org.mitre.openid.connect.request.ConnectOAuth2RequestFactory クラス

org.mitre.openid.connect.request.ConnectOAuth2RequestFactory の継承関係図

org.mitre.openid.connect.request.ConnectOAuth2RequestFactory 連携図

公開メンバ関数
	ConnectOAuth2RequestFactory (ClientDetailsEntityService clientDetailsService)
AuthorizationRequest	createAuthorizationRequest (Map< String, String > inputParams)

非公開メンバ関数
void	processRequestObject (String jwtString, AuthorizationRequest request)
JsonObject	parseClaimRequest (String claimRequestString)

非公開変数類
ClientDetailsEntityService	clientDetailsService
ClientKeyCacheService	validators
JWTEncryptionAndDecryptionService	encryptionService
JsonParser	parser = new JsonParser()

静的非公開変数類
static final Logger	logger = LoggerFactory.getLogger(ConnectOAuth2RequestFactory.class)

詳解

構築子と解体子

ConnectOAuth2RequestFactory()

org.mitre.openid.connect.request.ConnectOAuth2RequestFactory.ConnectOAuth2RequestFactory ( ClientDetailsEntityService  clientDetailsService )

inline

Constructor with arguments

引数

clientDetailsService

                                                                                            {
                super(clientDetailsService);
                this.clientDetailsService = clientDetailsService;
        }

関数詳解

createAuthorizationRequest()

AuthorizationRequest org.mitre.openid.connect.request.ConnectOAuth2RequestFactory.createAuthorizationRequest ( Map< String, String >  inputParams )

inline

                                                                                                {


                AuthorizationRequest request = new AuthorizationRequest(inputParams, Collections.<String, String> emptyMap(),
                                inputParams.get(OAuth2Utils.CLIENT_ID),
                                OAuth2Utils.parseParameterList(inputParams.get(OAuth2Utils.SCOPE)), null,
                                null, false, inputParams.get(OAuth2Utils.STATE),
                                inputParams.get(OAuth2Utils.REDIRECT_URI),
                                OAuth2Utils.parseParameterList(inputParams.get(OAuth2Utils.RESPONSE_TYPE)));

                //Add extension parameters to the 'extensions' map

                if (inputParams.containsKey(PROMPT)) {
                        request.getExtensions().put(PROMPT, inputParams.get(PROMPT));
                }
                if (inputParams.containsKey(NONCE)) {
                        request.getExtensions().put(NONCE, inputParams.get(NONCE));
                }

                if (inputParams.containsKey(CLAIMS)) {
                        JsonObject claimsRequest = parseClaimRequest(inputParams.get(CLAIMS));
                        if (claimsRequest != null) {
                                request.getExtensions().put(CLAIMS, claimsRequest.toString());
                        }
                }

                if (inputParams.containsKey(MAX_AGE)) {
                        request.getExtensions().put(MAX_AGE, inputParams.get(MAX_AGE));
                }

                if (inputParams.containsKey(LOGIN_HINT)) {
                        request.getExtensions().put(LOGIN_HINT, inputParams.get(LOGIN_HINT));
                }

                if (inputParams.containsKey(AUD)) {
                        request.getExtensions().put(AUD, inputParams.get(AUD));
                }

                if (inputParams.containsKey(CODE_CHALLENGE)) {
                        request.getExtensions().put(CODE_CHALLENGE, inputParams.get(CODE_CHALLENGE));
                        if (inputParams.containsKey(CODE_CHALLENGE_METHOD)) {
                                request.getExtensions().put(CODE_CHALLENGE_METHOD, inputParams.get(CODE_CHALLENGE_METHOD));
                        } else {
                                // if the client doesn't specify a code challenge transformation method, it's "plain"
                                request.getExtensions().put(CODE_CHALLENGE_METHOD, PKCEAlgorithm.plain.getName());
                        }

                }

                if (inputParams.containsKey(REQUEST)) {
                        request.getExtensions().put(REQUEST, inputParams.get(REQUEST));
                        processRequestObject(inputParams.get(REQUEST), request);
                }

                if (request.getClientId() != null) {
                        try {
                                ClientDetailsEntity client = clientDetailsService.loadClientByClientId(request.getClientId());

