Package net.shibboleth.idp.plugin.oidc.op.token.support

Class TokenClaimsSet.Builder<T extends TokenClaimsSet>

java.lang.Object

net.shibboleth.idp.plugin.oidc.op.token.support.TokenClaimsSet.Builder<T>

Type Parameters:

T - claim set type

Direct Known Subclasses:

AccessTokenClaimsSet.Builder, AuthorizeCodeClaimsSet.Builder, RefreshTokenClaimsSet.Builder

Enclosing class:

TokenClaimsSet

public abstract static class TokenClaimsSet.Builder<T extends TokenClaimsSet>
extends Object

Abstract builder to extend builders from that are instantiating claims sets extending TokenClaimsSet.

Field Summary

Fields

Modifier and Type	Field	Description
protected com.nimbusds.openid.connect.sdk.claims.ACR	acr	Authentication context class reference value of the authentication.
protected List<String>	audience	Audience of token request.
protected Instant	authTime	Authentication time of the user.
protected String	codeChallenge	Code challenge.
protected List<Object>	consentedClaims	consented claims.
protected Boolean	consentEnabled	Has consent been asked from the end-user.
protected Map<String,Object>	customClaims	Extends the token with custom claims.
protected com.nimbusds.openid.connect.sdk.claims.ClaimsSet	dlClaims	Token delivery claims delivered both for id token and userinfo response.
protected com.nimbusds.openid.connect.sdk.claims.ClaimsSet	dlClaimsID	Token delivery claims delivered for id token.
protected com.nimbusds.openid.connect.sdk.claims.ClaimsSet	dlClaimsUI	Token delivery claims delivered for userinfo response.
protected Instant	exp	Expiration time of the claims set.
protected Instant	iat	Issue time of the claims set.
protected String	iss	OP issuer value.
protected String	jwtid	Token ID.
protected Instant	nbt	Not Before time of the claims set.
protected com.nimbusds.openid.connect.sdk.Nonce	nonce	Nonce of the authentication request.
protected String	principal	User Principal of the authenticated user.
protected URI	redirect	Validated redirect URI of the authentication request.
protected com.nimbusds.openid.connect.sdk.OIDCClaimsRequest	reqClaims	Claims request of the authentication request.
protected com.nimbusds.oauth2.sdk.Scope	reqScope	Scope of the token request.
protected com.nimbusds.oauth2.sdk.id.ClientID	rpId	Client Id of the rp.
protected String	sub	Subject claim value of the authenticated user.

Constructor Summary

Constructors

Modifier	Constructor	Description
protected	Builder()	Default constructor.

