Package net.shibboleth.oidc.security.impl

Class CheckClientJWTDecryptionConfiguration

java.lang.Object

net.shibboleth.utilities.java.support.component.AbstractInitializableComponent

org.opensaml.profile.action.AbstractProfileAction

org.opensaml.profile.action.AbstractConditionalProfileAction

net.shibboleth.idp.profile.AbstractProfileAction

net.shibboleth.oidc.security.impl.CheckClientJWTDecryptionConfiguration

All Implemented Interfaces:

Component, DestructableComponent, InitializableComponent, ProfileAction, Aware, MessageSource, MessageSourceAware, Action

public class CheckClientJWTDecryptionConfiguration
extends net.shibboleth.idp.profile.AbstractProfileAction

An action that uses a OIDCClientInformation to verify the encryption parameters of an incoming encrypted JWT are compliant with configuration in the client metadata.

Field Summary

Fields

Modifier and Type	Field	Description
private Function<ProfileRequestContext,com.nimbusds.openid.connect.sdk.rp.OIDCClientInformation>	clientInformationLookupStrategy	Function that looks up client information from the given profile context.
private Function<com.nimbusds.openid.connect.sdk.rp.OIDCClientInformation,String>	dataEncryptionAlgorithmLookupStrategy	A lookup function for the data encryption algorithm in the client metadata.
private com.nimbusds.jwt.EncryptedJWT	encryptedJwt	The extracted encrypted JWT that is to be processed.
private boolean	encryptionOptional	Whether encryption is optional.
private Predicate<ProfileRequestContext>	encryptionOptionalPredicate	Predicate to determine how to proceed if JWT token was not encrypted.
private String	errorEventId	Event identifier to publish if token parameters are not compliant with the configuration.
private Function<ProfileRequestContext,com.nimbusds.jwt.JWT>	jwtTokenLookupStrategy	Function that looks up an encrypted JWT token from the given profile context to validate .
private Function<com.nimbusds.openid.connect.sdk.rp.OIDCClientInformation,String>	keyTransportEncryptionAlgorithmLookupStrategy	A lookup function for the key transport algorithm in the client metadata.
private org.slf4j.Logger	log	Logger.

Constructor Summary

Constructors

Constructor	Description
CheckClientJWTDecryptionConfiguration()

Method Summary

Modifier and Type	Method	Description
protected void	doExecute(ProfileRequestContext profileRequestContext)
protected void	doInitialize()
protected boolean	doPreExecute(ProfileRequestContext profileRequestContext)
void	setClientInformationLookupStrategy(Function<ProfileRequestContext,com.nimbusds.openid.connect.sdk.rp.OIDCClientInformation> strategy)	Set the lookup strategy to locate the client information.
void	setDataEncryptionAlgorithmLookupStrategy(Function<com.nimbusds.openid.connect.sdk.rp.OIDCClientInformation,String> strategy)	Set the strategy used to look up the data encryption algorithm in the client metadata.
void	setEncryptionOptionalPredicate(Predicate<ProfileRequestContext> condition)	Sets the condition to apply to determine how to proceed if encryption parameter resolution fails.
void	setErrorEventId(String id)	Sets the event identifier to publish if token parameters are not compliant with the configuration.
void	setJwtTokenLookupStrategy(Function<ProfileRequestContext,com.nimbusds.jwt.JWT> strategy)	Set the strategy used to look up a JWT.
void	setKeyTransportEncryptionAlgorithmLookupStrategy(Function<com.nimbusds.openid.connect.sdk.rp.OIDCClientInformation,String> strategy)	Set the strategy used to look up the data encryption algorithm in the client metadata.

Methods inherited from class net.shibboleth.idp.profile.AbstractProfileAction

doExecute, execute, getBean, getBean, getMessage, getMessage, getMessage, getParameter, getParameter, getProfileContextLookupStrategy, getRequestContext, getResult, setMessageSource, setProfileContextLookupStrategy

Methods inherited from class org.opensaml.profile.action.AbstractConditionalProfileAction

getActivationCondition, setActivationCondition

Methods inherited from class org.opensaml.profile.action.AbstractProfileAction

doPostExecute, doPostExecute, execute, getHttpServletRequest, getHttpServletRequestSupplier, getHttpServletResponse, getHttpServletResponseSupplier, getLogPrefix, setHttpServletRequest, setHttpServletRequestSupplier, setHttpServletResponse, setHttpServletResponseSupplier

