org.mitre.openid.connect.web.DynamicClientRegistrationEndpoint クラス

org.mitre.openid.connect.web.DynamicClientRegistrationEndpoint 連携図

公開メンバ関数
String	registerNewClient (@RequestBody String jsonString, Model m)
String	readClientConfiguration (@PathVariable("id") String clientId, Model m, OAuth2Authentication auth)
String	updateClient (@PathVariable("id") String clientId, @RequestBody String jsonString, Model m, OAuth2Authentication auth)
String	deleteClient (@PathVariable("id") String clientId, Model m, OAuth2Authentication auth)

静的公開変数類
static final String	URL = "register"

非公開メンバ関数
ClientDetailsEntity	validateScopes (ClientDetailsEntity newClient) throws ValidationException
ClientDetailsEntity	validateResponseTypes (ClientDetailsEntity newClient) throws ValidationException
ClientDetailsEntity	validateGrantTypes (ClientDetailsEntity newClient) throws ValidationException
ClientDetailsEntity	validateRedirectUris (ClientDetailsEntity newClient) throws ValidationException
ClientDetailsEntity	validateAuth (ClientDetailsEntity newClient) throws ValidationException
ClientDetailsEntity	validateSoftwareStatement (ClientDetailsEntity newClient) throws ValidationException
OAuth2AccessTokenEntity	rotateRegistrationTokenIfNecessary (OAuth2Authentication auth, ClientDetailsEntity client)

非公開変数類
ClientDetailsEntityService	clientService
OAuth2TokenEntityService	tokenService
SystemScopeService	scopeService
BlacklistedSiteService	blacklistService
ConfigurationPropertiesBean	config
OIDCTokenService	connectTokenService
AssertionValidator	assertionValidator

静的非公開変数類
static final Logger	logger = LoggerFactory.getLogger(DynamicClientRegistrationEndpoint.class)

詳解

関数詳解

deleteClient()

String org.mitre.openid.connect.web.DynamicClientRegistrationEndpoint.deleteClient ( @PathVariable("id") String  clientId, Model  m, OAuth2Authentication  auth  )

inline

Delete the indicated client from the system.

引数

clientId
m
auth

戻り値

                                                                                                            {

                ClientDetailsEntity client = clientService.loadClientByClientId(clientId);

                if (client != null && client.getClientId().equals(auth.getOAuth2Request().getClientId())) {

                        clientService.deleteClient(client);

                        m.addAttribute(HttpCodeView.CODE, HttpStatus.NO_CONTENT); // http 204

                        return HttpCodeView.VIEWNAME;
                } else {
                        // client mismatch
                        logger.error("readClientConfiguration failed, client ID mismatch: "
                                        + clientId + " and " + auth.getOAuth2Request().getClientId() + " do not match.");
                        m.addAttribute(HttpCodeView.CODE, HttpStatus.FORBIDDEN); // http 403

                        return HttpCodeView.VIEWNAME;
                }
        }

readClientConfiguration()

String org.mitre.openid.connect.web.DynamicClientRegistrationEndpoint.readClientConfiguration ( @PathVariable("id") String  clientId, Model  m, OAuth2Authentication  auth  )

inline

Get the meta information for a client.

引数

clientId
m
auth

戻り値

                                                                                                                       {

                ClientDetailsEntity client = clientService.loadClientByClientId(clientId);

                if (client != null && client.getClientId().equals(auth.getOAuth2Request().getClientId())) {

                        try {
                                OAuth2AccessTokenEntity token = rotateRegistrationTokenIfNecessary(auth, client);
                                RegisteredClient registered = new RegisteredClient(client, token.getValue(), config.getIssuer() + "register/" +  UriUtils.encodePathSegment(client.getClientId(), "UTF-8"));

                                // send it all out to the view
                                m.addAttribute("client", registered);
                                m.addAttribute(HttpCodeView.CODE, HttpStatus.OK); // http 200

                                return ClientInformationResponseView.VIEWNAME;
                        } catch (UnsupportedEncodingException e) {
                                logger.error("Unsupported encoding", e);
                                m.addAttribute(HttpCodeView.CODE, HttpStatus.INTERNAL_SERVER_ERROR);
                                return HttpCodeView.VIEWNAME;
                        }

                } else {
                        // client mismatch
                        logger.error("readClientConfiguration failed, client ID mismatch: "
                                        + clientId + " and " + auth.getOAuth2Request().getClientId() + " do not match.");
                        m.addAttribute(HttpCodeView.CODE, HttpStatus.FORBIDDEN); // http 403

                        return HttpCodeView.VIEWNAME;
                }
        }

registerNewClient()

String org.mitre.openid.connect.web.DynamicClientRegistrationEndpoint.registerNewClient ( @RequestBody String  jsonString, Model  m  )

inline

Create a new Client, issue a client ID, and create a registration access token.

