Package org.mitre.oauth2.token

Examples of org.mitre.oauth2.token.StructuredScopeAwareOAuth2RequestValidator

136
137
138
139
140
141
142
143
144
145
146
  public String getRegistrationTokenByClientId(@PathVariable("clientId") String clientId, ModelMap m, Principal p) {
   
    ClientDetailsEntity client = clientService.loadClientByClientId(clientId);
   
    if (client != null) {
      OAuth2AccessTokenEntity token = tokenService.getRegistrationAccessTokenForClient(client);
      if (token != null) {
        m.put("entity", token);
        return TokenApiView.VIEWNAME;
      } else {
        m.put("code", HttpStatus.NOT_FOUND);
View Full Code Here
160
161
162
163
164
165
166
167
168
169
170
  @RequestMapping(value = "/registration/{clientId}", method = RequestMethod.PUT, produces = "application/json")
  public String rotateRegistrationTokenByClientId(@PathVariable("clientId") String clientId, ModelMap m, Principal p) {
    ClientDetailsEntity client = clientService.loadClientByClientId(clientId);
   
    if (client != null) {
      OAuth2AccessTokenEntity token = oidcTokenService.rotateRegistrationAccessTokenForClient(client);
      token = tokenService.saveAccessToken(token);
     
      if (token != null) {
        m.put("entity", token);
        return TokenApiView.VIEWNAME;
View Full Code Here
56
57
58
59
60
61
62
63
64
65
66
67
68
69
    }

    try {
      // check and handle access tokens first

      OAuth2AccessTokenEntity accessToken = tokenServices.readAccessToken(tokenValue);
      if (authRequest != null) {
        // client acting on its own, make sure it owns the token
        if (!accessToken.getClient().getClientId().equals(authRequest.getClientId())) {
          // trying to revoke a token we don't own, throw a 403
          model.addAttribute("code", HttpStatus.FORBIDDEN);
          return HttpCodeView.VIEWNAME;
        }
      }
View Full Code Here
414
415
416
417
418
419
420
421
422
423
424
425
426
427
    Integer accessTokenValiditySeconds = 3600;

    Mockito.when(client.getAccessTokenValiditySeconds()).thenReturn(accessTokenValiditySeconds);

    long start = System.currentTimeMillis();
    OAuth2AccessTokenEntity token = service.refreshAccessToken(refreshTokenValue, tokenRequest);
    long end = System.currentTimeMillis();

    // Accounting for some delta for time skew on either side.
    Date lowerBoundAccessTokens = new Date(start + (accessTokenValiditySeconds * 1000L) - DELTA);
    Date upperBoundAccessTokens = new Date(end + (accessTokenValiditySeconds * 1000L) + DELTA);

    assertTrue(token.getExpiration().after(lowerBoundAccessTokens) && token.getExpiration().before(upperBoundAccessTokens));
  }
View Full Code Here
42
43
44
45
46
47
48
49
50
51
52
    @Test
    public void shouldAssembleExpectedResultForAccessToken() {

        // given
        OAuth2AccessTokenEntity accessToken = accessToken(new Date(123), scopes("foo", "bar"), "Bearer",
                authentication("name", request("clientId")));

        UserInfo userInfo = userInfo("sub");

        // when
View Full Code Here
68
69
70
71
72
73
74
75
76
77
78
    @Test
    public void shouldAssembleExpectedResultForAccessTokenWithoutUserInfo() {

        // given
        OAuth2AccessTokenEntity accessToken = accessToken(new Date(123), scopes("foo", "bar"), "Bearer",
                authentication("name", request("clientId")));

        // when
        Map<String, Object> result = assembler.assembleFrom(accessToken, null);
View Full Code Here
92
93
94
95
96
97
98
99
100
101
102
    @Test
    public void shouldAssembleExpectedResultForAccessTokenWithoutExpiry() {

        // given
        OAuth2AccessTokenEntity accessToken = accessToken(null, scopes("foo", "bar"), "Bearer",
                authentication("name", request("clientId")));

        UserInfo userInfo = userInfo("sub");

        // when
View Full Code Here
192
193
194
195
196
197
198
199
200
201
202
203
        given(userInfo.getSub()).willReturn(sub);
        return userInfo;
    }

    private OAuth2AccessTokenEntity accessToken(Date exp, Set<String> scopes, String tokenType, OAuth2Authentication authentication) {
        OAuth2AccessTokenEntity accessToken = mock(OAuth2AccessTokenEntity.class, RETURNS_DEEP_STUBS);
        given(accessToken.getExpiration()).willReturn(exp);
        given(accessToken.getScope()).willReturn(scopes);
        given(accessToken.getTokenType()).willReturn(tokenType);
        given(accessToken.getAuthenticationHolder().getAuthentication()).willReturn(authentication);
        return accessToken;
    }
View Full Code Here
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
   */
  @Override
  protected OAuth2Authentication getOAuth2Authentication(ClientDetails client, TokenRequest tokenRequest) throws AuthenticationException, InvalidTokenException {
    // read and load up the existing token
    String incomingTokenValue = tokenRequest.getRequestParameters().get("token");
    OAuth2AccessTokenEntity incomingToken = tokenServices.readAccessToken(incomingTokenValue);

