final HttpServletRequest request,
final HttpServletResponse response)
throws IOException, OAuthSystemException {
// Create the OAuth request from the HTTP request.
OAuthAuthzRequest oauthRequest;
try {
oauthRequest = new OAuthAuthzRequest(request);
}
// The request does not conform to the RFC, so we return a HTTP 400
// with a reason.
catch(OAuthProblemException e) {
// Create the OAuth response.
OAuthResponse oauthResponse =
OAuthASResponse
.errorResponse(HttpServletResponse.SC_BAD_REQUEST)
.error(e)
.buildJSONMessage();
// Set the status and return the error message.
response.setStatus(oauthResponse.getResponseStatus());
return oauthResponse.getBody();
}
// Validate that the user is requesting a "code" response type, which
// is the only response type we accept.
try {
if(!
ResponseType
.CODE.toString().equals(oauthRequest.getResponseType())) {
// Create the OAuth response.
OAuthResponse oauthResponse =
OAuthASResponse
.errorResponse(HttpServletResponse.SC_BAD_REQUEST)
.setError(CodeResponse.UNSUPPORTED_RESPONSE_TYPE)
.setErrorDescription(
"The response type must be '" +
ResponseType.CODE.toString() +
"' but was instead: " +
oauthRequest.getResponseType())
.setState(oauthRequest.getState())
.buildJSONMessage();
// Set the status and return the error message.
response.setStatus(oauthResponse.getResponseStatus());
return oauthResponse.getBody();
}
}
catch(IllegalArgumentException e) {
// Create the OAuth response.
OAuthResponse oauthResponse =
OAuthASResponse
.errorResponse(HttpServletResponse.SC_BAD_REQUEST)
.setError(CodeResponse.UNSUPPORTED_RESPONSE_TYPE)
.setErrorDescription(
"The response type is unknown: " +
oauthRequest.getResponseType())
.setState(oauthRequest.getState())
.buildJSONMessage();
// Set the status and return the error message.
response.setStatus(oauthResponse.getResponseStatus());
return oauthResponse.getBody();
}
// Make sure no redirect URI was given.
if(oauthRequest.getRedirectURI() != null) {
// Create the OAuth response.
OAuthResponse oauthResponse =
OAuthASResponse
.errorResponse(HttpServletResponse.SC_BAD_REQUEST)
.setError(CodeResponse.INVALID_REQUEST)
.setErrorDescription(
"A URI must not be given. Instead, the one given " +
"when the account was created will be used.")
.setState(oauthRequest.getState())
.buildJSONMessage();
// Set the status and return the error message.
response.setStatus(oauthResponse.getResponseStatus());
return oauthResponse.getBody();
}
// Attempt to get the third-party.
ThirdParty thirdParty =
ThirdPartyBin
.getInstance().getThirdParty(oauthRequest.getClientId());
// If the third-party is unknown, reject the request.
if(thirdParty == null) {
// Create the OAuth response.
OAuthResponse oauthResponse =
OAuthASResponse
.errorResponse(HttpServletResponse.SC_BAD_REQUEST)
.setError(CodeResponse.INVALID_REQUEST)
.setErrorDescription(
"The client ID is unknown: " +
oauthRequest.getClientId())
.setState(oauthRequest.getState())
.buildJSONMessage();
// Set the status and return the error message.
response.setStatus(oauthResponse.getResponseStatus());
return oauthResponse.getBody();
}
// Attempt to get the scopes.
Set<String> scopes = oauthRequest.getScopes();
if((scopes == null) || (scopes.size() == 0)) {
// Create the OAuth response.
OAuthResponse oauthResponse =
OAuthASResponse
.errorResponse(HttpServletResponse.SC_BAD_REQUEST)
.setError(CodeResponse.INVALID_SCOPE)
.setErrorDescription("A scope is required.")
.setState(oauthRequest.getState())
.buildJSONMessage();
// Set the status and return the error message.
response.setStatus(oauthResponse.getResponseStatus());
return oauthResponse.getBody();
}
// Validate the scopes.
Registry registry = Registry.getInstance();
for(String scope : scopes) {
if(registry.getSchemas(scope, null, 0, 1).size() != 1) {
// Create the OAuth response.
OAuthResponse oauthResponse =
OAuthASResponse
.errorResponse(HttpServletResponse.SC_BAD_REQUEST)
.setError(CodeResponse.INVALID_SCOPE)
.setErrorDescription(
"Each scope must be a known schema ID: " + scope)
.setState(oauthRequest.getState())
.buildJSONMessage();
// Set the status and return the error message.
response.setStatus(oauthResponse.getResponseStatus());
return oauthResponse.getBody();
}
}
// Create the temporary code to be granted or rejected by the user.
AuthorizationCode code =
new AuthorizationCode(
thirdParty,
oauthRequest.getScopes(),
oauthRequest.getState());
// Store the authorization code.
AuthorizationCodeBin.getInstance().storeCode(code);
// Build the scope as specified by the OAuth specification.