mitreid-connect
公開メンバ関数 | 非公開メンバ関数 | 非公開変数類 | 静的非公開変数類 | 全メンバ一覧
org.mitre.oauth2.service.impl.DefaultOAuth2ProviderTokenService クラス
org.mitre.oauth2.service.impl.DefaultOAuth2ProviderTokenService の継承関係図
Inheritance graph
org.mitre.oauth2.service.impl.DefaultOAuth2ProviderTokenService 連携図
Collaboration graph

公開メンバ関数

Set< OAuth2AccessTokenEntitygetAllAccessTokensForUser (String id)
 
Set< OAuth2RefreshTokenEntitygetAllRefreshTokensForUser (String id)
 
OAuth2AccessTokenEntity getAccessTokenById (Long id)
 
OAuth2RefreshTokenEntity getRefreshTokenById (Long id)
 
OAuth2AccessTokenEntity createAccessToken (OAuth2Authentication authentication) throws AuthenticationException, InvalidClientException
 
OAuth2AccessTokenEntity refreshAccessToken (String refreshTokenValue, TokenRequest authRequest) throws AuthenticationException
 
OAuth2Authentication loadAuthentication (String accessTokenValue) throws AuthenticationException
 
OAuth2AccessTokenEntity readAccessToken (String accessTokenValue) throws AuthenticationException
 
OAuth2AccessTokenEntity getAccessToken (OAuth2Authentication authentication)
 
OAuth2RefreshTokenEntity getRefreshToken (String refreshTokenValue) throws AuthenticationException
 
void revokeRefreshToken (OAuth2RefreshTokenEntity refreshToken)
 
void revokeAccessToken (OAuth2AccessTokenEntity accessToken)
 
List< OAuth2AccessTokenEntitygetAccessTokensForClient (ClientDetailsEntity client)
 
List< OAuth2RefreshTokenEntitygetRefreshTokensForClient (ClientDetailsEntity client)
 
void clearExpiredTokens ()
 
OAuth2AccessTokenEntity saveAccessToken (OAuth2AccessTokenEntity accessToken)
 
OAuth2RefreshTokenEntity saveRefreshToken (OAuth2RefreshTokenEntity refreshToken)
 
TokenEnhancer getTokenEnhancer ()
 
void setTokenEnhancer (TokenEnhancer tokenEnhancer)
 
OAuth2AccessTokenEntity getRegistrationAccessTokenForClient (ClientDetailsEntity client)
 

非公開メンバ関数

OAuth2AccessTokenEntity clearExpiredAccessToken (OAuth2AccessTokenEntity token)
 
OAuth2RefreshTokenEntity clearExpiredRefreshToken (OAuth2RefreshTokenEntity token)
 
OAuth2RefreshTokenEntity createRefreshToken (ClientDetailsEntity client, AuthenticationHolderEntity authHolder)
 

非公開変数類

OAuth2TokenRepository tokenRepository
 
AuthenticationHolderRepository authenticationHolderRepository
 
ClientDetailsEntityService clientDetailsService
 
TokenEnhancer tokenEnhancer
 
SystemScopeService scopeService
 
ApprovedSiteService approvedSiteService
 

静的非公開変数類

static final Logger logger = LoggerFactory.getLogger(DefaultOAuth2ProviderTokenService.class)
 

詳解

著者
jricher

関数詳解

◆ clearExpiredAccessToken()

OAuth2AccessTokenEntity org.mitre.oauth2.service.impl.DefaultOAuth2ProviderTokenService.clearExpiredAccessToken ( OAuth2AccessTokenEntity  token)
inlineprivate

Utility function to delete an access token that's expired before returning it.

引数
tokenthe token to check
戻り値
null if the token is null or expired, the input token (unchanged) if it hasn't
151  {
152  if (token == null) {
153  return null;
154  } else if (token.isExpired()) {
155  // immediately revoke expired token
156  logger.debug("Clearing expired access token: " + token.getValue());
157  revokeAccessToken(token);
158  return null;
159  } else {
160  return token;
161  }
162  }
void revokeAccessToken(OAuth2AccessTokenEntity accessToken)
Definition: DefaultOAuth2ProviderTokenService.java:480
static final Logger logger
Definition: DefaultOAuth2ProviderTokenService.java:85

◆ clearExpiredRefreshToken()

OAuth2RefreshTokenEntity org.mitre.oauth2.service.impl.DefaultOAuth2ProviderTokenService.clearExpiredRefreshToken ( OAuth2RefreshTokenEntity  token)
inlineprivate

Utility function to delete a refresh token that's expired before returning it.

