gluu
公開メンバ関数 | 非公開メンバ関数 | 非公開変数類 | 全メンバ一覧
org.xdi.oxauth.token.ws.rs.TokenRestWebServiceImpl クラス
org.xdi.oxauth.token.ws.rs.TokenRestWebServiceImpl の継承関係図
Inheritance graph
org.xdi.oxauth.token.ws.rs.TokenRestWebServiceImpl 連携図
Collaboration graph

公開メンバ関数

Response requestAccessToken (String grantType, String code, String redirectUri, String username, String password, String scope, String assertion, String refreshToken, String clientId, String clientSecret, String codeVerifier, String ticket, String claimToken, String claimTokenFormat, String pctCode, String rptCode, HttpServletRequest request, SecurityContext sec)
 
String getJSonResponse (AccessToken accessToken, TokenType tokenType, Integer expiresIn, RefreshToken refreshToken, String scope, IdToken idToken)
 
Response requestAccessToken ( @FormParam("grant_type") @ApiParam(value="Grant type value, one of these: authorization_code, implicit, password, client_credentials, refresh_token as described in OAuth 2.0 [RFC6749]", required=true) String grantType, @FormParam("code") @ApiParam(value="Code which is returned by authorization endpoint. (For grant_type=authorization_code)", required=false) String code, @FormParam("redirect_uri") @ApiParam(value="Redirection URI to which the response will be sent. This URI MUST exactly match one of the Redirection URI values for the Client pre-registered at the OpenID Provider", required=false) String redirectUri, @FormParam("username") @ApiParam(value="End-User username.", required=false) String username, @FormParam("password") @ApiParam(value="End-User password.", required=false) String password, @FormParam("scope") @ApiParam(value="OpenID Connect requests MUST contain the openid scope value. If the openid scope value is not present, the behavior is entirely unspecified. Other scope values MAY be present. Scope values used that are not understood by an implementation SHOULD be ignored.", required=false) String scope, @FormParam("assertion") @ApiParam(value="Assertion", required=false) String assertion, @FormParam("refresh_token") @ApiParam(value="Refresh token", required=false) String refreshToken, @FormParam("client_id") @ApiParam(value="OAuth 2.0 Client Identifier valid at the Authorization Server.", required=false) String clientId, @FormParam("client_secret") @ApiParam(value="The client secret. The client MAY omit the parameter if the client secret is an empty string.", required=false) String clientSecret, @FormParam("code_verifier") @ApiParam(value="The client's PKCE code verifier.", required=false) String codeVerifier, @FormParam("ticket") String ticket, @FormParam("claim_token") String claimToken, @FormParam("claim_token_format") String claimTokenFormat, @FormParam("pct") String pctCode, @FormParam("rpt") String rptCode, @Context HttpServletRequest request, @Context SecurityContext sec)
 

非公開メンバ関数

void validatePKCE (AuthorizationCodeGrant grant, String codeVerifier, OAuth2AuditLog oAuth2AuditLog)
 
Response response (ResponseBuilder builder, OAuth2AuditLog oAuth2AuditLog)
 
ResponseBuilder error (int p_status, TokenErrorResponseType p_type)
 

非公開変数類

Logger log
 
Identity identity
 
ApplicationAuditLogger applicationAuditLogger
 
ErrorResponseFactory errorResponseFactory
 
AuthorizationGrantList authorizationGrantList
 
UserService userService
 
GrantService grantService
 
AuthenticationFilterService authenticationFilterService
 
AuthenticationService authenticationService
 
AppConfiguration appConfiguration
 
UmaTokenService umaTokenService
 

詳解

Provides interface for token REST web services

著者
Yuriy Zabrovarnyy
Javier Rojas Blum
バージョン
September 3, 2018

関数詳解

◆ error()

ResponseBuilder org.xdi.oxauth.token.ws.rs.TokenRestWebServiceImpl.error ( int  p_status,
TokenErrorResponseType  p_type 
)
inlineprivate
375  {
376  return Response.status(p_status).entity(errorResponseFactory.getErrorAsJson(p_type));
377  }
org.xdi.oxauth.model.error.ErrorResponseFactory.getErrorAsJson
String getErrorAsJson(IErrorType p_type)
Definition: ErrorResponseFactory.java:86
org.xdi.oxauth.token.ws.rs.TokenRestWebServiceImpl.errorResponseFactory
ErrorResponseFactory errorResponseFactory
Definition: TokenRestWebServiceImpl.java:71

◆ getJSonResponse()

String org.xdi.oxauth.token.ws.rs.TokenRestWebServiceImpl.getJSonResponse ( AccessToken  accessToken,
TokenType  tokenType,
Integer  expiresIn,
RefreshToken  refreshToken,
String  scope,
IdToken  idToken 
)
inline

Builds a JSon String with the structure for token issues.

