gluu
公開メンバ関数 | 非公開メンバ関数 | 非公開変数類 | 全メンバ一覧
org.xdi.oxauth.model.token.IdTokenFactory クラス
org.xdi.oxauth.model.token.IdTokenFactory 連携図
Collaboration graph

公開メンバ関数

Jwt generateSignedIdToken (IAuthorizationGrant authorizationGrant, String nonce, AuthorizationCode authorizationCode, AccessToken accessToken, Set< String > scopes, boolean includeIdTokenClaims, Function< JsonWebResponse, Void > preProcessing) throws Exception
 
Jwe generateEncryptedIdToken (IAuthorizationGrant authorizationGrant, String nonce, AuthorizationCode authorizationCode, AccessToken accessToken, Set< String > scopes, boolean includeIdTokenClaims, Function< JsonWebResponse, Void > preProcessing) throws Exception
 
JsonWebResponse createJwr (IAuthorizationGrant grant, String nonce, AuthorizationCode authorizationCode, AccessToken accessToken, Set< String > scopes, boolean includeIdTokenClaims, Function< JsonWebResponse, Void > preProcessing) throws Exception
 
boolean validateRequesteClaim (GluuAttribute gluuAttribute, String[] clientAllowedClaims, Collection< String > scopes)
 

非公開メンバ関数

void setAmrClaim (JsonWebResponse jwt, String acrValues)
 

非公開変数類

ExternalDynamicScopeService externalDynamicScopeService
 
ExternalAuthenticationService externalAuthenticationService
 
ClientService clientService
 
ScopeService scopeService
 
AttributeService attributeService
 
PairwiseIdentifierService pairwiseIdentifierService
 
AppConfiguration appConfiguration
 
WebKeysConfiguration webKeysConfiguration
 

詳解

JSON Web Token (JWT) is a compact token format intended for space constrained environments such as HTTP Authorization headers and URI query parameters. JWTs encode claims to be transmitted as a JSON object (as defined in RFC 4627) that is base64url encoded and digitally signed. Signing is accomplished using a JSON Web Signature (JWS). JWTs may also be optionally encrypted using JSON Web Encryption (JWE).

著者
Javier Rojas Blum
Yuriy Movchan
バージョン
June 30, 2018

関数詳解

◆ createJwr()

JsonWebResponse org.xdi.oxauth.model.token.IdTokenFactory.createJwr ( IAuthorizationGrant  grant,
String  nonce,
AuthorizationCode  authorizationCode,
AccessToken  accessToken,
Set< String >  scopes,
boolean  includeIdTokenClaims,
Function< JsonWebResponse, Void >  preProcessing 
) throws Exception
inline
538  {
539  final Client grantClient = grant.getClient();
540  if (grantClient != null && grantClient.getIdTokenEncryptedResponseAlg() != null
541  && grantClient.getIdTokenEncryptedResponseEnc() != null) {
542  return generateEncryptedIdToken(
543  grant, nonce, authorizationCode, accessToken, scopes, includeIdTokenClaims, preProcessing);
544  } else {
545  return generateSignedIdToken(
546  grant, nonce, authorizationCode, accessToken, scopes, includeIdTokenClaims, preProcessing);
547  }
548  }
org.xdi.oxauth.model.token.IdTokenFactory.generateSignedIdToken
Jwt generateSignedIdToken(IAuthorizationGrant authorizationGrant, String nonce, AuthorizationCode authorizationCode, AccessToken accessToken, Set< String > scopes, boolean includeIdTokenClaims, Function< JsonWebResponse, Void > preProcessing)
Definition: IdTokenFactory.java:111
org.xdi.oxauth.model.token.IdTokenFactory.generateEncryptedIdToken
Jwe generateEncryptedIdToken(IAuthorizationGrant authorizationGrant, String nonce, AuthorizationCode authorizationCode, AccessToken accessToken, Set< String > scopes, boolean includeIdTokenClaims, Function< JsonWebResponse, Void > preProcessing)
Definition: IdTokenFactory.java:335

◆ generateEncryptedIdToken()

