Package swiss.trustbroker.oidc

Class OidcValidator

java.lang.Object

swiss.trustbroker.oidc.OidcValidator

public class OidcValidator
extends Object

Method Summary

Modifier and Type	Method	Description
static void	validateClaimsProviderMapping(RelyingParty relyingParty, ClaimsParty claimsParty, String errorUri)
static void	validateInputParams(OidcClient rpOidcClient, org.springframework.security.oauth2.server.authorization.client.RegisteredClient registeredClient, String registeredClientId, org.springframework.security.oauth2.server.authorization.authentication.OAuth2TokenExchangeAuthenticationToken tokenExchangeAuthentication, String errorUri)
static void	validateProtocolRestrictions(CounterParty counterParty, String clientId, jakarta.servlet.http.HttpServletRequest request, TrustBrokerProperties trustBrokerProperties)	Validate protocol restrictions on OIDC RP/CP: - party enabled (with option to override) - OIDC allowed
static void	validateProtocolRestrictions(CounterParty counterParty, String clientId, TrustBrokerProperties trustBrokerProperties)	Validate restrictions on OIDC RP/CP: - OIDC allowed
static void	validateSubjectTokenIatExpNbf(com.nimbusds.jwt.JWTClaimsSet claimsSet, OidcClient oidcClient, TrustBrokerProperties trustBrokerProperties, String errorUri)
static boolean	validExpirationLifeTime(Date expirationTime, long now, int expirationLifeTimeSec)
static void	validIat(Integer maxAgeSex, String clientId, Date tokenIat, long now, String errorUri)
static boolean	validNotOnOrAfter(Date check, long now, long notOnOrAfterToleranceSec)

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Method Details

validateClaimsProviderMapping

public static void validateClaimsProviderMapping(RelyingParty relyingParty,
 ClaimsParty claimsParty,
 String errorUri)

validateInputParams

public static void validateInputParams(OidcClient rpOidcClient,
 org.springframework.security.oauth2.server.authorization.client.RegisteredClient registeredClient,
 String registeredClientId,
 org.springframework.security.oauth2.server.authorization.authentication.OAuth2TokenExchangeAuthenticationToken tokenExchangeAuthentication,
 String errorUri)

validateSubjectTokenIatExpNbf

public static void validateSubjectTokenIatExpNbf(com.nimbusds.jwt.JWTClaimsSet claimsSet,
 OidcClient oidcClient,
 TrustBrokerProperties trustBrokerProperties,
 String errorUri)

validIat

public static void validIat(Integer maxAgeSex,
 String clientId,
 Date tokenIat,
 long now,
 String errorUri)

validNotOnOrAfter

public static boolean validNotOnOrAfter(Date check,
 long now,
 long notOnOrAfterToleranceSec)

validExpirationLifeTime

public static boolean validExpirationLifeTime(Date expirationTime,
 long now,
 int expirationLifeTimeSec)

validateProtocolRestrictions

public static void validateProtocolRestrictions(CounterParty counterParty,
 String clientId,
 jakarta.servlet.http.HttpServletRequest request,
 TrustBrokerProperties trustBrokerProperties)

Validate protocol restrictions on OIDC RP/CP: - party enabled (with option to override) - OIDC allowed

Parameters:

request - optional for canary override - in a request context this will be read from a thread local of missing

validateProtocolRestrictions

public static void validateProtocolRestrictions(CounterParty counterParty,
 String clientId,
 TrustBrokerProperties trustBrokerProperties)

Validate restrictions on OIDC RP/CP: - OIDC allowed