStrategy(Function<com.nimbusds.openid.connect.sdk.op.OIDCProviderMetadata,List<String>> strategy)	Set the strategy used to locate the supported signing algorithms from the OP's metadata for this resolver instance.

Methods inherited from class net.shibboleth.oidc.security.jose.impl.BasicSignatureSigningParametersResolver

credentialSupportsAlgorithm, getAlgorithmRegistry, getAlgorithmRuntimeSupportedPredicate, getEffectiveSignatureAlgorithms, getEffectiveSigningCredentials, getIncludeExcludePredicate, logResult, resolve, resolveSingle, setAlgorithmRegistry, validate

Methods inherited from class org.opensaml.xmlsec.impl.AbstractSecurityParametersResolver

lookupKeyInfoGenerator, resolveAndPopulateIncludesExcludes, resolveEffectiveExcludes, resolveEffectiveIncludes, resolveIncludeExcludePrecedence, resolveIncludeExcludePredicate

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Field Detail

log

@Nonnull
private final org.slf4j.Logger log

Logger.

providerMetadataAlgorithmLookupStrategy

@Nonnull
private Function<com.nimbusds.openid.connect.sdk.op.OIDCProviderMetadata,List<String>> providerMetadataAlgorithmLookupStrategy

A strategy to pull out the correct set of supported algorithms from the OIDCProviderMetadata. By default returns null, signalling 'do not filter'.

Constructor Detail

RelyingPartyProxySigningParametersResolver

public RelyingPartyProxySigningParametersResolver()

Constructor.

Method Detail

setProviderMetadataAlgorithmLookupStrategy

public void setProviderMetadataAlgorithmLookupStrategy(@Nonnull
                                                       Function<com.nimbusds.openid.connect.sdk.op.OIDCProviderMetadata,List<String>> strategy)

Set the strategy used to locate the supported signing algorithms from the OP's metadata for this resolver instance. For example, id_token or request object signing algorithms.

Parameters:

strategy - the strategy

resolveAndPopulateCredentialAndSignatureAlgorithm

protected void resolveAndPopulateCredentialAndSignatureAlgorithm(@Nonnull
                                                                 net.shibboleth.oidc.security.jose.SignatureSigningParameters params,
                                                                 @Nonnull
                                                                 CriteriaSet criteria,
                                                                 @Nonnull
                                                                 Predicate<String> includeExcludePredicate)

Overrides:

resolveAndPopulateCredentialAndSignatureAlgorithm in class net.shibboleth.oidc.security.jose.impl.BasicSignatureSigningParametersResolver

convertSupportAlgorithmsToJwkAlgorithms

@Nonnull
private List<com.nimbusds.jose.JWSAlgorithm> convertSupportAlgorithmsToJwkAlgorithms(@Nonnull
                                                                                     List<String> algos)

Convert the algorithms represented as strings, into Nimbus Algorithms for later comparison.

Parameters:

algos - the algorithms to convert

Returns:

the converted algorithms

credentialSupportsSigningAlgorithm

@Nullable
private com.nimbusds.jose.JWSAlgorithm credentialSupportsSigningAlgorithm(@Nonnull
                                                                          Credential credential,
                                                                          @Nonnull
                                                                          com.nimbusds.jose.JWSAlgorithm supportedAlgorithm)

Check the credential supports the algorithm input. If it does, the algorithm it supports is returned. If none are supported, null is returned.

Parameters:

credential - the credential to test

supportedAlgorithm - the list of supported algorithms to check support for

Returns:

the supported algorithm, or null if none are supported

curveMatchesESAlgorithm

private boolean curveMatchesESAlgorithm(com.nimbusds.jose.jwk.Curve curve,
                                        com.nimbusds.jose.JWSAlgorithm algorithm)

Helper to match ECKey curve to JWS algorithm ES256, ES384 and ES512.

Parameters:

curve - curve to match.

algorithm - algorithm to match.

Returns:

true if key curve matches algorithm, otherwise false.

filterForProviderSupportedAlgorithms

private List<String> filterForProviderSupportedAlgorithms(@Nonnull
                                                          CriteriaSet criteria,
                                                          @Nonnull
                                                          List<String> algorithms)

Filter the set of algorithms against the set supported by the OpenID Provider. Always returns a new list reference. The ordering of the input algorithms should be preserved.

Parameters:

criteria - the criteria to extract the OP's metadata from to check supported algorithms.

algorithms - the current set of supported algorithms

Returns:

the current set of supported algorithms filtered by those also supported by the OP.