384  {
385  JSONObject jsonObj = new JSONObject();
386  try {
387  jsonObj.put("access_token", accessToken.getCode()); // Required
388  jsonObj.put("token_type", tokenType.toString()); // Required
389  if (expiresIn != null) { // Optional
390  jsonObj.put("expires_in", expiresIn);
391  }
392  if (refreshToken != null) { // Optional
393  jsonObj.put("refresh_token", refreshToken.getCode());
394  }
395  if (scope != null) { // Optional
396  jsonObj.put("scope", scope);
397  }
398  if (idToken != null) {
399  jsonObj.put("id_token", idToken.getCode());
400  }
401  } catch (JSONException e) {
402  log.error(e.getMessage(), e);
403  }
404 
405  return jsonObj.toString();
406  }
org.xdi.oxauth.model.common.TokenType.toString
String toString()
Definition: TokenType.java:56
org.xdi.oxauth.model.common.AbstractToken.getCode
String getCode()
Definition: AbstractToken.java:112
org.xdi.oxauth.token.ws.rs.TokenRestWebServiceImpl.log
Logger log
Definition: TokenRestWebServiceImpl.java:62

◆ requestAccessToken() [1/2]

Response org.xdi.oxauth.token.ws.rs.TokenRestWebService.requestAccessToken ( @FormParam("grant_type") @ApiParam(value="Grant type value, one of these: authorization_code, implicit, password, client_credentials, refresh_token as described in OAuth 2.0 [RFC6749]", required=true) String  grantType,
@FormParam("code") @ApiParam(value="Code which is returned by authorization endpoint. (For grant_type=authorization_code)", required=false) String  code,
@FormParam("redirect_uri") @ApiParam(value="Redirection URI to which the response will be sent. This URI MUST exactly match one of the Redirection URI values for the Client pre-registered at the OpenID Provider", required=false) String  redirectUri,
@FormParam("username") @ApiParam(value="End-User username.", required=false) String  username,
@FormParam("password") @ApiParam(value="End-User password.", required=false) String  password,
@FormParam("scope") @ApiParam(value="OpenID Connect requests MUST contain the openid scope value. If the openid scope value is not present, the behavior is entirely unspecified. Other scope values MAY be present. Scope values used that are not understood by an implementation SHOULD be ignored.", required=false) String  scope,
@FormParam("assertion") @ApiParam(value="Assertion", required=false) String  assertion,
@FormParam("refresh_token") @ApiParam(value="Refresh token", required=false) String  refreshToken,
@FormParam("client_id") @ApiParam(value="OAuth 2.0 Client Identifier valid at the Authorization Server.", required=false) String  clientId,
@FormParam("client_secret") @ApiParam(value="The client secret. The client MAY omit the parameter if the client secret is an empty string.", required=false) String  clientSecret,
@FormParam("code_verifier") @ApiParam(value="The client's PKCE code verifier.", required=false) String  codeVerifier,
@FormParam("ticket") String  ticket,
@FormParam("claim_token") String  claimToken,
@FormParam("claim_token_format") String  claimTokenFormat,
@FormParam("pct") String  pctCode,
@FormParam("rpt") String  rptCode,
@Context HttpServletRequest  request,
@Context SecurityContext  sec 
)
inherited

◆ requestAccessToken() [2/2]

