org.xdi.oxauth.uma.service.UmaValidationService クラス

org.xdi.oxauth.uma.service.UmaValidationService 連携図

公開メンバ関数
AuthorizationGrant	assertHasProtectionScope (String authorization)
UmaRPT	validateRPT (String rptCode)
void	validatePermissions (List< UmaPermission > permissions)
void	validatePermission (UmaPermission permission)
void	validatePermissions (UmaPermissionList permissions)
void	validatePermission (org.xdi.oxauth.model.uma.UmaPermission permission)
void	validateGrantType (String grantType)
List< UmaPermission >	validateTicket (String ticket)
List< UmaPermission >	validateTicketWithRedirect (String ticket, String claimsRedirectUri, String state)
Jwt	validateClaimToken (String claimToken, String claimTokenFormat)
boolean	isIdTokenValid (Jwt idToken)
UmaPCT	validatePct (String pctCode)
Map< UmaScopeDescription, Boolean >	validateScopes (String scope, List< UmaPermission > permissions)
void	validateScopeExpression (String scopeExpression)
Client	validateClientAndClaimsRedirectUri (String clientId, String claimsRedirectUri, String state)
String []	validatesGatheringScriptNames (String scriptNamesAsString, String claimsRedirectUri, String state)
void	validateRestrictedByClient (String patClientDn, String rsId)
void	validateResource (org.xdi.oxauth.model.uma.UmaResource resource)

非公開メンバ関数
AuthorizationGrant	validateAuthorization (String authorization, UmaScopeType umaScopeType)
RSAPublicKey	getPublicKey (String kid)
String	getEqualRedirectUri (String redirectUri, String[] clientRedirectUris)

非公開変数類
Logger	log
ErrorResponseFactory	errorResponseFactory
TokenService	tokenService
AuthorizationGrantList	authorizationGrantList
UmaResourceService	resourceService
UmaScopeService	umaScopeService
AppConfiguration	appConfiguration
UmaPermissionService	permissionService
UmaPctService	pctService
UmaRptService	rptService
WebKeysConfiguration	webKeysConfiguration
ClientService	clientService
UmaExpressionService	expressionService

詳解

著者

Yuriy Zabrovarnyy

バージョン

0.9, 04/02/2013

関数詳解

assertHasProtectionScope()

AuthorizationGrant org.xdi.oxauth.uma.service.UmaValidationService.assertHasProtectionScope ( String  authorization )

inline

                                                                             {
        return validateAuthorization(authorization, UmaScopeType.PROTECTION);
    }

getEqualRedirectUri()

String org.xdi.oxauth.uma.service.UmaValidationService.getEqualRedirectUri ( String  redirectUri, String []  clientRedirectUris  )

inlineprivate

                                                                                        {
        final String redirectUriWithoutParams = RedirectionUriService.uriWithoutParams(redirectUri);

        for (String uri : clientRedirectUris) {
            log.debug("Comparing {} == {}", uri, redirectUri);
            if (uri.equals(redirectUri)) { // compare complete uri
                return redirectUri;
            }

            String uriWithoutParams = RedirectionUriService.uriWithoutParams(uri);
            final Map<String, String> params = RedirectionUriService.getParams(uri);

            if ((uriWithoutParams.equals(redirectUriWithoutParams) && params.size() == 0 && RedirectionUriService.getParams(redirectUri).size() == 0) ||
                    uriWithoutParams.equals(redirectUriWithoutParams) && params.size() > 0 && RedirectionUriService.compareParams(redirectUri, uri)) {
                return redirectUri;
            }
        }
        return null;
    }

getPublicKey()

