Examples of org.springframework.security.oauth2.provider.expression.OAuth2WebSecurityExpressionHandler

Package org.springframework.security.oauth2.provider.expression

Examples of org.springframework.security.oauth2.provider.expression.OAuth2WebSecurityExpressionHandler

org.springframework.security.oauth2.provider.OAuth2Request

A security expression handler that can handle default web security expressions plus the set provided by {@link OAuth2SecurityExpressionMethods} using the variable oauth2 to access the methods. For example, the expression#oauth2.clientHasRole('ROLE_ADMIN') would invoke {@link OAuth2SecurityExpressionMethods#clientHasRole}.

By default the {@link OAuth2ExpressionParser} is used. If this is undesirable one can inject their own{@link ExpressionParser} using {@link #setExpressionParser(ExpressionParser)}.
@author Dave Syer @author Rob Winch @see OAuth2ExpressionParser

                            currentId = reader.nextLong();
                        } else if (name.equals("ownerId")) {
                            //not needed
                            reader.skipValue();
                        } else if (name.equals("authentication")) {
                            OAuth2Request clientAuthorization = null;
                            Authentication userAuthentication = null;
                            reader.beginObject();
                            while (reader.hasNext()) {
                                switch (reader.peek()) {
                                    case END_OBJECT:

View Full Code Here

                    reader.skipValue();
                    continue;
            }
        }
        reader.endObject();
        return new OAuth2Request(requestParameters, clientId, authorities, approved, scope, resourceIds, redirectUri, responseTypes, extensions);
    }

View Full Code Here

    }
    
    // create a new token
    
    Map<String, String> authorizationParameters = Maps.newHashMap();
    OAuth2Request clientAuth = new OAuth2Request(authorizationParameters, client.getClientId(),
        Sets.newHashSet(new SimpleGrantedAuthority("ROLE_CLIENT")), true,
        scope, null, null, null, null);
    OAuth2Authentication authentication = new OAuth2Authentication(clientAuth, null);


    OAuth2AccessTokenEntity token = new OAuth2AccessTokenEntity();

View Full Code Here

  public String revoke(@RequestParam("token") String tokenValue, @RequestParam(value = "token_type_hint", required = false) String tokenType, Principal principal, Model model) {


    // This is the token as passed in from OAuth (in case we need it some day)
    //OAuth2AccessTokenEntity tok = tokenServices.getAccessToken((OAuth2Authentication) principal);


    OAuth2Request authRequest = null;
    if (principal instanceof OAuth2Authentication) {
      // if the client is acting on its own behalf (the common case), pull out the client authorization request
      authRequest = ((OAuth2Authentication) principal).getOAuth2Request();
    }


    try {
      // check and handle access tokens first


      OAuth2AccessTokenEntity accessToken = tokenServices.readAccessToken(tokenValue);
      if (authRequest != null) {
        // client acting on its own, make sure it owns the token
        if (!accessToken.getClient().getClientId().equals(authRequest.getClientId())) {
          // trying to revoke a token we don't own, throw a 403
          model.addAttribute("code", HttpStatus.FORBIDDEN);
          return HttpCodeView.VIEWNAME;
        }
      }


      // if we got this far, we're allowed to do this
      tokenServices.revokeAccessToken(accessToken);
      model.addAttribute("code", HttpStatus.OK);
      return HttpCodeView.VIEWNAME;


    } catch (InvalidTokenException e) {


      // access token wasn't found, check the refresh token


      try {
        OAuth2RefreshTokenEntity refreshToken = tokenServices.getRefreshToken(tokenValue);
        if (authRequest != null) {
          // client acting on its own, make sure it owns the token
          if (!refreshToken.getClient().getClientId().equals(authRequest.getClientId())) {
            // trying to revoke a token we don't own, throw a 403
            model.addAttribute("code", HttpStatus.FORBIDDEN);
            return HttpCodeView.VIEWNAME;
          }
        }

View Full Code Here

                            currentId = reader.nextLong();
                        } else if (name.equals("ownerId")) {
                            //not needed
                            reader.skipValue();
                        } else if (name.equals("authentication")) {
                            OAuth2Request clientAuthorization = null;
                            Authentication userAuthentication = null;
                            reader.beginObject();
                            while (reader.hasNext()) {
                                switch (reader.peek()) {
                                    case END_OBJECT:

View Full Code Here

    Mockito.reset(tokenRepository, authenticationHolderRepository, clientDetailsService, tokenEnhancer);






    authentication = Mockito.mock(OAuth2Authentication.class);
    OAuth2Request clientAuth = new OAuth2Request(null, clientId, null, true, scope, null, null, null, null);
    Mockito.when(authentication.getOAuth2Request()).thenReturn(clientAuth);


    client = Mockito.mock(ClientDetailsEntity.class);
    Mockito.when(client.getClientId()).thenReturn(clientId);
    Mockito.when(clientDetailsService.loadClientByClientId(clientId)).thenReturn(client);

View Full Code Here

                    reader.skipValue();
                    continue;
            }
        }
        reader.endObject();
        return new OAuth2Request(authorizationParameters, clientId, authorities, approved, scope, resourceIds, redirectUri, responseTypes, null);
    }

View Full Code Here

   * Tests the creation of access tokens for clients that are allowed to have refresh tokens.
   */
  @Test
  public void createAccessToken_yesRefresh() {


    OAuth2Request clientAuth = new OAuth2Request(null, clientId, null, true, Sets.newHashSet(SystemScopeService.OFFLINE_ACCESS), null, null, null, null);
    Mockito.when(authentication.getOAuth2Request()).thenReturn(clientAuth);
    Mockito.when(client.isAllowRefresh()).thenReturn(true);


    OAuth2AccessTokenEntity token = service.createAccessToken(authentication);

View Full Code Here

    private OAuth2Request request(String clientId) {
        return request(clientId, null);
    }


    private OAuth2Request request(String clientId, Set<String> scopes) {
        return new OAuth2Request(null, clientId, null, true, scopes, null, null, null, null);
    }

View Full Code Here

      scopes.addAll(OAuth2Utils.parseParameterList(token.get("scope").getAsString()));
    }
    Map<String, String> parameters = new HashMap<String, String>();
    parameters.put("client_id", clientId);
    parameters.put("scope", OAuth2Utils.formatParameterList(scopes));
    OAuth2Request storedRequest = new OAuth2Request(parameters, clientId, null, true, scopes, null, null, null, null);
    return storedRequest;
  }

View Full Code Here

0 1 2 3 4 5 6 7 8 9

TOP

Related Classes of org.springframework.security.oauth2.provider.expression.OAuth2WebSecurityExpressionHandler

client.ClientServerInteractionTests

com.springsource.greenhouse.settings.SettingsControllerTest

demo.Application

demo.Application$OAuth2Config

demo.Application$ResourceServer

demo.Application$TokenEndpointSecurity

OAuth2AuthenticationReadConverter

org.codehaus.jackson.map.ObjectMapper

org.mitre.oauth2.introspectingfilter.IntrospectingTokenService

org.mitre.oauth2.repository.impl.JpaAuthorizationCodeRepository

All source code are property of their respective owners. Java is a trademark of Sun Microsystems, Inc and owned by ORACLE Inc. Contact coftware#gmail.com.