Method Summary

Modifier and Type	Method	Description
TokenClaimsSet.Builder<T>	addCustomClaim(String name, Object value)	Add a custom claim.
abstract T	build()	Builds claims set.
protected com.nimbusds.jwt.JWTClaimsSet	buildJWTClaimsSet(String tokenType)	Produce the underlying JWT to pass into the constructor methods.
TokenClaimsSet.Builder<T>	setACR(com.nimbusds.openid.connect.sdk.claims.ACR authenticationContextReference)	Set authentication context class reference value of the authentication.
TokenClaimsSet.Builder<T>	setAudience(Collection<String> aud)	Set audience.
TokenClaimsSet.Builder<T>	setAuthenticationTime(Instant i)	Set authentication time.
TokenClaimsSet.Builder<T>	setClaims(com.nimbusds.openid.connect.sdk.OIDCClaimsRequest claimsRequest)	Deprecated, for removal: This API element is subject to removal in a future version.
TokenClaimsSet.Builder<T>	setClaimsRequest(com.nimbusds.openid.connect.sdk.OIDCClaimsRequest claimsRequest)	Set claims request of the authentication request.
TokenClaimsSet.Builder<T>	setClientID(com.nimbusds.oauth2.sdk.id.ClientID id)	Set client ID.
TokenClaimsSet.Builder<T>	setCodeChallenge(String challenge)	Set code challenge.
TokenClaimsSet.Builder<T>	setConsentedClaims(List<Object> claims)	Set consented claims.
TokenClaimsSet.Builder<T>	setConsentEnabled(Boolean flag)	Set whether consent has been enabled.
TokenClaimsSet.Builder<T>	setCustomClaims(net.minidev.json.JSONObject claims)	Sets a batch of custom claim from a JSONObject.
TokenClaimsSet.Builder<T>	setDlClaims(com.nimbusds.openid.connect.sdk.claims.ClaimsSet claims)	Set token delivery claims delivered both for id token and userinfo response.
TokenClaimsSet.Builder<T>	setDlClaimsID(com.nimbusds.openid.connect.sdk.claims.ClaimsSet claims)	Set token delivery claims delivered for id token.
TokenClaimsSet.Builder<T>	setDlClaimsUI(com.nimbusds.openid.connect.sdk.claims.ClaimsSet claims)	Set token delivery claims delivered for userinfo response.
TokenClaimsSet.Builder<T>	setExpiresAt(Instant i)	Set expiration time.
TokenClaimsSet.Builder<T>	setIssuedAt(Instant i)	Set issue time.
TokenClaimsSet.Builder<T>	setIssuer(String s)	Set issuer.
TokenClaimsSet.Builder<T>	setJWTID(String id)	Set JWT ID.
TokenClaimsSet.Builder<T>	setJWTID(IdentifierGenerationStrategy generator)	Set JWT ID via generator.
TokenClaimsSet.Builder<T>	setNonce(com.nimbusds.openid.connect.sdk.Nonce requestNonce)	Set nonce of the authentication request.
TokenClaimsSet.Builder<T>	setNotBefore(Instant i)	Set not before time.
TokenClaimsSet.Builder<T>	setPrincipal(String s)	Set user principal name.
TokenClaimsSet.Builder<T>	setRedirectURI(URI uri)	Set redirect URI.
TokenClaimsSet.Builder<T>	setScope(com.nimbusds.oauth2.sdk.Scope s)	Set scope.
TokenClaimsSet.Builder<T>	setSubject(String s)	Set subject name.

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Field Detail

jwtid

@Nonnull
@NotEmpty
protected String jwtid

Token ID.

rpId

@Nullable
protected com.nimbusds.oauth2.sdk.id.ClientID rpId

Client Id of the rp.

iss

@Nullable
@NotEmpty
protected String iss

OP issuer value.

principal

@Nullable
@NotEmpty
protected String principal

User Principal of the authenticated user.

sub

@Nullable
@NotEmpty
protected String sub

Subject claim value of the authenticated user.

acr

@Nullable
protected com.nimbusds.openid.connect.sdk.claims.ACR acr

Authentication context class reference value of the authentication.

iat

@Nullable
protected Instant iat

Issue time of the claims set.

exp

@Nullable
protected Instant exp

Expiration time of the claims set.

nbt

@Nullable
protected Instant nbt

Not Before time of the claims set.

authTime

@Nullable
protected Instant authTime

Authentication time of the user.

redirect

@Nullable
protected URI redirect

Validated redirect URI of the authentication request.

reqScope

@Nullable
protected com.nimbusds.oauth2.sdk.Scope reqScope

Scope of the token request.

audience

@Nonnull
@NonnullElements
protected List<String> audience

Audience of token request.

nonce

@Nullable
protected com.nimbusds.openid.connect.sdk.Nonce nonce

Nonce of the authentication request.

reqClaims

@Nullable
protected com.nimbusds.openid.connect.sdk.OIDCClaimsRequest reqClaims

Claims request of the authentication request.

dlClaims

@Nullable
protected com.nimbusds.openid.connect.sdk.claims.ClaimsSet dlClaims

Token delivery claims delivered both for id token and userinfo response.

