Package org.forgerock.openig.fapi.certificate

Class ResponsePathTransportCertValidationFilter

java.lang.Object

org.forgerock.openig.fapi.certificate.ResponsePathTransportCertValidationFilter

All Implemented Interfaces:

Filter

public final class ResponsePathTransportCertValidationFilter
extends Object
implements Filter

Filter responsible for validating the inbound request's TLS transport certificate, when making a request to an Authorisation Server endpoint.

Note that this is a specialised alternative to the TransportCertValidationFilter, which does the same validation, but does so on the response path. By deferring the validation to the response path we can be sure that we have an authenticated client, and been provisioned with the client's ApiClient (via the authorization response).

This filter should be used in flows where, the JWKs to verify the certificate against are obtained from the ApiClient associated with the authenticated registration request, which is present on the RegistrationRequestFapiContext following authorization, through inclusion of a ResponsePathFetchApiClientFilter later in the chain.

certificateIsMandatory controls whether the mTLS certificate is required for all requests processed by this filter. If it is not required, then validation is skipped if it is not present.

This filter is not expected to be instantiated directly as it is managed as part of the core FAPI Filter chains e.g. FapiParFilterChainHeaplet.

See Also:

• TransportCertValidator is used to validate an X509Certificate against a JwkSetSecretStore

Method Summary

Modifier and Type	Method	Description
Promise<Response,NeverThrowsException>	filter(Context context, Request request, Handler next)	Filters the request and/or response of an exchange.
static Filter	mandatoryTransportCertValidationFilter()	Create an instance of a ResponsePathTransportCertValidationFilter where the transport cert must always be passed to the token endpoint as it is mandatory for sender constrained access tokens.
static Filter	optionalTransportCertValidationFilter()	Create an instance of a ResponsePathTransportCertValidationFilter where the transport cert is optional, only required when doing tls_client_auth.

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Method Details

filter

public Promise<Response,NeverThrowsException> filter(Context context,
 Request request,
 Handler next)

Description copied from interface: Filter

Filters the request and/or response of an exchange. To pass the request to the next filter or handler in the chain, the filter calls next.handle(context, request).

This method may elect not to pass the request to the next filter or handler, and instead handle the request itself. It can achieve this by merely avoiding a call to next.handle(context, request) and creating its own response object. The filter is also at liberty to replace a response with another of its own by intercepting the response returned by the next handler.

Specified by:

filter in interface Filter

Parameters:

context - The request context.

request - The request.

next - The next filter or handler in the chain to handle the request.

Returns:

A Promise representing the response to be returned to the client.

mandatoryTransportCertValidationFilter

public static Filter mandatoryTransportCertValidationFilter()

Create an instance of a ResponsePathTransportCertValidationFilter where the transport cert must always be passed to the token endpoint as it is mandatory for sender constrained access tokens.

Returns:

ResponsePathTransportCertValidationFilter configured for validation of a mandatory cert

optionalTransportCertValidationFilter

public static Filter optionalTransportCertValidationFilter()

Create an instance of a ResponsePathTransportCertValidationFilter where the transport cert is optional, only required when doing tls_client_auth.

Returns:

ResponsePathTransportCertValidationFilter configured validation of a cert that may not be present