Package net.shibboleth.idp.plugin.oidc.op.profile.impl

Class ValidatePKCE

java.lang.Object

net.shibboleth.utilities.java.support.component.AbstractInitializableComponent

org.opensaml.profile.action.AbstractProfileAction

org.opensaml.profile.action.AbstractConditionalProfileAction

net.shibboleth.idp.profile.AbstractProfileAction

net.shibboleth.idp.plugin.oidc.op.profile.impl.AbstractOIDCResponseAction

net.shibboleth.idp.plugin.oidc.op.profile.impl.ValidatePKCE

All Implemented Interfaces:

Component, DestructableComponent, InitializableComponent, ProfileAction, Aware, MessageSource, MessageSourceAware, Action

public class ValidatePKCE
extends AbstractOIDCResponseAction

Action performs PKCE (https://oauth.net/2/pkce/) validation. If authentication request contains code_challenge parameter, token request when passing authorization code as grant must include code_verifier parameter. Profile configuration may used to force using PKCE, by default it is optional. Profile configuration may be used to allow plain PKCE, by default it is not allowed.

Field Summary

Fields

Modifier and Type	Field	Description
private Predicate<ProfileRequestContext>	allowPKCEPlainCondition	Strategy used to determine whether to allow plaintext PKCE.
private String	codeChallenge	PKCE code challenge.
private String	codeVerifier	PKCE code verifier.
private Function<ProfileRequestContext,String>	codeVerifierLookupStrategy	Strategy used to locate the PKCE Code Verifier value.
private boolean	forcePKCE	Whether PKCE is mandatory.
private Predicate<ProfileRequestContext>	forcePKCECondition	Strategy used to determine whether to require PKCE.
private org.slf4j.Logger	log	Class logger.
private boolean	plainPKCE	Whether plain PKCE is allowed.

Constructor Summary

Constructors

Constructor	Description
ValidatePKCE()	Constructor.

Method Summary

Modifier and Type	Method	Description
protected void	doExecute(ProfileRequestContext profileRequestContext)
protected boolean	doPreExecute(ProfileRequestContext profileRequestContext)
void	setAllowPKCEPlainCondition(Predicate<ProfileRequestContext> condition)	Set the condition used to determine whether to allow plaintext PKCE.
void	setCodeVerifierLookupStrategy(Function<ProfileRequestContext,String> strategy)	Set the strategy used to locate the Code Verifier value.
void	setForcePKCECondition(Predicate<ProfileRequestContext> condition)	Set the condition used to determine whether to require PKCE.

Methods inherited from class net.shibboleth.idp.plugin.oidc.op.profile.impl.AbstractOIDCResponseAction

getMetadataContext, getOidcResponseContext

Methods inherited from class net.shibboleth.idp.profile.AbstractProfileAction

doExecute, execute, getMessage, getMessage, getMessage, getProfileContextLookupStrategy, getRequestContext, getResult, setMessageSource, setProfileContextLookupStrategy

Methods inherited from class org.opensaml.profile.action.AbstractConditionalProfileAction

getActivationCondition, setActivationCondition

Methods inherited from class org.opensaml.profile.action.AbstractProfileAction

doPostExecute, doPostExecute, execute, getHttpServletRequest, getHttpServletResponse, getLogPrefix, setHttpServletRequest, setHttpServletResponse

Methods inherited from class net.shibboleth.utilities.java.support.component.AbstractInitializableComponent

destroy, doDestroy, doInitialize, initialize, isDestroyed, isInitialized

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Methods inherited from interface net.shibboleth.utilities.java.support.component.InitializableComponent

initialize, isInitialized

Field Detail

log

@Nonnull
private org.slf4j.Logger log

Class logger.

codeVerifierLookupStrategy

@Nonnull
private Function<ProfileRequestContext,String> codeVerifierLookupStrategy

Strategy used to locate the PKCE Code Verifier value.

forcePKCECondition

@Nonnull
private Predicate<ProfileRequestContext> forcePKCECondition

Strategy used to determine whether to require PKCE.

allowPKCEPlainCondition

@Nonnull
private Predicate<ProfileRequestContext> allowPKCEPlainCondition

Strategy used to determine whether to allow plaintext PKCE.

forcePKCE

private boolean forcePKCE

Whether PKCE is mandatory.

plainPKCE

private boolean plainPKCE

Whether plain PKCE is allowed.

codeChallenge

@Nullable
private String codeChallenge

PKCE code challenge.

codeVerifier

@Nullable
private String codeVerifier

PKCE code verifier.

Constructor Detail

ValidatePKCE

public ValidatePKCE()

Constructor.

Method Detail

setForcePKCECondition

public void setForcePKCECondition(@Nonnull
                                  Predicate<ProfileRequestContext> condition)

Set the condition used to determine whether to require PKCE.

Parameters:

condition - condition to apply

setAllowPKCEPlainCondition

public void setAllowPKCEPlainCondition(@Nonnull
                                       Predicate<ProfileRequestContext> condition)

Set the condition used to determine whether to allow plaintext PKCE.

Parameters:

condition - condition to apply

setCodeVerifierLookupStrategy

public void setCodeVerifierLookupStrategy(@Nonnull
                                          Function<ProfileRequestContext,String> strategy)

Set the strategy used to locate the Code Verifier value.

Parameters:

strategy - strategy used to locate the Code Verifier value

doPreExecute

protected boolean doPreExecute(@Nonnull
                               ProfileRequestContext profileRequestContext)

Overrides:

doPreExecute in class AbstractOIDCResponseAction

doExecute

protected void doExecute(@Nonnull
                         ProfileRequestContext profileRequestContext)

Overrides:

doExecute in class AbstractProfileAction