Methods inherited from class net.shibboleth.utilities.java.support.component.AbstractInitializableComponent

destroy, doDestroy, initialize, isDestroyed, isInitialized

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Methods inherited from interface net.shibboleth.utilities.java.support.component.InitializableComponent

initialize, isInitialized

Field Detail

log

@Nonnull
private final org.slf4j.Logger log

Logger.

jwtTokenLookupStrategy

@NonnullAfterInit
private Function<ProfileRequestContext,com.nimbusds.jwt.JWT> jwtTokenLookupStrategy

Function that looks up an encrypted JWT token from the given profile context to validate .

encryptionOptionalPredicate

@NonnullAfterInit
private Predicate<ProfileRequestContext> encryptionOptionalPredicate

Predicate to determine how to proceed if JWT token was not encrypted.

clientInformationLookupStrategy

@NonnullAfterInit
private Function<ProfileRequestContext,com.nimbusds.openid.connect.sdk.rp.OIDCClientInformation> clientInformationLookupStrategy

Function that looks up client information from the given profile context.

dataEncryptionAlgorithmLookupStrategy

@NonnullAfterInit
private Function<com.nimbusds.openid.connect.sdk.rp.OIDCClientInformation,String> dataEncryptionAlgorithmLookupStrategy

A lookup function for the data encryption algorithm in the client metadata.

keyTransportEncryptionAlgorithmLookupStrategy

@NonnullAfterInit
private Function<com.nimbusds.openid.connect.sdk.rp.OIDCClientInformation,String> keyTransportEncryptionAlgorithmLookupStrategy

A lookup function for the key transport algorithm in the client metadata.

errorEventId

@NonnullAfterInit
private String errorEventId

Event identifier to publish if token parameters are not compliant with the configuration.

encryptedJwt

@Nullable
private com.nimbusds.jwt.EncryptedJWT encryptedJwt

The extracted encrypted JWT that is to be processed.

encryptionOptional

private boolean encryptionOptional

Whether encryption is optional.

Constructor Detail

CheckClientJWTDecryptionConfiguration

public CheckClientJWTDecryptionConfiguration()

Method Detail

setJwtTokenLookupStrategy

public void setJwtTokenLookupStrategy(@Nonnull
                                      Function<ProfileRequestContext,com.nimbusds.jwt.JWT> strategy)

Set the strategy used to look up a JWT.

Parameters:

strategy - lookup strategy

setClientInformationLookupStrategy

public void setClientInformationLookupStrategy(@Nonnull
                                               Function<ProfileRequestContext,com.nimbusds.openid.connect.sdk.rp.OIDCClientInformation> strategy)

Set the lookup strategy to locate the client information.

Parameters:

strategy - the strategy.

setDataEncryptionAlgorithmLookupStrategy

public void setDataEncryptionAlgorithmLookupStrategy(@Nonnull
                                                     Function<com.nimbusds.openid.connect.sdk.rp.OIDCClientInformation,String> strategy)

Set the strategy used to look up the data encryption algorithm in the client metadata.

Parameters:

strategy - lookup strategy

setKeyTransportEncryptionAlgorithmLookupStrategy

public void setKeyTransportEncryptionAlgorithmLookupStrategy(@Nonnull
                                                             Function<com.nimbusds.openid.connect.sdk.rp.OIDCClientInformation,String> strategy)

Set the strategy used to look up the data encryption algorithm in the client metadata.

Parameters:

strategy - lookup strategy

setEncryptionOptionalPredicate

public void setEncryptionOptionalPredicate(@Nonnull
                                           Predicate<ProfileRequestContext> condition)

Sets the condition to apply to determine how to proceed if encryption parameter resolution fails.

Parameters:

condition - condition to set

setErrorEventId

public void setErrorEventId(@Nonnull
                            String id)

Sets the event identifier to publish if token parameters are not compliant with the configuration.

Parameters:

id - the identifier to set

doInitialize

protected void doInitialize()
                     throws ComponentInitializationException

Overrides:

doInitialize in class AbstractInitializableComponent

Throws:

ComponentInitializationException

doPreExecute

protected boolean doPreExecute(ProfileRequestContext profileRequestContext)

Overrides:

doPreExecute in class AbstractConditionalProfileAction

doExecute

protected void doExecute(ProfileRequestContext profileRequestContext)

Overrides:

doExecute in class AbstractProfileAction