Class EntityStatementClaimsSet
- java.lang.Object
-
- com.nimbusds.openid.connect.sdk.claims.ClaimsSet
-
- com.nimbusds.openid.connect.sdk.claims.CommonClaimsSet
-
- com.nimbusds.openid.connect.sdk.federation.entities.CommonFederationClaimsSet
-
- com.nimbusds.openid.connect.sdk.federation.entities.EntityStatementClaimsSet
-
- All Implemented Interfaces:
net.minidev.json.JSONAware
public class EntityStatementClaimsSet extends CommonFederationClaimsSet
Federation entity statement claims set, serialisable to a JSON object.Example claims set:
{ "iss": "https://feide.no", "sub": "https://ntnu.no", "iat": 1516239022, "exp": 1516298022, "crit": ["jti"], "jti": "7l2lncFdY6SlhNia", "policy_language_crit": ["regexp"], "metadata": { "openid_provider": { "issuer": "https://ntnu.no", "organization_name": "NTNU", }, "oauth_client": { "organization_name": "NTNU" } }, "metadata_policy": { "openid_provider": { "id_token_signing_alg_values_supported": { "subset_of": ["RS256", "RS384", "RS512"] }, "op_policy_uri": { "regexp": "^https:\/\/[\\w-]+\\.example\\.com\/[\\w-]+\\.html"} }, "oauth_client": { "grant_types": { "subset_of": ["authorization_code", "client_credentials"]}, "scope": { "subset_of": ["openid", "profile", "email", "phone"]} } }, "constraints": { "max_path_length": 2 }, "jwks": { "keys": [ { "alg": "RS256", "e": "AQAB", "key_ops": ["verify"], "kid": "key1", "kty": "RSA", "n": "pnXBOusEANuug6ewezb9J_...", "use": "sig" } ] } }
Related specifications:
- OpenID Connect Federation 1.0, section 3.1.
-
-
Field Summary
Fields Modifier and Type Field Description static String
AUTHORITY_HINTS_CLAIM_NAME
The authority hints claim name.static String
CONSTRAINTS_CLAIM_NAME
The constraints claim name.static String
CRITICAL_CLAIM_NAME
The critical claim name.static String
JWKS_CLAIM_NAME
The JWK set claim name.static String
METADATA_POLICY_CLAIM_NAME
The metadata policy claim name.static String
POLICY_LANGUAGE_CRITICAL_CLAIM_NAME
The policy critical claim name.static String
TRUST_ANCHOR_ID_CLAIM_NAME
The assumed trust anchor in a explicit client registration.static String
TRUST_MARKS_ISSUERS_CLAIM_NAME
The trust marks issuers claim name.-
Fields inherited from class com.nimbusds.openid.connect.sdk.federation.entities.CommonFederationClaimsSet
EXP_CLAIM_NAME, METADATA_CLAIM_NAME, TRUST_MARKS_CLAIM_NAME
-
Fields inherited from class com.nimbusds.openid.connect.sdk.claims.CommonClaimsSet
IAT_CLAIM_NAME, SUB_CLAIM_NAME
-
Fields inherited from class com.nimbusds.openid.connect.sdk.claims.ClaimsSet
AUD_CLAIM_NAME, claims, ISS_CLAIM_NAME
-
-
Constructor Summary
Constructors Constructor Description EntityStatementClaimsSet(com.nimbusds.jwt.JWTClaimsSet jwtClaimsSet)
Creates a new federation entity statement claims set from the specified JWT claims set.EntityStatementClaimsSet(Issuer iss, Subject sub, Date iat, Date exp, com.nimbusds.jose.jwk.JWKSet jwks)
Creates a new federation entity statement claims set with the minimum required claims.EntityStatementClaimsSet(EntityID iss, EntityID sub, Date iat, Date exp, com.nimbusds.jose.jwk.JWKSet jwks)
Creates a new federation entity statement claims set with the minimum required claims.
