Package net.shibboleth.idp.plugin.oidc.op.security.impl

Class OIDCClientInformationSignatureValidationParametersResolver

java.lang.Object

org.opensaml.xmlsec.impl.AbstractSecurityParametersResolver<SignatureSigningParameters>

org.opensaml.xmlsec.impl.BasicSignatureSigningParametersResolver

net.shibboleth.idp.plugin.oidc.op.security.impl.OIDCClientInformationSignatureValidationParametersResolver

All Implemented Interfaces:

Resolver<SignatureSigningParameters,CriteriaSet>, SignatureSigningParametersResolver

public class OIDCClientInformationSignatureValidationParametersResolver
extends BasicSignatureSigningParametersResolver

A specialization of BasicSignatureSigningParametersResolver which supports selecting signature validation credentials based on client registration data. If the resolver fails to resolve credentials it leaves the job to the hands of the super class method.

In addition to the Criterion inputs documented in BasicSignatureSigningParametersResolver, the following inputs are also supported:

• ClientInformationCriterion - optional

Nested Class Summary

Nested Classes

Modifier and Type	Class	Description
static class	OIDCClientInformationSignatureValidationParametersResolver.ParameterType	Whether to create parameters for request object signature validation or token endpoint JWT validation.

Field Summary

Fields

Modifier and Type	Field	Description
private Duration	keyFetchInterval	The remote key refresh interval.
private org.slf4j.Logger	log	Logger.
private net.shibboleth.oidc.jwk.RemoteJwkSetCache	remoteJwkSetCache	The cache for remote JWK key sets.
private OIDCClientInformationSignatureValidationParametersResolver.ParameterType	target	The type of validation.

Constructor Summary

Constructors

Constructor	Description
OIDCClientInformationSignatureValidationParametersResolver()

Method Summary

Modifier and Type	Method	Description
private List<com.nimbusds.jose.JWSAlgorithm>	convertToJWSAlgorithmList(List<String> algorithms)	Convert algorithm string list to JWSAlgorithm list.
private boolean	curveMatchesESAlgorithm(com.nimbusds.jose.jwk.Curve curve, com.nimbusds.jose.JWSAlgorithm algorithm)	Helper to match ECKey curve to JWS algorithm ES256, ES384 and ES512.
protected void	resolveAndPopulateCredentialAndSignatureAlgorithm(SignatureSigningParameters params, CriteriaSet criteria, Predicate<String> whitelistBlacklistPredicate)
SignatureSigningParameters	resolveSingle(CriteriaSet criteria)
void	setKeyFetchInterval(Duration interval)	Set the remote key refresh interval.
void	setParameterType(OIDCClientInformationSignatureValidationParametersResolver.ParameterType value)	Whether to create parameters for request object signature validation or token endpoint jwt validation.
void	setRemoteJwkSetCache(net.shibboleth.oidc.jwk.RemoteJwkSetCache jwkSetCache)	Set the cache for remote JWK key sets.
protected boolean	validate(SignatureSigningParameters params)

Methods inherited from class org.opensaml.xmlsec.impl.BasicSignatureSigningParametersResolver

credentialSupportsAlgorithm, getAlgorithmRegistry, getAlgorithmRuntimeSupportedPredicate, getEffectiveSignatureAlgorithms, getEffectiveSigningCredentials, getIncludeExcludePredicate, getWhitelistBlacklistPredicate, logResult, resolve, resolveCanonicalizationAlgorithm, resolveHMACOutputLength, resolveKeyInfoGenerator, resolveReferenceCanonicalizationAlgorithm, resolveReferenceDigestMethod, setAlgorithmRegistry

Methods inherited from class org.opensaml.xmlsec.impl.AbstractSecurityParametersResolver

lookupKeyInfoGenerator, resolveAndPopulateIncludesExcludes, resolveEffectiveExcludes, resolveEffectiveIncludes, resolveIncludeExcludePrecedence, resolveIncludeExcludePredicate

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Field Detail

log

@Nonnull
private org.slf4j.Logger log

Logger.

target

private OIDCClientInformationSignatureValidationParametersResolver.ParameterType target

The type of validation.

remoteJwkSetCache

private net.shibboleth.oidc.jwk.RemoteJwkSetCache remoteJwkSetCache

The cache for remote JWK key sets.

keyFetchInterval

@Positive
private Duration keyFetchInterval

The remote key refresh interval. Default value: 30 minutes.

Constructor Detail

OIDCClientInformationSignatureValidationParametersResolver

public OIDCClientInformationSignatureValidationParametersResolver()

Method Detail

setParameterType

public void setParameterType(OIDCClientInformationSignatureValidationParametersResolver.ParameterType value)

Whether to create parameters for request object signature validation or token endpoint jwt validation.

Parameters:

value - Whether to create parameters for request object signature validation, id token signing or userinfo response signing.

setRemoteJwkSetCache

public void setRemoteJwkSetCache(net.shibboleth.oidc.jwk.RemoteJwkSetCache jwkSetCache)

Set the cache for remote JWK key sets.

Parameters:

jwkSetCache - What to set.

setKeyFetchInterval

public void setKeyFetchInterval(@Positive
                                Duration interval)

Set the remote key refresh interval.

Parameters:

interval - What to set.

resolveSingle

@Nullable
public SignatureSigningParameters resolveSingle(@Nonnull
                                                CriteriaSet criteria)
                                         throws ResolverException

Specified by:

resolveSingle in interface Resolver<SignatureSigningParameters,CriteriaSet>

Overrides:

resolveSingle in class BasicSignatureSigningParametersResolver

Throws:

ResolverException

curveMatchesESAlgorithm

private boolean curveMatchesESAlgorithm(com.nimbusds.jose.jwk.Curve curve,
                                        com.nimbusds.jose.JWSAlgorithm algorithm)

Helper to match ECKey curve to JWS algorithm ES256, ES384 and ES512.

Parameters:

curve - curve to match.

algorithm - algorithm to match.

Returns:

true if key curve matches algorithm, otherwise false.

resolveAndPopulateCredentialAndSignatureAlgorithm

protected void resolveAndPopulateCredentialAndSignatureAlgorithm(@Nonnull
                                                                 SignatureSigningParameters params,
                                                                 @Nonnull
                                                                 CriteriaSet criteria,
                                                                 @Nonnull
                                                                 Predicate<String> whitelistBlacklistPredicate)

Overrides:

resolveAndPopulateCredentialAndSignatureAlgorithm in class BasicSignatureSigningParametersResolver

convertToJWSAlgorithmList

private List<com.nimbusds.jose.JWSAlgorithm> convertToJWSAlgorithmList(List<String> algorithms)

Convert algorithm string list to JWSAlgorithm list.

Parameters:

algorithms - algorithm string list

Returns:

JWSAlgorithm list

validate

protected boolean validate(@Nonnull
                           SignatureSigningParameters params)

Overrides:

validate in class BasicSignatureSigningParametersResolver