org.mitre.openid.connect.filter.AuthorizationRequestFilter クラス

org.mitre.openid.connect.filter.AuthorizationRequestFilter の継承関係図

org.mitre.openid.connect.filter.AuthorizationRequestFilter 連携図

公開メンバ関数
void	doFilter (ServletRequest req, ServletResponse res, FilterChain chain) throws IOException, ServletException
RequestMatcher	getRequestMatcher ()
void	setRequestMatcher (RequestMatcher requestMatcher)

静的公開変数類
static final String	PROMPTED = "PROMPT_FILTER_PROMPTED"
static final String	PROMPT_REQUESTED = "PROMPT_FILTER_REQUESTED"

非公開メンバ関数
Map< String, String >	createRequestMap (Map< String, String[]> parameterMap)

非公開変数類
OAuth2RequestFactory	authRequestFactory
ClientDetailsEntityService	clientService
RedirectResolver	redirectResolver
LoginHintExtracter	loginHintExtracter = new RemoveLoginHintsWithHTTP()
RequestMatcher	requestMatcher = new AntPathRequestMatcher("/authorize")

静的非公開変数類
static final Logger	logger = LoggerFactory.getLogger(AuthorizationRequestFilter.class)

詳解

著者

jricher

関数詳解

createRequestMap()

Map<String, String> org.mitre.openid.connect.filter.AuthorizationRequestFilter.createRequestMap ( Map< String, String[]>  parameterMap )

inlineprivate

引数

parameterMap

戻り値

                                                                                         {
                Map<String, String> requestMap = new HashMap<>();
                for (String key : parameterMap.keySet()) {
                        String[] val = parameterMap.get(key);
                        if (val != null && val.length > 0) {
                                requestMap.put(key, val[0]); // add the first value only (which is what Spring seems to do)
                        }
                }

                return requestMap;
        }

doFilter()

void org.mitre.openid.connect.filter.AuthorizationRequestFilter.doFilter ( ServletRequest  req, ServletResponse  res, FilterChain  chain  ) throws IOException, ServletException

inline

                                                                                                                              {

                HttpServletRequest request = (HttpServletRequest) req;
                HttpServletResponse response = (HttpServletResponse) res;
                HttpSession session = request.getSession();

                // skip everything that's not an authorize URL
                if (!requestMatcher.matches(request)) {
                        chain.doFilter(req, res);
                        return;
                }

                try {
                        // we have to create our own auth request in order to get at all the parmeters appropriately
                        AuthorizationRequest authRequest = null;

                        ClientDetailsEntity client = null;

                        authRequest = authRequestFactory.createAuthorizationRequest(createRequestMap(request.getParameterMap()));
                        if (!Strings.isNullOrEmpty(authRequest.getClientId())) {
                                client = clientService.loadClientByClientId(authRequest.getClientId());
                        }

                        // save the login hint to the session
                        // but first check to see if the login hint makes any sense
                        String loginHint = loginHintExtracter.extractHint((String) authRequest.getExtensions().get(LOGIN_HINT));
                        if (!Strings.isNullOrEmpty(loginHint)) {
                                session.setAttribute(LOGIN_HINT, loginHint);
                        } else {
                                session.removeAttribute(LOGIN_HINT);
                        }

                        if (authRequest.getExtensions().get(PROMPT) != null) {
                                // we have a "prompt" parameter
                                String prompt = (String)authRequest.getExtensions().get(PROMPT);
                                List<String> prompts = Splitter.on(PROMPT_SEPARATOR).splitToList(Strings.nullToEmpty(prompt));

                                if (prompts.contains(PROMPT_NONE)) {
                                        // see if the user's logged in
                                        Authentication auth = SecurityContextHolder.getContext().getAuthentication();

                                        if (auth != null) {
                                                // user's been logged in already (by session management)
                                                // we're OK, continue without prompting
                                                chain.doFilter(req, res);
                                        } else {
                                                logger.info("Client requested no prompt");
                                                // user hasn't been logged in, we need to "return an error"
                                                if (client != null && authRequest.getRedirectUri() != null) {

                                                        // if we've got a redirect URI then we'll send it

                                                        String url = redirectResolver.resolveRedirect(authRequest.getRedirectUri(), client);

                                                        try {
                                                                URIBuilder uriBuilder = new URIBuilder(url);

                                                                uriBuilder.addParameter(ERROR, LOGIN_REQUIRED);
                                                                if (!Strings.isNullOrEmpty(authRequest.getState())) {
                                                                        uriBuilder.addParameter(STATE, authRequest.getState()); // copy the state parameter if one was given
                                                                }

                                                                response.sendRedirect(uriBuilder.toString());
                                                                return;