Response org.xdi.oxauth.token.ws.rs.TokenRestWebServiceImpl.requestAccessToken ( String  grantType,
String  code,
String  redirectUri,
String  username,
String  password,
String  scope,
String  assertion,
String  refreshToken,
String  clientId,
String  clientSecret,
String  codeVerifier,
String  ticket,
String  claimToken,
String  claimTokenFormat,
String  pctCode,
String  rptCode,
HttpServletRequest  request,
SecurityContext  sec 
)
inline
100  {
101  log.debug(
102  "Attempting to request access token: grantType = {}, code = {}, redirectUri = {}, username = {}, refreshToken = {}, " +
103  "clientId = {}, ExtraParams = {}, isSecure = {}, codeVerifier = {}, ticket = {}",
104  grantType, code, redirectUri, username, refreshToken, clientId, request.getParameterMap(),
105  sec.isSecure(), codeVerifier, ticket);
106 
107  boolean isUma = StringUtils.isNotBlank(ticket);
108  if (isUma) {
109  return umaTokenService.requestRpt(grantType, ticket, claimToken, claimTokenFormat, pctCode, rptCode, scope, request);
110  }
111 
112  OAuth2AuditLog oAuth2AuditLog = new OAuth2AuditLog(ServerUtil.getIpAddress(request), Action.TOKEN_REQUEST);
113  oAuth2AuditLog.setClientId(clientId);
114  oAuth2AuditLog.setUsername(username);
115  oAuth2AuditLog.setScope(scope);
116 
117  String tokenBindingHeader = request.getHeader("Sec-Token-Binding");
118 
119  scope = ServerUtil.urlDecode(scope); // it may be encoded in uma case
120  ResponseBuilder builder = Response.ok();
121 
122  try {
123  log.debug("Starting to validate request parameters");
124  if (!TokenParamsValidator.validateParams(grantType, code, redirectUri, username, password,
125  scope, assertion, refreshToken)) {
126  log.trace("Failed to validate request parameters");
127  builder = error(400, TokenErrorResponseType.INVALID_REQUEST);
128  } else {
129  log.trace("Request parameters are right");
130  GrantType gt = GrantType.fromString(grantType);
131  log.debug("Grant type: '{}'", gt);
132 
133  SessionClient sessionClient = identity.getSessionClient();
134  Client client = null;
135  if (sessionClient != null) {
136  client = sessionClient.getClient();
137  log.debug("Get sessionClient: '{}'", sessionClient);
138  }
139 
140  if (client != null) {
141  log.debug("Get client from session: '{}'", client.getClientId());
142  if (client.isDisabled()) {
143  return response(error(Response.Status.FORBIDDEN.getStatusCode(), TokenErrorResponseType.DISABLED_CLIENT), oAuth2AuditLog);
144  }
145  } else {
146  return response(error(401, TokenErrorResponseType.INVALID_GRANT), oAuth2AuditLog);
147  }
148 
149  final Function<JsonWebResponse, Void> idTokenTokingBindingPreprocessing = TokenBindingMessage.createIdTokenTokingBindingPreprocessing(
150  tokenBindingHeader, client.getIdTokenTokenBindingCnf()); // for all except authorization code grant
151 
152  if (gt == GrantType.AUTHORIZATION_CODE) {
153  if (!TokenParamsValidator.validateGrantType(gt, client.getGrantTypes(), appConfiguration.getGrantTypesSupported())) {
154  return response(error(400, TokenErrorResponseType.INVALID_GRANT), oAuth2AuditLog);
155  }
156 
157  log.debug("Attempting to find authorizationCodeGrant by clinetId: '{}', code: '{}'", client.getClientId(), code);
158  final AuthorizationCodeGrant authorizationCodeGrant = authorizationGrantList.getAuthorizationCodeGrant(client.getClientId(), code);
159  log.trace("AuthorizationCodeGrant : '{}'", authorizationCodeGrant);
160 
161  if (authorizationCodeGrant != null) {
162  validatePKCE(authorizationCodeGrant, codeVerifier, oAuth2AuditLog);
163 
164  authorizationCodeGrant.setIsCachedWithNoPersistence(false);
165  authorizationCodeGrant.save();
166 
167  AccessToken accToken = authorizationCodeGrant.createAccessToken();
168  log.debug("Issuing access token: {}", accToken.getCode());
169 
170  RefreshToken reToken = null;
171  if (client.getGrantTypes() != null
172  && client.getGrantTypes().length > 0
173  && Arrays.asList(client.getGrantTypes()).contains(GrantType.REFRESH_TOKEN)) {
174  reToken = authorizationCodeGrant.createRefreshToken();
175  }
176 
177  if (scope != null && !scope.isEmpty()) {
178  scope = authorizationCodeGrant.checkScopesPolicy(scope);
179  }
180 
181  IdToken idToken = null;
182  if (authorizationCodeGrant.getScopes().contains("openid")) {
183  String nonce = authorizationCodeGrant.getNonce();
184  boolean includeIdTokenClaims = Boolean.TRUE.equals(
185  appConfiguration.getLegacyIdTokenClaims());
186  final String idTokenTokenBindingCnf = client.getIdTokenTokenBindingCnf();
187  Function<JsonWebResponse, Void> authorizationCodePreProcessing = new Function<JsonWebResponse, Void>() {
188  @Override
189  public Void apply(JsonWebResponse jsonWebResponse) {
190  if (StringUtils.isNotBlank(idTokenTokenBindingCnf) && StringUtils.isNotBlank(authorizationCodeGrant.getTokenBindingHash())) {
191  TokenBindingMessage.setCnfClaim(jsonWebResponse, authorizationCodeGrant.getTokenBindingHash(), idTokenTokenBindingCnf);
192  }
193  return null;
194  }
195  };
196  idToken = authorizationCodeGrant.createIdToken(
197  nonce, null, accToken, authorizationCodeGrant, includeIdTokenClaims, authorizationCodePreProcessing);