Jwe org.xdi.oxauth.model.token.IdTokenFactory.generateEncryptedIdToken ( IAuthorizationGrant  authorizationGrant,
String  nonce,
AuthorizationCode  authorizationCode,
AccessToken  accessToken,
Set< String >  scopes,
boolean  includeIdTokenClaims,
Function< JsonWebResponse, Void >  preProcessing 
) throws Exception
inline
337  {
338  Jwe jwe = new Jwe();
339 
340  // Header
341  KeyEncryptionAlgorithm keyEncryptionAlgorithm = KeyEncryptionAlgorithm.fromName(authorizationGrant.getClient().getIdTokenEncryptedResponseAlg());
342  BlockEncryptionAlgorithm blockEncryptionAlgorithm = BlockEncryptionAlgorithm.fromName(authorizationGrant.getClient().getIdTokenEncryptedResponseEnc());
343  jwe.getHeader().setType(JwtType.JWT);
344  jwe.getHeader().setAlgorithm(keyEncryptionAlgorithm);
345  jwe.getHeader().setEncryptionMethod(blockEncryptionAlgorithm);
346 
347  // Claims
348  jwe.getClaims().setIssuer(appConfiguration.getIssuer());
349  jwe.getClaims().setAudience(authorizationGrant.getClient().getClientId());
350 
351  int lifeTime = appConfiguration.getIdTokenLifetime();
352  Calendar calendar = Calendar.getInstance();
353  Date issuedAt = calendar.getTime();
354  calendar.add(Calendar.SECOND, lifeTime);
355  Date expiration = calendar.getTime();
356 
357  jwe.getClaims().setExpirationTime(expiration);
358  jwe.getClaims().setIssuedAt(issuedAt);
359 
360  if (preProcessing != null) {
361  preProcessing.apply(jwe);
362  }
363 
364  if (authorizationGrant.getAcrValues() != null) {
365  jwe.getClaims().setClaim(JwtClaimName.AUTHENTICATION_CONTEXT_CLASS_REFERENCE, authorizationGrant.getAcrValues());
366  setAmrClaim(jwe, authorizationGrant.getAcrValues());
367  }
368  if (StringUtils.isNotBlank(nonce)) {
369  jwe.getClaims().setClaim(JwtClaimName.NONCE, nonce);
370  }
371  if (authorizationGrant.getAuthenticationTime() != null) {
372  jwe.getClaims().setClaim(JwtClaimName.AUTHENTICATION_TIME, authorizationGrant.getAuthenticationTime());
373  }
374  if (authorizationCode != null) {
375  String codeHash = authorizationCode.getHash(null);
376  jwe.getClaims().setClaim(JwtClaimName.CODE_HASH, codeHash);
377  }
378  if (accessToken != null) {
379  String accessTokenHash = accessToken.getHash(null);
380  jwe.getClaims().setClaim(JwtClaimName.ACCESS_TOKEN_HASH, accessTokenHash);
381  }
382  jwe.getClaims().setClaim(JwtClaimName.OX_OPENID_CONNECT_VERSION, appConfiguration.getOxOpenIdConnectVersion());
383 
384  List<org.xdi.oxauth.model.common.Scope> dynamicScopes = Lists.newArrayList();
385  if (includeIdTokenClaims && authorizationGrant.getClient().isIncludeClaimsInIdToken()) {
386  for (String scopeName : scopes) {
387  org.xdi.oxauth.model.common.Scope scope = scopeService.getScopeByDisplayName(scopeName);
388  if (org.xdi.oxauth.model.common.ScopeType.DYNAMIC == scope.getScopeType()) {
389  dynamicScopes.add(scope);
390  continue;
391  }
392 
393  if (scope != null && scope.getOxAuthClaims() != null) {
394  for (String claimDn : scope.getOxAuthClaims()) {
395  GluuAttribute gluuAttribute = attributeService.getAttributeByDn(claimDn);
396 
397  String claimName = gluuAttribute.getOxAuthClaimName();
398  String ldapName = gluuAttribute.getName();
399  Object attributeValue;
400 
401  if (StringUtils.isNotBlank(claimName) && StringUtils.isNotBlank(ldapName)) {
402  if (ldapName.equals("uid")) {
403  attributeValue = authorizationGrant.getUser().getUserId();
404  } else {
405  attributeValue = authorizationGrant.getUser().getAttribute(gluuAttribute.getName(), true);
406  }
407 
408  if (attributeValue != null) {
409  if (attributeValue instanceof JSONArray) {
410  JSONArray jsonArray = (JSONArray) attributeValue;
411  List<String> values = new ArrayList<String>();
412  for (int i = 0; i < jsonArray.length(); i++) {
413  String value = jsonArray.optString(i);
414  if (value != null) {
415  values.add(value);
416  }
417  }
418  jwe.getClaims().setClaim(claimName, values);
419  } else {
420  String value = attributeValue.toString();
421  jwe.getClaims().setClaim(claimName, value);
422  }
423  }
424  }
425  }
426  }
427  }
428  }
429 
430  if (authorizationGrant.getJwtAuthorizationRequest() != null