                                                        } catch (URISyntaxException e) {
                                                                logger.error("Can't build redirect URI for prompt=none, sending error instead", e);
                                                                response.sendError(HttpServletResponse.SC_FORBIDDEN, "Access Denied");
                                                                return;
                                                        }
                                                }

                                                response.sendError(HttpServletResponse.SC_FORBIDDEN, "Access Denied");
                                                return;
                                        }
                                } else if (prompts.contains(PROMPT_LOGIN)) {

                                        // first see if the user's already been prompted in this session
                                        if (session.getAttribute(PROMPTED) == null) {
                                                // user hasn't been PROMPTED yet, we need to check

                                                session.setAttribute(PROMPT_REQUESTED, Boolean.TRUE);

                                                // see if the user's logged in
                                                Authentication auth = SecurityContextHolder.getContext().getAuthentication();
                                                if (auth != null) {
                                                        // user's been logged in already (by session management)
                                                        // log them out and continue
                                                        SecurityContextHolder.getContext().setAuthentication(null);
                                                        chain.doFilter(req, res);
                                                } else {
                                                        // user hasn't been logged in yet, we can keep going since we'll get there
                                                        chain.doFilter(req, res);
                                                }
                                        } else {
                                                // user has been PROMPTED, we're fine

                                                // but first, undo the prompt tag
                                                session.removeAttribute(PROMPTED);
                                                chain.doFilter(req, res);
                                        }
                                } else {
                                        // prompt parameter is a value we don't care about, not our business
                                        chain.doFilter(req, res);
                                }

                        } else if (authRequest.getExtensions().get(MAX_AGE) != null ||
                                        (client != null && client.getDefaultMaxAge() != null)) {

                                // default to the client's stored value, check the string parameter
                                Integer max = (client != null ? client.getDefaultMaxAge() : null);
                                String maxAge = (String) authRequest.getExtensions().get(MAX_AGE);
                                if (maxAge != null) {
                                        max = Integer.parseInt(maxAge);
                                }

                                if (max != null) {

                                        Date authTime = (Date) session.getAttribute(AuthenticationTimeStamper.AUTH_TIMESTAMP);

                                        Date now = new Date();
                                        if (authTime != null) {
                                                long seconds = (now.getTime() - authTime.getTime()) / 1000;
                                                if (seconds > max) {
                                                        // session is too old, log the user out and continue
                                                        SecurityContextHolder.getContext().setAuthentication(null);
                                                }
                                        }
                                }
                                chain.doFilter(req, res);
                        } else {
                                // no prompt parameter, not our business
                                chain.doFilter(req, res);
                        }

                } catch (InvalidClientException e) {
                        // we couldn't find the client, move on and let the rest of the system catch the error
                        chain.doFilter(req, res);
                }
        }

getRequestMatcher()

RequestMatcher org.mitre.openid.connect.filter.AuthorizationRequestFilter.getRequestMatcher ( )

inline

戻り値

the requestMatcher

                                                  {
                return requestMatcher;
        }

setRequestMatcher()

void org.mitre.openid.connect.filter.AuthorizationRequestFilter.setRequestMatcher ( RequestMatcher  requestMatcher )

inline

引数

requestMatcher

the requestMatcher to set

                                                                     {
                this.requestMatcher = requestMatcher;
        }

メンバ詳解

authRequestFactory

OAuth2RequestFactory org.mitre.openid.connect.filter.AuthorizationRequestFilter.authRequestFactory

private

clientService

ClientDetailsEntityService org.mitre.openid.connect.filter.AuthorizationRequestFilter.clientService

private

logger

final Logger org.mitre.openid.connect.filter.AuthorizationRequestFilter.logger = LoggerFactory.getLogger(AuthorizationRequestFilter.class)

staticprivate

Logger for this class

loginHintExtracter

LoginHintExtracter org.mitre.openid.connect.filter.AuthorizationRequestFilter.loginHintExtracter = new RemoveLoginHintsWithHTTP()

private

PROMPT_REQUESTED

final String org.mitre.openid.connect.filter.AuthorizationRequestFilter.PROMPT_REQUESTED = "PROMPT_FILTER_REQUESTED"

static

PROMPTED

final String org.mitre.openid.connect.filter.AuthorizationRequestFilter.PROMPTED = "PROMPT_FILTER_PROMPTED"

static

redirectResolver

RedirectResolver org.mitre.openid.connect.filter.AuthorizationRequestFilter.redirectResolver

private

requestMatcher

RequestMatcher org.mitre.openid.connect.filter.AuthorizationRequestFilter.requestMatcher = new AntPathRequestMatcher("/authorize")

private

---

このクラス詳解は次のファイルから抽出されました:

• D:/AppData/OpenId/mitreid-connect/src/openid-connect-server/src/main/java/org/mitre/openid/connect/filter/AuthorizationRequestFilter.java