198  }
199 
200  builder.entity(getJSonResponse(accToken,
201  accToken.getTokenType(),
202  accToken.getExpiresIn(),
203  reToken,
204  scope,
205  idToken));
206 
207  oAuth2AuditLog.updateOAuth2AuditLog(authorizationCodeGrant, true);
208 
209  grantService.removeByCode(authorizationCodeGrant.getAuthorizationCode().getCode(), authorizationCodeGrant.getClientId());
210  } else {
211  log.debug("AuthorizationCodeGrant is empty by clinetId: '{}', code: '{}'", client.getClientId(), code);
212  // if authorization code is not found then code was already used = remove all grants with this auth code
213  grantService.removeAllByAuthorizationCode(code);
214  builder = error(400, TokenErrorResponseType.INVALID_GRANT);
215  }
216  } else if (gt == GrantType.REFRESH_TOKEN) {
217  if (!TokenParamsValidator.validateGrantType(gt, client.getGrantTypes(), appConfiguration.getGrantTypesSupported())) {
218  return response(error(400, TokenErrorResponseType.INVALID_GRANT), oAuth2AuditLog);
219  }
220 
221  AuthorizationGrant authorizationGrant = authorizationGrantList.getAuthorizationGrantByRefreshToken(client.getClientId(), refreshToken);
222 
223  if (authorizationGrant != null) {
224  AccessToken accToken = authorizationGrant.createAccessToken();
225 
226  /*
227  The authorization server MAY issue a new refresh token, in which case
228  the client MUST discard the old refresh token and replace it with the
229  new refresh token.
230  */
231  RefreshToken reToken = authorizationGrant.createRefreshToken();
232  grantService.removeByCode(refreshToken, client.getClientId());
233 
234  if (scope != null && !scope.isEmpty()) {
235  scope = authorizationGrant.checkScopesPolicy(scope);
236  }
237 
238  builder.entity(getJSonResponse(accToken,
239  accToken.getTokenType(),
240  accToken.getExpiresIn(),
241  reToken,
242  scope,
243  null));
244  oAuth2AuditLog.updateOAuth2AuditLog(authorizationGrant, true);
245  } else {
246  builder = error(401, TokenErrorResponseType.INVALID_GRANT);
247  }
248  } else if (gt == GrantType.CLIENT_CREDENTIALS) {
249  if (!TokenParamsValidator.validateGrantType(gt, client.getGrantTypes(), appConfiguration.getGrantTypesSupported())) {
250  return response(error(400, TokenErrorResponseType.INVALID_GRANT), oAuth2AuditLog);
251  }
252 
253  ClientCredentialsGrant clientCredentialsGrant = authorizationGrantList.createClientCredentialsGrant(new User(), client); // TODO: fix the user arg
254 
255  AccessToken accessToken = clientCredentialsGrant.createAccessToken();
256 
257  if (scope != null && !scope.isEmpty()) {
258  scope = clientCredentialsGrant.checkScopesPolicy(scope);
259  }
260 
261  IdToken idToken = null;
262  if (appConfiguration.getOpenidScopeBackwardCompatibility() && clientCredentialsGrant.getScopes().contains("openid")) {
263  boolean includeIdTokenClaims = Boolean.TRUE.equals(
264  appConfiguration.getLegacyIdTokenClaims());
265  idToken = clientCredentialsGrant.createIdToken(
266  null, null, null, clientCredentialsGrant, includeIdTokenClaims, idTokenTokingBindingPreprocessing);
267  }
268 
269  oAuth2AuditLog.updateOAuth2AuditLog(clientCredentialsGrant, true);
270  builder.entity(getJSonResponse(accessToken,
271  accessToken.getTokenType(),
272  accessToken.getExpiresIn(),
273  null,
274  scope,
275  idToken));
276  } else if (gt == GrantType.RESOURCE_OWNER_PASSWORD_CREDENTIALS) {
277  if (!TokenParamsValidator.validateGrantType(gt, client.getGrantTypes(), appConfiguration.getGrantTypesSupported())) {
278  return response(error(400, TokenErrorResponseType.INVALID_GRANT), oAuth2AuditLog);
279  }
280 
281  User user = null;
282  if (authenticationFilterService.isEnabled()) {
283  String userDn = authenticationFilterService.processAuthenticationFilters(request.getParameterMap());
284  if (StringHelper.isNotEmpty(userDn)) {
285  user = userService.getUserByDn(userDn);
286  }
287  }
288 
289  if (user == null) {
290  boolean authenticated = authenticationService.authenticate(username, password);
291  if (authenticated) {
292  user = authenticationService.getAuthenticatedUser();
293  }
294  }
295 
296  if (user != null) {
297  ResourceOwnerPasswordCredentialsGrant resourceOwnerPasswordCredentialsGrant = authorizationGrantList.createResourceOwnerPasswordCredentialsGrant(user, client);
298  AccessToken accessToken = resourceOwnerPasswordCredentialsGrant.createAccessToken();
299  RefreshToken reToken = resourceOwnerPasswordCredentialsGrant.createRefreshToken();
300 
301  if (scope != null && !scope.isEmpty()) {
302  scope = resourceOwnerPasswordCredentialsGrant.checkScopesPolicy(scope);
303  }
304 
305  IdToken idToken = null;
306  if (appConfiguration.getOpenidScopeBackwardCompatibility() && resourceOwnerPasswordCredentialsGrant.getScopes().contains("openid")) {
307  boolean includeIdTokenClaims = Boolean.TRUE.equals(
308  appConfiguration.getLegacyIdTokenClaims());
309  idToken = resourceOwnerPasswordCredentialsGrant.createIdToken(
310  null, null, null, resourceOwnerPasswordCredentialsGrant, includeIdTokenClaims, idTokenTokingBindingPreprocessing);
311  }
312 
313  oAuth2AuditLog.updateOAuth2AuditLog(resourceOwnerPasswordCredentialsGrant, true);
