Package org.forgerock.openig.fapi.dcr.request

Class RegistrationRequestFilter

java.lang.Object

org.forgerock.openig.fapi.dcr.request.RegistrationRequestFilter

All Implemented Interfaces:

Filter

public class RegistrationRequestFilter
extends Object
implements Filter

This filter builds and validates a RegistrationRequest object that contains a SoftwareStatement from the body of a request to the /register endpoint.

This filter ensures that the following conditions of the FAPI spec are met:

• Financial-grade API Security Profile 1.0 - Part 2: Advanced, section 5.2.2 (2) states:
  • the response_type value code id_token, or
  • the response_type value code in conjunction with the response_mode value jwt;
• Financial-grade API Security Profile 1.0 - Part 2: Advanced , section 8.6 requires:
  • For JWS, both clients and authorization servers:
    • shall use PS256 or ES256 algorithms;
    • should not use algorithms that use RSASSA-PKCS1-v1_5 (e.g. RS256); and
    • shall not use none
• Financial-grade API Security Profile 1.0 - Part 2: Advanced, section 5.2.2 (14) states:
  • shall authenticate the confidential client using one of the following methods - note this overrides FAPI Security Profile 1.0 - Part 1: Baseline clause 5.2.2 (4):
    1. tls_client_auth or self_signed_tls_client_auth as specified in section 2 of MTLS, or
    2. private_key_jwt as specified in section 9 of OIDC;
• Financial-grade API Security Profile 1.0 - Part 1: Baseline states:
  • 5.2.2 (8): shall require redirect URIs to be pre-registered;
  • 5.2.2 (9): shall require the redirect_uri in the authorization request;
  • 5.2.2 (20): shall require redirect URIs to use the https scheme;

As an additional restriction, this filter also forbids the 'redirect_uri' from redirecting to localhost.

If the RegistrationRequest can successfully be built then a dedicated RegistrationRequestFapiContext is created for use by subsequent filters.

This filter is not expected to be instantiated directly as it is managed as part of the core FAPI Filter chain FapiDcrFilterChainHeaplet.

Constructor Summary

Constructors

Constructor	Description
RegistrationRequestFilter(RegistrationRequestFactory registrationRequestFactory, Set<String> supportedSigningAlgorithms, Set<String> supportedTokenEndpointAuthMethods, Set<String> registrationObjectSigningFieldNames, boolean applyOpenBankingRolesBasedScopeValidation)	RegistrationRequestFilter constructor, though this filter shouldn't be initiated directly as it is managed as part of FapiDcrFilterChainHeaplet.

Method Summary

Modifier and Type	Method	Description
Promise<Response,NeverThrowsException>	filter(Context context, Request request, Handler next)	Filters the request and/or response of an exchange.

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Details

RegistrationRequestFilter

public RegistrationRequestFilter(RegistrationRequestFactory registrationRequestFactory,
 Set<String> supportedSigningAlgorithms,
 Set<String> supportedTokenEndpointAuthMethods,
 Set<String> registrationObjectSigningFieldNames,
 boolean applyOpenBankingRolesBasedScopeValidation)

RegistrationRequestFilter constructor, though this filter shouldn't be initiated directly as it is managed as part of FapiDcrFilterChainHeaplet.

Parameters:

registrationRequestFactory - used to create a RegistrationRequest from the JWT extracted from the request payload

supportedSigningAlgorithms - the JWS signing algorithms supported by FAPI

supportedTokenEndpointAuthMethods - the registration request object's token_endpoint_auth_method values which are allowed by FAPI

registrationObjectSigningFieldNames - fields within the registration request object to validate against the supportedSigningAlgorithms

applyOpenBankingRolesBasedScopeValidation - Set to true if Open Banking roles-based scope validation should be applied.

Method Details

filter

public Promise<Response,NeverThrowsException> filter(Context context,
 Request request,
 Handler next)

Description copied from interface: Filter

Filters the request and/or response of an exchange. To pass the request to the next filter or handler in the chain, the filter calls next.handle(context, request).

This method may elect not to pass the request to the next filter or handler, and instead handle the request itself. It can achieve this by merely avoiding a call to next.handle(context, request) and creating its own response object. The filter is also at liberty to replace a response with another of its own by intercepting the response returned by the next handler.

Specified by:

filter in interface Filter

Parameters:

context - The request context.

request - The request.

next - The next filter or handler in the chain to handle the request.

Returns:

A Promise representing the response to be returned to the client.