引数
tokenthe token to check
戻り値
null if the token is null or expired, the input token (unchanged) if it hasn't
169  {
170  if (token == null) {
171  return null;
172  } else if (token.isExpired()) {
173  // immediately revoke expired token
174  logger.debug("Clearing expired refresh token: " + token.getValue());
175  revokeRefreshToken(token);
176  return null;
177  } else {
178  return token;
179  }
180  }
static final Logger logger
Definition: DefaultOAuth2ProviderTokenService.java:85
void revokeRefreshToken(OAuth2RefreshTokenEntity refreshToken)
Definition: DefaultOAuth2ProviderTokenService.java:470

◆ clearExpiredTokens()

void org.mitre.oauth2.service.impl.DefaultOAuth2ProviderTokenService.clearExpiredTokens ( )
inline

Clears out expired tokens and any abandoned authentication objects

org.mitre.oauth2.service.OAuth2TokenEntityServiceを実装しています。

505  {
506  logger.debug("Cleaning out all expired tokens");
507 
508  new AbstractPageOperationTemplate<OAuth2AccessTokenEntity>("clearExpiredAccessTokens") {
509  @Override
510  public Collection<OAuth2AccessTokenEntity> fetchPage() {
511  return tokenRepository.getAllExpiredAccessTokens(new DefaultPageCriteria());
512  }
513 
514  @Override
515  public void doOperation(OAuth2AccessTokenEntity item) {
516  revokeAccessToken(item);
517  }
518  }.execute();
519 
520  new AbstractPageOperationTemplate<OAuth2RefreshTokenEntity>("clearExpiredRefreshTokens") {
521  @Override
522  public Collection<OAuth2RefreshTokenEntity> fetchPage() {
523  return tokenRepository.getAllExpiredRefreshTokens(new DefaultPageCriteria());
524  }
525 
526  @Override
527  public void doOperation(OAuth2RefreshTokenEntity item) {
528  revokeRefreshToken(item);
529  }
530  }.execute();
531 
532  new AbstractPageOperationTemplate<AuthenticationHolderEntity>("clearExpiredAuthenticationHolders") {
533  @Override
534  public Collection<AuthenticationHolderEntity> fetchPage() {
535  return authenticationHolderRepository.getOrphanedAuthenticationHolders(new DefaultPageCriteria());
536  }
537 
538  @Override
539  public void doOperation(AuthenticationHolderEntity item) {
541  }
542  }.execute();
543  }
void revokeAccessToken(OAuth2AccessTokenEntity accessToken)
Definition: DefaultOAuth2ProviderTokenService.java:480
Set< OAuth2RefreshTokenEntity > getAllExpiredRefreshTokens()
AuthenticationHolderRepository authenticationHolderRepository
Definition: DefaultOAuth2ProviderTokenService.java:91
OAuth2TokenRepository tokenRepository
Definition: DefaultOAuth2ProviderTokenService.java:88
List< AuthenticationHolderEntity > getOrphanedAuthenticationHolders()
static final Logger logger
Definition: DefaultOAuth2ProviderTokenService.java:85
void revokeRefreshToken(OAuth2RefreshTokenEntity refreshToken)
Definition: DefaultOAuth2ProviderTokenService.java:470
Set< OAuth2AccessTokenEntity > getAllExpiredAccessTokens()

◆ createAccessToken()

