org.xdi.oxauth.ws.rs.fido.u2f.U2fAuthenticationWS クラス

org.xdi.oxauth.ws.rs.fido.u2f.U2fAuthenticationWS 連携図

公開メンバ関数
Response	startAuthentication (@QueryParam("username") String userName, @QueryParam("keyhandle") String keyHandle, @QueryParam("application") String appId, @QueryParam("session_id") String sessionId)
Response	finishAuthentication (@FormParam("username") String userName, @FormParam("tokenResponse") String authenticateResponseString)

非公開変数類
Logger	log
AppConfiguration	appConfiguration
ErrorResponseFactory	errorResponseFactory
UserService	userService
AuthenticationService	u2fAuthenticationService
DeviceRegistrationService	deviceRegistrationService
UserSessionIdService	userSessionIdService
ValidationService	u2fValidationService

詳解

The endpoint allows to start and finish U2F authentication process

著者

Yuriy Movchan

バージョン

August 9, 2017

関数詳解

finishAuthentication()

Response org.xdi.oxauth.ws.rs.fido.u2f.U2fAuthenticationWS.finishAuthentication ( @FormParam("username") String  userName, @FormParam("tokenResponse") String  authenticateResponseString  )

inline

                                                                                                                                                {
        String sessionId = null;
        try {
            if (appConfiguration.getDisableU2fEndpoint()) {
                return Response.status(Status.FORBIDDEN).build();
            }

            log.debug("Finishing authentication for username '{}' with response '{}'", userName, authenticateResponseString);

            AuthenticateResponse authenticateResponse = ServerUtil.jsonMapperWithWrapRoot().readValue(authenticateResponseString, AuthenticateResponse.class);

            String requestId = authenticateResponse.getRequestId();
            AuthenticateRequestMessageLdap authenticateRequestMessageLdap = u2fAuthenticationService.getAuthenticationRequestMessageByRequestId(requestId);
            if (authenticateRequestMessageLdap == null) {
                throw new WebApplicationException(Response.status(Response.Status.FORBIDDEN)
                        .entity(errorResponseFactory.getJsonErrorResponse(U2fErrorResponseType.SESSION_EXPIRED)).build());
            }
            sessionId = authenticateRequestMessageLdap.getSessionId();
            u2fAuthenticationService.removeAuthenticationRequestMessage(authenticateRequestMessageLdap);

            AuthenticateRequestMessage authenticateRequestMessage = authenticateRequestMessageLdap.getAuthenticateRequestMessage();

            String foundUserInum = authenticateRequestMessageLdap.getUserInum();
            DeviceRegistrationResult deviceRegistrationResult = u2fAuthenticationService.finishAuthentication(authenticateRequestMessage, authenticateResponse, foundUserInum);

            // If sessionId is not empty update session
            if (StringHelper.isNotEmpty(sessionId)) {
                log.debug("There is session id. Setting session id attributes");

                boolean oneStep = StringHelper.isEmpty(userName);
                userSessionIdService.updateUserSessionIdOnFinishRequest(sessionId, foundUserInum, deviceRegistrationResult, false, oneStep);
            }

            AuthenticateStatus authenticationStatus = new AuthenticateStatus(Constants.RESULT_SUCCESS, requestId);

            // convert manually to avoid possible conflict between resteasy
            // providers, e.g. jettison, jackson
            final String entity = ServerUtil.asJson(authenticationStatus);

            return Response.status(Response.Status.OK).entity(entity).cacheControl(ServerUtil.cacheControl(true)).build();
        } catch (Exception ex) {
            log.error("Exception happened", ex);
            if (ex instanceof WebApplicationException) {
                throw (WebApplicationException) ex;
            }

            try {
                // If sessionId is not empty update session
                if (StringHelper.isNotEmpty(sessionId)) {
                    log.debug("There is session id. Setting session id status to 'declined'");
                    userSessionIdService.updateUserSessionIdOnError(sessionId);
                }
            } catch (Exception ex2) {
                log.error("Failed to update session id status", ex2);
            }

            if (ex instanceof BadInputException) {
                throw new WebApplicationException(Response.status(Response.Status.FORBIDDEN)
                        .entity(errorResponseFactory.getErrorResponse(U2fErrorResponseType.INVALID_REQUEST)).build());
            }

            if (ex instanceof DeviceCompromisedException) {
                DeviceRegistration deviceRegistration = ((DeviceCompromisedException) ex).getDeviceRegistration();
                try {
                    deviceRegistrationService.disableUserDeviceRegistration(deviceRegistration);
                } catch (Exception ex2) {
                    log.error("Failed to mark device '{}' as compomised", ex2, deviceRegistration.getId());
                }
                throw new WebApplicationException(Response.status(Response.Status.FORBIDDEN)
                        .entity(errorResponseFactory.getErrorResponse(U2fErrorResponseType.DEVICE_COMPROMISED)).build());
            }

            throw new WebApplicationException(Response.status(Response.Status.INTERNAL_SERVER_ERROR)
                    .entity(errorResponseFactory.getJsonErrorResponse(U2fErrorResponseType.SERVER_ERROR)).build());
        }
    }

startAuthentication()

