Package net.shibboleth.idp.plugin.oidc.op.token.support

Class TokenClaimsSet

java.lang.Object

net.shibboleth.idp.plugin.oidc.op.token.support.TokenClaimsSet

Direct Known Subclasses:

AccessTokenClaimsSet, AuthorizeCodeClaimsSet, RefreshTokenClaimsSet

public class TokenClaimsSet
extends Object

Class to extend for token claims sets. Offers the base functionality to Authorize Code, Refresh Token and Access Token.

Nested Class Summary

Nested Classes

Modifier and Type	Class	Description
static class	TokenClaimsSet.Builder<T extends TokenClaimsSet>	Abstract builder to extend builders from that are instantiating claims sets extending TokenClaimsSet.

Field Summary

Fields

Modifier and Type	Field	Description
static String	KEY_AC_ID	Identifier for the token.
static String	KEY_ACR	Authentication context class reference value of the performed authentication.
static String	KEY_AUTH_TIME	Authentication time of the performed authentication.
static String	KEY_CLAIMS	Claims request of the original authentication request.
static String	KEY_CLIENTID	Client id of the rp the token is generated for.
static String	KEY_CODE_CHALLENGE	Code Challenge.
static String	KEY_CONSENT_ENABLED	Whether consent has been enabled.
static String	KEY_CONSENTED_CLAIMS	Claims/Attributes having consent.
static String	KEY_DELIVERY_CLAIMS	Claims set for token delivery.
static String	KEY_DELIVERY_CLAIMS_IDTOKEN	Claims set for token delivery, id token only.
static String	KEY_DELIVERY_CLAIMS_USERINFO	Claims set for token delivery, user info only.
static String	KEY_EXPIRATION_TIME	Expiration time of the token.
static String	KEY_ISSUED_AT	Issue time of the token.
static String	KEY_ISSUER	OP issuer.
static String	KEY_NONCE	Nonce of the original authentication request.
static String	KEY_REDIRECT_URI	Redirect uri of the original authentication request.
static String	KEY_SCOPE	Scope of the original authentication request.
static String	KEY_SUBJECT	Subject of the user.
static String	KEY_TYPE	Type of the token.
static String	KEY_USER_PRINCIPAL	User principal representing authenticated user.
private org.slf4j.Logger	log	Class logger.
private com.nimbusds.jwt.JWTClaimsSet	tokenClaimsSet	Claims set for the claim.

Constructor Summary

Constructors

Modifier	Constructor	Description
protected	TokenClaimsSet()	Constructor.
protected	TokenClaimsSet(String tokenType, String tokenID, com.nimbusds.oauth2.sdk.id.ClientID clientID, String issuer, String userPrincipal, String subject, com.nimbusds.openid.connect.sdk.claims.ACR acr, Instant iat, Instant exp, com.nimbusds.openid.connect.sdk.Nonce nonce, Instant authTime, URI redirectURI, com.nimbusds.oauth2.sdk.Scope scope, com.nimbusds.openid.connect.sdk.OIDCClaimsRequest claims, com.nimbusds.openid.connect.sdk.claims.ClaimsSet dlClaims, com.nimbusds.openid.connect.sdk.claims.ClaimsSet dlClaimsID, com.nimbusds.openid.connect.sdk.claims.ClaimsSet dlClaimsUI, List<Object> consentedClaims, String codeChallenge, boolean consentEnabled)	Constructor for token claims set.

Method Summary

Modifier and Type	Method	Description
String	getACR()	Get acr of the performed authentication.
Instant	getAuthenticationTime()	Get auth time of the user.
com.nimbusds.openid.connect.sdk.OIDCClaimsRequest	getClaimsRequest()	Get claims request of the authentication request.
com.nimbusds.jwt.JWTClaimsSet	getClaimsSet()	Get the token claims set.
com.nimbusds.oauth2.sdk.id.ClientID	getClientID()	Get Client ID of the token.
String	getCodeChallenge()	Get code challenge of the authentication request.
List<Object>	getConsentedClaims()	Get consented claims.
com.nimbusds.openid.connect.sdk.claims.ClaimsSet	getDeliveryClaims()	Get token delivery claims.
Instant	getExp()	Get expiration time of the token.
String	getID()	Get the id of the token.
com.nimbusds.openid.connect.sdk.claims.ClaimsSet	getIDTokenDeliveryClaims()	Get id token token delivery claims.
com.nimbusds.openid.connect.sdk.Nonce	getNonce()	Get nonce of the authentication request.
String	getPrincipal()	Get principal of the user.
URI	getRedirectURI()	Get redirect uri of the request.
com.nimbusds.oauth2.sdk.Scope	getScope()	Get scope of the authentication request.
String	getType()	Get type of the claims set.
com.nimbusds.openid.connect.sdk.claims.ClaimsSet	getUserinfoDeliveryClaims()	Get user info response token delivery claims.
boolean	isConsentEnabled()	Get whether consent has been enabled.
boolean	isExpired()	Check if the token is expired.
String	serialize()	Serialize the token as JSON String.
String	serialize(DataSealer dataSealer)	Serialize the token as JSON String wrapped with sealer.
void	setClaimsSet(com.nimbusds.jwt.JWTClaimsSet claimsSet)	Set the token claims set.
protected static void	verifyParsedClaims(String tokenType, com.nimbusds.jwt.JWTClaimsSet tokenClaimsSet)	Helper to verify parsed claims are what is expected.

