Examples of org.springframework.security.oauth2.provider.expression.OAuth2MethodSecurityExpressionHandler

Package org.springframework.security.oauth2.provider.expression

Examples of org.springframework.security.oauth2.provider.expression.OAuth2MethodSecurityExpressionHandler

org.springframework.security.oauth2.provider.AuthorizationRequest

A security expression handler that can handle default method security expressions plus the set provided by {@link OAuth2SecurityExpressionMethods} using the variable oauth2 to access the methods. For example, the expression#oauth2.clientHasRole('ROLE_ADMIN') would invoke {@link OAuth2SecurityExpressionMethods#clientHasRole}

By default the {@link OAuth2ExpressionParser} is used. If this is undesirable one can inject their own{@link ExpressionParser} using {@link #setExpressionParser(ExpressionParser)}.
@author Dave Syer @author Rob Winch @see OAuth2ExpressionParser

      OAuth2Authentication authentication = new OAuth2Authentication(getRequestFactory().createOAuth2Request(client, tokenRequest), incomingToken.getAuthenticationHolder().getAuthentication().getUserAuthentication());


      return authentication;


    } else {
      throw new InvalidScopeException("Invalid scope requested in chained request", approvedScopes);
    }


  }

View Full Code Here

   */
  private void validateScope(Set<String> requestedScopes, Set<String> clientScopes) throws InvalidScopeException {
    if (requestedScopes != null && !requestedScopes.isEmpty()) {
      if (clientScopes != null && !clientScopes.isEmpty()) {
        if (!scopeService.scopesMatch(clientScopes, requestedScopes)) {
          throw new InvalidScopeException("Invalid scope", clientScopes);
        }
      }
    }
  }

View Full Code Here

        // set the scope of the new access token if requested
        token.setScope(scope);
      } else {
        String errorMsg = "Up-scoping is not allowed.";
        logger.error(errorMsg);
        throw new InvalidScopeException(errorMsg);
      }
    } else {
      // otherwise inherit the scope of the refresh token (if it's there -- this can return a null scope set)
      token.setScope(refreshScopes);
    }

View Full Code Here

  public OAuth2AccessTokenEntity refreshAccessToken(String refreshTokenValue, TokenRequest authRequest) throws AuthenticationException {


    OAuth2RefreshTokenEntity refreshToken = tokenRepository.getRefreshTokenByValue(refreshTokenValue);


    if (refreshToken == null) {
      throw new InvalidTokenException("Invalid refresh token: " + refreshTokenValue);
    }


    ClientDetailsEntity client = refreshToken.getClient();


    AuthenticationHolderEntity authHolder = refreshToken.getAuthenticationHolder();


    //Make sure this client allows access token refreshing
    if (!client.isAllowRefresh()) {
      throw new InvalidClientException("Client does not allow refreshing access token!");
    }


    // clear out any access tokens
    // TODO: make this a configurable option
    tokenRepository.clearAccessTokensForRefreshToken(refreshToken);


    if (refreshToken.isExpired()) {
      tokenRepository.removeRefreshToken(refreshToken);
      throw new InvalidTokenException("Expired refresh token: " + refreshTokenValue);
    }


    // TODO: have the option to recycle the refresh token here, too
    // for now, we just reuse it as long as it's valid, which is the original intent

View Full Code Here

  public OAuth2Authentication loadAuthentication(String accessTokenValue) throws AuthenticationException {


    OAuth2AccessTokenEntity accessToken = tokenRepository.getAccessTokenByValue(accessTokenValue);


    if (accessToken == null) {
      throw new InvalidTokenException("Invalid access token: " + accessTokenValue);
    }


    if (accessToken.isExpired()) {
      //tokenRepository.removeAccessToken(accessToken);
      revokeAccessToken(accessToken);
      throw new InvalidTokenException("Expired access token: " + accessTokenValue);
    }


    return accessToken.getAuthenticationHolder().getAuthentication();
  }

View Full Code Here

   */
  @Override
  public OAuth2AccessTokenEntity readAccessToken(String accessTokenValue) throws AuthenticationException {
    OAuth2AccessTokenEntity accessToken = tokenRepository.getAccessTokenByValue(accessTokenValue);
    if (accessToken == null) {
      throw new InvalidTokenException("Access token for value " + accessTokenValue + " was not found");
    }
    else {
      return accessToken;
    }
  }