OAuth2AccessTokenEntity org.mitre.oauth2.service.impl.DefaultOAuth2ProviderTokenService.createAccessToken ( OAuth2Authentication  authentication) throws AuthenticationException, InvalidClientException
inline
184  {
185  if (authentication != null && authentication.getOAuth2Request() != null) {
186  // look up our client
187  OAuth2Request request = authentication.getOAuth2Request();
188 
189  ClientDetailsEntity client = clientDetailsService.loadClientByClientId(request.getClientId());
190 
191  if (client == null) {
192  throw new InvalidClientException("Client not found: " + request.getClientId());
193  }
194 
195 
196  // handle the PKCE code challenge if present
197  if (request.getExtensions().containsKey(CODE_CHALLENGE)) {
198  String challenge = (String) request.getExtensions().get(CODE_CHALLENGE);
199  PKCEAlgorithm alg = PKCEAlgorithm.parse((String) request.getExtensions().get(CODE_CHALLENGE_METHOD));
200 
201  String verifier = request.getRequestParameters().get(CODE_VERIFIER);
202 
203  if (alg.equals(PKCEAlgorithm.plain)) {
204  // do a direct string comparison
205  if (!challenge.equals(verifier)) {
206  throw new InvalidRequestException("Code challenge and verifier do not match");
207  }
208  } else if (alg.equals(PKCEAlgorithm.S256)) {
209  // hash the verifier
210  try {
211  MessageDigest digest = MessageDigest.getInstance("SHA-256");
212  String hash = Base64URL.encode(digest.digest(verifier.getBytes(StandardCharsets.US_ASCII))).toString();
213  if (!challenge.equals(hash)) {
214  throw new InvalidRequestException("Code challenge and verifier do not match");
215  }
216  } catch (NoSuchAlgorithmException e) {
217  logger.error("Unknown algorithm for PKCE digest", e);
218  }
219  }
220 
221  }
222 
223 
224  OAuth2AccessTokenEntity token = new OAuth2AccessTokenEntity();//accessTokenFactory.createNewAccessToken();
225 
226  // attach the client
227  token.setClient(client);
228 
229  // inherit the scope from the auth, but make a new set so it is
230  //not unmodifiable. Unmodifiables don't play nicely with Eclipselink, which
231  //wants to use the clone operation.
232  Set<SystemScope> scopes = scopeService.fromStrings(request.getScope());
233 
234  // remove any of the special system scopes
235  scopes = scopeService.removeReservedScopes(scopes);
236 
237  token.setScope(scopeService.toStrings(scopes));
238 
239  // make it expire if necessary
240  if (client.getAccessTokenValiditySeconds() != null && client.getAccessTokenValiditySeconds() > 0) {
241  Date expiration = new Date(System.currentTimeMillis() + (client.getAccessTokenValiditySeconds() * 1000L));
242  token.setExpiration(expiration);
243  }
244 
245  // attach the authorization so that we can look it up later
246  AuthenticationHolderEntity authHolder = new AuthenticationHolderEntity();
247  authHolder.setAuthentication(authentication);
248  authHolder = authenticationHolderRepository.save(authHolder);
249 
250  token.setAuthenticationHolder(authHolder);
251 
252  // attach a refresh token, if this client is allowed to request them and the user gets the offline scope
253  if (client.isAllowRefresh() && token.getScope().contains(SystemScopeService.OFFLINE_ACCESS)) {
254  OAuth2RefreshTokenEntity savedRefreshToken = createRefreshToken(client, authHolder);
255 
256  token.setRefreshToken(savedRefreshToken);
257  }
258 
259  //Add approved site reference, if any
260  OAuth2Request originalAuthRequest = authHolder.getAuthentication().getOAuth2Request();
261 
262  if (originalAuthRequest.getExtensions() != null && originalAuthRequest.getExtensions().containsKey("approved_site")) {
263 
264  Long apId = Long.parseLong((String) originalAuthRequest.getExtensions().get("approved_site"));
265  ApprovedSite ap = approvedSiteService.getById(apId);
266 
267  token.setApprovedSite(ap);
268  }
269 
270  OAuth2AccessTokenEntity enhancedToken = (OAuth2AccessTokenEntity) tokenEnhancer.enhance(token, authentication);
271 
272  OAuth2AccessTokenEntity savedToken = saveAccessToken(enhancedToken);
273 
274  if (savedToken.getRefreshToken() != null) {
275  tokenRepository.saveRefreshToken(savedToken.getRefreshToken()); // make sure we save any changes that might have been enhanced
276  }
277 
278  return savedToken;
279  }
280 
281  throw new AuthenticationCredentialsNotFoundException("No authentication credentials found");
282  }
OAuth2AccessTokenEntity saveAccessToken(OAuth2AccessTokenEntity accessToken)
Definition: DefaultOAuth2ProviderTokenService.java:550
OAuth2RefreshTokenEntity createRefreshToken(ClientDetailsEntity client, AuthenticationHolderEntity authHolder)
Definition: DefaultOAuth2ProviderTokenService.java:285
AuthenticationHolderRepository authenticationHolderRepository
Definition: DefaultOAuth2ProviderTokenService.java:91
OAuth2RefreshTokenEntity saveRefreshToken(OAuth2RefreshTokenEntity refreshToken)
Set< SystemScope > removeReservedScopes(Set< SystemScope > scopes)
ClientDetailsEntityService clientDetailsService
Definition: DefaultOAuth2ProviderTokenService.java:94
OAuth2TokenRepository tokenRepository
Definition: DefaultOAuth2ProviderTokenService.java:88
AuthenticationHolderEntity save(AuthenticationHolderEntity a)
Set< SystemScope > fromStrings(Set< String > scope)
TokenEnhancer tokenEnhancer
Definition: DefaultOAuth2ProviderTokenService.java:97
static final Logger logger
Definition: DefaultOAuth2ProviderTokenService.java:85
SystemScopeService scopeService
Definition: DefaultOAuth2ProviderTokenService.java:100
ApprovedSiteService approvedSiteService
Definition: DefaultOAuth2ProviderTokenService.java:103
Set< String > toStrings(Set< SystemScope > scope)
ClientDetailsEntity loadClientByClientId(String clientId)