431  && authorizationGrant.getJwtAuthorizationRequest().getIdTokenMember() != null) {
432  for (Claim claim : authorizationGrant.getJwtAuthorizationRequest().getIdTokenMember().getClaims()) {
433  boolean optional = true; // ClaimValueType.OPTIONAL.equals(claim.getClaimValue().getClaimValueType());
434  GluuAttribute gluuAttribute = attributeService.getByClaimName(claim.getName());
435 
436  if (gluuAttribute != null) {
437  Client client = authorizationGrant.getClient();
438 
439  if (validateRequesteClaim(gluuAttribute, client.getClaims(), scopes)) {
440  String ldapClaimName = gluuAttribute.getName();
441  Object attribute = authorizationGrant.getUser().getAttribute(ldapClaimName, optional);
442  if (attribute != null) {
443  if (attribute instanceof JSONArray) {
444  JSONArray jsonArray = (JSONArray) attribute;
445  List<String> values = new ArrayList<String>();
446  for (int i = 0; i < jsonArray.length(); i++) {
447  String value = jsonArray.optString(i);
448  if (value != null) {
449  values.add(value);
450  }
451  }
452  jwe.getClaims().setClaim(claim.getName(), values);
453  } else {
454  String value = attribute.toString();
455  jwe.getClaims().setClaim(claim.getName(), value);
456  }
457  }
458  }
459  }
460  }
461  }
462 
463  // Check for Subject Identifier Type
464  if (authorizationGrant.getClient().getSubjectType() != null &&
465  SubjectType.fromString(authorizationGrant.getClient().getSubjectType()).equals(SubjectType.PAIRWISE)) {
466  String sectorIdentifierUri;
467  if (StringUtils.isNotBlank(authorizationGrant.getClient().getSectorIdentifierUri())) {
468  sectorIdentifierUri = authorizationGrant.getClient().getSectorIdentifierUri();
469  } else {
470  sectorIdentifierUri = authorizationGrant.getClient().getRedirectUris()[0];
471  }
472 
473  String userInum = authorizationGrant.getUser().getAttribute("inum");
474  String clientId = authorizationGrant.getClientId();
475  PairwiseIdentifier pairwiseIdentifier = pairwiseIdentifierService.findPairWiseIdentifier(
476  userInum, sectorIdentifierUri, clientId);
477  if (pairwiseIdentifier == null) {
478  pairwiseIdentifier = new PairwiseIdentifier(sectorIdentifierUri, clientId);
479  pairwiseIdentifier.setId(UUID.randomUUID().toString());
480  pairwiseIdentifier.setDn(pairwiseIdentifierService.getDnForPairwiseIdentifier(
481  pairwiseIdentifier.getId(),
482  userInum));
483  pairwiseIdentifierService.addPairwiseIdentifier(userInum, pairwiseIdentifier);
484  }
485  jwe.getClaims().setSubjectIdentifier(pairwiseIdentifier.getId());
486  } else {
487  String openidSubAttribute = appConfiguration.getOpenidSubAttribute();
488 
489  if (openidSubAttribute.equals("uid")) {
490  jwe.getClaims().setSubjectIdentifier(authorizationGrant.getUser().getUserId());
491  } else {
492  jwe.getClaims().setSubjectIdentifier(authorizationGrant.getUser().getAttribute(openidSubAttribute));
493  }
494  }
495 
496  if ((dynamicScopes.size() > 0) && externalDynamicScopeService.isEnabled()) {
497  final UnmodifiableAuthorizationGrant unmodifiableAuthorizationGrant = new UnmodifiableAuthorizationGrant(authorizationGrant);
498  DynamicScopeExternalContext dynamicScopeContext = new DynamicScopeExternalContext(dynamicScopes, jwe, unmodifiableAuthorizationGrant);
499  externalDynamicScopeService.executeExternalUpdateMethods(dynamicScopeContext);
500  }
501 
502  // Encryption
503  if (keyEncryptionAlgorithm == KeyEncryptionAlgorithm.RSA_OAEP
504  || keyEncryptionAlgorithm == KeyEncryptionAlgorithm.RSA1_5) {
505  JSONObject jsonWebKeys = JwtUtil.getJSONWebKeys(authorizationGrant.getClient().getJwksUri());
506  AbstractCryptoProvider cryptoProvider = CryptoProviderFactory.getCryptoProvider(appConfiguration);
507  String keyId = cryptoProvider.getKeyId(JSONWebKeySet.fromJSONObject(jsonWebKeys), SignatureAlgorithm.RS256, Use.ENCRYPTION);
508  PublicKey publicKey = cryptoProvider.getPublicKey(keyId, jsonWebKeys);
509  jwe.getHeader().setKeyId(keyId);
510 
511  if (publicKey != null) {
512  JweEncrypter jweEncrypter = new JweEncrypterImpl(keyEncryptionAlgorithm, blockEncryptionAlgorithm, publicKey);
513  jwe = jweEncrypter.encrypt(jwe);
514  } else {
515  throw new InvalidJweException("The public key is not valid");