314  builder.entity(getJSonResponse(accessToken,
315  accessToken.getTokenType(),
316  accessToken.getExpiresIn(),
317  reToken,
318  scope,
319  idToken));
320  } else {
321  log.error("Invalid user", new RuntimeException("User is empty"));
322  builder = error(401, TokenErrorResponseType.INVALID_CLIENT);
323  }
324  }
325  }
326  } catch (WebApplicationException e) {
327  throw e;
328  } catch (SignatureException e) {
329  builder = Response.status(500);
330  log.error(e.getMessage(), e);
331  } catch (StringEncrypter.EncryptionException e) {
332  builder = Response.status(500);
333  log.error(e.getMessage(), e);
334  } catch (InvalidJwtException e) {
335  builder = Response.status(500);
336  log.error(e.getMessage(), e);
337  } catch (InvalidJweException e) {
338  builder = Response.status(500);
339  log.error(e.getMessage(), e);
340  } catch (Exception e) {
341  builder = Response.status(500);
342  log.error(e.getMessage(), e);
343  }
344 
345  return response(builder, oAuth2AuditLog);
346  }
org.xdi.oxauth.token.ws.rs.TokenRestWebServiceImpl.authorizationGrantList
AuthorizationGrantList authorizationGrantList
Definition: TokenRestWebServiceImpl.java:74
org.xdi.oxauth.model.common.GrantType.fromString
static GrantType fromString(String param)
Definition: GrantType.java:121
org.xdi.oxauth.model.common.AbstractAuthorizationGrant.getAuthorizationCode
AuthorizationCode getAuthorizationCode()
Definition: AbstractAuthorizationGrant.java:105
org.xdi.oxauth.model.common.AbstractAuthorizationGrant.getNonce
String getNonce()
Definition: AbstractAuthorizationGrant.java:128
org.xdi.oxauth.service.GrantService.removeByCode
void removeByCode(String p_code, String p_clientId)
Definition: GrantService.java:362
org.xdi.oxauth.security.Identity.getSessionClient
SessionClient getSessionClient()
Definition: Identity.java:50
org.xdi.oxauth.model.common.RefreshToken
Definition: RefreshToken.java:45
org.xdi.oxauth.model.configuration.AppConfiguration.getOpenidScopeBackwardCompatibility
Boolean getOpenidScopeBackwardCompatibility()
Definition: AppConfiguration.java:1393
org.xdi.oxauth.model.common.AuthorizationGrant.createAccessToken
AccessToken createAccessToken()
Definition: AuthorizationGrant.java:158
org.xdi.oxauth.model.registration.Client.getClientId
String getClientId()
Definition: Client.java:275
org.xdi.oxauth.model.common.AuthorizationGrant.save
void save()
Definition: AuthorizationGrant.java:103
org.xdi.oxauth.model.common.AbstractAuthorizationGrant.getTokenBindingHash
String getTokenBindingHash()
Definition: AbstractAuthorizationGrant.java:119
org.xdi.oxauth.model.registration.Client.getGrantTypes
GrantType [] getGrantTypes()
Definition: Client.java:456
org.xdi.oxauth.token.ws.rs.TokenRestWebServiceImpl.validatePKCE
void validatePKCE(AuthorizationCodeGrant grant, String codeVerifier, OAuth2AuditLog oAuth2AuditLog)
Definition: TokenRestWebServiceImpl.java:348
org.xdi.oxauth.model.common.GrantType
Definition: GrantType.java:23
org.xdi.oxauth.util.ServerUtil.getIpAddress
static String getIpAddress(HttpServletRequest httpRequest)
Definition: ServerUtil.java:188
org.xdi.oxauth.token.ws.rs.TokenRestWebServiceImpl.error
ResponseBuilder error(int p_status, TokenErrorResponseType p_type)
Definition: TokenRestWebServiceImpl.java:375
org.xdi.oxauth.model.common.AbstractToken.getExpiresIn
int getExpiresIn()
Definition: AbstractToken.java:230
org.xdi.oxauth.model.common.AuthorizationGrant.checkScopesPolicy
String checkScopesPolicy(String scope)
Definition: AuthorizationGrant.java:96
org.xdi.oxauth.token.ws.rs.TokenRestWebServiceImpl.umaTokenService
UmaTokenService umaTokenService
Definition: TokenRestWebServiceImpl.java:92
org.xdi.oxauth.service.GrantService.removeAllByAuthorizationCode
void removeAllByAuthorizationCode(String p_authorizationCode)
Definition: GrantService.java:370
org.xdi.oxauth.model.common.GrantType.REFRESH_TOKEN
REFRESH_TOKEN
Definition: GrantType.java:70
org.xdi.oxauth.model.common.AuthorizationGrantList.getAuthorizationGrantByRefreshToken
AuthorizationGrant getAuthorizationGrantByRefreshToken(String clientId, String refreshTokenCode)
Definition: AuthorizationGrantList.java:131
org.xdi.oxauth.model.registration.Client.getIdTokenTokenBindingCnf
String getIdTokenTokenBindingCnf()
Definition: Client.java:534
org.xdi.oxauth.model.configuration.AppConfiguration.getLegacyIdTokenClaims
Boolean getLegacyIdTokenClaims()
Definition: AppConfiguration.java:1265
org.xdi.oxauth.model.registration.Client.isDisabled
boolean isDisabled()
Definition: Client.java:1114
org.xdi.oxauth.model.common.GrantType.AUTHORIZATION_CODE
AUTHORIZATION_CODE
Definition: GrantType.java:33
org.xdi.oxauth.token.ws.rs.TokenRestWebServiceImpl.response
Response response(ResponseBuilder builder, OAuth2AuditLog oAuth2AuditLog)
Definition: TokenRestWebServiceImpl.java:363
org.xdi.oxauth.service.BaseAuthFilterService.processAuthenticationFilters
String processAuthenticationFilters(Map<?, ?> attributeValues)
Definition: BaseAuthFilterService.java:234
org.xdi.oxauth.model.common.AuthorizationGrant
Definition: AuthorizationGrant.java:49
org.xdi.oxauth.model.configuration.AppConfiguration.getGrantTypesSupported