RSAPublicKey org.xdi.oxauth.uma.service.UmaValidationService.getPublicKey ( String  kid )

inlineprivate

                                                  {
        JSONWebKey key = webKeysConfiguration.getKey(kid);
        if (key != null) {
            switch (key.getKty()) {
                case RSA:
                    return new RSAPublicKey(
                            key.getN(),
                            key.getE());
            }
        }
        return null;
    }

isIdTokenValid()

boolean org.xdi.oxauth.uma.service.UmaValidationService.isIdTokenValid ( Jwt  idToken )

inline

                                               {
        try {
            final String issuer = idToken.getClaims().getClaimAsString(JwtClaimName.ISSUER);
            //final String nonceFromToken = idToken.getClaims().getClaimAsString(JwtClaimName.NONCE);
            //final String audienceFromToken = idToken.getClaims().getClaimAsString(JwtClaimName.AUDIENCE);

            final Date expiresAt = idToken.getClaims().getClaimAsDate(JwtClaimName.EXPIRATION_TIME);
            final Date now = new Date();
            if (now.after(expiresAt)) {
                log.error("ID Token is expired. (It is after " + now + ").");
                return false;
            }

            // 1. validate issuer
            if (!issuer.equals(appConfiguration.getIssuer())) {
                log.error("ID Token issuer is invalid. Token issuer: " + issuer + ", server issuer: " + appConfiguration.getIssuer());
                return false;
            }

            // 2. validate signature
            final String kid = idToken.getHeader().getClaimAsString(JwtHeaderName.KEY_ID);
            final String algorithm = idToken.getHeader().getClaimAsString(JwtHeaderName.ALGORITHM);
            RSAPublicKey publicKey = getPublicKey(kid);
            if (publicKey != null) {
                RSASigner rsaSigner = new RSASigner(SignatureAlgorithm.fromString(algorithm), publicKey);
                boolean signature = rsaSigner.validate(idToken);
                if (signature) {
                    log.debug("ID Token is successfully validated.");
                    return true;
                }
                log.error("ID Token signature is invalid.");
            } else {
                log.error("Failed to get RSA public key.");
            }
            return false;
        } catch (Exception e) {
            log.error("Failed to validate id_token. Message: " + e.getMessage(), e);
            return false;
        }
    }

validateAuthorization()

AuthorizationGrant org.xdi.oxauth.uma.service.UmaValidationService.validateAuthorization ( String  authorization, UmaScopeType  umaScopeType  )

inlineprivate

                                                                                                      {
        log.trace("Validate authorization: {}", authorization);
        if (StringHelper.isEmpty(authorization)) {
            errorResponseFactory.throwUmaWebApplicationException(UNAUTHORIZED, UNAUTHORIZED_CLIENT);
        }

        String token = tokenService.getTokenFromAuthorizationParameter(authorization);
        if (StringHelper.isEmpty(token)) {
            log.debug("Token is invalid");
            errorResponseFactory.throwUmaWebApplicationException(UNAUTHORIZED, UNAUTHORIZED_CLIENT);
        }

        AuthorizationGrant authorizationGrant = authorizationGrantList.getAuthorizationGrantByAccessToken(token);
        if (authorizationGrant == null) {
            errorResponseFactory.throwUmaWebApplicationException(UNAUTHORIZED, ACCESS_DENIED);
        }

        if (!authorizationGrant.isValid()) {
            errorResponseFactory.throwUmaWebApplicationException(UNAUTHORIZED, INVALID_TOKEN);
        }

        Set<String> scopes = authorizationGrant.getScopes();
        if (!scopes.contains(umaScopeType.getValue())) {
            errorResponseFactory.throwUmaWebApplicationException(Response.Status.NOT_ACCEPTABLE, INVALID_CLIENT_SCOPE);
        }
        return authorizationGrant;
    }

validateClaimToken()