516  }
517  } else if (keyEncryptionAlgorithm == KeyEncryptionAlgorithm.A128KW
518  || keyEncryptionAlgorithm == KeyEncryptionAlgorithm.A256KW) {
519  try {
520  byte[] sharedSymmetricKey = clientService.decryptSecret(authorizationGrant.getClient().getClientSecret()).getBytes(Util.UTF8_STRING_ENCODING);
521  JweEncrypter jweEncrypter = new JweEncrypterImpl(keyEncryptionAlgorithm, blockEncryptionAlgorithm, sharedSymmetricKey);
522  jwe = jweEncrypter.encrypt(jwe);
523  } catch (UnsupportedEncodingException e) {
524  throw new InvalidJweException(e);
525  } catch (StringEncrypter.EncryptionException e) {
526  throw new InvalidJweException(e);
527  } catch (Exception e) {
528  throw new InvalidJweException(e);
529  }
530  }
531 
532  return jwe;
533  }
org.xdi.oxauth.service.PairwiseIdentifierService.getDnForPairwiseIdentifier
String getDnForPairwiseIdentifier(String oxId, String userInum)
Definition: PairwiseIdentifierService.java:107
org.xdi.oxauth.model.token.IdTokenFactory.appConfiguration
AppConfiguration appConfiguration
Definition: IdTokenFactory.java:106
org.xdi.oxauth.service.AttributeService.getAttributeByDn
GluuAttribute getAttributeByDn(String dn)
Definition: AttributeService.java:47
org.xdi.oxauth.model.token.IdTokenFactory.pairwiseIdentifierService
PairwiseIdentifierService pairwiseIdentifierService
Definition: IdTokenFactory.java:103
org.xdi.oxauth.service.AttributeService.getByClaimName
GluuAttribute getByClaimName(String name)
Definition: AttributeService.java:73
org.xdi.oxauth.service.ScopeService.getScopeByDisplayName
org.xdi.oxauth.model.common.Scope getScopeByDisplayName(String displayName)
Definition: ScopeService.java:119
org.xdi.oxauth.model.token.IdTokenFactory.externalDynamicScopeService
ExternalDynamicScopeService externalDynamicScopeService
Definition: IdTokenFactory.java:88
org.xdi.oxauth.model.common.ScopeType.DYNAMIC
DYNAMIC
Definition: ScopeType.java:56
org.xdi.oxauth.model.configuration.AppConfiguration.getOxOpenIdConnectVersion
String getOxOpenIdConnectVersion()
Definition: AppConfiguration.java:864
org.xdi.oxauth.model.token.IdTokenFactory.validateRequesteClaim
boolean validateRequesteClaim(GluuAttribute gluuAttribute, String[] clientAllowedClaims, Collection< String > scopes)
Definition: IdTokenFactory.java:550
org.xdi.oxauth.model.token.IdTokenFactory.clientService
ClientService clientService
Definition: IdTokenFactory.java:94
org.xdi.oxauth.model.configuration.AppConfiguration.getIdTokenLifetime
int getIdTokenLifetime()
Definition: AppConfiguration.java:784
org.xdi.oxauth.model.common.Scope
Definition: Scope.java:23
org.xdi.oxauth.model.common.ScopeType
Definition: ScopeType.java:21
org.xdi.oxauth.service.PairwiseIdentifierService.addPairwiseIdentifier
void addPairwiseIdentifier(String userInum, PairwiseIdentifier pairwiseIdentifier)
Definition: PairwiseIdentifierService.java:100
org.xdi.oxauth.model.configuration.AppConfiguration.getIssuer
String getIssuer()
Definition: AppConfiguration.java:274
org.xdi.oxauth.model.token.IdTokenFactory.setAmrClaim
void setAmrClaim(JsonWebResponse jwt, String acrValues)
Definition: IdTokenFactory.java:312
org.xdi.oxauth.model.token.IdTokenFactory.attributeService
AttributeService attributeService
Definition: IdTokenFactory.java:100
org.xdi.oxauth.service.ClientService.decryptSecret
String decryptSecret(String encryptedClientSecret)
Definition: ClientService.java:390
org.xdi.oxauth.model.token.IdTokenFactory.scopeService
ScopeService scopeService
Definition: IdTokenFactory.java:97
org.xdi.oxauth.model.common
Definition: AuthenticationMethod.java:7
org.xdi.oxauth.model.configuration.AppConfiguration.getOpenidSubAttribute
String getOpenidSubAttribute()
Definition: AppConfiguration.java:509
org.xdi.oxauth.service.PairwiseIdentifierService.findPairWiseIdentifier
PairwiseIdentifier findPairWiseIdentifier(String userInum, String sectorIdentifierUri, String clientId)
Definition: PairwiseIdentifierService.java:59
org.xdi.oxauth.service.external.ExternalDynamicScopeService.executeExternalUpdateMethods
boolean executeExternalUpdateMethods(DynamicScopeExternalContext dynamicScopeContext)
Definition: ExternalDynamicScopeService.java:95

