Class EntityStatementClaimsSet

  • All Implemented Interfaces:
    net.minidev.json.JSONAware

    public class EntityStatementClaimsSet
    extends CommonClaimsSet
    Federation entity statement claims set, serialisable to a JSON object.

    Example claims set:

     {
       "iss": "https://feide.no",
       "sub": "https://ntnu.no",
       "iat": 1516239022,
       "exp": 1516298022,
       "crit": ["jti"],
       "jti": "7l2lncFdY6SlhNia",
       "policy_language_crit": ["regexp"],
       "metadata_policy": {
         "openid_provider": {
           "issuer": {"value": "https://ntnu.no"},
           "organization_name": {"value": "NTNU"},
           "id_token_signing_alg_values_supported":
             {"subset_of": ["RS256", "RS384", "RS512"]},
           "op_policy_uri": {
             "regexp": "^https:\/\/[\w-]+\.example\.com\/[\w-]+\.html"}
         },
         "openid_relying_party": {
           "organization_name": {"value": "NTNU"},
           "grant_types_supported": {
             "subset_of": ["authorization_code", "implicit"]},
           "scopes": {
             "subset_of": ["openid", "profile", "email", "phone"]}
         }
       },
       "constraints": {
         "max_path_length": 2
       }
       "jwks": {
         "keys": [
           {
             "alg": "RS256",
             "e": "AQAB",
             "ext": true,
             "key_ops": ["verify"],
             "kid": "key1",
             "kty": "RSA",
             "n": "pnXBOusEANuug6ewezb9J_...",
             "use": "sig"
           }
         ]
       },
       "authority_hints": [
         "https://edugain.org/federation"
       ]
     }
     

    Related specifications:

    • OpenID Connect Federation 1.0, section 2.1.
    • Constructor Detail

      • EntityStatementClaimsSet

        public EntityStatementClaimsSet​(Issuer iss,
                                        Subject sub,
                                        Date iat,
                                        Date exp,
                                        com.nimbusds.jose.jwk.JWKSet jwks)
        Creates a new federation entity statement claims set with the minimum required claims.
        Parameters:
        iss - The issuer. Must not be null.
        sub - The subject. Must not be null.
        iat - The issue time. Must not be null.
        exp - The expiration time. Must not be null.
        jwks - The entity public JWK set, null if not required.
      • EntityStatementClaimsSet

        public EntityStatementClaimsSet​(EntityID iss,
                                        EntityID sub,
                                        Date iat,
                                        Date exp,
                                        com.nimbusds.jose.jwk.JWKSet jwks)
        Creates a new federation entity statement claims set with the minimum required claims.
        Parameters:
        iss - The issuer. Must not be null.
        sub - The subject. Must not be null.
        iat - The issue time. Must not be null.
        exp - The expiration time. Must not be null.
        jwks - The entity public JWK set, null if not required.
      • EntityStatementClaimsSet

        public EntityStatementClaimsSet​(com.nimbusds.jwt.JWTClaimsSet jwtClaimsSet)
                                 throws ParseException
        Creates a new federation entity statement claims set from the specified JWT claims set.
        Parameters:
        jwtClaimsSet - The JWT claims set. Must not be null.
        Throws:
        ParseException - If the JWT claims set doesn't represent a valid federation entity statement claims set.
    • Method Detail

      • isSelfStatement

        public boolean isSelfStatement()
        Returns true if this is a self-statement (issuer and subject match).
        Returns:
        true for a self-statement, false if not.
      • getExpirationTime

        public Date getExpirationTime()
        Gets the entity statement expiration time. Corresponds to the exp claim.
        Returns:
        The expiration time, null if not specified or parsing failed.
      • getJWKSet

        public com.nimbusds.jose.jwk.JWKSet getJWKSet()
        Gets the entity JWK set.
        Returns:
        The entity JWK set, null if not specified or parsing failed.
      • getAuthorityHints

        public List<EntityIDgetAuthorityHints()
        Gets the entity IDs of the intermediate entities or trust anchors.
        Returns:
        The entity IDs, null or empty list for a trust anchor, or if parsing failed.
      • setAuthorityHints

        public void setAuthorityHints​(List<EntityID> trustChain)
        Sets the entity IDs of the intermediate entities or trust anchors.
        Parameters:
        trustChain - The entity IDs, null or empty list for a trust anchor.
      • hasMetadata

        public boolean hasMetadata()
        Returns true if a metadata field is present.
        Returns:
        true if for a metadata field for an OpenID relying party, OpenID provider, OAuth authorisation server, OAuth client, OAuth protected resource or a federation entity is present.
      • getMetadata

        public net.minidev.json.JSONObject getMetadata​(FederationMetadataType type)
        Gets the metadata for the specified type. Use a typed getter, such as getRPMetadata(), when available.
        Parameters:
        type - The type. Must not be null.
        Returns:
        The metadata, null if not specified.
      • getRPMetadata