-
Method Summary
All Methods Static Methods Instance Methods Concrete Methods Deprecated Methods Modifier and Type Method Description List<EntityID>
getAuthorityHints()
Gets the entity IDs of the intermediate entities or trust anchors.TrustChainConstraints
getConstraints()
Gets the trust chain constraints for subordinate entities.List<String>
getCriticalExtensionClaims()
Gets the names of the critical extension claims.List<String>
getCriticalPolicyExtensions()
Gets the names of the critical policy extensions.com.nimbusds.jose.jwk.JWKSet
getJWKSet()
Gets the entity JWK set.MetadataPolicy
getMetadataPolicy(EntityType type)
Gets the metadata policy for the specified type.net.minidev.json.JSONObject
getMetadataPolicyJSONObject()
Gets the complete metadata policy JSON object.OIDCClientInformation
getRPInformation()
Gets the OpenID relying party information (metadata plusclient_id
and potentially other client information fields) if present for this entity.static Set<String>
getStandardClaimNames()
Gets the names of the standard top-level claims.EntityID
getTrustAnchorID()
Gets the used trust anchor in a explicit client registration in OpenID Connect Federation 1.0.Map<Identifier,List<Issuer>>
getTrustMarksIssuers()
Gets the trust marks issuers.boolean
hasMetadata()
Returnstrue
if a metadata field is present.boolean
isSelfStatement()
Returnstrue
if this is a self-statement (issuer and subject match).void
setAuthorityHints(List<EntityID> trustChain)
Sets the entity IDs of the intermediate entities or trust anchors.void
setConstraints(TrustChainConstraints constraints)
Sets the trust chain constraint for subordinate entities.void
setCriticalExtensionClaims(List<String> claimNames)
Sets the names of the critical extension claims.void
setCriticalPolicyExtensions(List<String> extNames)
Sets the names of the critical policy extensions.void
setMetadataPolicy(EntityType type, MetadataPolicy metadataPolicy)
Sets the metadata policy for the specified type.void
setMetadataPolicyJSONObject(net.minidev.json.JSONObject metadataPolicy)
Sets the complete metadata policy JSON object.void
setRPInformation(OIDCClientInformation rpInfo)
Sets the OpenID relying party information (metadata plusclient_id
and potentially other client information fields) if present for this entity.void
setTrustAnchorID(EntityID trustAnchorID)
Sets the used trust anchor in a explicit client registration in OpenID Connect Federation 1.0.void
setTrustMarkIssuerMetadata(TrustMarkIssuerMetadata trustMarkIssuerMetadata)
Deprecated.void
setTrustMarks(List<TrustMarkEntry> marks)
Sets the trust marks.void
setTrustMarksIssuers(Map<Identifier,List<Issuer>> issuers)
Sets the trust marks issuers.void
validateRequiredClaimsPresence()
Validates this claims set for having all minimum required claims for an entity statement.-
Methods inherited from class com.nimbusds.openid.connect.sdk.federation.entities.CommonFederationClaimsSet
getASMetadata, getExpirationTime, getFederationEntityMetadata, getIssuerEntityID, getMetadata, getOAuthClientMetadata, getOPMetadata, getRPMetadata, getSubjectEntityID, getTrustMarkIssuerMetadata, getTrustMarks, setASMetadata, setFederationEntityMetadata, setMetadata, setOAuthClientMetadata, setOPMetadata, setRPMetadata
-
Methods inherited from class com.nimbusds.openid.connect.sdk.claims.CommonClaimsSet
getIssueTime, getSubject
-
Methods inherited from class com.nimbusds.openid.connect.sdk.claims.ClaimsSet
equals, getAudience, getBooleanClaim, getClaim, getClaim, getDateClaim, getIssuer, getJSONArrayClaim, getJSONObjectClaim, getLangTaggedClaim, getNumberClaim, getStringClaim, getStringClaim, getStringListClaim, getURIClaim, getURLClaim, hashCode, putAll, putAll, setAudience, setAudience, setClaim, setClaim, setDateClaim, setIssuer, setURIClaim, setURLClaim, toJSONObject, toJSONString, toJWTClaimsSet, toString
-
-
-
-
Field Detail
-
JWKS_CLAIM_NAME
public static final String JWKS_CLAIM_NAME
The JWK set claim name.- See Also:
- Constant Field Values
-
AUTHORITY_HINTS_CLAIM_NAME
public static final String AUTHORITY_HINTS_CLAIM_NAME
The authority hints claim name.- See Also:
- Constant Field Values
-
METADATA_POLICY_CLAIM_NAME
public static final String METADATA_POLICY_CLAIM_NAME
The metadata policy claim name.- See Also:
- Constant Field Values
-
TRUST_ANCHOR_ID_CLAIM_NAME
public static final String TRUST_ANCHOR_ID_CLAIM_NAME
The assumed trust anchor in a explicit client registration. Intended for entity statements issued by an OP for RP performing explicit client registration only.- See Also:
- Constant Field Values
-
CONSTRAINTS_CLAIM_NAME
public static final String CONSTRAINTS_CLAIM_NAME
The constraints claim name.- See Also:
- Constant Field Values
-
TRUST_MARKS_ISSUERS_CLAIM_NAME
public static final String TRUST_MARKS_ISSUERS_CLAIM_NAME
The trust marks issuers claim name.- See Also:
- Constant Field Values
-
CRITICAL_CLAIM_NAME
public static final String CRITICAL_CLAIM_NAME
The critical claim name.- See Also:
- Constant Field Values
-
POLICY_LANGUAGE_CRITICAL_CLAIM_NAME
public static final String POLICY_LANGUAGE_CRITICAL_CLAIM_NAME
The policy critical claim name.- See Also:
- Constant Field Values
-
-
Constructor Detail
-
EntityStatementClaimsSet
public EntityStatementClaimsSet(Issuer iss, Subject sub, Date iat, Date exp, com.nimbusds.jose.jwk.JWKSet jwks)
Creates a new federation entity statement claims set with the minimum required claims.- Parameters:
iss
- The issuer. Must not benull
.sub
- The subject. Must not benull
.iat
- The issue time. Must not benull
.exp
- The expiration time. Must not benull
.jwks
- The entity public JWK set,null
if not required.