dlClaimsID

@Nullable
protected com.nimbusds.openid.connect.sdk.claims.ClaimsSet dlClaimsID

Token delivery claims delivered for id token.

dlClaimsUI

@Nullable
protected com.nimbusds.openid.connect.sdk.claims.ClaimsSet dlClaimsUI

Token delivery claims delivered for userinfo response.

consentedClaims

@Nullable
protected List<Object> consentedClaims

consented claims.

consentEnabled

protected Boolean consentEnabled

Has consent been asked from the end-user.

codeChallenge

@Nullable
protected String codeChallenge

Code challenge.

customClaims

@Nonnull
protected Map<String,Object> customClaims

Extends the token with custom claims.

Constructor Detail

Builder

protected Builder()

Default constructor.

Method Detail

buildJWTClaimsSet

@Nonnull
protected com.nimbusds.jwt.JWTClaimsSet buildJWTClaimsSet(@Nonnull @NotEmpty
                                                          String tokenType)

Produce the underlying JWT to pass into the constructor methods.

Used by subclasses to manufacture the input required to build the object.

Parameters:

tokenType - a type designation

Returns:

the JWT claims set

Since:

3.1.0

setJWTID

public TokenClaimsSet.Builder<T> setJWTID(@Nonnull
                                          IdentifierGenerationStrategy generator)

Set JWT ID via generator.

Parameters:

generator - ID generator

Returns:

the builder

Since:

3.1.0

setJWTID

public TokenClaimsSet.Builder<T> setJWTID(@Nonnull @NotEmpty
                                          String id)

Set JWT ID.

Parameters:

id - id

Returns:

the builder

Since:

3.1.0

setClientID

public TokenClaimsSet.Builder<T> setClientID(@Nonnull
                                             com.nimbusds.oauth2.sdk.id.ClientID id)

Set client ID.

Parameters:

id - client ID

Returns:

the builder

Since:

3.1.0

setIssuer

public TokenClaimsSet.Builder<T> setIssuer(@Nonnull
                                           String s)

Set issuer.

Parameters:

s - issuer

Returns:

the builder

Since:

3.1.0

setPrincipal

public TokenClaimsSet.Builder<T> setPrincipal(@Nonnull
                                              String s)

Set user principal name.

Parameters:

s - principal name

Returns:

the builder

Since:

3.1.0

setSubject

public TokenClaimsSet.Builder<T> setSubject(@Nonnull
                                            String s)

Set subject name.

Parameters:

s - subject name

Returns:

the builder

Since:

3.1.0

setIssuedAt

public TokenClaimsSet.Builder<T> setIssuedAt(@Nonnull
                                             Instant i)

Set issue time.

Parameters:

i - time

Returns:

the builder

Since:

3.1.0

setExpiresAt

public TokenClaimsSet.Builder<T> setExpiresAt(@Nonnull
                                              Instant i)

Set expiration time.

Parameters:

i - time

Returns:

the builder

Since:

3.1.0

setNotBefore

public TokenClaimsSet.Builder<T> setNotBefore(@Nonnull
                                              Instant i)

Set not before time.

Parameters:

i - time

Returns:

the builder

Since:

3.1.0

setRedirectURI

public TokenClaimsSet.Builder<T> setRedirectURI(@Nonnull
                                                URI uri)

Set redirect URI.

Parameters:

uri - redirect URI

Returns:

the builder

Since:

3.1.0

setScope

public TokenClaimsSet.Builder<T> setScope(@Nonnull
                                          com.nimbusds.oauth2.sdk.Scope s)

Set scope.

Parameters:

s - scope

Returns:

the builder

Since:

3.1.0

setAudience

public TokenClaimsSet.Builder<T> setAudience(@Nullable @NonnullElements
                                             Collection<String> aud)

Set audience.

Parameters:

aud - audience

Returns:

the builder

Since:

3.1.0

setAuthenticationTime

public TokenClaimsSet.Builder<T> setAuthenticationTime(@Nonnull
                                                       Instant i)

Set authentication time.