View Full Code Here

   */
  @Override
  public OAuth2RefreshTokenEntity getRefreshToken(String refreshTokenValue) throws AuthenticationException {
    OAuth2RefreshTokenEntity refreshToken = tokenRepository.getRefreshTokenByValue(refreshTokenValue);
    if (refreshToken == null) {
      throw new InvalidTokenException("Refresh token for value " + refreshTokenValue + " was not found");
    }
    else {
      return refreshToken;
    }
  }

View Full Code Here

  public Authentication authenticate(Authentication authentication) throws AuthenticationException {


    String token = (String) authentication.getPrincipal();
    OAuth2Authentication auth = tokenServices.loadAuthentication(token);
    if (auth == null) {
      throw new InvalidTokenException("Invalid token: " + token);
    }


    Collection<String> resourceIds = auth.getOAuth2Request().getResourceIds();
    if (resourceId != null && resourceIds != null && !resourceIds.isEmpty() && !resourceIds.contains(resourceId)) {
      throw new OAuth2AccessDeniedException("Invalid token does not contain resource id (" + resourceId + ")");

View Full Code Here

    for (String redirectUri : redirectUris) {
      if (requestedRedirect != null && redirectMatches(requestedRedirect, redirectUri)) {
        return requestedRedirect;
      }
    }
    throw new RedirectMismatchException("Invalid redirect: " + requestedRedirect
        + " does not match one of the registered values: " + redirectUris.toString());
  }

View Full Code Here


  @Override
  public AuthorizationRequest createAuthorizationRequest(Map<String, String> inputParams) {




    AuthorizationRequest request = new AuthorizationRequest(inputParams, Collections.<String, String> emptyMap(),
        inputParams.get(OAuth2Utils.CLIENT_ID),
        OAuth2Utils.parseParameterList(inputParams.get(OAuth2Utils.SCOPE)), null,
        null, false, inputParams.get(OAuth2Utils.STATE),
        inputParams.get(OAuth2Utils.REDIRECT_URI),
        OAuth2Utils.parseParameterList(inputParams.get(OAuth2Utils.RESPONSE_TYPE)));


    //Add extension parameters to the 'extensions' map


    if (inputParams.containsKey("prompt")) {
      request.getExtensions().put("prompt", inputParams.get("prompt"));
    }
    if (inputParams.containsKey("nonce")) {
      request.getExtensions().put("nonce", inputParams.get("nonce"));
    }


    if (inputParams.containsKey("claims")) {
      JsonObject claimsRequest = parseClaimRequest(inputParams.get("claims"));
      if (claimsRequest != null) {
        request.getExtensions().put("claims", claimsRequest.toString());
      }
    }


    if (inputParams.containsKey("max_age")) {
      request.getExtensions().put("max_age", inputParams.get("max_age"));
    }


    if (inputParams.containsKey("request")) {
      request.getExtensions().put("request", inputParams.get("request"));
      processRequestObject(inputParams.get("request"), request);
    }


    if (request.getClientId() != null) {
      try {
        ClientDetailsEntity client = clientDetailsService.loadClientByClientId(request.getClientId());


        if ((request.getScope() == null || request.getScope().isEmpty())) {
          Set<String> clientScopes = client.getScope();
          request.setScope(clientScopes);
        }


        if (request.getExtensions().get("max_age") == null && client.getDefaultMaxAge() != null) {
          request.getExtensions().put("max_age", client.getDefaultMaxAge().toString());
        }
      } catch (OAuth2Exception e) {
        logger.error("Caught OAuth2 exception trying to test client scopes and max age:", e);
      }
    }




    // add CSRF protection to the request on first parse
    String csrf = UUID.randomUUID().toString();
    request.getExtensions().put("csrf", csrf);






    return request;
  }

View Full Code Here

0 1 2 3 4 5 6 7 8 9

TOP

Related Classes of org.springframework.security.oauth2.provider.expression.OAuth2MethodSecurityExpressionHandler

client.ClientServerInteractionTests

com.springsource.greenhouse.settings.SettingsControllerTest

demo.Application

demo.Application$OAuth2Config

demo.Application$TokenEndpointSecurity

OAuth2AuthenticationReadConverter

org.codehaus.jackson.map.ObjectMapper

org.mitre.oauth2.introspectingfilter.IntrospectingTokenService

org.mitre.oauth2.repository.impl.JpaAuthorizationCodeRepository

org.mitre.oauth2.service.impl.DefaultIntrospectionResultAssembler

All source code are property of their respective owners. Java is a trademark of Sun Microsystems, Inc and owned by ORACLE Inc. Contact coftware#gmail.com.