Set< GrantType > getGrantTypesSupported()
Definition: AppConfiguration.java:549
org.xdi.oxauth.token.ws.rs.TokenRestWebServiceImpl.userService
UserService userService
Definition: TokenRestWebServiceImpl.java:77
org.xdi.oxauth.service.AuthenticationService.getAuthenticatedUser
User getAuthenticatedUser()
Definition: AuthenticationService.java:487
org.xdi.oxauth.model.common.AuthorizationGrantList.createClientCredentialsGrant
ClientCredentialsGrant createClientCredentialsGrant(User user, Client client)
Definition: AuthorizationGrantList.java:104
org.xdi.oxauth.model.common.AbstractToken.getCode
String getCode()
Definition: AbstractToken.java:112
org.xdi.oxauth.token.ws.rs.TokenRestWebServiceImpl.getJSonResponse
String getJSonResponse(AccessToken accessToken, TokenType tokenType, Integer expiresIn, RefreshToken refreshToken, String scope, IdToken idToken)
Definition: TokenRestWebServiceImpl.java:382
org.xdi.oxauth.service.BaseAuthFilterService.isEnabled
boolean isEnabled()
Definition: BaseAuthFilterService.java:259
org.xdi.oxauth.model.common.GrantType.CLIENT_CREDENTIALS
CLIENT_CREDENTIALS
Definition: GrantType.java:64
org.xdi.oxauth.model.common.GrantType.RESOURCE_OWNER_PASSWORD_CREDENTIALS
RESOURCE_OWNER_PASSWORD_CREDENTIALS
Definition: GrantType.java:52
org.xdi.oxauth.token.ws.rs.TokenRestWebServiceImpl.identity
Identity identity
Definition: TokenRestWebServiceImpl.java:65
org.xdi.oxauth.uma.service.UmaTokenService.requestRpt
Response requestRpt(String grantType, String ticket, String claimToken, String claimTokenFormat, String pctCode, String rptCode, String scope, HttpServletRequest httpRequest)
Definition: UmaTokenService.java:80
org.xdi.oxauth.model.common.AccessToken
Definition: AccessToken.java:35
org.xdi.oxauth.util.ServerUtil
Definition: ServerUtil.java:50
org.xdi.oxauth.model.common.AuthorizationGrantList.createResourceOwnerPasswordCredentialsGrant
ResourceOwnerPasswordCredentialsGrant createResourceOwnerPasswordCredentialsGrant(User user, Client client)
Definition: AuthorizationGrantList.java:112
org.xdi.oxauth.model.common.AuthorizationGrantList.getAuthorizationCodeGrant
AuthorizationCodeGrant getAuthorizationCodeGrant(String clientId, String authorizationCode)
Definition: AuthorizationGrantList.java:120
org.xdi.oxauth.token.ws.rs.TokenRestWebServiceImpl.log
Logger log
Definition: TokenRestWebServiceImpl.java:62
org.xdi.oxauth.model.exception.InvalidJwtException
Definition: InvalidJwtException.java:12
org.xdi.oxauth.token.ws.rs.TokenRestWebServiceImpl.appConfiguration
AppConfiguration appConfiguration
Definition: TokenRestWebServiceImpl.java:89
org.xdi.oxauth.model.common.AbstractAuthorizationGrant.getScopes
Set< String > getScopes()
Definition: AbstractAuthorizationGrant.java:377
org.xdi.oxauth.util.ServerUtil.urlDecode
static String urlDecode(String p_str)
Definition: ServerUtil.java:140
org.xdi.oxauth.model.common.AuthorizationCodeGrant
Definition: AuthorizationCodeGrant.java:39
org.xdi.oxauth.model.common.User
Definition: User.java:23
org.xdi.oxauth.model.common.AbstractAuthorizationGrant.getClientId
String getClientId()
Definition: AbstractAuthorizationGrant.java:345
org.xdi.oxauth.service.AuthenticationService.authenticate
boolean authenticate(String userName, String password)
Definition: AuthenticationService.java:124
org.xdi.oxauth.model.common.AuthorizationGrant.createIdToken
IdToken createIdToken(IAuthorizationGrant grant, String nonce, AuthorizationCode authorizationCode, AccessToken accessToken, Set< String > scopes, boolean includeIdTokenClaims, Function< JsonWebResponse, Void > preProcessing)
Definition: AuthorizationGrant.java:87
org.xdi.oxauth.model.exception.InvalidJweException
Definition: InvalidJweException.java:12
org.xdi.oxauth.model.common.ClientCredentialsGrant
Definition: ClientCredentialsGrant.java:24
org.xdi.oxauth.service.UserService.getUserByDn
User getUserByDn(String dn, String... returnAttributes)
Definition: UserService.java:66
org.xdi.oxauth.model.common.AccessToken.getTokenType
TokenType getTokenType()
Definition: AccessToken.java:68
org.xdi.oxauth.model.token.JsonWebResponse
Definition: JsonWebResponse.java:21
org.xdi.oxauth.token.ws.rs.TokenRestWebServiceImpl.authenticationFilterService
AuthenticationFilterService authenticationFilterService
Definition: TokenRestWebServiceImpl.java:83
org.xdi.oxauth.token.ws.rs.TokenRestWebServiceImpl.authenticationService
AuthenticationService authenticationService
Definition: TokenRestWebServiceImpl.java:86
org.xdi.oxauth.model.common.AuthorizationGrant.createRefreshToken
RefreshToken createRefreshToken()
Definition: AuthorizationGrant.java:197
org.xdi.oxauth.model.common.ResourceOwnerPasswordCredentialsGrant
Definition: ResourceOwnerPasswordCredentialsGrant.java:32
org.xdi.oxauth.token.ws.rs.TokenRestWebServiceImpl.grantService
GrantService grantService
Definition: TokenRestWebServiceImpl.java:80
org.xdi.oxauth.model.common.AuthorizationGrant.setIsCachedWithNoPersistence
void setIsCachedWithNoPersistence(boolean isCachedWithNoPersistence)
Definition: AuthorizationGrant.java:381
org.xdi.oxauth.model.common.IdToken
Definition: IdToken.java:14