引数

jsonString
m
p

戻り値

                                                                                 {

                ClientDetailsEntity newClient = null;
                try {
                        newClient = ClientDetailsEntityJsonProcessor.parse(jsonString);
                } catch (JsonSyntaxException e) {
                        // bad parse
                        // didn't parse, this is a bad request
                        logger.error("registerNewClient failed; submitted JSON is malformed");
                        m.addAttribute(HttpCodeView.CODE, HttpStatus.BAD_REQUEST); // http 400
                        return HttpCodeView.VIEWNAME;
                }

                if (newClient != null) {
                        // it parsed!

                        //
                        // Now do some post-processing consistency checks on it
                        //

                        // clear out any spurious id/secret (clients don't get to pick)
                        newClient.setClientId(null);
                        newClient.setClientSecret(null);

                        // do validation on the fields
                        try {
                                newClient = validateSoftwareStatement(newClient); // need to handle the software statement first because it might override requested values
                                newClient = validateScopes(newClient);
                                newClient = validateResponseTypes(newClient);
                                newClient = validateGrantTypes(newClient);
                                newClient = validateRedirectUris(newClient);
                                newClient = validateAuth(newClient);
                        } catch (ValidationException ve) {
                                // validation failed, return an error
                                m.addAttribute(JsonErrorView.ERROR, ve.getError());
                                m.addAttribute(JsonErrorView.ERROR_MESSAGE, ve.getErrorDescription());
                                m.addAttribute(HttpCodeView.CODE, ve.getStatus());
                                return JsonErrorView.VIEWNAME;
                        }

                        if (newClient.getTokenEndpointAuthMethod() == null) {
                                newClient.setTokenEndpointAuthMethod(AuthMethod.SECRET_BASIC);
                        }

                        if (newClient.getTokenEndpointAuthMethod() == AuthMethod.SECRET_BASIC ||
                                        newClient.getTokenEndpointAuthMethod() == AuthMethod.SECRET_JWT ||
                                        newClient.getTokenEndpointAuthMethod() == AuthMethod.SECRET_POST) {

                                // we need to generate a secret
                                newClient = clientService.generateClientSecret(newClient);
                        }

                        // set some defaults for token timeouts
                        if (config.isHeartMode()) {
                                // heart mode has different defaults depending on primary grant type
                                if (newClient.getGrantTypes().contains("authorization_code")) {
                                        newClient.setAccessTokenValiditySeconds((int)TimeUnit.HOURS.toSeconds(1)); // access tokens good for 1hr
                                        newClient.setIdTokenValiditySeconds((int)TimeUnit.MINUTES.toSeconds(5)); // id tokens good for 5min
                                        newClient.setRefreshTokenValiditySeconds((int)TimeUnit.HOURS.toSeconds(24)); // refresh tokens good for 24hr
                                } else if (newClient.getGrantTypes().contains("implicit")) {
                                        newClient.setAccessTokenValiditySeconds((int)TimeUnit.MINUTES.toSeconds(15)); // access tokens good for 15min
                                        newClient.setIdTokenValiditySeconds((int)TimeUnit.MINUTES.toSeconds(5)); // id tokens good for 5min
                                        newClient.setRefreshTokenValiditySeconds(0); // no refresh tokens
                                } else if (newClient.getGrantTypes().contains("client_credentials")) {
                                        newClient.setAccessTokenValiditySeconds((int)TimeUnit.HOURS.toSeconds(6)); // access tokens good for 6hr
                                        newClient.setIdTokenValiditySeconds(0); // no id tokens
                                        newClient.setRefreshTokenValiditySeconds(0); // no refresh tokens
                                }
                        } else {
                                newClient.setAccessTokenValiditySeconds((int)TimeUnit.HOURS.toSeconds(1)); // access tokens good for 1hr
                                newClient.setIdTokenValiditySeconds((int)TimeUnit.MINUTES.toSeconds(10)); // id tokens good for 10min
                                newClient.setRefreshTokenValiditySeconds(null); // refresh tokens good until revoked
                        }

                        // this client has been dynamically registered (obviously)
                        newClient.setDynamicallyRegistered(true);

                        // this client can't do token introspection
                        newClient.setAllowIntrospection(false);