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Field Detail

KEY_AC_ID

public static final String KEY_AC_ID

Identifier for the token.

See Also:

Constant Field Values

KEY_TYPE

public static final String KEY_TYPE

Type of the token.

See Also:

Constant Field Values

KEY_ISSUER

public static final String KEY_ISSUER

OP issuer.

See Also:

Constant Field Values

KEY_USER_PRINCIPAL

public static final String KEY_USER_PRINCIPAL

User principal representing authenticated user.

See Also:

Constant Field Values

KEY_SUBJECT

public static final String KEY_SUBJECT

Subject of the user.

See Also:

Constant Field Values

KEY_CLIENTID

public static final String KEY_CLIENTID

Client id of the rp the token is generated for.

See Also:

Constant Field Values

KEY_EXPIRATION_TIME

public static final String KEY_EXPIRATION_TIME

Expiration time of the token.

See Also:

Constant Field Values

KEY_ISSUED_AT

public static final String KEY_ISSUED_AT

Issue time of the token.

See Also:

Constant Field Values

KEY_ACR

public static final String KEY_ACR

Authentication context class reference value of the performed authentication.

See Also:

Constant Field Values

KEY_NONCE

public static final String KEY_NONCE

Nonce of the original authentication request.

See Also:

Constant Field Values

KEY_AUTH_TIME

public static final String KEY_AUTH_TIME

Authentication time of the performed authentication.

See Also:

Constant Field Values

KEY_REDIRECT_URI

public static final String KEY_REDIRECT_URI

Redirect uri of the original authentication request.

See Also:

Constant Field Values

KEY_SCOPE

public static final String KEY_SCOPE

Scope of the original authentication request.

See Also:

Constant Field Values

KEY_CLAIMS

public static final String KEY_CLAIMS

Claims request of the original authentication request.

See Also:

Constant Field Values

KEY_DELIVERY_CLAIMS

public static final String KEY_DELIVERY_CLAIMS

Claims set for token delivery.

See Also:

Constant Field Values

KEY_DELIVERY_CLAIMS_IDTOKEN

public static final String KEY_DELIVERY_CLAIMS_IDTOKEN

Claims set for token delivery, id token only.

See Also:

Constant Field Values

KEY_DELIVERY_CLAIMS_USERINFO

public static final String KEY_DELIVERY_CLAIMS_USERINFO

Claims set for token delivery, user info only.

See Also:

Constant Field Values

KEY_CONSENTED_CLAIMS

public static final String KEY_CONSENTED_CLAIMS

Claims/Attributes having consent.

See Also:

Constant Field Values

KEY_CONSENT_ENABLED

public static final String KEY_CONSENT_ENABLED

Whether consent has been enabled.

See Also:

Constant Field Values

KEY_CODE_CHALLENGE

public static final String KEY_CODE_CHALLENGE

Code Challenge.

See Also:

Constant Field Values

tokenClaimsSet

private com.nimbusds.jwt.JWTClaimsSet tokenClaimsSet

Claims set for the claim.

log

@Nonnull
private org.slf4j.Logger log

Class logger.

Constructor Detail

TokenClaimsSet

protected TokenClaimsSet()

Constructor.

TokenClaimsSet

protected TokenClaimsSet(@Nonnull
                         String tokenType,
                         @Nonnull
                         String tokenID,
                         @Nonnull
                         com.nimbusds.oauth2.sdk.id.ClientID clientID,
                         @Nonnull
                         String issuer,
                         @Nonnull
                         String userPrincipal,
                         @Nonnull
                         String subject,
                         @Nullable
                         com.nimbusds.openid.connect.sdk.claims.ACR acr,
                         @Nonnull
                         Instant iat,
                         @Nonnull
                         Instant exp,
                         @Nullable
                         com.nimbusds.openid.connect.sdk.Nonce nonce,
                         @Nonnull
                         Instant authTime,
                         @Nonnull
                         URI redirectURI,
                         @Nonnull
                         com.nimbusds.oauth2.sdk.Scope scope,
                         @Nullable
                         com.nimbusds.openid.connect.sdk.OIDCClaimsRequest claims,
                         @Nullable
                         com.nimbusds.openid.connect.sdk.claims.ClaimsSet dlClaims,
                         @Nullable
                         com.nimbusds.openid.connect.sdk.claims.ClaimsSet dlClaimsID,
                         @Nullable
                         com.nimbusds.openid.connect.sdk.claims.ClaimsSet dlClaimsUI,
                         @Nullable
                         List<Object> consentedClaims,
                         @Nullable
                         String codeChallenge,
                         boolean consentEnabled)

Constructor for token claims set.