Jwt org.xdi.oxauth.uma.service.UmaValidationService.validateClaimToken ( String  claimToken, String  claimTokenFormat  )

inline

                                                                              {
        if (StringUtils.isNotBlank(claimToken)) {
            if (!ClaimTokenFormatType.isValueValid(claimTokenFormat)) {
                log.error("claim_token_format is unsupported. Supported format is http://openid.net/specs/openid-connect-core-1_0.html#IDToken");
                errorResponseFactory.throwUmaWebApplicationException(BAD_REQUEST, INVALID_CLAIM_TOKEN_FORMAT);
            }

            try {
                final Jwt idToken = Jwt.parse(claimToken);
                if (idToken != null) {
                    if (ServerUtil.isTrue(appConfiguration.getUmaValidateClaimToken()) && !isIdTokenValid(idToken)) {
                        log.error("claim_token validation failed.");
                        errorResponseFactory.throwUmaWebApplicationException(BAD_REQUEST, INVALID_CLAIM_TOKEN);
                    }
                    return idToken;
                }
            } catch (Exception e) {
                log.error("Failed to parse claim_token as valid id_token.", e);
            }

            errorResponseFactory.throwUmaWebApplicationException(BAD_REQUEST, INVALID_CLAIM_TOKEN);
        } else if (StringUtils.isNotBlank(claimTokenFormat)) {
            log.error("claim_token is blank but claim_token_format is not blank. Both must be blank or both must be not blank");
            errorResponseFactory.throwUmaWebApplicationException(BAD_REQUEST, INVALID_CLAIM_TOKEN);
        }
        return null;
    }

validateClientAndClaimsRedirectUri()

Client org.xdi.oxauth.uma.service.UmaValidationService.validateClientAndClaimsRedirectUri ( String  clientId, String  claimsRedirectUri, String  state  )

inline

                                                                                                              {
        if (StringUtils.isBlank(clientId)) {
            log.error("Invalid clientId: {}", clientId);
            throw new UmaWebException(BAD_REQUEST, errorResponseFactory, UmaErrorResponseType.INVALID_CLIENT_ID);
        }
        Client client = clientService.getClient(clientId);
        if (client == null) {
            log.error("Failed to find client with client_id: {}", clientId);
            throw new UmaWebException(BAD_REQUEST, errorResponseFactory, UmaErrorResponseType.INVALID_CLIENT_ID);
        }

        if (StringUtils.isNotBlank(claimsRedirectUri)) {
            if (ArrayUtils.isEmpty(client.getClaimRedirectUris())) {
                log.error("Client does not have claims_redirect_uri specified, clientId: " + clientId);
                throw new UmaWebException(BAD_REQUEST, errorResponseFactory, UmaErrorResponseType.INVALID_CLAIMS_REDIRECT_URI);
            }

            String equalRedirectUri = getEqualRedirectUri(claimsRedirectUri, client.getClaimRedirectUris());
            if (equalRedirectUri != null) {
                log.trace("Found match for claims_redirect_uri : " + equalRedirectUri);
                return client;
            } else {
                log.trace("Failed to find match for claims_redirect_uri : " + claimsRedirectUri + ", client claimRedirectUris: " + Arrays.toString(client.getClaimRedirectUris()));
            }
        } else {
            log.trace("claims_redirect_uri is blank");
            if (client.getClaimRedirectUris() != null && client.getClaimRedirectUris().length == 1) {
                log.trace("claims_redirect_uri is blank and only one claims_redirect_uri is registered.");
                return client;
            }
        }

        if (StringUtils.isBlank(claimsRedirectUri)) {
            log.error("claims_redirect_uri is blank and there is none or more then one registered claims_redirect_uri for clientId: " + clientId);
            throw new UmaWebException(BAD_REQUEST, errorResponseFactory, UmaErrorResponseType.INVALID_CLAIMS_REDIRECT_URI);
        }

        throw new UmaWebException(claimsRedirectUri, errorResponseFactory, INVALID_CLAIMS_REDIRECT_URI, state);
    }

validateGrantType()

void org.xdi.oxauth.uma.service.UmaValidationService.validateGrantType ( String  grantType )

inline

                                                    {
        log.trace("Validate grantType: {}", grantType);

        if (!GrantType.OXAUTH_UMA_TICKET.getValue().equals(grantType)) {
            errorResponseFactory.throwUmaWebApplicationException(BAD_REQUEST, INVALID_RESOURCE_ID);
        }
    }

validatePct()

