Package net.shibboleth.oidc.security.impl

Class CheckClientJWTSignatureAlgorithmHandler

java.lang.Object

net.shibboleth.utilities.java.support.component.AbstractInitializableComponent

org.opensaml.messaging.handler.AbstractMessageHandler

net.shibboleth.oidc.security.impl.CheckClientJWTSignatureAlgorithmHandler

All Implemented Interfaces:

Component, DestructableComponent, InitializableComponent, MessageHandler

public class CheckClientJWTSignatureAlgorithmHandler
extends AbstractMessageHandler

A MessageHandler that uses a OIDCClientInformation to verify the signature of a signed JWT uses expected algorithm.

Field Summary

Fields

Modifier and Type	Field	Description
private Function<MessageContext,com.nimbusds.openid.connect.sdk.rp.OIDCClientInformation>	clientInformationLookupStrategy	Function that looks up client information from the given message context.
private String	defaultAlgorithmValue	The default algorithm value used if lookup strategy returned null.
private Function<MessageContext,com.nimbusds.jwt.SignedJWT>	jwtTokenLookupStrategy	Function that looks up a signed JWT token from the given message context to validate .
private org.slf4j.Logger	log	Logger.
private Function<com.nimbusds.openid.connect.sdk.rp.OIDCClientInformation,String>	signatureAlgorithmLookupStrategy	A lookup function for the signature algorithm in the client metadata.
private com.nimbusds.jwt.SignedJWT	signedJwt	The extracted signed JWT that is to be validated.

Constructor Summary

Constructors

Constructor	Description
CheckClientJWTSignatureAlgorithmHandler()

Method Summary

Modifier and Type	Method	Description
protected void	doInitialize()
protected void	doInvoke(MessageContext messageContext)
protected boolean	doPreInvoke(MessageContext messageContext)
protected String	getExpectedAlgorithm(com.nimbusds.openid.connect.sdk.rp.OIDCClientInformation clientInformation)	Fetches the expected signature algorithm from the OIDCClientInformation.
void	setClientInformationLookupStrategy(Function<MessageContext,com.nimbusds.openid.connect.sdk.rp.OIDCClientInformation> strategy)	Set the lookup strategy to locate the client information.
void	setDefaultAlgorithmValue(String value)	Set the default algorithm value used if lookup strategy returned null.
void	setJwtTokenLookupStrategy(Function<MessageContext,com.nimbusds.jwt.SignedJWT> strategy)	Set the strategy used to look up a SignedJWT.
void	setSignatureAlgorithmLookupStrategy(Function<com.nimbusds.openid.connect.sdk.rp.OIDCClientInformation,String> strategy)	Set the strategy used to look up the signature algorithm in the client metadata.

Methods inherited from class org.opensaml.messaging.handler.AbstractMessageHandler

doPostInvoke, doPostInvoke, getActivationCondition, getLogPrefix, invoke, setActivationCondition

Methods inherited from class net.shibboleth.utilities.java.support.component.AbstractInitializableComponent

destroy, doDestroy, initialize, isDestroyed, isInitialized

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Methods inherited from interface net.shibboleth.utilities.java.support.component.InitializableComponent

initialize, isInitialized

Field Detail

log

@Nonnull
private final org.slf4j.Logger log

Logger.

jwtTokenLookupStrategy

@NonnullAfterInit
private Function<MessageContext,com.nimbusds.jwt.SignedJWT> jwtTokenLookupStrategy

Function that looks up a signed JWT token from the given message context to validate .

clientInformationLookupStrategy

@NonnullAfterInit
private Function<MessageContext,com.nimbusds.openid.connect.sdk.rp.OIDCClientInformation> clientInformationLookupStrategy

Function that looks up client information from the given message context. Can return null if not used.

signatureAlgorithmLookupStrategy

@NonnullAfterInit
private Function<com.nimbusds.openid.connect.sdk.rp.OIDCClientInformation,String> signatureAlgorithmLookupStrategy

A lookup function for the signature algorithm in the client metadata.

signedJwt

@Nullable
private com.nimbusds.jwt.SignedJWT signedJwt

The extracted signed JWT that is to be validated.

defaultAlgorithmValue

@Nullable
private String defaultAlgorithmValue

The default algorithm value used if lookup strategy returned null.

Constructor Detail

CheckClientJWTSignatureAlgorithmHandler

public CheckClientJWTSignatureAlgorithmHandler()

Method Detail

setJwtTokenLookupStrategy

public void setJwtTokenLookupStrategy(@Nonnull
                                      Function<MessageContext,com.nimbusds.jwt.SignedJWT> strategy)

Set the strategy used to look up a SignedJWT.

Parameters:

strategy - lookup strategy

setClientInformationLookupStrategy

public void setClientInformationLookupStrategy(@Nonnull
                                               Function<MessageContext,com.nimbusds.openid.connect.sdk.rp.OIDCClientInformation> strategy)

Set the lookup strategy to locate the client information.

Parameters:

strategy - the strategy.

setSignatureAlgorithmLookupStrategy

public void setSignatureAlgorithmLookupStrategy(@Nonnull
                                                Function<com.nimbusds.openid.connect.sdk.rp.OIDCClientInformation,String> strategy)

Set the strategy used to look up the signature algorithm in the client metadata.

Parameters:

strategy - lookup strategy

setDefaultAlgorithmValue

public void setDefaultAlgorithmValue(@Nullable
                                     String value)

Set the default algorithm value used if lookup strategy returned null.

Parameters:

value - default value

doInitialize

protected void doInitialize()
                     throws ComponentInitializationException

Overrides:

doInitialize in class AbstractInitializableComponent

Throws:

ComponentInitializationException

doPreInvoke

protected boolean doPreInvoke(MessageContext messageContext)
                       throws MessageHandlerException

Overrides:

doPreInvoke in class AbstractMessageHandler

Throws:

MessageHandlerException

doInvoke

protected void doInvoke(MessageContext messageContext)
                 throws MessageHandlerException

Specified by:

doInvoke in class AbstractMessageHandler

Throws:

MessageHandlerException

getExpectedAlgorithm

@Nullable
protected String getExpectedAlgorithm(@Nullable
                                      com.nimbusds.openid.connect.sdk.rp.OIDCClientInformation clientInformation)

Fetches the expected signature algorithm from the OIDCClientInformation.

Parameters:

clientInformation - the client information/metadata.

Returns:

the expected algorithm value.