◆ response()

Response org.xdi.oxauth.token.ws.rs.TokenRestWebServiceImpl.response ( ResponseBuilder  builder,
OAuth2AuditLog  oAuth2AuditLog 
)
inlineprivate
363  {
364  CacheControl cacheControl = new CacheControl();
365  cacheControl.setNoTransform(false);
366  cacheControl.setNoStore(true);
367  builder.cacheControl(cacheControl);
368  builder.header("Pragma", "no-cache");
369 
370  applicationAuditLogger.sendMessage(oAuth2AuditLog);
371 
372  return builder.build();
373  }
org.xdi.oxauth.audit.ApplicationAuditLogger.sendMessage
void sendMessage(OAuth2AuditLog oAuth2AuditLog)
Definition: ApplicationAuditLogger.java:78
org.xdi.oxauth.token.ws.rs.TokenRestWebServiceImpl.applicationAuditLogger
ApplicationAuditLogger applicationAuditLogger
Definition: TokenRestWebServiceImpl.java:68

◆ validatePKCE()

void org.xdi.oxauth.token.ws.rs.TokenRestWebServiceImpl.validatePKCE ( AuthorizationCodeGrant  grant,
String  codeVerifier,
OAuth2AuditLog  oAuth2AuditLog 
)
inlineprivate
348  {
349  log.trace("PKCE validation, code_verifier: {}, code_challenge: {}, method: {}",
350  codeVerifier, grant.getCodeChallenge(), grant.getCodeChallengeMethod());
351 
352  if (Strings.isNullOrEmpty(grant.getCodeChallenge()) && Strings.isNullOrEmpty(codeVerifier)) {
353  return; // if no code challenge then it's valid, no PKCE check
354  }
355 
356  if (!CodeVerifier.matched(grant.getCodeChallenge(), grant.getCodeChallengeMethod(), codeVerifier)) {
357  log.error("PKCE check fails. Code challenge does not match to request code verifier, " +
358  "grantId:" + grant.getGrantId() + ", codeVerifier: " + codeVerifier);
359  throw new WebApplicationException(response(error(401, TokenErrorResponseType.INVALID_GRANT), oAuth2AuditLog));
360  }
361  }
org.xdi.oxauth.model.common.AbstractAuthorizationGrant.getCodeChallengeMethod
String getCodeChallengeMethod()
Definition: AbstractAuthorizationGrant.java:145
org.xdi.oxauth.token.ws.rs.TokenRestWebServiceImpl.error
ResponseBuilder error(int p_status, TokenErrorResponseType p_type)
Definition: TokenRestWebServiceImpl.java:375
org.xdi.oxauth.model.common.AbstractAuthorizationGrant.getCodeChallenge
String getCodeChallenge()
Definition: AbstractAuthorizationGrant.java:137
org.xdi.oxauth.token.ws.rs.TokenRestWebServiceImpl.response
Response response(ResponseBuilder builder, OAuth2AuditLog oAuth2AuditLog)
Definition: TokenRestWebServiceImpl.java:363
org.xdi.oxauth.model.common.AbstractAuthorizationGrant.getGrantId
synchronized String getGrantId()
Definition: AbstractAuthorizationGrant.java:90
org.xdi.oxauth.token.ws.rs.TokenRestWebServiceImpl.log
Logger log
Definition: TokenRestWebServiceImpl.java:62