UmaPCT org.xdi.oxauth.uma.service.UmaValidationService.validatePct ( String  pctCode )

inline

                                              {
        if (StringUtils.isNotBlank(pctCode)) {
            UmaPCT pct = pctService.getByCode(pctCode);

            if (pct != null) {
                pct.checkExpired();
                if (pct.isValid()) {
                    log.trace("PCT is validated successfully, pct: " + pctCode);
                    return pct;
                } else {
                    log.error("PCT is not valid. Revoked: " + pct.isRevoked() + ", Expired: " + pct.isExpired() + ", pctCode: " + pctCode);
                }
            } else {
                log.error("Failed to find PCT with pctCode: " + pctCode);
            }

            errorResponseFactory.throwUmaWebApplicationException(UNAUTHORIZED, INVALID_PCT);
        }
        return null;
    }

validatePermission() [1/2]

void org.xdi.oxauth.uma.service.UmaValidationService.validatePermission ( UmaPermission  permission )

inline

                                                             {
        if (permission == null || "invalidated".equalsIgnoreCase(permission.getStatus())) {
            log.error("Permission is null or otherwise invalidated. Status: " + (permission != null ? permission.getStatus() : ""));
            errorResponseFactory.throwUmaWebApplicationException(BAD_REQUEST, INVALID_TICKET);
        }

        permission.checkExpired();
        if (!permission.isValid()) {
            log.error("Permission is not valid.");
            errorResponseFactory.throwUmaWebApplicationException(BAD_REQUEST, EXPIRED_TICKET);
        }
    }

validatePermission() [2/2]

void org.xdi.oxauth.uma.service.UmaValidationService.validatePermission ( org.xdi.oxauth.model.uma.UmaPermission  permission )

inline

                                                                                      {
        String resourceId = permission.getResourceId();
        if (StringHelper.isEmpty(resourceId)) {
            log.error("Resource id is empty");
            errorResponseFactory.throwUmaWebApplicationException(BAD_REQUEST, INVALID_RESOURCE_ID);
        }

        try {
            UmaResource resource = resourceService.getResourceById(resourceId);
            if (resource == null) {
                log.error("Resource isn't registered or there are two resources with same Id");
                errorResponseFactory.throwUmaWebApplicationException(BAD_REQUEST, INVALID_RESOURCE_ID);
                return;
            }

            final List<String> scopeUrls = umaScopeService.getScopeIdsByDns(resource.getScopes());
            if (!scopeUrls.containsAll(permission.getScopes())) {
                log.error("At least one of the scope isn't registered");
                errorResponseFactory.throwUmaWebApplicationException(BAD_REQUEST, INVALID_RESOURCE_SCOPE);
            } else {
                return;
            }
        } catch (EntryPersistenceException ex) {
            log.error(ex.getMessage(), ex);
        }

        log.error("Resource isn't registered");
        errorResponseFactory.throwUmaWebApplicationException(BAD_REQUEST, INVALID_RESOURCE_ID);
    }

validatePermissions() [1/2]

void org.xdi.oxauth.uma.service.UmaValidationService.validatePermissions ( List< UmaPermission >  permissions )

inline

                                                                     {
        for (UmaPermission permission : permissions) {
            validatePermission(permission);
        }
    }

validatePermissions() [2/2]

void org.xdi.oxauth.uma.service.UmaValidationService.validatePermissions ( UmaPermissionList  permissions )

inline

                                                                   {
        for (org.xdi.oxauth.model.uma.UmaPermission permission : permissions) {
            validatePermission(permission);
        }
    }

validateResource()

void org.xdi.oxauth.uma.service.UmaValidationService.validateResource ( org.xdi.oxauth.model.uma.UmaResource  resource )

inline

                                                                                {
        validateScopeExpression(resource.getScopeExpression());