                        // now save it
                        try {
                                ClientDetailsEntity savedClient = clientService.saveNewClient(newClient);

                                // generate the registration access token
                                OAuth2AccessTokenEntity token = connectTokenService.createRegistrationAccessToken(savedClient);
                                token = tokenService.saveAccessToken(token);

                                // send it all out to the view

                                RegisteredClient registered = new RegisteredClient(savedClient, token.getValue(), config.getIssuer() + "register/" + UriUtils.encodePathSegment(savedClient.getClientId(), "UTF-8"));
                                m.addAttribute("client", registered);
                                m.addAttribute(HttpCodeView.CODE, HttpStatus.CREATED); // http 201

                                return ClientInformationResponseView.VIEWNAME;
                        } catch (UnsupportedEncodingException e) {
                                logger.error("Unsupported encoding", e);
                                m.addAttribute(HttpCodeView.CODE, HttpStatus.INTERNAL_SERVER_ERROR);
                                return HttpCodeView.VIEWNAME;
                        } catch (IllegalArgumentException e) {
                                logger.error("Couldn't save client", e);

                                m.addAttribute(JsonErrorView.ERROR, "invalid_client_metadata");
                                m.addAttribute(JsonErrorView.ERROR_MESSAGE, "Unable to save client due to invalid or inconsistent metadata.");
                                m.addAttribute(HttpCodeView.CODE, HttpStatus.BAD_REQUEST); // http 400

                                return JsonErrorView.VIEWNAME;
                        }
                } else {
                        // didn't parse, this is a bad request
                        logger.error("registerNewClient failed; submitted JSON is malformed");
                        m.addAttribute(HttpCodeView.CODE, HttpStatus.BAD_REQUEST); // http 400

                        return HttpCodeView.VIEWNAME;
                }

        }

rotateRegistrationTokenIfNecessary()

OAuth2AccessTokenEntity org.mitre.openid.connect.web.DynamicClientRegistrationEndpoint.rotateRegistrationTokenIfNecessary ( OAuth2Authentication  auth, ClientDetailsEntity  client  )

inlineprivate

                                                                                                                                  {

                OAuth2AuthenticationDetails details = (OAuth2AuthenticationDetails) auth.getDetails();
                OAuth2AccessTokenEntity token = tokenService.readAccessToken(details.getTokenValue());

                if (config.getRegTokenLifeTime() != null) {

                        try {
                                // Re-issue the token if it has been issued before [currentTime - validity]
                                Date validToDate = new Date(System.currentTimeMillis() - config.getRegTokenLifeTime() * 1000);
                                if(token.getJwt().getJWTClaimsSet().getIssueTime().before(validToDate)) {
                                        logger.info("Rotating the registration access token for " + client.getClientId());
                                        tokenService.revokeAccessToken(token);
                                        OAuth2AccessTokenEntity newToken = connectTokenService.createRegistrationAccessToken(client);
                                        tokenService.saveAccessToken(newToken);
                                        return newToken;
                                } else {
                                        // it's not expired, keep going
                                        return token;
                                }
                        } catch (ParseException e) {
                                logger.error("Couldn't parse a known-valid token?", e);
                                return token;
                        }
                } else {
                        // tokens don't expire, just return it
                        return token;
                }
        }

updateClient()

String org.mitre.openid.connect.web.DynamicClientRegistrationEndpoint.updateClient ( @PathVariable("id") String  clientId, @RequestBody String  jsonString, Model  m, OAuth2Authentication  auth  )

inline

Update the metainformation for a given client.

引数

clientId
jsonString
m
auth

戻り値

                                                                                                                                            {


                ClientDetailsEntity newClient = null;
                try {
                        newClient = ClientDetailsEntityJsonProcessor.parse(jsonString);
                } catch (JsonSyntaxException e) {
                        // bad parse
                        // didn't parse, this is a bad request
                        logger.error("updateClient failed; submitted JSON is malformed");
                        m.addAttribute(HttpCodeView.CODE, HttpStatus.BAD_REQUEST); // http 400
                        return HttpCodeView.VIEWNAME;
                }
                ClientDetailsEntity oldClient = clientService.loadClientByClientId(clientId);

                if (newClient != null && oldClient != null  // we have an existing client and the new one parsed
                                && oldClient.getClientId().equals(auth.getOAuth2Request().getClientId()) // the client passed in the URI matches the one in the auth
                                && oldClient.getClientId().equals(newClient.getClientId()) // the client passed in the body matches the one in the URI
                                ) {

                        // a client can't ask to update its own client secret to any particular value
                        newClient.setClientSecret(oldClient.getClientSecret());

