org.gluu.oxauth.client.validation.OAuthValidationFilter クラス

org.gluu.oxauth.client.validation.OAuthValidationFilter の継承関係図

org.gluu.oxauth.client.validation.OAuthValidationFilter 連携図

公開メンバ関数
final void	init (final FilterConfig filterConfig) throws ServletException
final void	doFilter (final ServletRequest servletRequest, final ServletResponse servletResponse, final FilterChain filterChain) throws IOException, ServletException
void	destroy ()

静的公開メンバ関数
static String	getParameter (final HttpServletRequest request, final String parameter)

限定公開メンバ関数
final boolean	preFilter (final ServletRequest servletRequest, final ServletResponse servletResponse, final FilterChain filterChain) throws IOException, ServletException
final String	constructRedirectUrl (final HttpServletRequest request)
final String	getPropertyFromInitParams (final FilterConfig filterConfig, final String propertyName, final String defaultValue)

限定公開変数類
final Log	log = LogFactory.getLog(getClass())

非公開メンバ関数
OAuthData	getOAuthData (HttpSession session, HttpServletRequest request, String authorizationCode) throws Exception
String	getOAuthHost (String oAuthAuthorizeUrl)

詳解

Validates grants recieved from OAuth server.

Add OAuth data to servlet session. Add remoteUser/Principal to servlet request for IDP.

著者

Yuriy Movchan

関数詳解

constructRedirectUrl()

final String org.gluu.oxauth.client.session.AbstractOAuthFilter.constructRedirectUrl ( final HttpServletRequest  request )

inlineprotectedinherited

                                                                                  {
        int serverPort = request.getServerPort();

        String redirectUrl;
        if ((serverPort == 80) || (serverPort == 443)) {
                redirectUrl = String.format("%s://%s%s%s", request.getScheme(), request.getServerName(), request.getContextPath(), "/auth-code.jsp");
        } else {
                redirectUrl = String.format("%s://%s:%s%s%s", request.getScheme(), request.getServerName(), request.getServerPort(), request.getContextPath(), "/auth-code.jsp");
        }
        
        return redirectUrl.toLowerCase();
    }

destroy()

void org.gluu.oxauth.client.validation.OAuthValidationFilter.destroy ( )

inline

                          {
    }

doFilter()

final void org.gluu.oxauth.client.validation.OAuthValidationFilter.doFilter ( final ServletRequest  servletRequest, final ServletResponse  servletResponse, final FilterChain  filterChain  ) throws IOException, ServletException

inline

                                                                                                                                                                               {

        log.debug("Attempting to validate grants");
        final HttpServletRequest request = (HttpServletRequest) servletRequest;
        final HttpServletResponse response = (HttpServletResponse) servletResponse;
        
        String conversation = request.getHeader(ExternalAuthentication.CONVERSATION_KEY);

        final HttpSession session = request.getSession(false);
        if (session != null && (conversation == null || conversation.isEmpty())) {

                conversation = (String)session.getAttribute(AuthenticationFilter.SESSION_CONVERSATION_KEY);
                if (conversation == null || conversation.isEmpty()) {
                        throw new ServletException("IDP v3 conversation param is null or empty");
                }

                log.debug("########## SESSION conversation = " + conversation);

        } else {
                log.error("Session not created yet");
        }
        
        CustomHttpServletRequest customRequest = new CustomHttpServletRequest(request);
        customRequest.addCustomParameter(ExternalAuthentication.CONVERSATION_KEY, conversation);
        
        if (!preFilter(servletRequest, servletResponse, filterChain)) {
            // unauthorized way
            filterChain.doFilter(customRequest, response);
            return;
        }
        
        // authorized way
        final String code = getParameter(request, Configuration.OAUTH_CODE);

        log.debug("Attempting to validate code: " + code);
        try {
                OAuthData oAuthData = getOAuthData(session, request, code);
                session.setAttribute(Configuration.SESSION_OAUTH_DATA, oAuthData);
                
                customRequest.setRemoteUser(oAuthData.getUserUid());
        } catch (Exception ex) {
            response.setStatus(HttpServletResponse.SC_FORBIDDEN);
            log.warn("Failed to validate code and id_token", ex);

            throw new ServletException(ex);
        }
                
        filterChain.doFilter(customRequest, response);
    }

getOAuthData()

