Package org.forgerock.openig.fapi.dcr.request

Class RegistrationRequestFactory

java.lang.Object

org.forgerock.openig.fapi.dcr.request.RegistrationRequestFactory

public final class RegistrationRequestFactory
extends Object

A factory for creating RegistrationRequest objects.

This class supports transforming a SignedJwt into a RegistrationRequest, which is typical of the FAPI use case where the OAuth2.0 Dynamic Client Registration request is wrapped in a JWT signed by the client for added security.

Constructor Summary

Constructors

Constructor	Description
RegistrationRequestFactory(JwkSetService jwkSetService, TrustedDirectoryService trustedDirectoryService, Clock clock, Duration skewAllowance, Set<JwsAlgorithm> supportedSigningAlgorithms)	Constructor.

Method Summary

Modifier and Type	Method	Description
Promise<RegistrationRequest,FapiException>	createRegistrationRequest(SignedJwt registrationRequestJwt)	Creates a RegistrationRequest from a SignedJwt.

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Details

RegistrationRequestFactory

public RegistrationRequestFactory(JwkSetService jwkSetService,
 TrustedDirectoryService trustedDirectoryService,
 Clock clock,
 Duration skewAllowance,
 Set<JwsAlgorithm> supportedSigningAlgorithms)

Constructor.

Parameters:

jwkSetService - service used to retrieve JWKSet objects

trustedDirectoryService - service used to decode software statement assertions issued by Trusted Directories

clock - the clock to use for time-based validation

skewAllowance - the amount of skew to allow when validating time-based claims

supportedSigningAlgorithms - the signing algorithms that are supported for registration requests

Method Details

createRegistrationRequest

public Promise<RegistrationRequest,FapiException> createRegistrationRequest(SignedJwt registrationRequestJwt)

Creates a RegistrationRequest from a SignedJwt. These requests extend the OAuth2.0 Dynamic Client Registration protocol by wrapping the client's registration metadata in a JWT, which is then signed by the client using a key that can be obtained via their software statement.

In order to trust the registration request, the SoftwareStatement must first be decoded and validated to verify that it was issued by a Trusted Directory that we support, this then allows us to retrieve the client's JWKSet which can be used verify the registration request JWT.

Parameters:

registrationRequestJwt - the a SignedJwt containing the client's OAuth2.0 Dynamic Client Registration metadata as claims

Returns:

a Promise containing the RegistrationRequest if the registrationRequestJwt represents a valid registration request, or an FapiException if the JWT is invalid.