◆ createRefreshToken()

OAuth2RefreshTokenEntity org.mitre.oauth2.service.impl.DefaultOAuth2ProviderTokenService.createRefreshToken ( ClientDetailsEntity  client,
AuthenticationHolderEntity  authHolder 
)
inlineprivate
285  {
286  OAuth2RefreshTokenEntity refreshToken = new OAuth2RefreshTokenEntity(); //refreshTokenFactory.createNewRefreshToken();
287  JWTClaimsSet.Builder refreshClaims = new JWTClaimsSet.Builder();
288 
289 
290  // make it expire if necessary
291  if (client.getRefreshTokenValiditySeconds() != null) {
292  Date expiration = new Date(System.currentTimeMillis() + (client.getRefreshTokenValiditySeconds() * 1000L));
293  refreshToken.setExpiration(expiration);
294  refreshClaims.expirationTime(expiration);
295  }
296 
297  // set a random identifier
298  refreshClaims.jwtID(UUID.randomUUID().toString());
299 
300  // TODO: add issuer fields, signature to JWT
301 
302  PlainJWT refreshJwt = new PlainJWT(refreshClaims.build());
303  refreshToken.setJwt(refreshJwt);
304 
305  //Add the authentication
306  refreshToken.setAuthenticationHolder(authHolder);
307  refreshToken.setClient(client);
308 
309 
310 
311  // save the token first so that we can set it to a member of the access token (NOTE: is this step necessary?)
312  OAuth2RefreshTokenEntity savedRefreshToken = tokenRepository.saveRefreshToken(refreshToken);
313  return savedRefreshToken;
314  }
OAuth2RefreshTokenEntity saveRefreshToken(OAuth2RefreshTokenEntity refreshToken)
OAuth2TokenRepository tokenRepository
Definition: DefaultOAuth2ProviderTokenService.java:88

◆ getAccessToken()

OAuth2AccessTokenEntity org.mitre.oauth2.service.impl.DefaultOAuth2ProviderTokenService.getAccessToken ( OAuth2Authentication  authentication)
inline

Get an access token by its authentication object.

org.mitre.oauth2.service.OAuth2TokenEntityServiceを実装しています。

446  {
447  // TODO: implement this against the new service (#825)
448  throw new UnsupportedOperationException("Unable to look up access token from authentication object.");
449  }

◆ getAccessTokenById()

OAuth2AccessTokenEntity org.mitre.oauth2.service.impl.DefaultOAuth2ProviderTokenService.getAccessTokenById ( Long  id)
inline

org.mitre.oauth2.service.OAuth2TokenEntityServiceを実装しています。

137  {
139  }
OAuth2AccessTokenEntity getAccessTokenById(Long id)
OAuth2AccessTokenEntity clearExpiredAccessToken(OAuth2AccessTokenEntity token)
Definition: DefaultOAuth2ProviderTokenService.java:151
OAuth2TokenRepository tokenRepository
Definition: DefaultOAuth2ProviderTokenService.java:88

◆ getAccessTokensForClient()

List<OAuth2AccessTokenEntity> org.mitre.oauth2.service.impl.DefaultOAuth2ProviderTokenService.getAccessTokensForClient ( ClientDetailsEntity  client)
inline

org.mitre.oauth2.service.OAuth2TokenEntityServiceを実装しています。

489  {
491  }
List< OAuth2AccessTokenEntity > getAccessTokensForClient(ClientDetailsEntity client)
OAuth2TokenRepository tokenRepository
Definition: DefaultOAuth2ProviderTokenService.java:88

◆ getAllAccessTokensForUser()