                        // we need to copy over all of the local and SECOAUTH fields
                        newClient.setAccessTokenValiditySeconds(oldClient.getAccessTokenValiditySeconds());
                        newClient.setIdTokenValiditySeconds(oldClient.getIdTokenValiditySeconds());
                        newClient.setRefreshTokenValiditySeconds(oldClient.getRefreshTokenValiditySeconds());
                        newClient.setDynamicallyRegistered(true); // it's still dynamically registered
                        newClient.setAllowIntrospection(false); // dynamically registered clients can't do introspection -- use the resource registration instead
                        newClient.setAuthorities(oldClient.getAuthorities());
                        newClient.setClientDescription(oldClient.getClientDescription());
                        newClient.setCreatedAt(oldClient.getCreatedAt());
                        newClient.setReuseRefreshToken(oldClient.isReuseRefreshToken());

                        // do validation on the fields
                        try {
                                newClient = validateSoftwareStatement(newClient); // need to handle the software statement first because it might override requested values
                                newClient = validateScopes(newClient);
                                newClient = validateResponseTypes(newClient);
                                newClient = validateGrantTypes(newClient);
                                newClient = validateRedirectUris(newClient);
                                newClient = validateAuth(newClient);
                        } catch (ValidationException ve) {
                                // validation failed, return an error
                                m.addAttribute(JsonErrorView.ERROR, ve.getError());
                                m.addAttribute(JsonErrorView.ERROR_MESSAGE, ve.getErrorDescription());
                                m.addAttribute(HttpCodeView.CODE, ve.getStatus());
                                return JsonErrorView.VIEWNAME;
                        }

                        try {
                                // save the client
                                ClientDetailsEntity savedClient = clientService.updateClient(oldClient, newClient);

                                OAuth2AccessTokenEntity token = rotateRegistrationTokenIfNecessary(auth, savedClient);

                                RegisteredClient registered = new RegisteredClient(savedClient, token.getValue(), config.getIssuer() + "register/" + UriUtils.encodePathSegment(savedClient.getClientId(), "UTF-8"));

                                // send it all out to the view
                                m.addAttribute("client", registered);
                                m.addAttribute(HttpCodeView.CODE, HttpStatus.OK); // http 200

                                return ClientInformationResponseView.VIEWNAME;
                        } catch (UnsupportedEncodingException e) {
                                logger.error("Unsupported encoding", e);
                                m.addAttribute(HttpCodeView.CODE, HttpStatus.INTERNAL_SERVER_ERROR);
                                return HttpCodeView.VIEWNAME;
                        } catch (IllegalArgumentException e) {
                                logger.error("Couldn't save client", e);

                                m.addAttribute(JsonErrorView.ERROR, "invalid_client_metadata");
                                m.addAttribute(JsonErrorView.ERROR_MESSAGE, "Unable to save client due to invalid or inconsistent metadata.");
                                m.addAttribute(HttpCodeView.CODE, HttpStatus.BAD_REQUEST); // http 400

                                return JsonErrorView.VIEWNAME;
                        }
                } else {
                        // client mismatch
                        logger.error("updateClient failed, client ID mismatch: "
                                        + clientId + " and " + auth.getOAuth2Request().getClientId() + " do not match.");
                        m.addAttribute(HttpCodeView.CODE, HttpStatus.FORBIDDEN); // http 403

                        return HttpCodeView.VIEWNAME;
                }
        }

validateAuth()

ClientDetailsEntity org.mitre.openid.connect.web.DynamicClientRegistrationEndpoint.validateAuth ( ClientDetailsEntity  newClient ) throws ValidationException

inlineprivate

                                                                                                           {
                if (newClient.getTokenEndpointAuthMethod() == null) {
                        newClient.setTokenEndpointAuthMethod(AuthMethod.SECRET_BASIC);
                }

                if (newClient.getTokenEndpointAuthMethod() == AuthMethod.SECRET_BASIC ||
                                newClient.getTokenEndpointAuthMethod() == AuthMethod.SECRET_JWT ||
                                newClient.getTokenEndpointAuthMethod() == AuthMethod.SECRET_POST) {

                        if (Strings.isNullOrEmpty(newClient.getClientSecret())) {
                                // no secret yet, we need to generate a secret
                                newClient = clientService.generateClientSecret(newClient);
                        }
                } else if (newClient.getTokenEndpointAuthMethod() == AuthMethod.PRIVATE_KEY) {
                        if (Strings.isNullOrEmpty(newClient.getJwksUri()) && newClient.getJwks() == null) {
                                throw new ValidationException("invalid_client_metadata", "JWK Set URI required when using private key authentication", HttpStatus.BAD_REQUEST);
                        }

