org.mitre.uma.web.AuthorizationRequestEndpoint クラス

org.mitre.uma.web.AuthorizationRequestEndpoint 連携図

公開メンバ関数
String	authorizationRequest (@RequestBody String jsonString, Model m, Authentication auth)

静的公開変数類
static final String	RPT = "rpt"
static final String	TICKET = "ticket"
static final String	URL = "authz_request"

非公開変数類
PermissionService	permissionService
OAuth2TokenEntityService	tokenService
ClaimsProcessingService	claimsProcessingService
UmaTokenService	umaTokenService

静的非公開変数類
static final Logger	logger = LoggerFactory.getLogger(AuthorizationRequestEndpoint.class)

詳解

著者

jricher

関数詳解

authorizationRequest()

String org.mitre.uma.web.AuthorizationRequestEndpoint.authorizationRequest ( @RequestBody String  jsonString, Model  m, Authentication  auth  )

inline

                                                                                                         {

                AuthenticationUtilities.ensureOAuthScope(auth, SystemScopeService.UMA_AUTHORIZATION_SCOPE);

                JsonParser parser = new JsonParser();
                JsonElement e = parser.parse(jsonString);

                if (e.isJsonObject()) {
                        JsonObject o = e.getAsJsonObject();

                        if (o.has(TICKET)) {

                                OAuth2AccessTokenEntity incomingRpt = null;
                                if (o.has(RPT)) {
                                        String rptValue = o.get(RPT).getAsString();
                                        incomingRpt = tokenService.readAccessToken(rptValue);
                                }

                                String ticketValue = o.get(TICKET).getAsString();

                                PermissionTicket ticket = permissionService.getByTicket(ticketValue);

                                if (ticket != null) {
                                        // found the ticket, see if it's any good

                                        ResourceSet rs = ticket.getPermission().getResourceSet();

                                        if (rs.getPolicies() == null || rs.getPolicies().isEmpty()) {
                                                // the required claims are empty, this resource has no way to be authorized

                                                m.addAttribute(JsonErrorView.ERROR, "not_authorized");
                                                m.addAttribute(JsonErrorView.ERROR_MESSAGE, "This resource set can not be accessed.");
                                                m.addAttribute(HttpCodeView.CODE, HttpStatus.FORBIDDEN);
                                                return JsonErrorView.VIEWNAME;
                                        } else {
                                                // claims weren't empty or missing, we need to check against what we have

                                                ClaimProcessingResult result = claimsProcessingService.claimsAreSatisfied(rs, ticket);


                                                if (result.isSatisfied()) {
                                                        // the service found what it was looking for, issue a token

                                                        // we need to downscope this based on the required set that was matched if it was matched
                                                        OAuth2Authentication o2auth = (OAuth2Authentication) auth;

                                                        OAuth2AccessTokenEntity token = umaTokenService.createRequestingPartyToken(o2auth, ticket, result.getMatched());

                                                        // if we have an inbound RPT, throw it out because we're replacing it
                                                        if (incomingRpt != null) {
                                                                tokenService.revokeAccessToken(incomingRpt);
                                                        }

                                                        Map<String, String> entity = ImmutableMap.of("rpt", token.getValue());

                                                        m.addAttribute(JsonEntityView.ENTITY, entity);

                                                        return JsonEntityView.VIEWNAME;

                                                } else {

                                                        // if we got here, the claim didn't match, forward the user to the claim gathering endpoint
                                                        JsonObject entity = new JsonObject();

                                                        entity.addProperty(JsonErrorView.ERROR, "need_info");
                                                        JsonObject details = new JsonObject();

                                                        JsonObject rpClaims = new JsonObject();
                                                        rpClaims.addProperty("redirect_user", true);
                                                        rpClaims.addProperty("ticket", ticketValue);
                                                        JsonArray req = new JsonArray();
                                                        for (Claim claim : result.getUnmatched()) {
                                                                JsonObject c = new JsonObject();
                                                                c.addProperty("name", claim.getName());
                                                                c.addProperty("friendly_name", claim.getFriendlyName());
                                                                c.addProperty("claim_type", claim.getClaimType());
                                                                JsonArray f = new JsonArray();
                                                                for (String format : claim.getClaimTokenFormat()) {
                                                                        f.add(new JsonPrimitive(format));
                                                                }
                                                                c.add("claim_token_format", f);
                                                                JsonArray i = new JsonArray();
                                                                for (String issuer : claim.getIssuer()) {
                                                                        i.add(new JsonPrimitive(issuer));
                                                                }
                                                                c.add("issuer", i);
                                                                req.add(c);
                                                        }
                                                        rpClaims.add("required_claims", req);
                                                        details.add("requesting_party_claims", rpClaims);
                                                        entity.add("error_details", details);

                                                        m.addAttribute(JsonEntityView.ENTITY, entity);
                                                        return JsonEntityView.VIEWNAME;
                                                }


                                        }
                                } else {
                                        // ticket wasn't found, return an error
                                        m.addAttribute(HttpStatus.BAD_REQUEST);
                                        m.addAttribute(JsonErrorView.ERROR, "invalid_ticket");
                                        return JsonErrorView.VIEWNAME;
                                }

                        } else {
                                m.addAttribute(HttpCodeView.CODE, HttpStatus.BAD_REQUEST);
                                m.addAttribute(JsonErrorView.ERROR_MESSAGE, "Missing JSON elements.");
                                return JsonErrorView.VIEWNAME;
                        }


                } else {
                        m.addAttribute(HttpCodeView.CODE, HttpStatus.BAD_REQUEST);
                        m.addAttribute(JsonErrorView.ERROR_MESSAGE, "Malformed JSON request.");
                        return JsonErrorView.VIEWNAME;
                }

        }

メンバ詳解

claimsProcessingService

ClaimsProcessingService org.mitre.uma.web.AuthorizationRequestEndpoint.claimsProcessingService

private

logger

final Logger org.mitre.uma.web.AuthorizationRequestEndpoint.logger = LoggerFactory.getLogger(AuthorizationRequestEndpoint.class)

staticprivate

permissionService

PermissionService org.mitre.uma.web.AuthorizationRequestEndpoint.permissionService

private

RPT

final String org.mitre.uma.web.AuthorizationRequestEndpoint.RPT = "rpt"

static

TICKET

final String org.mitre.uma.web.AuthorizationRequestEndpoint.TICKET = "ticket"

static

tokenService

OAuth2TokenEntityService org.mitre.uma.web.AuthorizationRequestEndpoint.tokenService

private

umaTokenService

UmaTokenService org.mitre.uma.web.AuthorizationRequestEndpoint.umaTokenService

private

URL

final String org.mitre.uma.web.AuthorizationRequestEndpoint.URL = "authz_request"

static

---

このクラス詳解は次のファイルから抽出されました:

• D:/AppData/OpenId/mitreid-connect/src/uma-server/src/main/java/org/mitre/uma/web/AuthorizationRequestEndpoint.java