    // check for scoping in the request, can't up-scope with a chained request
    Set<String> approvedScopes = incomingToken.getScope();
    Set<String> requestedScopes = tokenRequest.getScope();

    if (requestedScopes == null) {
      requestedScopes = new HashSet<String>();
    }

    // do a check on the requested scopes -- if they exactly match the client scopes, they were probably shadowed by the token granter
    if (client.getScope().equals(requestedScopes)) {
      requestedScopes = new HashSet<String>();
    }

    // if our scopes are a valid subset of what's allowed, we can continue
    if (approvedScopes.containsAll(requestedScopes)) {

      if (requestedScopes.isEmpty()) {
        // if there are no scopes, inherit the original scopes from the token
        tokenRequest.setScope(approvedScopes);
      } else {
        // if scopes were asked for, give only the subset of scopes requested
        // this allows safe downscoping
        tokenRequest.setScope(Sets.intersection(requestedScopes, approvedScopes));
      }

      // NOTE: don't revoke the existing access token

      // create a new access token
      OAuth2Authentication authentication = new OAuth2Authentication(getRequestFactory().createOAuth2Request(client, tokenRequest), incomingToken.getAuthenticationHolder().getAuthentication().getUserAuthentication());

      return authentication;

    } else {
      throw new InvalidScopeException("Invalid scope requested in chained request", approvedScopes);
View Full Code Here
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
   */
  @Override
  protected OAuth2AccessToken getAccessToken(ClientDetails client, TokenRequest tokenRequest) throws AuthenticationException, InvalidTokenException {
    // read and load up the existing token
    String incomingTokenValue = tokenRequest.getRequestParameters().get("assertion");
    OAuth2AccessTokenEntity incomingToken = tokenServices.readAccessToken(incomingTokenValue);

    if (incomingToken.getScope().contains(SystemScopeService.ID_TOKEN_SCOPE)) {

      if (!client.getClientId().equals(tokenRequest.getClientId())) {
        throw new InvalidClientException("Not the right client for this token");
      }

      // it's an ID token, process it accordingly

      try {

        // TODO: make this use a more specific idtoken class
        JWT idToken = JWTParser.parse(incomingTokenValue);

        OAuth2AccessTokenEntity accessToken = tokenServices.getAccessTokenForIdToken(incomingToken);

        if (accessToken != null) {

          //OAuth2AccessTokenEntity newIdToken = tokenServices.get

          OAuth2AccessTokenEntity newIdTokenEntity = new OAuth2AccessTokenEntity();

          // copy over all existing claims
          JWTClaimsSet claims = new JWTClaimsSet(idToken.getJWTClaimsSet());

          if (client instanceof ClientDetailsEntity) {

            ClientDetailsEntity clientEntity = (ClientDetailsEntity) client;

            // update expiration and issued-at claims
            if (clientEntity.getIdTokenValiditySeconds() != null) {
              Date expiration = new Date(System.currentTimeMillis() + (clientEntity.getIdTokenValiditySeconds() * 1000L));
              claims.setExpirationTime(expiration);
              newIdTokenEntity.setExpiration(expiration);
            }

          } else {
            //This should never happen
            logger.fatal("SEVERE: Client is not an instance of OAuth2AccessTokenEntity.");
            throw new BadCredentialsException("SEVERE: Client is not an instance of ClientDetailsEntity; JwtAssertionTokenGranter cannot process this request.");
          }

          claims.setIssueTime(new Date());


          SignedJWT newIdToken = new SignedJWT((JWSHeader) idToken.getHeader(), claims);
          jwtService.signJwt(newIdToken);

          newIdTokenEntity.setJwt(newIdToken);
          newIdTokenEntity.setAuthenticationHolder(incomingToken.getAuthenticationHolder());
          newIdTokenEntity.setScope(incomingToken.getScope());
          newIdTokenEntity.setClient(incomingToken.getClient());

          newIdTokenEntity = tokenServices.saveAccessToken(newIdTokenEntity);

          // attach the ID token to the access token entity
          accessToken.setIdToken(newIdTokenEntity);
View Full Code Here
TOP

Related Classes of org.mitre.oauth2.token.StructuredScopeAwareOAuth2RequestValidator

  • com.google.gson.JsonElement
  • com.google.gson.JsonObject
  • com.google.gson.JsonParser
  • com.nimbusds.jwt.JWT
  • com.nimbusds.jwt.JWTClaimsSet
  • com.nimbusds.jwt.PlainJWT
  • com.nimbusds.jwt.SignedJWT
  • org.mitre.jose.JWEAlgorithmEmbed
  • org.mitre.jose.JWEEncryptionMethodEmbed
  • org.mitre.jose.JWSAlgorithmEmbed
    • Copyright © 2018 www.massapicom. All rights reserved.
    All source code are property of their respective owners. Java is a trademark of Sun Microsystems, Inc and owned by ORACLE Inc. Contact coftware#gmail.com.