◆ generateSignedIdToken()

Jwt org.xdi.oxauth.model.token.IdTokenFactory.generateSignedIdToken ( IAuthorizationGrant  authorizationGrant,
String  nonce,
AuthorizationCode  authorizationCode,
AccessToken  accessToken,
Set< String >  scopes,
boolean  includeIdTokenClaims,
Function< JsonWebResponse, Void >  preProcessing 
) throws Exception
inline
113  {
114 
115  JwtSigner jwtSigner = JwtSigner.newJwtSigner(appConfiguration, webKeysConfiguration, authorizationGrant.getClient());
116  Jwt jwt = jwtSigner.newJwt();
117 
118  int lifeTime = appConfiguration.getIdTokenLifetime();
119  Calendar calendar = Calendar.getInstance();
120  Date issuedAt = calendar.getTime();
121  calendar.add(Calendar.SECOND, lifeTime);
122  Date expiration = calendar.getTime();
123 
124  jwt.getClaims().setExpirationTime(expiration);
125  jwt.getClaims().setIssuedAt(issuedAt);
126 
127  if (preProcessing != null) {
128  preProcessing.apply(jwt);
129  }
130 
131  if (authorizationGrant.getAcrValues() != null) {
132  jwt.getClaims().setClaim(JwtClaimName.AUTHENTICATION_CONTEXT_CLASS_REFERENCE, authorizationGrant.getAcrValues());
133  setAmrClaim(jwt, authorizationGrant.getAcrValues());
134  }
135  if (StringUtils.isNotBlank(nonce)) {
136  jwt.getClaims().setClaim(JwtClaimName.NONCE, nonce);
137  }
138  if (authorizationGrant.getAuthenticationTime() != null) {
139  jwt.getClaims().setClaim(JwtClaimName.AUTHENTICATION_TIME, authorizationGrant.getAuthenticationTime());
140  }
141  if (authorizationCode != null) {
142  String codeHash = authorizationCode.getHash(jwtSigner.getSignatureAlgorithm());
143  jwt.getClaims().setClaim(JwtClaimName.CODE_HASH, codeHash);
144  }
145  if (accessToken != null) {
146  String accessTokenHash = accessToken.getHash(jwtSigner.getSignatureAlgorithm());
147  jwt.getClaims().setClaim(JwtClaimName.ACCESS_TOKEN_HASH, accessTokenHash);
148  }
149  jwt.getClaims().setClaim(JwtClaimName.OX_OPENID_CONNECT_VERSION, appConfiguration.getOxOpenIdConnectVersion());
150 
151  List<org.xdi.oxauth.model.common.Scope> dynamicScopes = Lists.newArrayList();
152  if (includeIdTokenClaims && authorizationGrant.getClient().isIncludeClaimsInIdToken()) {
153  for (String scopeName : scopes) {
154  org.xdi.oxauth.model.common.Scope scope = scopeService.getScopeByDisplayName(scopeName);
155  if ((scope != null) && (org.xdi.oxauth.model.common.ScopeType.DYNAMIC == scope.getScopeType())) {
156  dynamicScopes.add(scope);
157  continue;
158  }
159 
160  if (scope != null && scope.getOxAuthClaims() != null) {
161  if (scope.getIsOxAuthGroupClaims()) {
162  JwtSubClaimObject groupClaim = new JwtSubClaimObject();
163  groupClaim.setName(scope.getDisplayName());
164 
165  for (String claimDn : scope.getOxAuthClaims()) {
166  GluuAttribute gluuAttribute = attributeService.getAttributeByDn(claimDn);
167 
168  String claimName = gluuAttribute.getOxAuthClaimName();
169  String ldapName = gluuAttribute.getName();
170  Object attributeValue;
171 
172  if (StringUtils.isNotBlank(claimName) && StringUtils.isNotBlank(ldapName)) {
173  if (ldapName.equals("uid")) {
174  attributeValue = authorizationGrant.getUser().getUserId();
175  } else {
176  attributeValue = authorizationGrant.getUser().getAttribute(gluuAttribute.getName(), true);
177  }
178 
179  if (attributeValue != null) {
180  if (attributeValue instanceof JSONArray) {
181  JSONArray jsonArray = (JSONArray) attributeValue;
182  List<String> values = new ArrayList<String>();
183  for (int i = 0; i < jsonArray.length(); i++) {
184  String value = jsonArray.optString(i);
185  if (value != null) {
186  values.add(value);
187  }
188  }
189  jwt.getClaims().setClaim(claimName, values);
190  } else {
191  String value = attributeValue.toString();
192  jwt.getClaims().setClaim(claimName, value);
193  }
194  }
195  }
196  }
197 
198  jwt.getClaims().setClaim(scope.getDisplayName(), groupClaim);
199  } else {
200  for (String claimDn : scope.getOxAuthClaims()) {
201  GluuAttribute gluuAttribute = attributeService.getAttributeByDn(claimDn);
202 
203  String claimName = gluuAttribute.getOxAuthClaimName();
204  String ldapName = gluuAttribute.getName();
205  Object attributeValue;
206 
207  if (StringUtils.isNotBlank(claimName) && StringUtils.isNotBlank(ldapName)) {
208  if (ldapName.equals("uid")) {
209  attributeValue = authorizationGrant.getUser().getUserId();
210  } else {
211  attributeValue = authorizationGrant.getUser().getAttribute(gluuAttribute.getName(), true);
212  }
213 
214  if (attributeValue != null) {
215  if (attributeValue instanceof JSONArray) {
216  JSONArray jsonArray = (JSONArray) attributeValue;
217  List<String> values = new ArrayList<String>();
218  for (int i = 0; i < jsonArray.length(); i++) {
219  String value = jsonArray.optString(i);
220  if (value != null) {
221  values.add(value);
222  }
223  }
224  jwt.getClaims().setClaim(claimName, values);
225  } else {
226  String value = attributeValue.toString();
227  jwt.getClaims().setClaim(claimName, value);
228  }
229  }
230  }
231  }
232  }
233  }
234  }
235  }
236 
237  if (authorizationGrant.getJwtAuthorizationRequest() != null
238  && authorizationGrant.getJwtAuthorizationRequest().getIdTokenMember() != null) {
239  for (Claim claim : authorizationGrant.getJwtAuthorizationRequest().getIdTokenMember().getClaims()) {
240  boolean optional = true; // ClaimValueType.OPTIONAL.equals(claim.getClaimValue().getClaimValueType());
241  GluuAttribute gluuAttribute = attributeService.getByClaimName(claim.getName());
242 
243  if (gluuAttribute != null) {
244  Client client = authorizationGrant.getClient();
245 
246  if (validateRequesteClaim(gluuAttribute, client.getClaims(), scopes)) {
247  String ldapClaimName = gluuAttribute.getName();
248  Object attribute = authorizationGrant.getUser().getAttribute(ldapClaimName, optional);
249  if (attribute != null) {