                        newClient.setClientSecret(null);
                } else if (newClient.getTokenEndpointAuthMethod() == AuthMethod.NONE) {
                        newClient.setClientSecret(null);
                } else {
                        throw new ValidationException("invalid_client_metadata", "Unknown authentication method", HttpStatus.BAD_REQUEST);
                }
                return newClient;
        }

validateGrantTypes()

ClientDetailsEntity org.mitre.openid.connect.web.DynamicClientRegistrationEndpoint.validateGrantTypes ( ClientDetailsEntity  newClient ) throws ValidationException

inlineprivate

                                                                                                                 {
                // set default grant types if needed
                if (newClient.getGrantTypes() == null || newClient.getGrantTypes().isEmpty()) {
                        if (newClient.getScope().contains("offline_access")) { // client asked for offline access
                                newClient.setGrantTypes(Sets.newHashSet("authorization_code", "refresh_token")); // allow authorization code and refresh token grant types by default
                        } else {
                                newClient.setGrantTypes(Sets.newHashSet("authorization_code")); // allow authorization code grant type by default
                        }
                        if (config.isDualClient()) {
                                Set<String> extendedGrandTypes = newClient.getGrantTypes();
                                extendedGrandTypes.add("client_credentials");
                                newClient.setGrantTypes(extendedGrandTypes);
                        }
                }

                // filter out unknown grant types
                // TODO: make this a pluggable service
                Set<String> requestedGrantTypes = new HashSet<>(newClient.getGrantTypes());
                requestedGrantTypes.retainAll(
                                ImmutableSet.of("authorization_code", "implicit",
                                                "password", "client_credentials", "refresh_token",
                                                "urn:ietf:params:oauth:grant_type:redelegate"));

                // don't allow "password" grant type for dynamic registration
                if (newClient.getGrantTypes().contains("password")) {
                        // return an error, you can't dynamically register for the password grant
                        throw new ValidationException("invalid_client_metadata", "The password grant type is not allowed in dynamic registration on this server.", HttpStatus.BAD_REQUEST);
                }

                // don't allow clients to have multiple incompatible grant types and scopes
                if (newClient.getGrantTypes().contains("authorization_code")) {

                        // check for incompatible grants
                        if (newClient.getGrantTypes().contains("implicit") ||
                                        (!config.isDualClient() && newClient.getGrantTypes().contains("client_credentials"))) {
                                // return an error, you can't have these grant types together
                                throw new ValidationException("invalid_client_metadata", "Incompatible grant types requested: " + newClient.getGrantTypes(), HttpStatus.BAD_REQUEST);
                        }

                        if (newClient.getResponseTypes().contains("token")) {
                                // return an error, you can't have this grant type and response type together
                                throw new ValidationException("invalid_client_metadata", "Incompatible response types requested: " + newClient.getGrantTypes() + " / " + newClient.getResponseTypes(), HttpStatus.BAD_REQUEST);
                        }

                        newClient.getResponseTypes().add("code");
                }

                if (newClient.getGrantTypes().contains("implicit")) {

                        // check for incompatible grants
                        if (newClient.getGrantTypes().contains("authorization_code") ||
                                        (!config.isDualClient() && newClient.getGrantTypes().contains("client_credentials"))) {
                                // return an error, you can't have these grant types together
                                throw new ValidationException("invalid_client_metadata", "Incompatible grant types requested: " + newClient.getGrantTypes(), HttpStatus.BAD_REQUEST);
                        }

                        if (newClient.getResponseTypes().contains("code")) {
                                // return an error, you can't have this grant type and response type together
                                throw new ValidationException("invalid_client_metadata", "Incompatible response types requested: " + newClient.getGrantTypes() + " / " + newClient.getResponseTypes(), HttpStatus.BAD_REQUEST);
                        }

                        newClient.getResponseTypes().add("token");

                        // don't allow refresh tokens in implicit clients
                        newClient.getGrantTypes().remove("refresh_token");
                        newClient.getScope().remove(SystemScopeService.OFFLINE_ACCESS);
                }

                if (newClient.getGrantTypes().contains("client_credentials")) {

                        // check for incompatible grants
                        if (!config.isDualClient() &&
                                        (newClient.getGrantTypes().contains("authorization_code") || newClient.getGrantTypes().contains("implicit"))) {
                                // return an error, you can't have these grant types together
                                throw new ValidationException("invalid_client_metadata", "Incompatible grant types requested: " + newClient.getGrantTypes(), HttpStatus.BAD_REQUEST);
                        }