Set<OAuth2AccessTokenEntity> org.mitre.oauth2.service.impl.DefaultOAuth2ProviderTokenService.getAllAccessTokensForUser ( String  id)
inline

org.mitre.oauth2.service.OAuth2TokenEntityServiceを実装しています。

107  {
108 
109  Set<OAuth2AccessTokenEntity> all = tokenRepository.getAllAccessTokens();
110  Set<OAuth2AccessTokenEntity> results = Sets.newLinkedHashSet();
111 
112  for (OAuth2AccessTokenEntity token : all) {
113  if (clearExpiredAccessToken(token) != null && token.getAuthenticationHolder().getAuthentication().getName().equals(id)) {
114  results.add(token);
115  }
116  }
117 
118  return results;
119  }
OAuth2AccessTokenEntity clearExpiredAccessToken(OAuth2AccessTokenEntity token)
Definition: DefaultOAuth2ProviderTokenService.java:151
AuthenticationHolderEntity getAuthenticationHolder()
Definition: OAuth2AccessTokenEntity.java:161
OAuth2Authentication getAuthentication()
Definition: AuthenticationHolderEntity.java:104
OAuth2TokenRepository tokenRepository
Definition: DefaultOAuth2ProviderTokenService.java:88
Set< OAuth2AccessTokenEntity > getAllAccessTokens()

◆ getAllRefreshTokensForUser()

Set<OAuth2RefreshTokenEntity> org.mitre.oauth2.service.impl.DefaultOAuth2ProviderTokenService.getAllRefreshTokensForUser ( String  id)
inline

org.mitre.oauth2.service.OAuth2TokenEntityServiceを実装しています。

123  {
124  Set<OAuth2RefreshTokenEntity> all = tokenRepository.getAllRefreshTokens();
125  Set<OAuth2RefreshTokenEntity> results = Sets.newLinkedHashSet();
126 
127  for (OAuth2RefreshTokenEntity token : all) {
128  if (clearExpiredRefreshToken(token) != null && token.getAuthenticationHolder().getAuthentication().getName().equals(id)) {
129  results.add(token);
130  }
131  }
132 
133  return results;
134  }
OAuth2Authentication getAuthentication()
Definition: AuthenticationHolderEntity.java:104
OAuth2RefreshTokenEntity clearExpiredRefreshToken(OAuth2RefreshTokenEntity token)
Definition: DefaultOAuth2ProviderTokenService.java:169
OAuth2TokenRepository tokenRepository
Definition: DefaultOAuth2ProviderTokenService.java:88
AuthenticationHolderEntity getAuthenticationHolder()
Definition: OAuth2RefreshTokenEntity.java:113
Set< OAuth2RefreshTokenEntity > getAllRefreshTokens()

◆ getRefreshToken()

OAuth2RefreshTokenEntity org.mitre.oauth2.service.impl.DefaultOAuth2ProviderTokenService.getRefreshToken ( String  refreshTokenValue) throws AuthenticationException
inline

Get a refresh token by its token value.

org.mitre.oauth2.service.OAuth2TokenEntityServiceを実装しています。

455  {
456  OAuth2RefreshTokenEntity refreshToken = tokenRepository.getRefreshTokenByValue(refreshTokenValue);
457  if (refreshToken == null) {
458  throw new InvalidTokenException("Refresh token for value " + refreshTokenValue + " was not found");
459  }
460  else {
461  return refreshToken;
462  }
463  }
OAuth2TokenRepository tokenRepository
Definition: DefaultOAuth2ProviderTokenService.java:88
OAuth2RefreshTokenEntity getRefreshTokenByValue(String refreshTokenValue)

◆ getRefreshTokenById()

OAuth2RefreshTokenEntity org.mitre.oauth2.service.impl.DefaultOAuth2ProviderTokenService.getRefreshTokenById ( Long  id)
inline

org.mitre.oauth2.service.OAuth2TokenEntityServiceを実装しています。

142  {
144  }
OAuth2RefreshTokenEntity clearExpiredRefreshToken(OAuth2RefreshTokenEntity token)
Definition: DefaultOAuth2ProviderTokenService.java:169
OAuth2TokenRepository tokenRepository
Definition: DefaultOAuth2ProviderTokenService.java:88
OAuth2RefreshTokenEntity getRefreshTokenById(Long Id)

◆ getRefreshTokensForClient()

List<OAuth2RefreshTokenEntity> org.mitre.oauth2.service.impl.DefaultOAuth2ProviderTokenService.getRefreshTokensForClient ( ClientDetailsEntity  client)
inline

org.mitre.oauth2.service.OAuth2TokenEntityServiceを実装しています。

497  {
499  }
List< OAuth2RefreshTokenEntity > getRefreshTokensForClient(ClientDetailsEntity client)
OAuth2TokenRepository tokenRepository
Definition: DefaultOAuth2ProviderTokenService.java:88

◆ getRegistrationAccessTokenForClient()