メンバ詳解

◆ appConfiguration

AppConfiguration org.xdi.oxauth.token.ws.rs.TokenRestWebServiceImpl.appConfiguration
private

◆ applicationAuditLogger

ApplicationAuditLogger org.xdi.oxauth.token.ws.rs.TokenRestWebServiceImpl.applicationAuditLogger
private

◆ authenticationFilterService

AuthenticationFilterService org.xdi.oxauth.token.ws.rs.TokenRestWebServiceImpl.authenticationFilterService
private

◆ authenticationService

AuthenticationService org.xdi.oxauth.token.ws.rs.TokenRestWebServiceImpl.authenticationService
private

◆ authorizationGrantList

AuthorizationGrantList org.xdi.oxauth.token.ws.rs.TokenRestWebServiceImpl.authorizationGrantList
private

◆ errorResponseFactory

ErrorResponseFactory org.xdi.oxauth.token.ws.rs.TokenRestWebServiceImpl.errorResponseFactory
private

◆ grantService

GrantService org.xdi.oxauth.token.ws.rs.TokenRestWebServiceImpl.grantService
private

◆ identity

Identity org.xdi.oxauth.token.ws.rs.TokenRestWebServiceImpl.identity
private

◆ log

Logger org.xdi.oxauth.token.ws.rs.TokenRestWebServiceImpl.log
private

◆ umaTokenService

UmaTokenService org.xdi.oxauth.token.ws.rs.TokenRestWebServiceImpl.umaTokenService
private

◆ userService

UserService org.xdi.oxauth.token.ws.rs.TokenRestWebServiceImpl.userService
private
このクラス詳解は次のファイルから抽出されました:
2018年09月30日(日) 14時46分26秒作成 - gluu / 構成:   doxygen 1.8.13