        List<String> scopeDNs = umaScopeService.getScopeDNsByIdsAndAddToLdapIfNeeded(resource.getScopes());
        if (scopeDNs.isEmpty() && StringUtils.isBlank(resource.getScopeExpression()) ) {
            log.error("Invalid resource. Both `scope` and `scope_expression` are blank.");
            throw new UmaWebException(BAD_REQUEST, errorResponseFactory, UmaErrorResponseType.INVALID_RESOURCE_SCOPE);
        }
    }

validateRestrictedByClient()

void org.xdi.oxauth.uma.service.UmaValidationService.validateRestrictedByClient ( String  patClientDn, String  rsId  )

inline

                                                                            {
        if (ServerUtil.isTrue(appConfiguration.getUmaRestrictResourceToAssociatedClient())) {
            final List<String> clients = resourceService.getResourceById(rsId).getClients();
            if (!clients.contains(patClientDn)) {
                log.error("Access to resource is denied because resource associated client does not match PAT client (it can be switched off if set umaRestrictResourceToAssociatedClient oxauth configuration property to false). Associated clients: " + clients + ", PAT client: " + patClientDn);
                throw new UmaWebException(Response.Status.FORBIDDEN, errorResponseFactory, ACCESS_DENIED);
            }
        }
    }

validateRPT()

UmaRPT org.xdi.oxauth.uma.service.UmaValidationService.validateRPT ( String  rptCode )

inline

                                              {
        if (StringUtils.isNotBlank(rptCode)) {
            UmaRPT rpt = rptService.getRPTByCode(rptCode);
            if (rpt != null) {
                rpt.checkExpired();
                if (rpt.isValid()) {
                    return rpt;
                } else {
                    log.error("RPT is not valid. Revoked: " + rpt.isRevoked() + ", Expired: " + rpt.isExpired() + ", rptCode: " + rptCode);
                }
            } else {
                log.error("RPT is null, rptCode: " + rptCode);
            }

            errorResponseFactory.throwUmaWebApplicationException(BAD_REQUEST, INVALID_RPT);
        }
        return null;
    }

validateScopeExpression()

void org.xdi.oxauth.uma.service.UmaValidationService.validateScopeExpression ( String  scopeExpression )

inline

                                                                {
        if (StringUtils.isNotBlank(scopeExpression) && !expressionService.isExpressionValid(scopeExpression)) {
            log.error("Scope expression is invalid. Expression: " + scopeExpression);
            throw new UmaWebException(BAD_REQUEST, errorResponseFactory, UmaErrorResponseType.INVALID_RESOURCE_SCOPE);
        }
    }

validateScopes()

Map<UmaScopeDescription, Boolean> org.xdi.oxauth.uma.service.UmaValidationService.validateScopes ( String  scope, List< UmaPermission >  permissions  )

inline

引数

scope	scope string from token request
permissions	permissions

戻り値

map of loaded scope and boolean, true - if client requested scope and false if it is permission ticket scope

                                                                                                           {
        scope = ServerUtil.urlDecode(scope);
        final String[] scopesRequested = StringUtils.isNotBlank(scope) ? scope.split(" ") : new String[0];

        final Map<UmaScopeDescription, Boolean> result = new HashMap<UmaScopeDescription, Boolean>();

        if (ArrayUtils.isNotEmpty(scopesRequested)) {
            for (UmaScopeDescription s : umaScopeService.getScopesByIds(Arrays.asList(scopesRequested))) {
                result.put(s, true);
            }
        }
        for (UmaPermission permission : permissions) {
            for (UmaScopeDescription s : umaScopeService.getScopesByDns(permission.getScopeDns())) {
                result.put(s, false);
            }
        }
        if (result.isEmpty()) {
            log.error("There are no any scopes requested in give request.");
            throw new UmaWebException(BAD_REQUEST, errorResponseFactory, UmaErrorResponseType.INVALID_RESOURCE_SCOPE);
        }
        log.trace("CandidateGrantedScopes: " + Joiner.on(", ").join(Iterables.transform(result.keySet(), new Function<UmaScopeDescription, String>() {
            @Override
            public String apply(UmaScopeDescription umaScopeDescription) {
                return umaScopeDescription.getId();
            }
        })));
        return result;
    }

validatesGatheringScriptNames()