OAuth2AccessTokenEntity org.mitre.oauth2.service.impl.DefaultOAuth2ProviderTokenService.getRegistrationAccessTokenForClient ( ClientDetailsEntity  client)
inline

org.mitre.oauth2.service.OAuth2TokenEntityServiceを実装しています。

585  {
586  List<OAuth2AccessTokenEntity> allTokens = getAccessTokensForClient(client);
587 
588  for (OAuth2AccessTokenEntity token : allTokens) {
589  if ((token.getScope().contains(SystemScopeService.REGISTRATION_TOKEN_SCOPE) || token.getScope().contains(SystemScopeService.RESOURCE_TOKEN_SCOPE))
590  && token.getScope().size() == 1) {
591  // if it only has the registration scope, then it's a registration token
592  return token;
593  }
594  }
595 
596  return null;
597  }
List< OAuth2AccessTokenEntity > getAccessTokensForClient(ClientDetailsEntity client)
Definition: DefaultOAuth2ProviderTokenService.java:489

◆ getTokenEnhancer()

TokenEnhancer org.mitre.oauth2.service.impl.DefaultOAuth2ProviderTokenService.getTokenEnhancer ( )
inline
戻り値
the tokenEnhancer
573  {
574  return tokenEnhancer;
575  }
TokenEnhancer tokenEnhancer
Definition: DefaultOAuth2ProviderTokenService.java:97

◆ loadAuthentication()

OAuth2Authentication org.mitre.oauth2.service.impl.DefaultOAuth2ProviderTokenService.loadAuthentication ( String  accessTokenValue) throws AuthenticationException
inline
417  {
418 
419  OAuth2AccessTokenEntity accessToken = clearExpiredAccessToken(tokenRepository.getAccessTokenByValue(accessTokenValue));
420 
421  if (accessToken == null) {
422  throw new InvalidTokenException("Invalid access token: " + accessTokenValue);
423  } else {
424  return accessToken.getAuthenticationHolder().getAuthentication();
425  }
426  }
OAuth2AccessTokenEntity clearExpiredAccessToken(OAuth2AccessTokenEntity token)
Definition: DefaultOAuth2ProviderTokenService.java:151
OAuth2TokenRepository tokenRepository
Definition: DefaultOAuth2ProviderTokenService.java:88
OAuth2AccessTokenEntity getAccessTokenByValue(String accessTokenValue)

◆ readAccessToken()

OAuth2AccessTokenEntity org.mitre.oauth2.service.impl.DefaultOAuth2ProviderTokenService.readAccessToken ( String  accessTokenValue) throws AuthenticationException
inline

Get an access token from its token value.

org.mitre.oauth2.service.OAuth2TokenEntityServiceを実装しています。

433  {
434  OAuth2AccessTokenEntity accessToken = clearExpiredAccessToken(tokenRepository.getAccessTokenByValue(accessTokenValue));
435  if (accessToken == null) {
436  throw new InvalidTokenException("Access token for value " + accessTokenValue + " was not found");
437  } else {
438  return accessToken;
439  }
440  }
OAuth2AccessTokenEntity clearExpiredAccessToken(OAuth2AccessTokenEntity token)
Definition: DefaultOAuth2ProviderTokenService.java:151
OAuth2TokenRepository tokenRepository
Definition: DefaultOAuth2ProviderTokenService.java:88
OAuth2AccessTokenEntity getAccessTokenByValue(String accessTokenValue)

◆ refreshAccessToken()

