Package net.shibboleth.oidc.security.credential.impl

Class BasicJOSEObjectCredentialResolver

java.lang.Object

org.opensaml.security.credential.impl.AbstractCredentialResolver

org.opensaml.security.credential.impl.AbstractCriteriaFilteringCredentialResolver

net.shibboleth.oidc.security.credential.impl.BasicJOSEObjectCredentialResolver

All Implemented Interfaces:

JOSEObjectCredentialResolver, Resolver<Credential,CriteriaSet>, CredentialResolver

Direct Known Subclasses:

ClientInformationCredentialResolver, ClientSecretCriterionCredentialResolver, CollectionJOSEObjectCredentialResolver, LocalJOSEObjectCredentialResolver, ProviderMetadataCredentialResolver

public class BasicJOSEObjectCredentialResolver
extends AbstractCriteriaFilteringCredentialResolver
implements JOSEObjectCredentialResolver

A basic implementation of JOSEObjectCredentialResolver. Resolves credentials from JOSE Headers.

Field Summary

Fields

Modifier and Type	Field	Description
private org.slf4j.Logger	log	Logger.

Constructor Summary

Constructors

Constructor	Description
BasicJOSEObjectCredentialResolver()

Method Summary

Modifier and Type	Method	Description
protected BasicJWKCredential	buildJWKCredential(com.nimbusds.jose.jwk.JWK jwk, String headerKid)
protected Credential	deriveClientSecretCredential(ClientSecretCredential secretCred, CriteriaSet criteriaSet)	Use the usage type and algorithm information in the criteria to build a suitable signing or encryption credential.
protected String	extractKeyIdFromCriteria(CriteriaSet criteriaSet)	Extract a KeyId from the criteria set if one exists.
protected void	populateCredentialsFromKeySet(com.nimbusds.jose.jwk.JWKSet keySet, Collection<Credential> credentials)	Convert the RSA and EC keys from the given JWKSet into the collection of credentials.
protected void	postProcess(CriteriaSet criteriaSet, com.nimbusds.jose.JOSEObject joseObject, List<Credential> credentials)	Hook for subclasses to do post-processing of the credential set after all JOSE header keys have been processed.
protected List<Credential>	processJWEHeader(com.nimbusds.jose.JWEHeader jweHeader)
protected List<Credential>	processJWSHeader(com.nimbusds.jose.JWSHeader jwsHeader)	Process credentials indicated by a JWS header.
protected Iterable<Credential>	resolveFromSource(CriteriaSet criteriaSet)

Methods inherited from class org.opensaml.security.credential.impl.AbstractCriteriaFilteringCredentialResolver

isSatisfyAllPredicates, resolve, setSatisfyAllPredicates

Methods inherited from class org.opensaml.security.credential.impl.AbstractCredentialResolver

resolveSingle

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Methods inherited from interface net.shibboleth.utilities.java.support.resolver.Resolver

resolve, resolveSingle

Field Detail

log

private final org.slf4j.Logger log

Logger.

Constructor Detail

BasicJOSEObjectCredentialResolver

public BasicJOSEObjectCredentialResolver()

Method Detail

resolveFromSource

@Nonnull
@NonnullElements
protected Iterable<Credential> resolveFromSource(@Nullable
                                                 CriteriaSet criteriaSet)
                                          throws ResolverException

Specified by:

resolveFromSource in class AbstractCriteriaFilteringCredentialResolver

Throws:

ResolverException

postProcess

protected void postProcess(@Nullable
                           CriteriaSet criteriaSet,
                           @Nonnull
                           com.nimbusds.jose.JOSEObject joseObject,
                           @Nonnull
                           List<Credential> credentials)
                    throws ResolverException

Hook for subclasses to do post-processing of the credential set after all JOSE header keys have been processed.

For example, the previously resolved credentials might be used to index into a store of local credentials, where the index is a key name or the public half of a key pair extracted from the headers.

Parameters:

criteriaSet - the credential criteria used to resolve credentials

joseObject - the extracted JOSE object

credentials - the list which will store the resolved credentials

Throws:

ResolverException - thrown if there is an error during processing

processJWSHeader

@Nonnull
@NonnullElements
protected List<Credential> processJWSHeader(@Nonnull
                                            com.nimbusds.jose.JWSHeader jwsHeader)

Process credentials indicated by a JWS header.

Parameters:

jwsHeader - the JWS header to process

Returns:

the list of credentials specified by the JWS header

processJWEHeader

@Nonnull
@NonnullElements
protected List<Credential> processJWEHeader(@Nonnull
                                            com.nimbusds.jose.JWEHeader jweHeader)

buildJWKCredential

@Nullable
protected BasicJWKCredential buildJWKCredential(@Nonnull
                                                com.nimbusds.jose.jwk.JWK jwk,
                                                @Nullable
                                                String headerKid)

extractKeyIdFromCriteria

@Nullable
protected String extractKeyIdFromCriteria(@Nonnull
                                          CriteriaSet criteriaSet)

Extract a KeyId from the criteria set if one exists. If not, return null.

Parameters:

criteriaSet - the criteria set to pull the keyId from

Returns:

a KeyId if one exists, null otherwise

populateCredentialsFromKeySet

protected void populateCredentialsFromKeySet(@Nonnull
                                             com.nimbusds.jose.jwk.JWKSet keySet,
                                             @Nonnull
                                             Collection<Credential> credentials)

Convert the RSA and EC keys from the given JWKSet into the collection of credentials.

Parameters:

keySet - the keyset containing RSA/EC keys to convert

credentials - the target collection to include the converted credentials

deriveClientSecretCredential

@Nullable
protected Credential deriveClientSecretCredential(@Nonnull
                                                  ClientSecretCredential secretCred,
                                                  @Nonnull
                                                  CriteriaSet criteriaSet)
                                           throws ResolverException

Use the usage type and algorithm information in the criteria to build a suitable signing or encryption credential.

Only supports symmetric key encryption algorithms. Request for asymmetric key encryption algorithms are ignored.

Parameters:

secretCred - the raw client_secret credential

criteriaSet - the criteria set used to find algorithm details for encryption keys

Returns:

a suitable credential, or null.

Throws:

ResolverException - if there is an error deriving the key