Package net.shibboleth.oidc.security.credential.impl

Class ProviderMetadataCredentialResolver

java.lang.Object

org.opensaml.security.credential.impl.AbstractCredentialResolver

org.opensaml.security.credential.impl.AbstractCriteriaFilteringCredentialResolver

net.shibboleth.oidc.security.credential.impl.BasicJOSEObjectCredentialResolver

net.shibboleth.oidc.security.credential.impl.ProviderMetadataCredentialResolver

All Implemented Interfaces:

JOSEObjectCredentialResolver, Component, InitializableComponent, Resolver<Credential,CriteriaSet>, CredentialResolver

public class ProviderMetadataCredentialResolver
extends BasicJOSEObjectCredentialResolver
implements InitializableComponent

A LocalJOSEObjectCredentialResolver that resolves credentials from the jwks_uri of an OpenID Provider. Further filtering of credentials is provided by the AbstractCriteriaFilteringCredentialResolver parent class.

Note, only RSA or EC keys are resolved as these are the only key types which should be exposed in public JWKS documents.

Field Summary

Fields

Modifier and Type	Field	Description
private boolean	isInitialized	Initialization flag.
private Duration	keyFetchInterval	The remote key refresh interval.
private org.slf4j.Logger	log	Class logger.
private RemoteJwkSetCache	remoteJwkSetCache	The cache for remote JWK key sets.

Constructor Summary

Constructors

Constructor	Description
ProviderMetadataCredentialResolver()

Method Summary

Modifier and Type	Method	Description
void	initialize()
boolean	isInitialized()
protected Collection<Credential>	resolveFromMetadata(CriteriaSet criteriaSet, com.nimbusds.openid.connect.sdk.op.OIDCProviderMetadata metadata)	Fetch the remote JWK Set from the jwk_uri in the OpenID Provider's metadata.
protected Iterable<Credential>	resolveFromSource(CriteriaSet criteriaSet)
void	setKeyFetchInterval(Duration interval)	Set the remote key refresh interval.
void	setRemoteJwkSetCache(RemoteJwkSetCache jwkSetCache)	Set the cache for remote JWK key sets.

Methods inherited from class net.shibboleth.oidc.security.credential.impl.BasicJOSEObjectCredentialResolver

buildJWKCredential, deriveClientSecretCredential, extractKeyIdFromCriteria, populateCredentialsFromKeySet, postProcess, processJWEHeader, processJWSHeader

Methods inherited from class org.opensaml.security.credential.impl.AbstractCriteriaFilteringCredentialResolver

isSatisfyAllPredicates, resolve, setSatisfyAllPredicates

Methods inherited from class org.opensaml.security.credential.impl.AbstractCredentialResolver

resolveSingle

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Methods inherited from interface net.shibboleth.utilities.java.support.resolver.Resolver

resolve, resolveSingle

Field Detail

log

@Nonnull
private final org.slf4j.Logger log

Class logger.

isInitialized

private boolean isInitialized

Initialization flag.

remoteJwkSetCache

@NonnullAfterInit
private RemoteJwkSetCache remoteJwkSetCache

The cache for remote JWK key sets.

keyFetchInterval

@Positive
private Duration keyFetchInterval

The remote key refresh interval. Default value: 30 minutes.

Constructor Detail

ProviderMetadataCredentialResolver

public ProviderMetadataCredentialResolver()

Method Detail

isInitialized

public boolean isInitialized()

Specified by:

isInitialized in interface InitializableComponent

initialize

public void initialize()
                throws ComponentInitializationException

Specified by:

initialize in interface InitializableComponent

Throws:

ComponentInitializationException

setKeyFetchInterval

public void setKeyFetchInterval(@Positive
                                Duration interval)

Set the remote key refresh interval.

Parameters:

interval - What to set.

setRemoteJwkSetCache

public void setRemoteJwkSetCache(RemoteJwkSetCache jwkSetCache)

Set the cache for remote JWK key sets.

Parameters:

jwkSetCache - What to set.

resolveFromSource

protected Iterable<Credential> resolveFromSource(@Nonnull
                                                 CriteriaSet criteriaSet)
                                          throws ResolverException

Overrides:

resolveFromSource in class BasicJOSEObjectCredentialResolver

Throws:

ResolverException

resolveFromMetadata

@Nonnull
protected Collection<Credential> resolveFromMetadata(@Nonnull
                                                     CriteriaSet criteriaSet,
                                                     @Nonnull
                                                     com.nimbusds.openid.connect.sdk.op.OIDCProviderMetadata metadata)

Fetch the remote JWK Set from the jwk_uri in the OpenID Provider's metadata. Convert each JWK into a Credential and return. Only supports EC (key agreement) and RSA (key encryption) keys.

If a keyId is passed through in the criteria set, it is used as a parameter to the remote JWK cache. This ensures if the key is not found any cached keyset document, the document is re-fetched irrespective of the cache entry expiry.

Parameters:

criteriaSet - the criteria set

metadata - the OpenID Provider's metadata

Returns:

a collection of credentials that represents EC and RSA keys in the remote JWK Set (if any)