        public OIDCClientMetadata getRPMetadata()
        Gets the OpenID relying party metadata if present for this entity.
        Returns:
        The RP metadata, null if not specified or if parsing failed.
      • setRPMetadata

        public void setRPMetadata​(OIDCClientMetadata rpMetadata)
        Sets the OpenID relying party metadata if present for this entity.
        Parameters:
        rpMetadata - The RP metadata, null if not specified.
      • getOPMetadata

        public OIDCProviderMetadata getOPMetadata()
        Gets the OpenID provider metadata if present for this entity.
        Returns:
        The OP metadata, null if not specified or if parsing failed.
      • setOPMetadata

        public void setOPMetadata​(OIDCProviderMetadata opMetadata)
        Gets the OpenID provider metadata if present for this entity.
        Parameters:
        opMetadata - The OP metadata, null if not specified.
      • getOAuthClientMetadata

        public ClientMetadata getOAuthClientMetadata()
        Gets the OAuth 2.0 client metadata if present for this entity.
        Returns:
        The client metadata, null if not specified or if parsing failed.
      • setOAuthClientMetadata

        public void setOAuthClientMetadata​(ClientMetadata clientMetadata)
        Sets the OAuth 2.0 client metadata if present for this entity.
        Parameters:
        clientMetadata - The client metadata, null if not specified.
      • getASMetadata

        public AuthorizationServerMetadata getASMetadata()
        Gets the OAuth 2.0 authorisation server metadata if present for this entity.
        Returns:
        The AS metadata, null if not specified or if parsing failed.
      • setASMetadata

        public void setASMetadata​(AuthorizationServerMetadata asMetadata)
        Sets the OAuth 2.0 authorisation server metadata if present for this entity.
        Parameters:
        asMetadata - The AS metadata, null if not specified.
      • setFederationEntityMetadata

        public void setFederationEntityMetadata​(FederationEntityMetadata entityMetadata)
        Sets the federation entity metadata if present for this entity.
        Parameters:
        entityMetadata - The federation entity metadata, null if not specified.
      • getMetadataPolicyJSONObject

        public net.minidev.json.JSONObject getMetadataPolicyJSONObject()
        Gets the complete metadata policy JSON object.
        Returns:
        The metadata policy JSON object, null if not specified or if parsing failed.
      • setMetadataPolicyJSONObject

        public void setMetadataPolicyJSONObject​(net.minidev.json.JSONObject metadataPolicy)
        Sets the complete metadata policy JSON object.
        Parameters:
        metadataPolicy - The metadata policy JSON object, null if not specified.
      • setMetadataPolicy

        public void setMetadataPolicy​(FederationMetadataType type,
                                      MetadataPolicy metadataPolicy)
        Sets the metadata policy for the specified type.
        Parameters:
        type - The type. Must not be null.
        metadataPolicy - The metadata policy, null if not specified.
      • getTrustAnchorID

        public EntityID getTrustAnchorID()
        Gets the used trust anchor in a explicit client registration in OpenID Connect Federation 1.0. Intended for entity statements issued by an OpenID provider for a Relying party performing explicit client registration only.Corresponds to the trust_anchor_id client metadata field.
        Returns:
        The trust anchor ID, null if not specified.
      • setTrustAnchorID

        public void setTrustAnchorID​(EntityID trustAnchorID)
        Sets the used trust anchor in a explicit client registration in OpenID Connect Federation 1.0. Intended for entity statements issued by an OpenID provider for a Relying party performing explicit client registration only.Corresponds to the trust_anchor_id client metadata field.
        Parameters:
        trustAnchorID - The trust anchor ID, null if not specified.
      • getConstraints

        public TrustChainConstraints getConstraints()
        Gets the trust chain constraints for subordinate entities.
        Returns:
        The trust chain constraints, null if not specified or if parsing failed.
      • setConstraints

        public void setConstraints​(TrustChainConstraints constraints)
        Sets the trust chain constraint for subordinate entities.
        Parameters:
        constraints - The trust chain constraints, null if not specified.
      • getCriticalExtensionClaims

        public List<StringgetCriticalExtensionClaims()
        Gets the names of the critical extension claims.
        Returns:
        The names of the critical extension claims, null if not specified or if parsing failed.
      • setCriticalExtensionClaims

        public void setCriticalExtensionClaims​(List<String> claimNames)
        Sets the names of the critical extension claims.
        Parameters:
        claimNames - The names of the critical extension claims, null if not specified. Must not be an empty list.
      • getCriticalPolicyExtensions

        public List<StringgetCriticalPolicyExtensions()
        Gets the names of the critical policy extensions.
        Returns:
        The names of the critical policy extensions or if parsing failed.
      • setCriticalPolicyExtensions

        public void setCriticalPolicyExtensions​(List<String> extNames)
        Sets the names of the critical policy extensions.
        Parameters:
        extNames - The names of the critical policy extensions, null if not specified. Must not be an empty list.