Package io.jans.as.server.service

Class ClientIdMetadataService

java.lang.Object
io.jans.as.server.service.ClientIdMetadataService
@ApplicationScoped public class ClientIdMetadataService extends Object
OAuth Client ID Metadata Document (CIMD) Service. Handles URL-based client_id resolution per IETF draft spec. Fetched clients are persisted to the database with TTL-based expiry. On TTL expiry, the client metadata is re-downloaded from the URL.
Author:
Yuriy Z

  • Constructor Details

    • ClientIdMetadataService

      public ClientIdMetadataService()

  • Method Details

    • isCimdClientId

      public boolean isCimdClientId(String clientId)
      Check if client_id is a CIMD URL candidate.
      Parameters:
      clientId - the client_id to check
      Returns:
      true if CIMD feature is enabled and client_id is a valid URL with allowed scheme

    • isFeatureEnabled

      public boolean isFeatureEnabled()
      Check if CIMD feature is enabled.
      Returns:
      true if CLIENT_ID_METADATA_DOCUMENT feature flag is enabled

    • getClient

      public io.jans.as.common.model.registration.Client getClient(String clientIdUrl)
      Fetch (or return persisted), validate, and return Client from CIMD URL. Persists the client with a TTL. On TTL expiry, re-downloads the metadata.
      Parameters:
      clientIdUrl - the URL-based client_id
      Returns:
      Client object populated from the CIMD document
      Throws:
      jakarta.ws.rs.WebApplicationException - if validation fails or fetch fails

    • validateClientIdUrl

      public void validateClientIdUrl(String clientIdUrl)
      Validate the client_id URL for SSRF and policy compliance.
      Parameters:
      clientIdUrl - the URL to validate
      Throws:
      jakarta.ws.rs.WebApplicationException - if validation fails

    • isPrivateAddress

      public boolean isPrivateAddress(InetAddress address)
      Check if an IP address is private/internal.
      Parameters:
      address - the address to check
      Returns:
      true if private/internal

    • doFetch

      protected ClientIdMetadataService.FetchResult doFetch(String url)

    • buildClientFromRequest

      protected io.jans.as.common.model.registration.Client buildClientFromRequest(io.jans.as.client.RegisterRequest registerRequest, String clientIdUrl)
      Build a Client from a RegisterRequest using the same DCR mapping path (RegisterService). This ensures all RFC 7591 fields are applied consistently with dynamic registration.

    • parseToClient

      protected io.jans.as.common.model.registration.Client parseToClient(String json, String clientIdUrl)
      Parse metadata JSON and build a Client. Convenience wrapper used by tests.

    • calculateTtl

      protected int calculateTtl(String cacheControl)

    • computeId

      public static String computeId(String url)
      Compute a stable, LDAP-safe inum from a CIMD URL. Uses SHA-256 hex digest to avoid special characters in LDAP DNs.

    • badRequest

      public jakarta.ws.rs.WebApplicationException badRequest(String msg)