OAuth2AccessTokenEntity org.mitre.oauth2.service.impl.DefaultOAuth2ProviderTokenService.refreshAccessToken ( String  refreshTokenValue,
TokenRequest  authRequest 
) throws AuthenticationException
inline
318  {
319 
320  if (Strings.isNullOrEmpty(refreshTokenValue)) {
321  // throw an invalid token exception if there's no refresh token value at all
322  throw new InvalidTokenException("Invalid refresh token: " + refreshTokenValue);
323  }
324 
325  OAuth2RefreshTokenEntity refreshToken = clearExpiredRefreshToken(tokenRepository.getRefreshTokenByValue(refreshTokenValue));
326 
327  if (refreshToken == null) {
328  // throw an invalid token exception if we couldn't find the token
329  throw new InvalidTokenException("Invalid refresh token: " + refreshTokenValue);
330  }
331 
332  ClientDetailsEntity client = refreshToken.getClient();
333 
334  AuthenticationHolderEntity authHolder = refreshToken.getAuthenticationHolder();
335 
336  // make sure that the client requesting the token is the one who owns the refresh token
337  ClientDetailsEntity requestingClient = clientDetailsService.loadClientByClientId(authRequest.getClientId());
338  if (!client.getClientId().equals(requestingClient.getClientId())) {
339  tokenRepository.removeRefreshToken(refreshToken);
340  throw new InvalidClientException("Client does not own the presented refresh token");
341  }
342 
343  //Make sure this client allows access token refreshing
344  if (!client.isAllowRefresh()) {
345  throw new InvalidClientException("Client does not allow refreshing access token!");
346  }
347 
348  // clear out any access tokens
349  if (client.isClearAccessTokensOnRefresh()) {
351  }
352 
353  if (refreshToken.isExpired()) {
354  tokenRepository.removeRefreshToken(refreshToken);
355  throw new InvalidTokenException("Expired refresh token: " + refreshTokenValue);
356  }
357 
358  OAuth2AccessTokenEntity token = new OAuth2AccessTokenEntity();
359 
360  // get the stored scopes from the authentication holder's authorization request; these are the scopes associated with the refresh token
361  Set<String> refreshScopesRequested = new HashSet<>(refreshToken.getAuthenticationHolder().getAuthentication().getOAuth2Request().getScope());
362  Set<SystemScope> refreshScopes = scopeService.fromStrings(refreshScopesRequested);
363  // remove any of the special system scopes
364  refreshScopes = scopeService.removeReservedScopes(refreshScopes);
365 
366  Set<String> scopeRequested = authRequest.getScope() == null ? new HashSet<String>() : new HashSet<>(authRequest.getScope());
367  Set<SystemScope> scope = scopeService.fromStrings(scopeRequested);
368 
369  // remove any of the special system scopes
370  scope = scopeService.removeReservedScopes(scope);
371 
372  if (scope != null && !scope.isEmpty()) {
373  // ensure a proper subset of scopes
374  if (refreshScopes != null && refreshScopes.containsAll(scope)) {
375  // set the scope of the new access token if requested
376  token.setScope(scopeService.toStrings(scope));
377  } else {
378  String errorMsg = "Up-scoping is not allowed.";
379  logger.error(errorMsg);
380  throw new InvalidScopeException(errorMsg);
381  }
382  } else {
383  // otherwise inherit the scope of the refresh token (if it's there -- this can return a null scope set)
384  token.setScope(scopeService.toStrings(refreshScopes));
385  }
386 
387  token.setClient(client);
388 
389  if (client.getAccessTokenValiditySeconds() != null) {
390  Date expiration = new Date(System.currentTimeMillis() + (client.getAccessTokenValiditySeconds() * 1000L));
391  token.setExpiration(expiration);
392  }
393 
394  if (client.isReuseRefreshToken()) {
395  // if the client re-uses refresh tokens, do that
396  token.setRefreshToken(refreshToken);
397  } else {
398  // otherwise, make a new refresh token
399  OAuth2RefreshTokenEntity newRefresh = createRefreshToken(client, authHolder);
400  token.setRefreshToken(newRefresh);
401 
402  // clean up the old refresh token
403  tokenRepository.removeRefreshToken(refreshToken);
404  }
405 
406  token.setAuthenticationHolder(authHolder);
407 
408  tokenEnhancer.enhance(token, authHolder.getAuthentication());
409 
411 
412  return token;
413 
414  }
OAuth2AccessTokenEntity saveAccessToken(OAuth2AccessTokenEntity token)
OAuth2RefreshTokenEntity createRefreshToken(ClientDetailsEntity client, AuthenticationHolderEntity authHolder)
Definition: DefaultOAuth2ProviderTokenService.java:285
void removeRefreshToken(OAuth2RefreshTokenEntity refreshToken)
OAuth2RefreshTokenEntity clearExpiredRefreshToken(OAuth2RefreshTokenEntity token)
Definition: DefaultOAuth2ProviderTokenService.java:169
Set< SystemScope > removeReservedScopes(Set< SystemScope > scopes)
ClientDetailsEntityService clientDetailsService
Definition: DefaultOAuth2ProviderTokenService.java:94
OAuth2TokenRepository tokenRepository
Definition: DefaultOAuth2ProviderTokenService.java:88
Set< SystemScope > fromStrings(Set< String > scope)
TokenEnhancer tokenEnhancer
Definition: DefaultOAuth2ProviderTokenService.java:97
static final Logger logger
Definition: DefaultOAuth2ProviderTokenService.java:85
SystemScopeService scopeService
Definition: DefaultOAuth2ProviderTokenService.java:100
OAuth2RefreshTokenEntity getRefreshTokenByValue(String refreshTokenValue)
Set< String > toStrings(Set< SystemScope > scope)
ClientDetailsEntity loadClientByClientId(String clientId)
void clearAccessTokensForRefreshToken(OAuth2RefreshTokenEntity refreshToken)

◆ revokeAccessToken()

void org.mitre.oauth2.service.impl.DefaultOAuth2ProviderTokenService.revokeAccessToken ( OAuth2AccessTokenEntity  accessToken)
inline

