Package org.forgerock.openig.fapi.dcr

Class FapiDcrFilterChainHeaplet

java.lang.Object
org.forgerock.openig.heap.GenericHeaplet
org.forgerock.openig.fapi.FapiGenericHeaplet
org.forgerock.openig.fapi.dcr.FapiDcrFilterChainHeaplet
All Implemented Interfaces:
Heaplet
public final class FapiDcrFilterChainHeaplet extends FapiGenericHeaplet
Filters chain that validates Dynamic Client Registration (DCR) requests to make sure that they will produce OAuth2.0 clients that are compliant with the following FAPI specifications:

This filter is intended to front filter(s) which implement DCR for a particular API, rejecting requests that would result in an OAuth2 client being created that does not conform to the FAPI spec. 

 {
    "type": "FapiDCRFilter",
    "config": {
      "forwardedHost"                       : String                  [REQUIRED - The forwarded host added to the
                                                                                  endpoint request. ]
      "clientCertificate"                   : Runtime Expression      [REQUIRED - A runtime expression which will
                                                                                  yield the client TLS certificate and
                                                                                  is evaluated on EVERY request. ]
      "jwkSetService"                       : JwkSetService           [REQUIRED - Reference to a
                                                                                  {@link JwkSetService}]
      "trustedDirectoryService"             : TrustedDirectoryService [REQUIRED - Reference to a
                                                                                  {@link TrustedDirectoryService}]
      "auditService"                        : AuditService            [OPTIONAL - Reference to a {@link AuditService}]
      "skewAllowance"                       : Duration                [OPTIONAL - Determines the amount of skew to
                                                                                  allow when validating time-based
                                                                                  claims.
                                                                                  Defaults to 5 seconds.]
      "supportedSigningAlgorithms"          : String[]                [OPTIONAL - List of supported signed attributes.
                                                                                  Default is [ PS256 , ES256 ]. (1) ]
      "supportedTokenEndpointAuthMethods"   : String[]                [OPTIONAL - Lists accepted OAuth2
                                                                                  {@code token_endpoint_auth_method}
                                                                                  values - see (2). ]
      "registrationObjectSigningFieldNames" : String[]                [OPTIONAL - Lists registration request fields
                                                                                  to be validated - see (3). ]
      "allowPingIssuedTestCerts"            : expression<boolean>     [OPTIONAL - Should a PingGateway-issued JWKSet
                                                                                  be permitted for client TLS
                                                                                  certificate validation - default is
                                                                                  false.]
      "apiClientService"                    : ApiClientService        [REQUIRED - reference to a
                                                                                  {@link ApiClientService} to use
                                                                                  to retrieve the {@link ApiClient }]
      "apiClientOrgService"                 : ApiClientOrgService     [REQUIRED - reference to a
                                                                                  {@link ApiClientOrganisationService}
                                                                                  to use to create
                                                                                  {@link ApiClientOrganisation }s]
      "clientId"                            : Expression              [REQUIRED - A runtime expression which will
                                                                                  yield the client id and is evaluated
                                                                                  on EVERY request.]
    }
  }
  1. '"supportedSigningAlgorithms"' configures which JWS algorithms are supported for signing, based on the FAPI specification. This is used to validate the registration request object (JWT) 'alg' header and configured signing fields, which configure the signing algorithms to use for the OAuth2 client. See Constants.FAPI_SUPPORTED_SIGNING_ALGORITHMS for supported algorithms, which are used as default if omitted.
  2. '"supportedTokenEndpointAuthMethods"' configures which OAuth2 'token_endpoint_auth_method' values are accepted by FAPI. See Constants.FAPI_SUPPORTED_TOKEN_ENDPOINT_AUTH_METHODS for supported auth methods, which are used as default values if omitted.
  3. '"registrationObjectSigningFieldNames"' configures which fields inside the registration request object should be validated against the '"supportedSigningAlgorithms"'. See Constants.DEFAULT_REGISTRATION_REQUEST_SIGNING_FIELD_NAMES for default values if omitted. 
 
 {
    "name": "fapiDCRFilter",
    "type": "FapiDCRFilter",
    "config": {
      "forwardedHost" : "&{as.fqdn}",
      "clientCertificate": "${pemCertificate(urlDecode(request.headers['ssl-client-cert'][0]))}",
      "jwkSetService": "jwkSetService",
      "trustedDirectoryService": "trustedDirectoryService",
      "auditService" : "auditService",
      "skewAllowance": "5 seconds",
      "supportedSigningAlgorithms": ["PS256", "ES256"],
      "supportedTokenEndpointAuthMethods" : [ "tls_client_auth",
                                              "self_signed_tls_client_auth",
                                              "private_key_jwt" ],
      "registrationObjectSigningFieldNames" : [ "token_endpoint_auth_signing_alg",
                                                "id_token_signed_response_alg",
                                                "request_object_signing_alg" ],
      "apiClientService" : "auditService",,
      "apiClientOrgService" : "auditService",,
      "clientId" : "${request.queryParams.client_id[0]}",
}
 }