Package net.shibboleth.oidc.security.impl

Class DecryptJWE

java.lang.Object

net.shibboleth.utilities.java.support.component.AbstractInitializableComponent

org.opensaml.profile.action.AbstractProfileAction

org.opensaml.profile.action.AbstractConditionalProfileAction

net.shibboleth.idp.profile.AbstractProfileAction

net.shibboleth.oidc.security.impl.DecryptJWE

All Implemented Interfaces:

Component, DestructableComponent, InitializableComponent, ProfileAction, Aware, MessageSource, MessageSourceAware, Action

public class DecryptJWE
extends net.shibboleth.idp.profile.AbstractProfileAction

Decrypt the located JWE using the decryption parameters stored in the security context.

Event:

EventIds.PROCEED_EVENT_ID, EventIds.INVALID_SEC_CFG, OidcEventIds.INVALID_TOKEN

Postcondition:

Decrypt a JWT and add it back to via an update strategy.

Field Summary

Fields

Modifier and Type	Field	Description
private JWETokenDecrypter	decrypter	The decryption object.
private com.nimbusds.jwt.EncryptedJWT	encryptedJwt	The extracted encrypted JWT that is to be validated.
private String	errorEventId	Event identifier to publish in the case of decryption errors.
private Function<ProfileRequestContext,com.nimbusds.jwt.EncryptedJWT>	jwtTokenLookupStrategy	Function that looks up a signed JWT token from the given message context to validate.
private BiConsumer<ProfileRequestContext,com.nimbusds.jwt.JWT>	jwtUpdateStrategy	A consumer that sets the JWT produced from this decryption operation back into the profile request context.
private org.slf4j.Logger	log	Class logger.
private Function<ProfileRequestContext,SecurityParametersContext>	securityParamsLookupStrategy	Strategy used to locate the SecurityParametersContext.

Constructor Summary

Constructors

Constructor	Description
DecryptJWE()	Constructor.

Method Summary

Modifier and Type	Method	Description
protected void	doExecute(ProfileRequestContext profileRequestContext)
protected void	doInitialize()
protected boolean	doPreExecute(ProfileRequestContext profileRequestContext)
private void	logJWT(com.nimbusds.jwt.JWT jwt)	Log (on trace) the JWT.
void	setErrorEventId(String id)	Sets the event identifier to publish in the case of decryption errors.
void	setJwtTokenLookupStrategy(Function<ProfileRequestContext,com.nimbusds.jwt.EncryptedJWT> strategy)	Set the strategy used to look up a encrypted JWT token.
void	setJwtUpdateStrategy(BiConsumer<ProfileRequestContext,com.nimbusds.jwt.JWT> strategy)	Set the strategy used to update the profile request context with the JWT produced as a result of this decryption operation.
void	setSecurityParametersContextLookupStrategy(Function<ProfileRequestContext,SecurityParametersContext> strategy)	Set the strategy used to locate the SecurityParametersContext associated with a given ProfileRequestContext.

Methods inherited from class net.shibboleth.idp.profile.AbstractProfileAction

doExecute, execute, getBean, getBean, getMessage, getMessage, getMessage, getParameter, getParameter, getProfileContextLookupStrategy, getRequestContext, getResult, setMessageSource, setProfileContextLookupStrategy

Methods inherited from class org.opensaml.profile.action.AbstractConditionalProfileAction

getActivationCondition, setActivationCondition

Methods inherited from class org.opensaml.profile.action.AbstractProfileAction

doPostExecute, doPostExecute, execute, getHttpServletRequest, getHttpServletRequestSupplier, getHttpServletResponse, getHttpServletResponseSupplier, getLogPrefix, setHttpServletRequest, setHttpServletRequestSupplier, setHttpServletResponse, setHttpServletResponseSupplier

Methods inherited from class net.shibboleth.utilities.java.support.component.AbstractInitializableComponent

destroy, doDestroy, initialize, isDestroyed, isInitialized

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Methods inherited from interface net.shibboleth.utilities.java.support.component.InitializableComponent

initialize, isInitialized

Field Detail

log

@Nonnull
private final org.slf4j.Logger log

Class logger.

jwtTokenLookupStrategy

@NonnullAfterInit
private Function<ProfileRequestContext,com.nimbusds.jwt.EncryptedJWT> jwtTokenLookupStrategy

Function that looks up a signed JWT token from the given message context to validate.

jwtUpdateStrategy

@NonnullAfterInit
private BiConsumer<ProfileRequestContext,com.nimbusds.jwt.JWT> jwtUpdateStrategy

A consumer that sets the JWT produced from this decryption operation back into the profile request context.

errorEventId

@Nonnull
private String errorEventId

Event identifier to publish in the case of decryption errors.

encryptedJwt

@Nullable
private com.nimbusds.jwt.EncryptedJWT encryptedJwt

The extracted encrypted JWT that is to be validated.

decrypter

@Nullable
private JWETokenDecrypter decrypter

The decryption object.

securityParamsLookupStrategy

@Nonnull
private Function<ProfileRequestContext,SecurityParametersContext> securityParamsLookupStrategy

Strategy used to locate the SecurityParametersContext.

Constructor Detail

DecryptJWE

public DecryptJWE()

Constructor.

Method Detail

setSecurityParametersContextLookupStrategy

public void setSecurityParametersContextLookupStrategy(@Nonnull
                                                       Function<ProfileRequestContext,SecurityParametersContext> strategy)

Set the strategy used to locate the SecurityParametersContext associated with a given ProfileRequestContext.

Parameters:

strategy - strategy used to locate the SecurityParametersContext associated with a given ProfileRequestContext

setJwtUpdateStrategy

public void setJwtUpdateStrategy(@Nonnull
                                 BiConsumer<ProfileRequestContext,com.nimbusds.jwt.JWT> strategy)

Set the strategy used to update the profile request context with the JWT produced as a result of this decryption operation.

Parameters:

strategy - the strategy

setJwtTokenLookupStrategy

public void setJwtTokenLookupStrategy(@Nonnull
                                      Function<ProfileRequestContext,com.nimbusds.jwt.EncryptedJWT> strategy)

Set the strategy used to look up a encrypted JWT token.

Parameters:

strategy - lookup strategy

setErrorEventId

public void setErrorEventId(@Nonnull
                            String id)

Sets the event identifier to publish in the case of decryption errors.

Parameters:

id - the identifier to set

doInitialize

protected void doInitialize()
                     throws ComponentInitializationException

Overrides:

doInitialize in class AbstractInitializableComponent

Throws:

ComponentInitializationException

doPreExecute

protected boolean doPreExecute(@Nonnull
                               ProfileRequestContext profileRequestContext)

Overrides:

doPreExecute in class AbstractConditionalProfileAction

doExecute

protected void doExecute(@Nonnull
                         ProfileRequestContext profileRequestContext)

Overrides:

doExecute in class AbstractProfileAction

logJWT

private void logJWT(@Nonnull
                    com.nimbusds.jwt.JWT jwt)

Log (on trace) the JWT.

Parameters:

jwt - the JWT to log.