Revoke an access token.

org.mitre.oauth2.service.OAuth2TokenEntityServiceを実装しています。

480  {
481  tokenRepository.removeAccessToken(accessToken);
482  }
OAuth2TokenRepository tokenRepository
Definition: DefaultOAuth2ProviderTokenService.java:88
void removeAccessToken(OAuth2AccessTokenEntity accessToken)

◆ revokeRefreshToken()

void org.mitre.oauth2.service.impl.DefaultOAuth2ProviderTokenService.revokeRefreshToken ( OAuth2RefreshTokenEntity  refreshToken)
inline

Revoke a refresh token and all access tokens issued to it.

org.mitre.oauth2.service.OAuth2TokenEntityServiceを実装しています。

470  {
472  tokenRepository.removeRefreshToken(refreshToken);
473  }
void removeRefreshToken(OAuth2RefreshTokenEntity refreshToken)
OAuth2TokenRepository tokenRepository
Definition: DefaultOAuth2ProviderTokenService.java:88
void clearAccessTokensForRefreshToken(OAuth2RefreshTokenEntity refreshToken)

◆ saveAccessToken()

OAuth2AccessTokenEntity org.mitre.oauth2.service.impl.DefaultOAuth2ProviderTokenService.saveAccessToken ( OAuth2AccessTokenEntity  accessToken)
inline

org.mitre.oauth2.service.OAuth2TokenEntityServiceを実装しています。

550  {
551  OAuth2AccessTokenEntity newToken = tokenRepository.saveAccessToken(accessToken);
552 
553  // if the old token has any additional information for the return from the token endpoint, carry it through here after save
554  if (accessToken.getAdditionalInformation() != null && !accessToken.getAdditionalInformation().isEmpty()) {
555  newToken.getAdditionalInformation().putAll(accessToken.getAdditionalInformation());
556  }
557 
558  return newToken;
559  }
OAuth2AccessTokenEntity saveAccessToken(OAuth2AccessTokenEntity token)
Map< String, Object > getAdditionalInformation()
Definition: OAuth2AccessTokenEntity.java:151
OAuth2TokenRepository tokenRepository
Definition: DefaultOAuth2ProviderTokenService.java:88

◆ saveRefreshToken()

OAuth2RefreshTokenEntity org.mitre.oauth2.service.impl.DefaultOAuth2ProviderTokenService.saveRefreshToken ( OAuth2RefreshTokenEntity  refreshToken)
inline

org.mitre.oauth2.service.OAuth2TokenEntityServiceを実装しています。

566  {
567  return tokenRepository.saveRefreshToken(refreshToken);
568  }
OAuth2RefreshTokenEntity saveRefreshToken(OAuth2RefreshTokenEntity refreshToken)
OAuth2TokenRepository tokenRepository
Definition: DefaultOAuth2ProviderTokenService.java:88

◆ setTokenEnhancer()

void org.mitre.oauth2.service.impl.DefaultOAuth2ProviderTokenService.setTokenEnhancer ( TokenEnhancer  tokenEnhancer)
inline
引数
tokenEnhancerthe tokenEnhancer to set
580  {
582  }
TokenEnhancer tokenEnhancer
Definition: DefaultOAuth2ProviderTokenService.java:97

メンバ詳解

◆ approvedSiteService

ApprovedSiteService org.mitre.oauth2.service.impl.DefaultOAuth2ProviderTokenService.approvedSiteService
private

◆ authenticationHolderRepository

AuthenticationHolderRepository org.mitre.oauth2.service.impl.DefaultOAuth2ProviderTokenService.authenticationHolderRepository
private

◆ clientDetailsService

ClientDetailsEntityService org.mitre.oauth2.service.impl.DefaultOAuth2ProviderTokenService.clientDetailsService
private

◆ logger

final Logger org.mitre.oauth2.service.impl.DefaultOAuth2ProviderTokenService.logger = LoggerFactory.getLogger(DefaultOAuth2ProviderTokenService.class)
staticprivate

Logger for this class

◆ scopeService

SystemScopeService org.mitre.oauth2.service.impl.DefaultOAuth2ProviderTokenService.scopeService
private

◆ tokenEnhancer

TokenEnhancer org.mitre.oauth2.service.impl.DefaultOAuth2ProviderTokenService.tokenEnhancer
private

◆ tokenRepository

OAuth2TokenRepository org.mitre.oauth2.service.impl.DefaultOAuth2ProviderTokenService.tokenRepository
private

このクラス詳解は次のファイルから抽出されました: