Package net.shibboleth.oidc.security.credential.impl

Class LocalJOSEObjectCredentialResolver

  • All Implemented Interfaces:
    JOSEObjectCredentialResolver, Resolver<Credential,​CriteriaSet>, CredentialResolver
    public class LocalJOSEObjectCredentialResolver
extends BasicJOSEObjectCredentialResolver
    A simple specialization of BasicJOSEObjectCredentialResolver which is capable of resolving local credentials from a supplied CredentialResolver which manages local credentials.

    The local credential resolver supplied should manage and return credentials which contain either a secret (symmetric) key or the private key half of a key pair.

    A typical use case for this class would be as a resolver of decryption keys, such as is needed by JWETokenDecrypter}.

    Resolution proceeds as follows:

    1. Any credential resolved via the standard BasicJOSEObjectCredentialResolver resolution process which is a local credential (contains private key) will be removed from the effective set of credentials to be returned.
    2. If a credential so removed contained a public key, that key will be used as a resolution criteria input to the local credential resolver (along with the keyID 'kid' if one exists in the JOSE headers). Any local credentials so resolved will be added to the set to be returned.
    3. Similarly, the keyID 'kid' from the JOSE headers will also be used as resolution criteria for local credentials and the resultant credentials added to the set to be returned providing they do not share the same private and public key pair as one already resolved - avoiding key duplication in the result.
    Adds either 'kid' or 'public key' to the criteria set sent to the local credential resolver for resolution.
    Since:
    2.2.0

    • Field Detail

      • log

        private final org.slf4j.Logger log
        Class logger.

    • Constructor Detail

      • LocalJOSEObjectCredentialResolver

        public LocalJOSEObjectCredentialResolver​(@Nonnull @ParameterName(name="localCredentialResolver")
                                         JOSEObjectCredentialResolver localCredentialResolver)
        Constructor.
        Parameters:
        localCredentialResolver - resolver of local credentials

    • Method Detail

      • getLocalCredentialResolver

        @Nonnull
public CredentialResolver getLocalCredentialResolver()
        Get the resolver for local credentials. The credentials managed and returned by this resolver should all contain either a secret (symmetric) or private key.
        Returns:
        resolver of local credentials

      • postProcess

        @Nonnull
protected void postProcess​(@Nullable
                           CriteriaSet criteriaSet,
                           @Nonnull
                           com.nimbusds.jose.JOSEObject joseObject,
                           @Nonnull
                           List<Credential> credentials)
                    throws ResolverException
        Description copied from class: BasicJOSEObjectCredentialResolver
        Hook for subclasses to do post-processing of the credential set after all JOSE header keys have been processed.

        For example, the previously resolved credentials might be used to index into a store of local credentials, where the index is a key name or the public half of a key pair extracted from the headers.

        Overrides:
        postProcess in class BasicJOSEObjectCredentialResolver
        Parameters:
        criteriaSet - the credential criteria used to resolve credentials
        joseObject - the extracted JOSE object
        credentials - the list which will store the resolved credentials
        Throws:
        ResolverException - thrown if there is an error during processing

      • filterAlreadyContained

        @Nonnull
@NonnullElements
@Live
private List<Credential> filterAlreadyContained​(@Nonnull
                                                List<Credential> credentialsToFilterOn,
                                                @Nonnull
                                                List<Credential> credentialsToFilter)
        Return a new list of credentials based on the credentialsToFilter that are not contained in credentialsToFilterOn. Containment is determined by equality of both private and public keys.
        Parameters:
        credentialsToFilterOn - the credentials used to filter the credentialsToFilter
        credentialsToFilter - the credentials which will be filtered
        Returns:
        credentials contained in credentialsToFilter not in credentialsToFilterOn.

      • resolveLocalCredentialsByCriteria

        @Nonnull
@NonnullElements
@Live
private List<Credential> resolveLocalCredentialsByCriteria​(CriteriaSet criteriaSet)
                                                    throws ResolverException
        Resolve credentials using the localCredResolver and the supplied criteria.
        Parameters:
        criteriaSet - the criterion to pass to the credential resolver
        Returns:
        collection of local credentials identified by the criteria
        Throws:
        ResolverException - thrown if there is a problem resolving credentials from the local credential resolver

      • resolveKeyIdFromJoseHeader

        @Nullable
private String resolveKeyIdFromJoseHeader​(@Nonnull
                                          com.nimbusds.jose.Header header)
        Return the KeyId from either a JWSHeader or a JWEHeader. Returns null if not found.
        Parameters:
        header - the JOSE header to find a kid from
        Returns:
        the keyId or null

      • isLocalCredential

        protected boolean isLocalCredential​(@Nonnull
                                    Credential credential)
        Determine whether the credential is a local credential. A local credential will have either a private key or a secret (symmetric) key.
        Parameters:
        credential - the credential to evaluate
        Returns:
        true if the credential has either a private or secret key, false otherwise