                        if (!newClient.getResponseTypes().isEmpty()) {
                                // return an error, you can't have this grant type and response type together
                                throw new ValidationException("invalid_client_metadata", "Incompatible response types requested: " + newClient.getGrantTypes() + " / " + newClient.getResponseTypes(), HttpStatus.BAD_REQUEST);
                        }

                        // don't allow refresh tokens or id tokens in client_credentials clients
                        newClient.getGrantTypes().remove("refresh_token");
                        newClient.getScope().remove(SystemScopeService.OFFLINE_ACCESS);
                        newClient.getScope().remove(SystemScopeService.OPENID_SCOPE);
                }

                if (newClient.getGrantTypes().isEmpty()) {
                        // return an error, you need at least one grant type selected
                        throw new ValidationException("invalid_client_metadata", "Clients must register at least one grant type.", HttpStatus.BAD_REQUEST);
                }
                return newClient;
        }

validateRedirectUris()

ClientDetailsEntity org.mitre.openid.connect.web.DynamicClientRegistrationEndpoint.validateRedirectUris ( ClientDetailsEntity  newClient ) throws ValidationException

inlineprivate

                                                                                                                   {
                // check to make sure this client registered a redirect URI if using a redirect flow
                if (newClient.getGrantTypes().contains("authorization_code") || newClient.getGrantTypes().contains("implicit")) {
                        if (newClient.getRedirectUris() == null || newClient.getRedirectUris().isEmpty()) {
                                // return an error
                                throw new ValidationException("invalid_redirect_uri", "Clients using a redirect-based grant type must register at least one redirect URI.", HttpStatus.BAD_REQUEST);
                        }

                        for (String uri : newClient.getRedirectUris()) {
                                if (blacklistService.isBlacklisted(uri)) {
                                        // return an error
                                        throw new ValidationException("invalid_redirect_uri", "Redirect URI is not allowed: " + uri, HttpStatus.BAD_REQUEST);
                                }

                                if (uri.contains("#")) {
                                        // if it contains the hash symbol then it has a fragment, which isn't allowed
                                        throw new ValidationException("invalid_redirect_uri", "Redirect URI can not have a fragment", HttpStatus.BAD_REQUEST);
                                }
                        }
                }

                return newClient;
        }

validateResponseTypes()

ClientDetailsEntity org.mitre.openid.connect.web.DynamicClientRegistrationEndpoint.validateResponseTypes ( ClientDetailsEntity  newClient ) throws ValidationException

inlineprivate

                                                                                                                    {
                if (newClient.getResponseTypes() == null) {
                        newClient.setResponseTypes(new HashSet<String>());
                }
                return newClient;
        }

validateScopes()

ClientDetailsEntity org.mitre.openid.connect.web.DynamicClientRegistrationEndpoint.validateScopes ( ClientDetailsEntity  newClient ) throws ValidationException

inlineprivate

                                                                                                             {
                // scopes that the client is asking for
                Set<SystemScope> requestedScopes = scopeService.fromStrings(newClient.getScope());

                // the scopes that the client can have must be a subset of the dynamically allowed scopes
                Set<SystemScope> allowedScopes = scopeService.removeRestrictedAndReservedScopes(requestedScopes);

                // if the client didn't ask for any, give them the defaults
                if (allowedScopes == null || allowedScopes.isEmpty()) {
                        allowedScopes = scopeService.getDefaults();
                }

                newClient.setScope(scopeService.toStrings(allowedScopes));

                return newClient;
        }

validateSoftwareStatement()

ClientDetailsEntity org.mitre.openid.connect.web.DynamicClientRegistrationEndpoint.validateSoftwareStatement ( ClientDetailsEntity  newClient ) throws ValidationException

inlineprivate

引数

newClient

戻り値

例外

ValidationException

                                                                                                                        {
                if (newClient.getSoftwareStatement() != null) {
                        if (assertionValidator.isValid(newClient.getSoftwareStatement())) {
                                // we have a software statement and its envelope passed all the checks from our validator