-
EntityStatementClaimsSet
public EntityStatementClaimsSet(EntityID iss, EntityID sub, Date iat, Date exp, com.nimbusds.jose.jwk.JWKSet jwks)
Creates a new federation entity statement claims set with the minimum required claims.- Parameters:
iss
- The issuer. Must not benull
.sub
- The subject. Must not benull
.iat
- The issue time. Must not benull
.exp
- The expiration time. Must not benull
.jwks
- The entity public JWK set,null
if not required.
-
EntityStatementClaimsSet
public EntityStatementClaimsSet(com.nimbusds.jwt.JWTClaimsSet jwtClaimsSet) throws ParseException
Creates a new federation entity statement claims set from the specified JWT claims set.- Parameters:
jwtClaimsSet
- The JWT claims set. Must not benull
.- Throws:
ParseException
- If the JWT claims set doesn't represent a valid federation entity statement claims set.
-
-
Method Detail
-
getStandardClaimNames
public static Set<String> getStandardClaimNames()
Gets the names of the standard top-level claims.- Returns:
- The names of the standard top-level claims (read-only set).
-
validateRequiredClaimsPresence
public void validateRequiredClaimsPresence() throws ParseException
Validates this claims set for having all minimum required claims for an entity statement. If aselt-statement
check for thepresence of metadata
. Ifcritical extension claims
are listed their presence is also checked.- Overrides:
validateRequiredClaimsPresence
in classCommonFederationClaimsSet
- Throws:
ParseException
- If the validation failed and a required claim is missing.
-
isSelfStatement
public boolean isSelfStatement()
Returnstrue
if this is a self-statement (issuer and subject match).- Returns:
true
for a self-statement,false
if not.
-
getJWKSet
public com.nimbusds.jose.jwk.JWKSet getJWKSet()
Gets the entity JWK set. Corresponds to thejwks
claim.- Returns:
- The entity JWK set,
null
if not specified or parsing failed.
-
getAuthorityHints
public List<EntityID> getAuthorityHints()
Gets the entity IDs of the intermediate entities or trust anchors. Corresponds to theauthority_hints
claim.- Returns:
- The entity IDs,
null
or empty list for a trust anchor, or if parsing failed.
-
setAuthorityHints
public void setAuthorityHints(List<EntityID> trustChain)
Sets the entity IDs of the intermediate entities or trust anchors. Corresponds to theauthority_hints
claim.- Parameters:
trustChain
- The entity IDs,null
or empty list for a trust anchor.
-
hasMetadata
public boolean hasMetadata()
Returnstrue
if a metadata field is present. Corresponds to themetadata
claim.- Returns:
true
if a metadata field for an OpenID relying party, an OpenID provider, an OAuth authorisation server, an OAuth client, an OAuth protected resource, a federation entity, or a trust mark issuer is present.
-
getRPInformation
public OIDCClientInformation getRPInformation()
Gets the OpenID relying party information (metadata plusclient_id
and potentially other client information fields) if present for this entity. Corresponds to themetadata.openid_relying_party
claim.- Returns:
- The RP information,
null
if not specified or if parsing failed.
-
setRPInformation
public void setRPInformation(OIDCClientInformation rpInfo)
Sets the OpenID relying party information (metadata plusclient_id
and potentially other client information fields) if present for this entity. Corresponds to themetadata.openid_relying_party
claim.- Parameters:
rpInfo
- The RP information,null
if not specified or if parsing failed.
-
setTrustMarkIssuerMetadata
@Deprecated public void setTrustMarkIssuerMetadata(TrustMarkIssuerMetadata trustMarkIssuerMetadata)
Deprecated.Sets the trust mark issuer metadata for this entity. Corresponds to themetadata.trust_mark_issuer
claim.- Parameters:
trustMarkIssuerMetadata
- The trust mark issuer metadata,null
if not specified.
-
getMetadataPolicyJSONObject
public net.minidev.json.JSONObject getMetadataPolicyJSONObject()
Gets the complete metadata policy JSON object. Corresponds to themetadata_policy
claim.- Returns:
- The metadata policy JSON object,
null
if not specified or if parsing failed.
-
setMetadataPolicyJSONObject
public void setMetadataPolicyJSONObject(net.minidev.json.JSONObject metadataPolicy)
Sets the complete metadata policy JSON object. Corresponds to themetadata_policy
claim.- Parameters:
metadataPolicy
- The metadata policy JSON object,null
if not specified.
-
getMetadataPolicy
public MetadataPolicy getMetadataPolicy(EntityType type) throws PolicyViolationException
Gets the metadata policy for the specified type. Corresponds to themetadata_policy
claim.- Parameters:
type
- The entity type. Must not benull
.- Returns:
- The metadata policy,
null
or if JSON parsing failed. - Throws:
PolicyViolationException
- On a policy violation.
-
setMetadataPolicy
public void setMetadataPolicy(EntityType type, MetadataPolicy metadataPolicy)
Sets the metadata policy for the specified type. Corresponds to themetadata_policy
claim.- Parameters:
type
- The entity type. Must not benull
.metadataPolicy
- The metadata policy,null
if not specified.
-
getTrustAnchorID
public EntityID getTrustAnchorID()
Gets the used trust anchor in a explicit client registration in OpenID Connect Federation 1.0. Intended for entity statements issued by an OpenID provider for a Relying party performing explicit client registration only. Corresponds to thetrust_anchor_id
claim.- Returns:
- The trust anchor ID,
null
if not specified.
-
setTrustAnchorID
public void setTrustAnchorID(EntityID trustAnchorID)
Sets the used trust anchor in a explicit client registration in OpenID Connect Federation 1.0. Intended for entity statements issued by an OpenID provider for a Relying party performing explicit client registration only. Corresponds to thetrust_anchor_id
claim.- Parameters:
trustAnchorID
- The trust anchor ID,null
if not specified.
-
getConstraints
public TrustChainConstraints getConstraints()
Gets the trust chain constraints for subordinate entities. Corresponds to theconstraints
claim.- Returns:
- The trust chain constraints,
null
if not specified or if parsing failed.
-
setConstraints
public void setConstraints(TrustChainConstraints constraints)
Sets the trust chain constraint for subordinate entities. Corresponds to theconstraints
claim.- Parameters:
constraints
- The trust chain constraints,null
if not specified.
-
setTrustMarks
public void setTrustMarks(List<TrustMarkEntry> marks)
Sets the trust marks. Corresponds to thetrust_marks
claim.- Overrides:
setTrustMarks
in classCommonFederationClaimsSet
- Parameters:
marks
- The trust marks,null
if not specified.
-
getTrustMarksIssuers
public Map<Identifier,List<Issuer>> getTrustMarksIssuers()
Gets the trust marks issuers. Corresponds to thetrust_marks_issuers
claim.- Returns:
- The trust marks issuers,
null
if not specified or parsing failed.
-
setTrustMarksIssuers
public void setTrustMarksIssuers(Map<Identifier,List<Issuer>> issuers)
Sets the trust marks issuers. Corresponds to thetrust_marks_issuers
claim.- Parameters:
issuers
- The trust marks issuers,null
if not specified.
-
getCriticalExtensionClaims
public List<String> getCriticalExtensionClaims()
Gets the names of the critical extension claims. Corresponds to thecrit
claim.- Returns:
- The names of the critical extension claims,
null
if not specified or if parsing failed.
-
setCriticalExtensionClaims
public void setCriticalExtensionClaims(List<String> claimNames)
Sets the names of the critical extension claims. Corresponds to thecrit
claim.- Parameters:
claimNames
- The names of the critical extension claims,null
if not specified. Must not be an empty list.
-
getCriticalPolicyExtensions
public List<String> getCriticalPolicyExtensions()
Gets the names of the critical policy extensions. Corresponds to thepolicy_language_crit
claim.- Returns:
- The names of the critical policy extensions or if parsing failed.
-
setCriticalPolicyExtensions
public void setCriticalPolicyExtensions(List<String> extNames)
Sets the names of the critical policy extensions. Corresponds to thepolicy_language_crit
claim.- Parameters:
extNames
- The names of the critical policy extensions,null
if not specified. Must not be an empty list.
-
-