Package net.shibboleth.oidc.security.jose.impl

Class ClientInformationSignatureSigningParametersResolver

java.lang.Object

org.opensaml.xmlsec.impl.AbstractSecurityParametersResolver<SignatureSigningParameters>

net.shibboleth.oidc.security.jose.impl.BasicSignatureSigningParametersResolver

net.shibboleth.oidc.security.jose.impl.ClientInformationSignatureSigningParametersResolver

All Implemented Interfaces:

SignatureSigningParametersResolver, Resolver<SignatureSigningParameters,CriteriaSet>

public class ClientInformationSignatureSigningParametersResolver
extends BasicSignatureSigningParametersResolver
implements SignatureSigningParametersResolver

An implementation of an SignatureSigningParametersResolver that extends the BasicSignatureSigningParametersResolver functionality by adding a configurable lookup strategy for fetching the desired algorithm value from OIDCClientInformation. It is expected to be found from the criteria set.

Field Summary

Fields

Modifier and Type	Field	Description
private String	defaultAlgorithmValue	The default algorithm value used if lookup strategy returned null.
private org.slf4j.Logger	log	Class logger.
private Function<com.nimbusds.openid.connect.sdk.rp.OIDCClientInformation,String>	signatureAlgorithmLookupStrategy	A lookup function for the signature algorithm.

Constructor Summary

Constructors

Constructor	Description
ClientInformationSignatureSigningParametersResolver(Function<com.nimbusds.openid.connect.sdk.rp.OIDCClientInformation,String> strategy, String defaultValue)	Constructor.

Method Summary

Modifier and Type	Method	Description
protected List<String>	convertIntoListIfEnabled(String algorithm, List<String> enabledAlgorithms)	Returns the given algorithm in a List if it was enabled in the list of enabled algorithms.
protected com.nimbusds.openid.connect.sdk.rp.OIDCClientInformation	getClientInformation(CriteriaSet criteria)	Returns the client information from the given criteria set, if one was found.
protected List<String>	getEffectiveSignatureAlgorithms(CriteriaSet criteria, Predicate<String> includeExcludePredicate)	Get the effective list of signature algorithm URIs to consider, including application of include/exclude policy.
protected List<Credential>	getEffectiveSigningCredentials(CriteriaSet criteria)	Get the effective list of signing credentials to consider.

Methods inherited from class net.shibboleth.oidc.security.jose.impl.BasicSignatureSigningParametersResolver

credentialSupportsSigningAlgorithm, findCompatibleAlgorithmAndCredential, getAlgorithmRegistry, getAlgorithmRuntimeSupportedPredicate, getIncludeExcludePredicate, logResult, resolve, resolveAndPopulateCredentialAndSignatureAlgorithm, resolveSingle, setAlgorithmRegistry, validate

Methods inherited from class org.opensaml.xmlsec.impl.AbstractSecurityParametersResolver

lookupKeyInfoGenerator, resolveAndPopulateIncludesExcludes, resolveEffectiveExcludes, resolveEffectiveIncludes, resolveIncludeExcludePrecedence, resolveIncludeExcludePredicate

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Methods inherited from interface net.shibboleth.utilities.java.support.resolver.Resolver

resolve, resolveSingle

Field Detail

log

private final org.slf4j.Logger log

Class logger.

signatureAlgorithmLookupStrategy

private final Function<com.nimbusds.openid.connect.sdk.rp.OIDCClientInformation,String> signatureAlgorithmLookupStrategy

A lookup function for the signature algorithm.

defaultAlgorithmValue

private final String defaultAlgorithmValue

The default algorithm value used if lookup strategy returned null.

Constructor Detail

ClientInformationSignatureSigningParametersResolver

public ClientInformationSignatureSigningParametersResolver(@Nonnull @ParameterName(name="signatureAlgorithmLookupStrategy")
                                                           Function<com.nimbusds.openid.connect.sdk.rp.OIDCClientInformation,String> strategy,
                                                           @Nullable @ParameterName(name="defaultAlgorithmValue")
                                                           String defaultValue)

Constructor.

Parameters:

strategy - a lookup function for the signature algorithm

defaultValue - the default algorithm value used if lookup strategy returned null

Method Detail

getEffectiveSignatureAlgorithms

@Nonnull
protected List<String> getEffectiveSignatureAlgorithms(@Nonnull
                                                       CriteriaSet criteria,
                                                       @Nonnull
                                                       Predicate<String> includeExcludePredicate)

Get the effective list of signature algorithm URIs to consider, including application of include/exclude policy.

Overrides:

getEffectiveSignatureAlgorithms in class BasicSignatureSigningParametersResolver

Parameters:

criteria - the input criteria being evaluated

includeExcludePredicate - the include/exclude predicate to use

Returns:

the list of effective algorithm URIs

getClientInformation

@Nullable
protected com.nimbusds.openid.connect.sdk.rp.OIDCClientInformation getClientInformation(@Nonnull
                                                                                        CriteriaSet criteria)

Returns the client information from the given criteria set, if one was found.

Parameters:

criteria - the input criteria being evaluated

Returns:

the client information if it existed, null otherwise

getEffectiveSigningCredentials

@Nonnull
protected List<Credential> getEffectiveSigningCredentials(@Nonnull
                                                          CriteriaSet criteria)

Get the effective list of signing credentials to consider. Adds the client secret credential to the list provided by the base-class, if secret is set in the metadata.

Overrides:

getEffectiveSigningCredentials in class BasicSignatureSigningParametersResolver

Parameters:

criteria - the input criteria being evaluated

Returns:

the list of credentials

convertIntoListIfEnabled

@Nonnull
protected List<String> convertIntoListIfEnabled(@Nonnull
                                                String algorithm,
                                                @Nonnull
                                                List<String> enabledAlgorithms)

Returns the given algorithm in a List if it was enabled in the list of enabled algorithms. An empty list is returned if the algorithm was not enabled.

Parameters:

algorithm - the algorithm to be checked against the list

enabledAlgorithms - the list of enabled algorithms

Returns:

the given algorithm as list if it was enabled, or an empty list if not