                                // swap out all of the client's fields for the associated parts of the software statement
                                try {
                                        JWTClaimsSet claimSet = newClient.getSoftwareStatement().getJWTClaimsSet();
                                        for (String claim : claimSet.getClaims().keySet()) {
                                                switch (claim) {
                                                        case SOFTWARE_STATEMENT:
                                                                throw new ValidationException("invalid_client_metadata", "Software statement can't include another software statement", HttpStatus.BAD_REQUEST);
                                                        case CLAIMS_REDIRECT_URIS:
                                                                newClient.setClaimsRedirectUris(Sets.newHashSet(claimSet.getStringListClaim(claim)));
                                                                break;
                                                        case CLIENT_SECRET_EXPIRES_AT:
                                                                throw new ValidationException("invalid_client_metadata", "Software statement can't include a client secret expiration time", HttpStatus.BAD_REQUEST);
                                                        case CLIENT_ID_ISSUED_AT:
                                                                throw new ValidationException("invalid_client_metadata", "Software statement can't include a client ID issuance time", HttpStatus.BAD_REQUEST);
                                                        case REGISTRATION_CLIENT_URI:
                                                                throw new ValidationException("invalid_client_metadata", "Software statement can't include a client configuration endpoint", HttpStatus.BAD_REQUEST);
                                                        case REGISTRATION_ACCESS_TOKEN:
                                                                throw new ValidationException("invalid_client_metadata", "Software statement can't include a client registration access token", HttpStatus.BAD_REQUEST);
                                                        case REQUEST_URIS:
                                                                newClient.setRequestUris(Sets.newHashSet(claimSet.getStringListClaim(claim)));
                                                                break;
                                                        case POST_LOGOUT_REDIRECT_URIS:
                                                                newClient.setPostLogoutRedirectUris(Sets.newHashSet(claimSet.getStringListClaim(claim)));
                                                                break;
                                                        case INITIATE_LOGIN_URI:
                                                                newClient.setInitiateLoginUri(claimSet.getStringClaim(claim));
                                                                break;
                                                        case DEFAULT_ACR_VALUES:
                                                                newClient.setDefaultACRvalues(Sets.newHashSet(claimSet.getStringListClaim(claim)));
                                                                break;
                                                        case REQUIRE_AUTH_TIME:
                                                                newClient.setRequireAuthTime(claimSet.getBooleanClaim(claim));
                                                                break;
                                                        case DEFAULT_MAX_AGE:
                                                                newClient.setDefaultMaxAge(claimSet.getIntegerClaim(claim));
                                                                break;
                                                        case TOKEN_ENDPOINT_AUTH_SIGNING_ALG:
                                                                newClient.setTokenEndpointAuthSigningAlg(JWSAlgorithm.parse(claimSet.getStringClaim(claim)));
                                                                break;
                                                        case ID_TOKEN_ENCRYPTED_RESPONSE_ENC:
                                                                newClient.setIdTokenEncryptedResponseEnc(EncryptionMethod.parse(claimSet.getStringClaim(claim)));
                                                                break;
                                                        case ID_TOKEN_ENCRYPTED_RESPONSE_ALG:
                                                                newClient.setIdTokenEncryptedResponseAlg(JWEAlgorithm.parse(claimSet.getStringClaim(claim)));
                                                                break;
                                                        case ID_TOKEN_SIGNED_RESPONSE_ALG:
                                                                newClient.setIdTokenSignedResponseAlg(JWSAlgorithm.parse(claimSet.getStringClaim(claim)));
                                                                break;
                                                        case USERINFO_ENCRYPTED_RESPONSE_ENC:
                                                                newClient.setUserInfoEncryptedResponseEnc(EncryptionMethod.parse(claimSet.getStringClaim(claim)));
                                                                break;
                                                        case USERINFO_ENCRYPTED_RESPONSE_ALG:
                                                                newClient.setUserInfoEncryptedResponseAlg(JWEAlgorithm.parse(claimSet.getStringClaim(claim)));
                                                                break;
                                                        case USERINFO_SIGNED_RESPONSE_ALG:
                                                                newClient.setUserInfoSignedResponseAlg(JWSAlgorithm.parse(claimSet.getStringClaim(claim)));
                                                                break;
                                                        case REQUEST_OBJECT_SIGNING_ALG:
                                                                newClient.setRequestObjectSigningAlg(JWSAlgorithm.parse(claimSet.getStringClaim(claim)));
                                                                break;
                                                        case SUBJECT_TYPE:
                                                                newClient.setSubjectType(SubjectType.getByValue(claimSet.getStringClaim(claim)));
                                                                break;
                                                        case SECTOR_IDENTIFIER_URI:
                                                                newClient.setSectorIdentifierUri(claimSet.getStringClaim(claim));
                                                                break;
                                                        case APPLICATION_TYPE:
                                                                newClient.setApplicationType(AppType.getByValue(claimSet.getStringClaim(claim)));
                                                                break;
                                                        case JWKS_URI:
                                                                newClient.setJwksUri(claimSet.getStringClaim(claim));
                                                                break;
                                                        case JWKS:
                                                                newClient.setJwks(JWKSet.parse(claimSet.getJSONObjectClaim(claim).toJSONString()));
                                                                break;
                                                        case POLICY_URI:
                                                                newClient.setPolicyUri(claimSet.getStringClaim(claim));
                                                                break;
                                                        case RESPONSE_TYPES:
                                                                newClient.setResponseTypes(Sets.newHashSet(claimSet.getStringListClaim(claim)));
                                                                break;
                                                        case GRANT_TYPES:
                                                                newClient.setGrantTypes(Sets.newHashSet(claimSet.getStringListClaim(claim)));
                                                                break;
                                                        case SCOPE:
                                                                newClient.setScope(OAuth2Utils.parseParameterList(claimSet.getStringClaim(claim)));
                                                                break;
                                                        case TOKEN_ENDPOINT_AUTH_METHOD:
                                                                newClient.setTokenEndpointAuthMethod(AuthMethod.getByValue(claimSet.getStringClaim(claim)));
                                                                break;
                                                        case TOS_URI:
                                                                newClient.setTosUri(claimSet.getStringClaim(claim));
                                                                break;
                                                        case CONTACTS:
                                                                newClient.setContacts(Sets.newHashSet(claimSet.getStringListClaim(claim)));
                                                                break;
                                                        case LOGO_URI:
                                                                newClient.setLogoUri(claimSet.getStringClaim(claim));
                                                                break;
                                                        case CLIENT_URI:
                                                                newClient.setClientUri(claimSet.getStringClaim(claim));
                                                                break;
                                                        case CLIENT_NAME:
                                                                newClient.setClientName(claimSet.getStringClaim(claim));
                                                                break;
                                                        case REDIRECT_URIS:
                                                                newClient.setRedirectUris(Sets.newHashSet(claimSet.getStringListClaim(claim)));
                                                                break;
                                                        case CLIENT_SECRET:
                                                                throw new ValidationException("invalid_client_metadata", "Software statement can't contain client secret", HttpStatus.BAD_REQUEST);
                                                        case CLIENT_ID:
                                                                throw new ValidationException("invalid_client_metadata", "Software statement can't contain client ID", HttpStatus.BAD_REQUEST);