Parameters:

i - time

Returns:

the builder

Since:

3.1.0

setACR

public TokenClaimsSet.Builder<T> setACR(@Nullable
                                        com.nimbusds.openid.connect.sdk.claims.ACR authenticationContextReference)

Set authentication context class reference value of the authentication.

Parameters:

authenticationContextReference - authentication context class reference value of the authentication.

Returns:

the builder

setNonce

public TokenClaimsSet.Builder<T> setNonce(@Nullable
                                          com.nimbusds.openid.connect.sdk.Nonce requestNonce)

Set nonce of the authentication request.

Parameters:

requestNonce - nonce of the authentication request.

Returns:

the builder

setClaims

@Deprecated(since="3.1.0",
            forRemoval=true)
public TokenClaimsSet.Builder<T> setClaims(@Nullable
                                           com.nimbusds.openid.connect.sdk.OIDCClaimsRequest claimsRequest)

Deprecated, for removal: This API element is subject to removal in a future version.

Set claims request of the authentication request.

Parameters:

claimsRequest - claims request of the authentication request.

Returns:

the builder

setClaimsRequest

public TokenClaimsSet.Builder<T> setClaimsRequest(@Nullable
                                                  com.nimbusds.openid.connect.sdk.OIDCClaimsRequest claimsRequest)

Set claims request of the authentication request.

Parameters:

claimsRequest - claims request of the authentication request.

Returns:

the builder

Since:

3.1.0

setDlClaims

public TokenClaimsSet.Builder<T> setDlClaims(@Nullable
                                             com.nimbusds.openid.connect.sdk.claims.ClaimsSet claims)

Set token delivery claims delivered both for id token and userinfo response.

Parameters:

claims - token delivery claims delivered both for id token and userinfo response.

Returns:

the builder

setDlClaimsID

public TokenClaimsSet.Builder<T> setDlClaimsID(@Nullable
                                               com.nimbusds.openid.connect.sdk.claims.ClaimsSet claims)

Set token delivery claims delivered for id token.

Parameters:

claims - token delivery claims delivered for id token

Returns:

the builder

setDlClaimsUI

public TokenClaimsSet.Builder<T> setDlClaimsUI(@Nullable
                                               com.nimbusds.openid.connect.sdk.claims.ClaimsSet claims)

Set token delivery claims delivered for userinfo response.

Parameters:

claims - token delivery claims delivered for userinfo response

Returns:

the builder

setConsentedClaims

public TokenClaimsSet.Builder<T> setConsentedClaims(@Nullable
                                                    List<Object> claims)

Set consented claims.

Parameters:

claims - consented claims

Returns:

the builder

setConsentEnabled

public TokenClaimsSet.Builder<T> setConsentEnabled(@Nullable
                                                   Boolean flag)

Set whether consent has been enabled.

Parameters:

flag - whether consent has been enabled.

Returns:

the builder

setCodeChallenge

public TokenClaimsSet.Builder<T> setCodeChallenge(@Nullable
                                                  String challenge)

Set code challenge.

Parameters:

challenge - code challenge

Returns:

the builder

addCustomClaim

public TokenClaimsSet.Builder<T> addCustomClaim(@Nonnull @NotEmpty
                                                String name,
                                                @Nullable
                                                Object value)

Add a custom claim.

This method does NOT check for overlap with existing claim names.

Parameters:

name - claim name

value - claim value

Returns:

this builder

Since:

3.1.0

setCustomClaims

public TokenClaimsSet.Builder<T> setCustomClaims(@Nonnull
                                                 net.minidev.json.JSONObject claims)

Sets a batch of custom claim from a JSONObject.

This method does NOT check for overlap with existing claim names.

Parameters:

claims - the claims

Returns:

this builder

Since:

3.1.0

build

public abstract T build()

Builds claims set.

Returns:

claims set instance.