String [] org.xdi.oxauth.uma.service.UmaValidationService.validatesGatheringScriptNames ( String  scriptNamesAsString, String  claimsRedirectUri, String  state  )

inline

                                                                                                                      {
        if (StringUtils.isNotBlank(scriptNamesAsString)) {
            final String[] scriptNames = scriptNamesAsString.split(" ");
            if (ArrayUtils.isNotEmpty(scriptNames)) {
                return scriptNames;
            }
        }
        throw new UmaWebException(claimsRedirectUri, errorResponseFactory, INVALID_CLAIMS_GATHERING_SCRIPT_NAME, state);
    }

validateTicket()

List<UmaPermission> org.xdi.oxauth.uma.service.UmaValidationService.validateTicket ( String  ticket )

inline

                                                             {
        if (StringUtils.isBlank(ticket)) {
            log.error("Ticket is null or blank.");
            errorResponseFactory.throwUmaWebApplicationException(BAD_REQUEST, INVALID_TICKET);
        }

        List<UmaPermission> permissions = permissionService.getPermissionsByTicket(ticket);
        if (permissions == null || permissions.isEmpty()) {
            log.error("Unable to find permissions registered for given ticket:" + ticket);
            errorResponseFactory.throwUmaWebApplicationException(BAD_REQUEST, INVALID_TICKET);
        }
        return permissions;
    }

validateTicketWithRedirect()

List<UmaPermission> org.xdi.oxauth.uma.service.UmaValidationService.validateTicketWithRedirect ( String  ticket, String  claimsRedirectUri, String  state  )

inline

                                                                                                                 {
        if (StringUtils.isBlank(ticket)) {
            log.error("Ticket is null or blank.");
            throw new UmaWebException(claimsRedirectUri, errorResponseFactory, INVALID_TICKET, state);
        }

        List<UmaPermission> permissions = permissionService.getPermissionsByTicket(ticket);
        if (permissions == null || permissions.isEmpty()) {
            log.error("Unable to find permissions registered for given ticket:" + ticket);
            throw new UmaWebException(claimsRedirectUri, errorResponseFactory, INVALID_TICKET, state);
        }
        return permissions;
    }

メンバ詳解

appConfiguration

AppConfiguration org.xdi.oxauth.uma.service.UmaValidationService.appConfiguration

private

authorizationGrantList

AuthorizationGrantList org.xdi.oxauth.uma.service.UmaValidationService.authorizationGrantList

private

clientService

ClientService org.xdi.oxauth.uma.service.UmaValidationService.clientService

private

errorResponseFactory

ErrorResponseFactory org.xdi.oxauth.uma.service.UmaValidationService.errorResponseFactory

private

expressionService

UmaExpressionService org.xdi.oxauth.uma.service.UmaValidationService.expressionService

private

log

Logger org.xdi.oxauth.uma.service.UmaValidationService.log

private

pctService

UmaPctService org.xdi.oxauth.uma.service.UmaValidationService.pctService

private

permissionService

UmaPermissionService org.xdi.oxauth.uma.service.UmaValidationService.permissionService

private

resourceService

UmaResourceService org.xdi.oxauth.uma.service.UmaValidationService.resourceService

private

rptService

UmaRptService org.xdi.oxauth.uma.service.UmaValidationService.rptService

private

tokenService

TokenService org.xdi.oxauth.uma.service.UmaValidationService.tokenService

private

umaScopeService

UmaScopeService org.xdi.oxauth.uma.service.UmaValidationService.umaScopeService

private

webKeysConfiguration

WebKeysConfiguration org.xdi.oxauth.uma.service.UmaValidationService.webKeysConfiguration

private

---

このクラス詳解は次のファイルから抽出されました:

• D:/AppData/OpenId/gluu/src/oxAuth/Server/src/main/java/org/xdi/oxauth/uma/service/UmaValidationService.java