Response org.xdi.oxauth.ws.rs.fido.u2f.U2fAuthenticationWS.startAuthentication ( @QueryParam("username") String  userName, @QueryParam("keyhandle") String  keyHandle, @QueryParam("application") String  appId, @QueryParam("session_id") String  sessionId  )

inline

                                                                                                                                                                                                                 {
        // Parameter username is deprecated. We uses it only to determine is it's one or two step workflow
        try {
            if (appConfiguration.getDisableU2fEndpoint()) {
                return Response.status(Status.FORBIDDEN).build();
            }

            log.debug("Startig authentication with username '{}', keyhandle '{}' for appId '{}' and session_id '{}'", userName, keyHandle, appId, sessionId);

            if (StringHelper.isEmpty(userName) && StringHelper.isEmpty(keyHandle)) {
                throw new BadInputException("The request should contains either username or keyhandle");
            }

            String foundUserInum = null;

            boolean twoStep = StringHelper.isNotEmpty(userName);
            if (twoStep) {
                boolean valid = u2fValidationService.isValidSessionId(userName, sessionId);
                if (!valid) {
                    throw new BadInputException(String.format("session_id '%s' is invalid", sessionId));
                }

                foundUserInum = userService.getUserInum(userName);
            } else {
                // Convert to non padding URL base64 string
                String keyHandleWithoutPading = Base64Util.base64urlencode(Base64Util.base64urldecode(keyHandle));

                // In one step we expects empty username and not empty keyhandle
                foundUserInum = u2fAuthenticationService.getUserInumByKeyHandle(appId, keyHandleWithoutPading);
            }

            if (StringHelper.isEmpty(foundUserInum)) {
                throw new BadInputException(String.format("Failed to find user by userName '%s' or keyHandle '%s' in LDAP", userName, keyHandle));
            }

            AuthenticateRequestMessage authenticateRequestMessage = u2fAuthenticationService.buildAuthenticateRequestMessage(appId, foundUserInum);
            u2fAuthenticationService.storeAuthenticationRequestMessage(authenticateRequestMessage, foundUserInum, sessionId);

            // convert manually to avoid possible conflict between resteasy
            // providers, e.g. jettison, jackson
            final String entity = ServerUtil.asJson(authenticateRequestMessage);

            return Response.status(Response.Status.OK).entity(entity).cacheControl(ServerUtil.cacheControl(true)).build();
        } catch (Exception ex) {
            log.error("Exception happened", ex);
            if (ex instanceof WebApplicationException) {
                throw (WebApplicationException) ex;
            }

            if ((ex instanceof NoEligableDevicesException) || (ex instanceof InvalidKeyHandleDeviceException)) {
                throw new WebApplicationException(Response.status(Response.Status.NOT_FOUND)
                        .entity(errorResponseFactory.getErrorResponse(U2fErrorResponseType.NO_ELIGABLE_DEVICES)).build());
            }

            throw new WebApplicationException(Response.status(Response.Status.INTERNAL_SERVER_ERROR)
                    .entity(errorResponseFactory.getJsonErrorResponse(U2fErrorResponseType.SERVER_ERROR)).build());
        }
    }

メンバ詳解

appConfiguration

AppConfiguration org.xdi.oxauth.ws.rs.fido.u2f.U2fAuthenticationWS.appConfiguration

private

deviceRegistrationService

DeviceRegistrationService org.xdi.oxauth.ws.rs.fido.u2f.U2fAuthenticationWS.deviceRegistrationService

private

errorResponseFactory

ErrorResponseFactory org.xdi.oxauth.ws.rs.fido.u2f.U2fAuthenticationWS.errorResponseFactory

private

log

Logger org.xdi.oxauth.ws.rs.fido.u2f.U2fAuthenticationWS.log

private

u2fAuthenticationService

AuthenticationService org.xdi.oxauth.ws.rs.fido.u2f.U2fAuthenticationWS.u2fAuthenticationService

private

u2fValidationService

ValidationService org.xdi.oxauth.ws.rs.fido.u2f.U2fAuthenticationWS.u2fValidationService

private

userService

UserService org.xdi.oxauth.ws.rs.fido.u2f.U2fAuthenticationWS.userService

private

userSessionIdService

UserSessionIdService org.xdi.oxauth.ws.rs.fido.u2f.U2fAuthenticationWS.userSessionIdService

private

---

このクラス詳解は次のファイルから抽出されました:

• D:/AppData/OpenId/gluu/src/oxAuth/Server/src/main/java/org/xdi/oxauth/ws/rs/fido/u2f/U2fAuthenticationWS.java