OAuthData org.gluu.oxauth.client.validation.OAuthValidationFilter.getOAuthData ( HttpSession  session, HttpServletRequest  request, String  authorizationCode  ) throws Exception

inlineprivate

                                                                                                                               {
        // Check state
        String authorizationState = request.getParameter(Configuration.OAUTH_STATE);
        final String stateSession = session != null ? (String) session.getAttribute(Configuration.SESSION_AUTH_STATE) : null;
        if (!StringHelper.equals(stateSession, authorizationState)) {
            log.error("Login failed, oxTrust wasn't allowed to access user data");
            return null;
        }

        String oAuthAuthorizeUrl = getPropertyFromInitParams(null, Configuration.OAUTH_PROPERTY_AUTHORIZE_URL, null);
        String oAuthHost = getOAuthHost(oAuthAuthorizeUrl);

        String oAuthTokenUrl = getPropertyFromInitParams(null, Configuration.OAUTH_PROPERTY_TOKEN_URL, null);
        String oAuthUserInfoUrl = getPropertyFromInitParams(null, Configuration.OAUTH_PROPERTY_USERINFO_URL, null);

        String oAuthClientId = getPropertyFromInitParams(null, Configuration.OAUTH_PROPERTY_CLIENT_ID, null);
        String oAuthClientPassword = getPropertyFromInitParams(null, Configuration.OAUTH_PROPERTY_CLIENT_PASSWORD, null);
        if (oAuthClientPassword != null) {
            try {
                oAuthClientPassword = StringEncrypter.defaultInstance().decrypt(oAuthClientPassword, Configuration.instance().getCryptoPropertyValue());
            } catch (EncryptionException ex) {
                log.error("Failed to decrypt property: " + Configuration.OAUTH_PROPERTY_CLIENT_PASSWORD, ex);
            }
        }

        String scopes = getParameter(request, Configuration.OAUTH_SCOPE);
        log.trace("scopes : " + scopes);

        // 1. Request access token using the authorization code
        log.trace("Getting access token");
        TokenClient tokenClient1 = new TokenClient(oAuthTokenUrl);

        String redirectURL = constructRedirectUrl(request);
        TokenResponse tokenResponse = tokenClient1.execAuthorizationCode(authorizationCode, redirectURL, oAuthClientId, oAuthClientPassword);
        if (tokenResponse == null) {
            log.error("Get empty token response. User can't log into application");
            return null;
        }

        log.trace("tokenResponse : " + tokenResponse);
        log.trace("tokenResponse.getErrorType() : " + tokenResponse.getErrorType());

        String accessToken = tokenResponse.getAccessToken();
        String idToken = tokenResponse.getIdToken();
        log.trace("accessToken : " + accessToken);
        log.trace("idToken : " + idToken);

        // Parse JWT
        Jwt jwt;
        try {
            jwt = Jwt.parse(idToken);
        } catch (InvalidJwtException ex) {
            log.error("Failed to parse id_token");
            return null;
        }

        // Check nonce
        String nonceResponse = (String) jwt.getClaims().getClaim(JwtClaimName.NONCE);
        final String nonceSession = session != null ? (String) session.getAttribute(Configuration.SESSION_AUTH_NONCE) : null;
        if (!StringHelper.equals(nonceSession, nonceResponse)) {
            log.error("User info response :  nonce is not matching.");
            return null;
        }

        log.info("Session validation successful. User is logged in");
        UserInfoClient userInfoClient = new UserInfoClient(oAuthUserInfoUrl);

        UserInfoResponse userInfoResponse = userInfoClient.execUserInfo(accessToken);
        if (userInfoResponse == null) {
            log.error("Get empty user info response. User can't log into application");
            return null;
        }

        OAuthData oAuthData = new OAuthData();
        oAuthData.setHost(oAuthHost);
        // Determine uid
        List<String> uidValues = userInfoResponse.getClaims().get(JwtClaimName.USER_NAME);
        if ((uidValues == null) || (uidValues.size() == 0)) {
            log.error("User infor response doesn't contains uid claim");
            return null;
        }

        oAuthData.setUserUid(uidValues.get(0));
        oAuthData.setAccessToken(accessToken);
        oAuthData.setAccessTokenExpirationInSeconds(tokenResponse.getExpiresIn());
        oAuthData.setScopes(scopes);
        oAuthData.setIdToken(idToken);

        log.trace("User uid: " + oAuthData.getUserUid());
        return oAuthData;
    }

getOAuthHost()