250  if (attribute instanceof JSONArray) {
251  JSONArray jsonArray = (JSONArray) attribute;
252  List<String> values = new ArrayList<String>();
253  for (int i = 0; i < jsonArray.length(); i++) {
254  String value = jsonArray.optString(i);
255  if (value != null) {
256  values.add(value);
257  }
258  }
259  jwt.getClaims().setClaim(claim.getName(), values);
260  } else {
261  String value = (String) attribute;
262  jwt.getClaims().setClaim(claim.getName(), value);
263  }
264  }
265  }
266  }
267  }
268  }
269 
270  // Check for Subject Identifier Type
271  if (authorizationGrant.getClient().getSubjectType() != null &&
272  SubjectType.fromString(authorizationGrant.getClient().getSubjectType()).equals(SubjectType.PAIRWISE)) {
273  String sectorIdentifierUri = null;
274  if (StringUtils.isNotBlank(authorizationGrant.getClient().getSectorIdentifierUri())) {
275  sectorIdentifierUri = authorizationGrant.getClient().getSectorIdentifierUri();
276  } else {
277  sectorIdentifierUri = authorizationGrant.getClient().getRedirectUris()[0];
278  }
279 
280  String userInum = authorizationGrant.getUser().getAttribute("inum");
281  String clientId = authorizationGrant.getClientId();
282  PairwiseIdentifier pairwiseIdentifier = pairwiseIdentifierService.findPairWiseIdentifier(
283  userInum, sectorIdentifierUri, clientId);
284  if (pairwiseIdentifier == null) {
285  pairwiseIdentifier = new PairwiseIdentifier(sectorIdentifierUri, clientId);
286  pairwiseIdentifier.setId(UUID.randomUUID().toString());
287  pairwiseIdentifier.setDn(pairwiseIdentifierService.getDnForPairwiseIdentifier(
288  pairwiseIdentifier.getId(),
289  userInum));
290  pairwiseIdentifierService.addPairwiseIdentifier(userInum, pairwiseIdentifier);
291  }
292  jwt.getClaims().setSubjectIdentifier(pairwiseIdentifier.getId());
293  } else {
294  String openidSubAttribute = appConfiguration.getOpenidSubAttribute();
295 
296  if (openidSubAttribute.equals("uid")) {
297  jwt.getClaims().setSubjectIdentifier(authorizationGrant.getUser().getUserId());
298  } else {
299  jwt.getClaims().setSubjectIdentifier(authorizationGrant.getUser().getAttribute(openidSubAttribute));
300  }
301  }
302 
303  if ((dynamicScopes.size() > 0) && externalDynamicScopeService.isEnabled()) {
304  final UnmodifiableAuthorizationGrant unmodifiableAuthorizationGrant = new UnmodifiableAuthorizationGrant(authorizationGrant);
305  DynamicScopeExternalContext dynamicScopeContext = new DynamicScopeExternalContext(dynamicScopes, jwt, unmodifiableAuthorizationGrant);
306  externalDynamicScopeService.executeExternalUpdateMethods(dynamicScopeContext);
307  }
308 
309  return jwtSigner.sign();
310  }
org.xdi.oxauth.service.PairwiseIdentifierService.getDnForPairwiseIdentifier
String getDnForPairwiseIdentifier(String oxId, String userInum)
Definition: PairwiseIdentifierService.java:107
org.xdi.oxauth.model.token.IdTokenFactory.appConfiguration
AppConfiguration appConfiguration
Definition: IdTokenFactory.java:106
org.xdi.oxauth.service.AttributeService.getAttributeByDn
GluuAttribute getAttributeByDn(String dn)
Definition: AttributeService.java:47
org.xdi.oxauth.model.token.IdTokenFactory.webKeysConfiguration
WebKeysConfiguration webKeysConfiguration
Definition: IdTokenFactory.java:109
org.xdi.oxauth.model.token.IdTokenFactory.pairwiseIdentifierService
PairwiseIdentifierService pairwiseIdentifierService
Definition: IdTokenFactory.java:103
org.xdi.oxauth.service.AttributeService.getByClaimName
GluuAttribute getByClaimName(String name)
Definition: AttributeService.java:73
org.xdi.oxauth.service.ScopeService.getScopeByDisplayName
org.xdi.oxauth.model.common.Scope getScopeByDisplayName(String displayName)
Definition: ScopeService.java:119
org.xdi.oxauth.model.token.IdTokenFactory.externalDynamicScopeService
ExternalDynamicScopeService externalDynamicScopeService
Definition: IdTokenFactory.java:88
org.xdi.oxauth.model.common.ScopeType.DYNAMIC
DYNAMIC
Definition: ScopeType.java:56
org.xdi.oxauth.model.configuration.AppConfiguration.getOxOpenIdConnectVersion
String getOxOpenIdConnectVersion()
Definition: AppConfiguration.java:864
org.xdi.oxauth.model.token.IdTokenFactory.validateRequesteClaim
boolean validateRequesteClaim(GluuAttribute gluuAttribute, String[] clientAllowedClaims, Collection< String > scopes)
Definition: IdTokenFactory.java:550
org.xdi.oxauth.model.configuration.AppConfiguration.getIdTokenLifetime
int getIdTokenLifetime()
Definition: AppConfiguration.java:784
org.xdi.oxauth.model.common.Scope
Definition: Scope.java:23
org.xdi.oxauth.model.common.ScopeType
Definition: ScopeType.java:21
org.xdi.oxauth.service.PairwiseIdentifierService.addPairwiseIdentifier
void addPairwiseIdentifier(String userInum, PairwiseIdentifier pairwiseIdentifier)
Definition: PairwiseIdentifierService.java:100
org.xdi.oxauth.model.token.IdTokenFactory.setAmrClaim
void setAmrClaim(JsonWebResponse jwt, String acrValues)
Definition: IdTokenFactory.java:312
org.xdi.oxauth.model.token.IdTokenFactory.attributeService
AttributeService attributeService
Definition: IdTokenFactory.java:100
org.xdi.oxauth.model.token.IdTokenFactory.scopeService
ScopeService scopeService
Definition: IdTokenFactory.java:97
org.xdi.oxauth.model.common
Definition: AuthenticationMethod.java:7
org.xdi.oxauth.model.configuration.AppConfiguration.getOpenidSubAttribute
String getOpenidSubAttribute()
Definition: AppConfiguration.java:509
org.xdi.oxauth.service.PairwiseIdentifierService.findPairWiseIdentifier
PairwiseIdentifier findPairWiseIdentifier(String userInum, String sectorIdentifierUri, String clientId)
Definition: PairwiseIdentifierService.java:59
org.xdi.oxauth.service.external.ExternalDynamicScopeService.executeExternalUpdateMethods
boolean executeExternalUpdateMethods(DynamicScopeExternalContext dynamicScopeContext)
Definition: ExternalDynamicScopeService.java:95

