Package net.shibboleth.idp.plugin.authn.oidc.rp.impl

Class ValidateOIDCAuthentication

  • All Implemented Interfaces:
    net.shibboleth.idp.authn.principal.PrincipalSupportingComponent, Component, DestructableComponent, InitializableComponent, ProfileAction, Aware, MessageSource, MessageSourceAware, Action
    public class ValidateOIDCAuthentication
extends net.shibboleth.idp.authn.AbstractValidationAction
    An action that builds an AuthenticationResult based on an inbound OIDC authentication response.

    A EndUserClaimsContext is used as the basis of the result, which stores the merged id_token and UserInfo claims set, alongside the raw id_token claims.

    Actual validation is all upstream of this action, but the use of the ValidationAction subclass is a convenience for auditing and handling the result.

    Event:
    EventIds.PROCEED_EVENT_ID, EventIds.INVALID_PROFILE_CTX, IdPEventIds.INVALID_RELYING_PARTY_CTX, IdPEventIds.INVALID_PROFILE_CONFIG, AuthnEventIds.NO_CREDENTIALS
    Precondition:
    ProfileRequestContext.getSubcontext(AuthenticationContext.class).getAttemptedFlow() != null
    Postcondition:
    If AuthenticationContext.getSubcontext(EndUserClaimsContext.class, false)!= null, then an AuthenticationResult is saved to the AuthenticationContext.

    • Field Detail

      • log

        @Nonnull
private final org.slf4j.Logger log
        Class logger.

      • transcoderRegistry

        @NonnullAfterInit
private ReloadableService<net.shibboleth.idp.attribute.transcoding.AttributeTranscoderRegistry> transcoderRegistry
        Transcoder registry service object.

      • attributeFilterService

        @Nullable
private ReloadableService<net.shibboleth.idp.attribute.filter.AttributeFilter> attributeFilterService
        Service used to get the engine used to filter attributes.

      • metadataResolver

        @Nullable
private MetadataResolver metadataResolver
        Optional supplemental metadata source for filtering.

      • relyingPartyContextLookupStrategy

        @Nonnull
private Function<ProfileRequestContext,​net.shibboleth.idp.profile.context.RelyingPartyContext> relyingPartyContextLookupStrategy
        Strategy used to look up a RelyingPartyContext for configuration options.

      • profileConfiguration

        @Nullable
private net.shibboleth.oidc.profile.config.OIDCAuthenticationRelyingPartyProfileConfiguration profileConfiguration
        Store off profile config.

      • endUserContext

        @Nullable
private EndUserClaimsContext endUserContext
        The context with claims pertaining to the end-user of this authentication.

      • attributeContext

        @Nullable
private net.shibboleth.idp.attribute.context.AttributeContext attributeContext
        Context for externally supplied inbound attributes.

      • attributeExtractionStrategy

        @Nullable
private Function<ProfileRequestContext,​Collection<net.shibboleth.idp.attribute.IdPAttribute>> attributeExtractionStrategy
        Pluggable strategy function for generalized extraction of data.

    • Constructor Detail

      • ValidateOIDCAuthentication

        public ValidateOIDCAuthentication()
        Constructor.

    • Method Detail

      • setContextToPrivateCredentialsMappingStrategy

        public void setContextToPrivateCredentialsMappingStrategy​(@Nullable
                                                          Function<ProfileRequestContext,​Collection<Principal>> strategy)
        Set the context to principal mapping strategy for mapping context information into principal collections to place in the private credentials set of the subject.
        Parameters:
        strategy - the strategy to use

      • setAttributeFilter

        public void setAttributeFilter​(@Nullable
                               ReloadableService<net.shibboleth.idp.attribute.filter.AttributeFilter> filterService)
        Sets the filter service to use for inbound attributes.
        Parameters:
        filterService - optional filter service for inbound attributes