String org.gluu.oxauth.client.validation.OAuthValidationFilter.getOAuthHost ( String  oAuthAuthorizeUrl )

inlineprivate

                                                          {
        try {
            URL url = new URL(oAuthAuthorizeUrl);
            return String.format("%s://%s:%s", url.getProtocol(), url.getHost(), url.getPort());
        } catch (MalformedURLException ex) {
            log.error("Invalid oAuth authorization URI: " + oAuthAuthorizeUrl, ex);
        }

        return null;
    }

getParameter()

static String org.gluu.oxauth.client.session.AbstractOAuthFilter.getParameter ( final HttpServletRequest  request, final String  parameter  )

inlinestaticinherited

Method for retrieving a parameter from the request without disrupting the reader UNLESS the parameter actually exists in the query string.

引数

request	the request to check.
parameter	the parameter to look for.

戻り値

the value of the parameter.

                                                                                                {
        return request.getQueryString() == null || request.getQueryString().indexOf(parameter) == -1 ? null : request.getParameter(parameter);       
    }

getPropertyFromInitParams()

final String org.gluu.oxauth.client.util.AbstractConfigurationFilter.getPropertyFromInitParams ( final FilterConfig  filterConfig, final String  propertyName, final String  defaultValue  )

inlineprotectedinherited

Retrieves the property from the FilterConfig. First it checks the FilterConfig's initParameters to see if it has a value. If it does, it returns that, otherwise it retrieves the ServletContext's initParameters and returns that value if any.

引数

filterConfig	the Filter Configuration.
propertyName	the property to retrieve.
defaultValue	the default value if the property is not found.

戻り値

the property value, following the above conventions. It will always return the more specific value (i.e. filter vs. context).

                                                                                                                                             {
//        final String value = filterConfig.getInitParameter(propertyName);
//
//        if (StringHelper.isNotEmpty(value)) {
//            log.info("Property [" + propertyName + "] loaded from FilterConfig.getInitParameter with value [" + value + "]");
//            return value;
//        }
//
//        final String value2 = filterConfig.getServletContext().getInitParameter(propertyName);
//        if (StringHelper.isNotEmpty(value2)) {
//            log.info("Property [" + propertyName + "] loaded from ServletContext.getInitParameter with value [" + value2 + "]");
//            return value2;
//        }

        final String value3 = Configuration.instance().getPropertyValue(propertyName);
        if (StringHelper.isNotEmpty(value3)) {
            log.info("Property [" + propertyName + "] loaded from oxTrust.properties");
            return value3;
        }

        log.info("Property [" + propertyName + "] not found.  Using default value [" + defaultValue + "]");
        return defaultValue;
    }

init()

final void org.gluu.oxauth.client.validation.OAuthValidationFilter.init ( final FilterConfig  filterConfig ) throws ServletException

inline

                                                                                    {
    }

preFilter()

final boolean org.gluu.oxauth.client.validation.OAuthValidationFilter.preFilter ( final ServletRequest  servletRequest, final ServletResponse  servletResponse, final FilterChain  filterChain  ) throws IOException, ServletException

inlineprotected

Determine filter execution conditions

                                                                                                          {
        final HttpServletRequest request = (HttpServletRequest) servletRequest;
        final HttpSession session = request.getSession(false);
        if (session == null) {
            return false;
        }

        final String code = getParameter(request, Configuration.OAUTH_CODE);
        if (StringHelper.isNotEmpty(code)) {
            return true;
        }

        return false;
    }

メンバ詳解

log

final Log org.gluu.oxauth.client.util.AbstractConfigurationFilter.log = LogFactory.getLog(getClass())

protectedinherited

---

このクラス詳解は次のファイルから抽出されました:

• D:/AppData/OpenId/gluu/src/oxTrust/saml-openid-auth-client/src/main/java/org/gluu/oxauth/client/validation/OAuthValidationFilter.java