org.forgerock.jaspi.modules.openid

Class OpenIdConnectModule

java.lang.Object

org.forgerock.jaspi.modules.openid.OpenIdConnectModule

All Implemented Interfaces:

org.forgerock.caf.authentication.api.AsyncServerAuthModule

public class OpenIdConnectModule
extends Object
implements org.forgerock.caf.authentication.api.AsyncServerAuthModule

OpenID Connect module that allows access when a valid OpenID Connect JWT which our server trusts is presented in the specific header field.

Field Summary

Fields

Modifier and Type	Field and Description
static String	CONNECTION_TIMEOUT_KEY Lookup key for the configured HTTP connection's connection timeout for this module.
static String	HEADER_KEY Lookup key for the configured HTTP header used by this module to locate JWSs.
static String	READ_TIMEOUT_KEY Lookup key for the configured HTTP connection's read timeout for this module.
static String	RESOLVERS_KEY Lookup key for the configured resolvers which will be used by this module.

Constructor Summary

Constructors

Constructor and Description
OpenIdConnectModule() Default constructor.

Method Summary

Methods

Modifier and Type	Method and Description
org.forgerock.util.promise.Promise<Void,org.forgerock.caf.authentication.api.AuthenticationException>	cleanSubject(org.forgerock.caf.authentication.api.MessageInfoContext messageInfo, Subject subject) Nothing to clean.
String	getModuleId()
Collection<Class<?>>	getSupportedMessageTypes()
org.forgerock.util.promise.Promise<Void,org.forgerock.caf.authentication.api.AuthenticationException>	initialize(javax.security.auth.message.MessagePolicy requestPolicy, javax.security.auth.message.MessagePolicy responsePolicy, CallbackHandler callbackHandler, Map<String,Object> config)
org.forgerock.util.promise.Promise<javax.security.auth.message.AuthStatus,org.forgerock.caf.authentication.api.AuthenticationException>	secureResponse(org.forgerock.caf.authentication.api.MessageInfoContext messageInfo, Subject subject) Sends SEND_SUCCESS automatically.
org.forgerock.util.promise.Promise<javax.security.auth.message.AuthStatus,org.forgerock.caf.authentication.api.AuthenticationException>	validateRequest(org.forgerock.caf.authentication.api.MessageInfoContext messageInfo, Subject clientSubject, Subject serviceSubject) Attempts to retrieve the value of the specified OpenID Connect header from the messageInfo, then converts this to a Jwt and attempts to decrypt.

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Methods inherited from interface org.forgerock.caf.authentication.api.AsyncServerAuthModule

toString

Field Detail

READ_TIMEOUT_KEY

public static final String READ_TIMEOUT_KEY

Lookup key for the configured HTTP connection's read timeout for this module.

See Also:

Constant Field Values

CONNECTION_TIMEOUT_KEY

public static final String CONNECTION_TIMEOUT_KEY

Lookup key for the configured HTTP connection's connection timeout for this module.

See Also:

Constant Field Values

HEADER_KEY

public static final String HEADER_KEY

Lookup key for the configured HTTP header used by this module to locate JWSs.

See Also:

Constant Field Values

RESOLVERS_KEY

public static final String RESOLVERS_KEY

Lookup key for the configured resolvers which will be used by this module.

See Also:

Constant Field Values

Constructor Detail

OpenIdConnectModule

public OpenIdConnectModule()

Default constructor.

Method Detail

getModuleId

public String getModuleId()

Specified by:

getModuleId in interface org.forgerock.caf.authentication.api.AsyncServerAuthModule

initialize

public org.forgerock.util.promise.Promise<Void,org.forgerock.caf.authentication.api.AuthenticationException> initialize(javax.security.auth.message.MessagePolicy requestPolicy,
                                                                                                               javax.security.auth.message.MessagePolicy responsePolicy,
                                                                                                               CallbackHandler callbackHandler,
                                                                                                               Map<String,Object> config)

Specified by:

initialize in interface org.forgerock.caf.authentication.api.AsyncServerAuthModule

validateRequest

public org.forgerock.util.promise.Promise<javax.security.auth.message.AuthStatus,org.forgerock.caf.authentication.api.AuthenticationException> validateRequest(org.forgerock.caf.authentication.api.MessageInfoContext messageInfo,
                                                                                                                                                      Subject clientSubject,
                                                                                                                                                      Subject serviceSubject)

Attempts to retrieve the value of the specified OpenID Connect header from the messageInfo, then converts this to a Jwt and attempts to decrypt. If both these steps succeed, we verify the Jwt through the OpenIdResolver interface to ensure that we are the intended audience, the token has not expired and the issuer was an expected source. If all of these validate, we return SUCCESS, otherwise SEND_FAILURE.

Specified by:

validateRequest in interface org.forgerock.caf.authentication.api.AsyncServerAuthModule

Parameters:

messageInfo -

clientSubject -

serviceSubject -

Returns:

A Promise completed with AuthStatus.SUCCESS if everything validates or with AuthStatus.SEND_FAILURE in the case of a failure, or completed with an exception if there are issues handling the request caused by improper config.

secureResponse

public org.forgerock.util.promise.Promise<javax.security.auth.message.AuthStatus,org.forgerock.caf.authentication.api.AuthenticationException> secureResponse(org.forgerock.caf.authentication.api.MessageInfoContext messageInfo,
                                                                                                                                                     Subject subject)

Sends SEND_SUCCESS automatically. As we're on our way out of the system at this point, there's no need to hold them up, or append anything new to the response.

Specified by:

secureResponse in interface org.forgerock.caf.authentication.api.AsyncServerAuthModule

Parameters:

messageInfo -

subject -

Returns:

Throws:

javax.security.auth.message.AuthException

cleanSubject

public org.forgerock.util.promise.Promise<Void,org.forgerock.caf.authentication.api.AuthenticationException> cleanSubject(org.forgerock.caf.authentication.api.MessageInfoContext messageInfo,
                                                                                                                 Subject subject)

Nothing to clean.

Specified by:

cleanSubject in interface org.forgerock.caf.authentication.api.AsyncServerAuthModule

Parameters:

messageInfo -

subject -

Throws:

javax.security.auth.message.AuthException

getSupportedMessageTypes

public Collection<Class<?>> getSupportedMessageTypes()

Specified by:

getSupportedMessageTypes in interface org.forgerock.caf.authentication.api.AsyncServerAuthModule