      • setTranscoderRegistry

        public void setTranscoderRegistry​(@Nonnull
                                  ReloadableService<net.shibboleth.idp.attribute.transcoding.AttributeTranscoderRegistry> registry)
        Sets the registry of transcoding rules to apply to encode attributes.
        Parameters:
        registry - registry service interface

      • setMetadataResolver

        public void setMetadataResolver​(@Nullable
                                MetadataResolver resolver)
        Set a metadata source to use during filtering.
        Parameters:
        resolver - metadata resolver

      • setRelyingPartyContextLookupStrategy

        public void setRelyingPartyContextLookupStrategy​(@Nonnull
                                                 Function<ProfileRequestContext,​net.shibboleth.idp.profile.context.RelyingPartyContext> strategy)
        Set the strategy used to return the RelyingPartyContext for configuration options.
        Parameters:
        strategy - lookup strategy

      • setAttributeExtractionStrategy

        public void setAttributeExtractionStrategy​(@Nullable
                                           Function<ProfileRequestContext,​Collection<net.shibboleth.idp.attribute.IdPAttribute>> strategy)
        Sets the strategy function to invoke for generalized extraction of data into IdPAttribute objects for inclusion in the AuthenticationResult.
        Parameters:
        strategy - extraction strategy

      • doPreExecute

        protected boolean doPreExecute​(@Nonnull
                               ProfileRequestContext profileRequestContext,
                               @Nonnull
                               net.shibboleth.idp.authn.context.AuthenticationContext authenticationContext)
        Overrides:
        doPreExecute in class net.shibboleth.idp.authn.AbstractValidationAction

      • doExecute

        protected void doExecute​(@Nonnull
                         ProfileRequestContext profileRequestContext,
                         @Nonnull
                         net.shibboleth.idp.authn.context.AuthenticationContext authenticationContext)
        Overrides:
        doExecute in class net.shibboleth.idp.authn.AbstractAuthenticationAction

      • populateSubject

        protected Subject populateSubject​(@Nonnull
                                  Subject subject)
        Specified by:
        populateSubject in class net.shibboleth.idp.authn.AbstractValidationAction

      • buildProxyPrincipal

        @Nonnull
private net.shibboleth.idp.authn.principal.ProxyAuthenticationPrincipal buildProxyPrincipal()
        Construct a populated ProxyAuthenticationPrincipal based on the upstream OP (the issuer of the id_token).
        Returns:
        a constructed ProxyAuthenticationPrincipal to include in the Subject

      • processAttributes

        private void processAttributes​(@Nonnull
                               ProfileRequestContext profileRequestContext)
        Process the inbound OIDC claims.
        Parameters:
        profileRequestContext - current profile request context

      • filterAttributes

        private void filterAttributes​(@Nonnull
                              ProfileRequestContext profileRequestContext)
        Check for inbound attributes and apply filtering.
        Parameters:
        profileRequestContext - current profile request context

      • populateFilterContext

        private void populateFilterContext​(@Nonnull
                                   ProfileRequestContext profileRequestContext,
                                   @Nonnull
                                   net.shibboleth.idp.attribute.filter.context.AttributeFilterContext filterContext)
        Fill in the filter context data.
        Parameters:
        profileRequestContext - current profile request context
        filterContext - context to populate

      • decodeAttribute

        private void decodeAttribute​(@Nonnull
                             net.shibboleth.idp.attribute.transcoding.AttributeTranscoderRegistry registry,
                             @Nonnull
                             ProfileRequestContext profileRequestContext,
                             @Nonnull
                             net.minidev.json.JSONObject input,
                             @Nonnull @NonnullElements @Live
                             Multimap<String,​net.shibboleth.idp.attribute.IdPAttribute> results)
                      throws net.shibboleth.idp.attribute.AttributeDecodingException
        Access the registry of transcoding rules to transform (decode) the input claims to IdP Attributes.
        Parameters:
        registry - registry of transcoding rules
        profileRequestContext - current profile request context
        input - input attribute
        results - collection to add results to
        Throws:
        net.shibboleth.idp.attribute.AttributeDecodingException - if a non-ignorable error occurs