◆ setAmrClaim()

void org.xdi.oxauth.model.token.IdTokenFactory.setAmrClaim ( JsonWebResponse  jwt,
String  acrValues 
)
inlineprivate
312  {
313  List<String> amrList = Lists.newArrayList();
314 
315  CustomScriptConfiguration script = externalAuthenticationService.getCustomScriptConfigurationByName(acrValues);
316  if (script != null) {
317  amrList.add(Integer.toString(script.getLevel()));
318 
319  PersonAuthenticationType externalAuthenticator = (PersonAuthenticationType) script.getExternalType();
320  int apiVersion = externalAuthenticator.getApiVersion();
321 
322  if (apiVersion > 3) {
323  Map<String, String> authenticationMethodClaimsOrNull = externalAuthenticator.getAuthenticationMethodClaims();
324  if (authenticationMethodClaimsOrNull != null) {
325  for (String key : authenticationMethodClaimsOrNull.keySet()) {
326  amrList.add(key + ":" + authenticationMethodClaimsOrNull.get(key));
327  }
328  }
329  }
330  }
331 
332  jwt.getClaims().setClaim(JwtClaimName.AUTHENTICATION_METHOD_REFERENCES, amrList);
333  }
org.xdi.oxauth.service.external.ExternalAuthenticationService.getCustomScriptConfigurationByName
CustomScriptConfiguration getCustomScriptConfigurationByName(String name)
Definition: ExternalAuthenticationService.java:400
org.xdi.oxauth.model.token.IdTokenFactory.externalAuthenticationService
ExternalAuthenticationService externalAuthenticationService
Definition: IdTokenFactory.java:91