                                                        default:
                                                                logger.warn("Software statement contained unknown field: " + claim + " with value " + claimSet.getClaim(claim));
                                                                break;
                                                }
                                        }

                                        return newClient;
                                } catch (ParseException e) {
                                        throw new ValidationException("invalid_client_metadata", "Software statement claims didn't parse", HttpStatus.BAD_REQUEST);
                                }
                        } else {
                                throw new ValidationException("invalid_client_metadata", "Software statement rejected by validator", HttpStatus.BAD_REQUEST);
                        }
                } else {
                        // nothing to see here, carry on
                        return newClient;
                }

        }

メンバ詳解

assertionValidator

AssertionValidator org.mitre.openid.connect.web.DynamicClientRegistrationEndpoint.assertionValidator

private

blacklistService

BlacklistedSiteService org.mitre.openid.connect.web.DynamicClientRegistrationEndpoint.blacklistService

private

clientService

ClientDetailsEntityService org.mitre.openid.connect.web.DynamicClientRegistrationEndpoint.clientService

private

config

ConfigurationPropertiesBean org.mitre.openid.connect.web.DynamicClientRegistrationEndpoint.config

private

connectTokenService

OIDCTokenService org.mitre.openid.connect.web.DynamicClientRegistrationEndpoint.connectTokenService

private

logger

final Logger org.mitre.openid.connect.web.DynamicClientRegistrationEndpoint.logger = LoggerFactory.getLogger(DynamicClientRegistrationEndpoint.class)

staticprivate

Logger for this class

scopeService

SystemScopeService org.mitre.openid.connect.web.DynamicClientRegistrationEndpoint.scopeService

private

tokenService

OAuth2TokenEntityService org.mitre.openid.connect.web.DynamicClientRegistrationEndpoint.tokenService

private

URL

final String org.mitre.openid.connect.web.DynamicClientRegistrationEndpoint.URL = "register"

static

---

このクラス詳解は次のファイルから抽出されました:

• D:/AppData/OpenId/mitreid-connect/src/openid-connect-server/src/main/java/org/mitre/openid/connect/web/DynamicClientRegistrationEndpoint.java