Parameters:

tokenType - Token type. Must not be NULL.

tokenID - identifier for the token. Must not be NULL.

clientID - Client Id of the rp. Must not be NULL.

issuer - OP issuer value. Must not be NULL.

userPrincipal - User Principal of the authenticated user. Must not be NULL.

subject - subject of the authenticated user. Must not be NULL.

acr - Authentication context class reference value of the authentication. May be NULL.

iat - Issue time of the token. Must not be NULL.

exp - Expiration time of the token. Must not be NULL.

nonce - Nonce of the authentication request. May be NULL.

authTime - Authentication time of the user. Must not be NULL.

redirectURI - Validated redirect URI of the authentication request. Must not be NULL.

scope - Scope of the authentication request. Must not be NULL.

claims - Claims request of the authentication request. May be NULL.

dlClaims - token delivery claims delivered both for id token and userinfo response. May be NULL.

dlClaimsID - token delivery claims delivered for id token. May be NULL.

dlClaimsUI - token delivery claims delivered for userinfo response. May be NULL.

consentedClaims - consented claims. May be NULL.

codeChallenge - Code Challenge. May be NULL.

consentEnabled - Whether consent has been enabled.

Throws:

RuntimeException - if called with not allowed null parameters

Method Detail

verifyParsedClaims

protected static void verifyParsedClaims(@Nonnull
                                         String tokenType,
                                         @Nonnull
                                         com.nimbusds.jwt.JWTClaimsSet tokenClaimsSet)
                                  throws ParseException

Helper to verify parsed claims are what is expected.

Parameters:

tokenType - The type of the expected token. Must not be NULL.

tokenClaimsSet - token claims set Must not be NULL.

Throws:

ParseException - if claims set is not expected one.

serialize

public String serialize()

Serialize the token as JSON String.

Returns:

token as JSON String

serialize

public String serialize(@Nonnull
                        DataSealer dataSealer)
                 throws DataSealerException

Serialize the token as JSON String wrapped with sealer.

Parameters:

dataSealer - data sealer to wrap the JSON serialization

Returns:

token as JSON String wrapped with sealer

Throws:

DataSealerException - is thrown if unwrapping fails

setClaimsSet

public void setClaimsSet(@Nonnull
                         com.nimbusds.jwt.JWTClaimsSet claimsSet)

Set the token claims set.

Parameters:

claimsSet - What to set.

getClaimsSet

@Nonnull
public com.nimbusds.jwt.JWTClaimsSet getClaimsSet()

Get the token claims set.

Returns:

token claims set

isExpired

public boolean isExpired()

Check if the token is expired.

Returns:

true if the token is expired, otherwise false.

getExp

@Nonnull
public Instant getExp()

Get expiration time of the token.

Returns:

expiration time of the token.

getRedirectURI

@Nonnull
public URI getRedirectURI()

Get redirect uri of the request.

Returns:

redirect uri of the request, null if not located.

getACR

@Nonnull
public String getACR()

Get acr of the performed authentication.

Returns:

acr of the performed authentication.

getType

@Nonnull
public String getType()

Get type of the claims set.

Returns:

Type of the claims set.

getPrincipal

@Nonnull
public String getPrincipal()

Get principal of the user.

Returns:

principal of the user.

getAuthenticationTime

@Nonnull
public Instant getAuthenticationTime()

Get auth time of the user.

Returns:

auth time of the user.

getNonce

@Nonnull
public com.nimbusds.openid.connect.sdk.Nonce getNonce()

Get nonce of the authentication request.

Returns:

nonce of the authentication request.

getClaimsRequest

@Nullable
public com.nimbusds.openid.connect.sdk.OIDCClaimsRequest getClaimsRequest()

Get claims request of the authentication request.

Returns:

claims request in authentication request, null if not existing.

getDeliveryClaims

public com.nimbusds.openid.connect.sdk.claims.ClaimsSet getDeliveryClaims()

Get token delivery claims.

Returns:

token delivery claims

getIDTokenDeliveryClaims

public com.nimbusds.openid.connect.sdk.claims.ClaimsSet getIDTokenDeliveryClaims()

Get id token token delivery claims.

Returns:

id token token delivery claims

getUserinfoDeliveryClaims

public com.nimbusds.openid.connect.sdk.claims.ClaimsSet getUserinfoDeliveryClaims()

Get user info response token delivery claims.

Returns:

user info response token delivery claims

getConsentedClaims

public List<Object> getConsentedClaims()

Get consented claims.

Returns:

consented claims

isConsentEnabled

public boolean isConsentEnabled()

Get whether consent has been enabled.

Returns:

whether consent has been enabled

getScope

@Nonnull
public com.nimbusds.oauth2.sdk.Scope getScope()

Get scope of the authentication request.

Returns:

scope of the authentication request.

getCodeChallenge

@Nonnull
public String getCodeChallenge()

Get code challenge of the authentication request.

Returns:

code challenge of the authentication request.

getID

@Nonnull
public String getID()

Get the id of the token.

Returns:

id of the token

getClientID

@Nonnull
public com.nimbusds.oauth2.sdk.id.ClientID getClientID()

Get Client ID of the token.

Returns:

Client ID of the token