class ClaimsParameterValidator implements AuthorizeRequestValidator {

    @Override
    public void validateRequest(OAuth2Request request) throws InvalidClientException, InvalidRequestException,
            RedirectUriMismatchException, UnsupportedResponseTypeException, ServerException, BadRequestException,
            InvalidScopeException, NotFoundException {

        final OAuth2ProviderSettings settings = providerSettingsFactory.get(request);

        final String claims = request.getParameter(OAuth2Constants.Custom.CLAIMS);

        //if we aren't supporting this no need to validate
        if (!settings.getClaimsParameterSupported()) {
            return;
        }

        //if we support, but it's not requested, no need to validate
        if (claims == null) {
            return;
        }

        final JSONObject claimsJson;

        //convert claims into JSON object
        try {
            claimsJson = new JSONObject(claims);
        } catch (JSONException e) {
            throw new BadRequestException("Invalid JSON in supplied claims parameter.");
        }

        JSONObject userinfoClaims = null;

        try {
            userinfoClaims = claimsJson.getJSONObject(OAuth2Constants.UserinfoEndpoint.USERINFO);
        } catch (Exception e) {
            //fall through
        }

        //When the userinfo member is used, the request MUST also use a response_type value that
        //results in an Access Token being issued to the Client for use at the UserInfo Endpoint.
        if (userinfoClaims != null) {
            String responseType = request.getParameter(OAuth2Constants.Params.RESPONSE_TYPE);
            if (responseType != null && responseType.trim().equals(OAuth2Constants.JWTTokenParams.ID_TOKEN)) {
                throw new BadRequestException("Must request an access token when providing " +
                        "userinfo in claims parameter.");
            }
        }

    }

    @Inject public  ClaimsParameterValidator(OAuth2ProviderSettingsFactory providerSettingsFactory);

}