Package net.shibboleth.idp.plugin.oidc.op.profile.impl

Class ValidateScope

  • All Implemented Interfaces:
    Component, DestructableComponent, InitializableComponent, ProfileAction, Aware, MessageSource, MessageSourceAware, Action
    public class ValidateScope
extends AbstractOIDCAuthenticationResponseAction
    Action that validates requested and previously granted scopes are also registered in client metadata and stores the resulting set in the response context.

    Requested scopes come from the inbound message and are possible but optional for both authorization and token requests. They come from lookup functions aware of each message type.

    Previously granted scopes are stored in the response context's slot for previous authorization grant claims. In the case where no scopes are explicitly requested, we still filter the previous grants against the metadata.

    Explicitly requested scopes are also filtered against, and override, any scopes previously validated as part of an authorization grant claim set. If this occurs, any grant-borne claims are removed because the association to specific scopes is gone by this point.

    The "offline_access" scope is ignored and stripped for the authentication endpoint unless the response type includes "code".