◆ validateRequesteClaim()

boolean org.xdi.oxauth.model.token.IdTokenFactory.validateRequesteClaim ( GluuAttribute  gluuAttribute,
String []  clientAllowedClaims,
Collection< String >  scopes 
)
inline
550  {
551  if (gluuAttribute != null) {
552  if (clientAllowedClaims != null) {
553  for (int i = 0; i < clientAllowedClaims.length; i++) {
554  if (gluuAttribute.getDn().equals(clientAllowedClaims[i])) {
555  return true;
556  }
557  }
558  }
559 
560  for (String scopeName : scopes) {
561  org.xdi.oxauth.model.common.Scope scope = scopeService.getScopeByDisplayName(scopeName);
562 
563  if (scope != null && scope.getOxAuthClaims() != null) {
564  for (String claimDn : scope.getOxAuthClaims()) {
565  if (gluuAttribute.getDisplayName().equals(attributeService.getAttributeByDn(claimDn).getDisplayName())) {
566  return true;
567  }
568  }
569  }
570  }
571  }
572 
573  return false;
574  }
org.xdi.oxauth.service.AttributeService.getAttributeByDn
GluuAttribute getAttributeByDn(String dn)
Definition: AttributeService.java:47
org.xdi.oxauth.service.ScopeService.getScopeByDisplayName
org.xdi.oxauth.model.common.Scope getScopeByDisplayName(String displayName)
Definition: ScopeService.java:119
org.xdi.oxauth.model.common.Scope
Definition: Scope.java:23
org.xdi.oxauth.model.token.IdTokenFactory.attributeService
AttributeService attributeService
Definition: IdTokenFactory.java:100
org.xdi.oxauth.model.token.IdTokenFactory.scopeService
ScopeService scopeService
Definition: IdTokenFactory.java:97
org.xdi.oxauth.model.common
Definition: AuthenticationMethod.java:7

メンバ詳解

◆ appConfiguration

AppConfiguration org.xdi.oxauth.model.token.IdTokenFactory.appConfiguration
private

◆ attributeService

AttributeService org.xdi.oxauth.model.token.IdTokenFactory.attributeService
private

◆ clientService

ClientService org.xdi.oxauth.model.token.IdTokenFactory.clientService
private

◆ externalAuthenticationService

ExternalAuthenticationService org.xdi.oxauth.model.token.IdTokenFactory.externalAuthenticationService
private

◆ externalDynamicScopeService

ExternalDynamicScopeService org.xdi.oxauth.model.token.IdTokenFactory.externalDynamicScopeService
private

◆ pairwiseIdentifierService

PairwiseIdentifierService org.xdi.oxauth.model.token.IdTokenFactory.pairwiseIdentifierService
private

◆ scopeService

ScopeService org.xdi.oxauth.model.token.IdTokenFactory.scopeService
private

◆ webKeysConfiguration

WebKeysConfiguration org.xdi.oxauth.model.token.IdTokenFactory.webKeysConfiguration
private
このクラス詳解は次のファイルから抽出されました:
2018年09月30日(日) 14時46分16秒作成 - gluu / 構成:   doxygen 1.8.13