Package org.forgerock.openidconnect

Class IdTokenHintValidator

java.lang.Object

org.forgerock.openidconnect.IdTokenHintValidator

@Singleton
public class IdTokenHintValidator
extends Object

Validates the id_token_hint that the OpenID Connect end-session endpoint is given.

The hint carries the identity of the client whose registration governs the logout redirect, and the identifier of the session to destroy. Both are decisions the caller must not be able to make on its own, so the token has to be shown to have been issued by this provider before either claim is read.

The claim naming the client is read before verification, which is safe: it only selects the key the signature is checked against. A hint naming a client whose key the sender does not hold fails verification. The algorithm is taken from that client's registration, and the alg header of the hint has to name the same one, so the sender chooses neither the key nor the digest.

Since:

16.2.0

Nested Class Summary

Nested Classes

Modifier and Type	Class	Description
static class	IdTokenHintValidator.VerifiedIdTokenHint	An id_token_hint whose signature has been verified, together with the registration of the client it names.

Constructor Summary

Constructors

Constructor	Description
IdTokenHintValidator(OpenIdConnectClientRegistrationStore clientRegistrationStore, OAuth2ProviderSettingsFactory providerSettingsFactory)	Constructs a new IdTokenHintValidator.

Method Summary

Modifier and Type	Method	Description
IdTokenHintValidator.VerifiedIdTokenHint	validate(OAuth2Request request, String idTokenHint)	Parses the given id_token_hint and verifies that this provider issued it to the client it names, in the realm the request is addressed to.

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Detail

IdTokenHintValidator

@Inject
public IdTokenHintValidator(OpenIdConnectClientRegistrationStore clientRegistrationStore,
                            OAuth2ProviderSettingsFactory providerSettingsFactory)

Constructs a new IdTokenHintValidator.

Parameters:

clientRegistrationStore - An instance of the OpenIdConnectClientRegistrationStore.

providerSettingsFactory - An instance of the OAuth2ProviderSettingsFactory.

Method Detail

validate

public IdTokenHintValidator.VerifiedIdTokenHint validate(OAuth2Request request,
                                                         String idTokenHint)
                                                  throws BadRequestException,
                                                         InvalidClientException,
                                                         NotFoundException,
                                                         ServerException

Parses the given id_token_hint and verifies that this provider issued it to the client it names, in the realm the request is addressed to.

Expiry is deliberately not enforced. Logout regularly happens long after the id_token it refers to has expired, and the signature is what establishes that the provider issued the hint; an expired hint is not a forged one.

Parameters:

request - The OAuth2 request.

idTokenHint - The value of the id_token_hint parameter.

Returns:

The parsed and verified token.

Throws:

BadRequestException - If the hint is missing, malformed, names no client, was issued in another realm, or its signature does not verify.

InvalidClientException - If the client named by the hint is not registered.

NotFoundException - If the realm does not exist.

ServerException - If the provider's own keys cannot be read.