Package net.shibboleth.oidc.security.jwt.claims.impl

Class AudienceClaimsValidator

java.lang.Object

net.shibboleth.utilities.java.support.component.AbstractInitializableComponent

net.shibboleth.utilities.java.support.component.AbstractIdentifiedInitializableComponent

net.shibboleth.utilities.java.support.component.AbstractIdentifiableInitializableComponent

net.shibboleth.oidc.jwt.claims.AbstractClaimsValidator

net.shibboleth.oidc.security.jwt.claims.impl.AudienceClaimsValidator

All Implemented Interfaces:

ClaimsValidator, Component, DestructableComponent, IdentifiableComponent, IdentifiedComponent, InitializableComponent

Direct Known Subclasses:

AuthenticationAudienceClaimsValidator

@ThreadSafeAfterInit
public class AudienceClaimsValidator
extends AbstractClaimsValidator

Verifies the Audience (aud) claim contains the appropriate value. The audience is determined at runtime using an appropriate strategy.

Field Summary

Fields

Modifier and Type	Field	Description
private BiFunction<ProfileRequestContext,com.nimbusds.jwt.JWTClaimsSet,Set<String>>	additionalAudiencesLookupStrategy	A strategy to lookup a list of additional audiences expected in the 'aud' claim.
private boolean	allowMissing	Allow a missing aud claim.
private BiFunction<ProfileRequestContext,com.nimbusds.jwt.JWTClaimsSet,String>	audienceLookupStrategy	Strategy to find the audience value from the context.
private boolean	extraAudienceValidation	If enabled, any extra audience must be contained in the List returned from the additionalAudiencesLookupStrategy.

Constructor Summary

Constructors

Constructor	Description
AudienceClaimsValidator()	Constructor.

Method Summary

Modifier and Type	Method	Description
protected void	doInitialize()
protected void	doValidate(com.nimbusds.jwt.JWTClaimsSet claims, ProfileRequestContext context)
protected Set<String>	resolveAcceptedAudiences(com.nimbusds.jwt.JWTClaimsSet claims, ProfileRequestContext context)	Resolve the set of accepted audiences.
void	setAdditionalAudiencesLookupStrategy(BiFunction<ProfileRequestContext,com.nimbusds.jwt.JWTClaimsSet,Set<String>> strategy)	Set the strategy used to lookup the list of additional audiences to find in the 'aud' claim.
void	setAllowMissing(boolean flag)	Set whether a missing 'aud' claim is valid or not.
void	setAudienceLookupStrategy(BiFunction<ProfileRequestContext,com.nimbusds.jwt.JWTClaimsSet,String> strategy)	Set the audience lookup strategy.
void	setExtraAudienceValidation(boolean flag)	Set whether to enable extra audience validation.

Methods inherited from class net.shibboleth.oidc.jwt.claims.AbstractClaimsValidator

setActivationCondition, validate

Methods inherited from class net.shibboleth.utilities.java.support.component.AbstractIdentifiableInitializableComponent

setId

Methods inherited from class net.shibboleth.utilities.java.support.component.AbstractIdentifiedInitializableComponent

getId

Methods inherited from class net.shibboleth.utilities.java.support.component.AbstractInitializableComponent

destroy, doDestroy, initialize, isDestroyed, isInitialized

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Methods inherited from interface net.shibboleth.utilities.java.support.component.IdentifiableComponent

setId

Methods inherited from interface net.shibboleth.utilities.java.support.component.IdentifiedComponent

getId

Field Detail

audienceLookupStrategy

@NonnullAfterInit
private BiFunction<ProfileRequestContext,com.nimbusds.jwt.JWTClaimsSet,String> audienceLookupStrategy

Strategy to find the audience value from the context.

additionalAudiencesLookupStrategy

@Nonnull
private BiFunction<ProfileRequestContext,com.nimbusds.jwt.JWTClaimsSet,Set<String>> additionalAudiencesLookupStrategy

A strategy to lookup a list of additional audiences expected in the 'aud' claim. If they are not found, the token is rejected.

allowMissing

private boolean allowMissing

Allow a missing aud claim.

extraAudienceValidation

private boolean extraAudienceValidation

If enabled, any extra audience must be contained in the List returned from the additionalAudiencesLookupStrategy. Defaults to false.

Constructor Detail

AudienceClaimsValidator

public AudienceClaimsValidator()

Constructor.

Method Detail

doInitialize

protected void doInitialize()
                     throws ComponentInitializationException

Overrides:

doInitialize in class AbstractIdentifiedInitializableComponent

Throws:

ComponentInitializationException

setAudienceLookupStrategy

public void setAudienceLookupStrategy(@Nonnull
                                      BiFunction<ProfileRequestContext,com.nimbusds.jwt.JWTClaimsSet,String> strategy)

Set the audience lookup strategy.

Parameters:

strategy - the strategy.

setAdditionalAudiencesLookupStrategy

public void setAdditionalAudiencesLookupStrategy(@Nonnull
                                                 BiFunction<ProfileRequestContext,com.nimbusds.jwt.JWTClaimsSet,Set<String>> strategy)

Set the strategy used to lookup the list of additional audiences to find in the 'aud' claim.

Parameters:

strategy - the strategy

Since:

2.2.0

setAllowMissing

public void setAllowMissing(boolean flag)

Set whether a missing 'aud' claim is valid or not.

Defaults to false.

Parameters:

flag - flag to set

Since:

2.1.0

setExtraAudienceValidation

public void setExtraAudienceValidation(boolean flag)

Set whether to enable extra audience validation.

Defaults to false.

Parameters:

flag - the flag to set

Since:

2.2.0

resolveAcceptedAudiences

@Nonnull
@NotEmpty
protected Set<String> resolveAcceptedAudiences(@Nonnull
                                               com.nimbusds.jwt.JWTClaimsSet claims,
                                               @Nonnull
                                               ProfileRequestContext context)
                                        throws JWTValidationException

Resolve the set of accepted audiences. This method is mostly a hook for classes extending this validator: in this case it simply returns the resolved single accepted audience in the set.

Parameters:

claims - the claims fed for the audience lookup strategy

context - the profile request context fed for the audience lookup strategy

Returns:

the set containing the accepted audience claim

Throws:

JWTValidationException - if the audience value could not be resolved via lookup strategy

doValidate

protected void doValidate(@Nonnull
                          com.nimbusds.jwt.JWTClaimsSet claims,
                          @Nonnull
                          ProfileRequestContext context)
                   throws JWTValidationException

Specified by:

doValidate in class AbstractClaimsValidator

Throws:

JWTValidationException