Package net.shibboleth.oidc.security.jose.impl

Class RelyingPartySigningParametersResolver

java.lang.Object

org.opensaml.xmlsec.impl.AbstractSecurityParametersResolver<SignatureSigningParameters>

net.shibboleth.oidc.security.jose.impl.BasicSignatureSigningParametersResolver

net.shibboleth.oidc.security.jose.impl.RelyingPartySigningParametersResolver

All Implemented Interfaces:

SignatureSigningParametersResolver, Resolver<SignatureSigningParameters,CriteriaSet>

public class RelyingPartySigningParametersResolver
extends BasicSignatureSigningParametersResolver

A specialization of BasicSignatureSigningParametersResolver which supports selecting signing credentials from client_secret credential criterion (e.g. from the relying party configuration) in addition to the configured signing credentials inside the signing configuration (determined by the superclass).

The OpenID Providers's metadata is also used to filter for those algorithms supported by the OP in addition to those supported by the security configuration.

*

In addition to the Criterion inputs documented in BasicSignatureSigningParametersResolver, the following inputs are also supported:

• ClientSecretCredentialCriterion - optional
• ProviderMetadataCriterion - required

Field Summary

Fields

Modifier and Type	Field	Description
private org.slf4j.Logger	log	Logger.
private Function<com.nimbusds.openid.connect.sdk.op.OIDCProviderMetadata,List<String>>	providerMetadataAlgorithmLookupStrategy	A strategy to pull out the correct set of supported algorithms from the OIDCProviderMetadata.

Constructor Summary

Constructors

Constructor	Description
RelyingPartySigningParametersResolver()	Constructor.

Method Summary

Modifier and Type	Method	Description
private List<com.nimbusds.jose.JWSAlgorithm>	convertSupportAlgorithmsToJwkAlgorithms(List<String> algos)	Convert the algorithms represented as strings, into Nimbus Algorithms for later comparison.
private List<String>	filterForProviderSupportedAlgorithms(CriteriaSet criteria, List<String> algorithms)	Filter the set of algorithms against the set supported by the OpenID Provider.
protected void	resolveAndPopulateCredentialAndSignatureAlgorithm(SignatureSigningParameters params, CriteriaSet criteria, Predicate<String> includeExcludePredicate)	Resolve and populate the signing credential and signature method algorithm URI on the supplied parameters instance.
void	setProviderMetadataAlgorithmLookupStrategy(Function<com.nimbusds.openid.connect.sdk.op.OIDCProviderMetadata,List<String>> strategy)	Set the strategy used to locate the supported signing algorithms from the OP's metadata for this resolver instance.

Methods inherited from class net.shibboleth.oidc.security.jose.impl.BasicSignatureSigningParametersResolver

credentialSupportsSigningAlgorithm, findCompatibleAlgorithmAndCredential, getAlgorithmRegistry, getAlgorithmRuntimeSupportedPredicate, getEffectiveSignatureAlgorithms, getEffectiveSigningCredentials, getIncludeExcludePredicate, logResult, resolve, resolveSingle, setAlgorithmRegistry, validate

Methods inherited from class org.opensaml.xmlsec.impl.AbstractSecurityParametersResolver

lookupKeyInfoGenerator, resolveAndPopulateIncludesExcludes, resolveEffectiveExcludes, resolveEffectiveIncludes, resolveIncludeExcludePrecedence, resolveIncludeExcludePredicate

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Field Detail

log

@Nonnull
private final org.slf4j.Logger log

Logger.

providerMetadataAlgorithmLookupStrategy

@Nonnull
private Function<com.nimbusds.openid.connect.sdk.op.OIDCProviderMetadata,List<String>> providerMetadataAlgorithmLookupStrategy

A strategy to pull out the correct set of supported algorithms from the OIDCProviderMetadata. By default returns null, signalling 'do not filter'.

Constructor Detail

RelyingPartySigningParametersResolver

public RelyingPartySigningParametersResolver()

Constructor.

Method Detail

setProviderMetadataAlgorithmLookupStrategy

public void setProviderMetadataAlgorithmLookupStrategy(@Nonnull
                                                       Function<com.nimbusds.openid.connect.sdk.op.OIDCProviderMetadata,List<String>> strategy)

Set the strategy used to locate the supported signing algorithms from the OP's metadata for this resolver instance. For example, id_token or request object signing algorithms.

Parameters:

strategy - the strategy

resolveAndPopulateCredentialAndSignatureAlgorithm

protected void resolveAndPopulateCredentialAndSignatureAlgorithm(@Nonnull
                                                                 SignatureSigningParameters params,
                                                                 @Nonnull
                                                                 CriteriaSet criteria,
                                                                 @Nonnull
                                                                 Predicate<String> includeExcludePredicate)

Description copied from class: BasicSignatureSigningParametersResolver

Resolve and populate the signing credential and signature method algorithm URI on the supplied parameters instance.

Overrides:

resolveAndPopulateCredentialAndSignatureAlgorithm in class BasicSignatureSigningParametersResolver

Parameters:

params - the parameters instance being populated

criteria - the input criteria being evaluated

includeExcludePredicate - the include/exclude predicate with which to evaluate the candidate signing method algorithm URIs

convertSupportAlgorithmsToJwkAlgorithms

@Nonnull
private List<com.nimbusds.jose.JWSAlgorithm> convertSupportAlgorithmsToJwkAlgorithms(@Nonnull
                                                                                     List<String> algos)

Convert the algorithms represented as strings, into Nimbus Algorithms for later comparison.

Parameters:

algos - the algorithms to convert

Returns:

the converted algorithms

filterForProviderSupportedAlgorithms

private List<String> filterForProviderSupportedAlgorithms(@Nonnull
                                                          CriteriaSet criteria,
                                                          @Nonnull
                                                          List<String> algorithms)

Filter the set of algorithms against the set supported by the OpenID Provider. Always returns a new list reference. The ordering of the input algorithms should be preserved.

Parameters:

criteria - the criteria to extract the OP's metadata from to check supported algorithms.

algorithms - the current set of supported algorithms

Returns:

the current set of supported algorithms filtered by those also supported by the OP.