                                if ((request.getScope() == null || request.getScope().isEmpty())) {
                                        Set<String> clientScopes = client.getScope();
                                        request.setScope(clientScopes);
                                }

                                if (request.getExtensions().get(MAX_AGE) == null && client.getDefaultMaxAge() != null) {
                                        request.getExtensions().put(MAX_AGE, client.getDefaultMaxAge().toString());
                                }
                        } catch (OAuth2Exception e) {
                                logger.error("Caught OAuth2 exception trying to test client scopes and max age:", e);
                        }
                }

                return request;
        }

parseClaimRequest()

JsonObject org.mitre.openid.connect.request.ConnectOAuth2RequestFactory.parseClaimRequest ( String  claimRequestString )

inlineprivate

引数

claimRequestString

戻り値

                                                                        {
                if (Strings.isNullOrEmpty(claimRequestString)) {
                        return null;
                } else {
                        JsonElement el = parser.parse(claimRequestString);
                        if (el != null && el.isJsonObject()) {
                                return el.getAsJsonObject();
                        } else {
                                return null;
                        }
                }
        }

processRequestObject()

void org.mitre.openid.connect.request.ConnectOAuth2RequestFactory.processRequestObject ( String  jwtString, AuthorizationRequest  request  )

inlineprivate

引数

jwtString
request

                                                                                          {

                // parse the request object
                try {
                        JWT jwt = JWTParser.parse(jwtString);

                        if (jwt instanceof SignedJWT) {
                                // it's a signed JWT, check the signature

                                SignedJWT signedJwt = (SignedJWT)jwt;

                                // need to check clientId first so that we can load the client to check other fields
                                if (request.getClientId() == null) {
                                        request.setClientId(signedJwt.getJWTClaimsSet().getStringClaim(CLIENT_ID));
                                }

                                ClientDetailsEntity client = clientDetailsService.loadClientByClientId(request.getClientId());

                                if (client == null) {
                                        throw new InvalidClientException("Client not found: " + request.getClientId());
                                }


                                JWSAlgorithm alg = signedJwt.getHeader().getAlgorithm();

                                if (client.getRequestObjectSigningAlg() == null ||
                                                !client.getRequestObjectSigningAlg().equals(alg)) {
                                        throw new InvalidClientException("Client's registered request object signing algorithm (" + client.getRequestObjectSigningAlg() + ") does not match request object's actual algorithm (" + alg.getName() + ")");
                                }

                                JWTSigningAndValidationService validator = validators.getValidator(client, alg);

                                if (validator == null) {
                                        throw new InvalidClientException("Unable to create signature validator for client " + client + " and algorithm " + alg);
                                }

                                if (!validator.validateSignature(signedJwt)) {
                                        throw new InvalidClientException("Signature did not validate for presented JWT request object.");
                                }

                        } else if (jwt instanceof PlainJWT) {
                                PlainJWT plainJwt = (PlainJWT)jwt;

                                // need to check clientId first so that we can load the client to check other fields
                                if (request.getClientId() == null) {
                                        request.setClientId(plainJwt.getJWTClaimsSet().getStringClaim(CLIENT_ID));
                                }

                                ClientDetailsEntity client = clientDetailsService.loadClientByClientId(request.getClientId());

                                if (client == null) {
                                        throw new InvalidClientException("Client not found: " + request.getClientId());
                                }

                                if (client.getRequestObjectSigningAlg() == null) {
                                        throw new InvalidClientException("Client is not registered for unsigned request objects (no request_object_signing_alg registered)");
                                } else if (!client.getRequestObjectSigningAlg().equals(Algorithm.NONE)) {
                                        throw new InvalidClientException("Client is not registered for unsigned request objects (request_object_signing_alg is " + client.getRequestObjectSigningAlg() +")");
                                }

                                // if we got here, we're OK, keep processing

                        } else if (jwt instanceof EncryptedJWT) {

                                EncryptedJWT encryptedJWT = (EncryptedJWT)jwt;

                                // decrypt the jwt if we can

                                encryptionService.decryptJwt(encryptedJWT);

                                // TODO: what if the content is a signed JWT? (#525)

                                if (!encryptedJWT.getState().equals(State.DECRYPTED)) {
                                        throw new InvalidClientException("Unable to decrypt the request object");
                                }

                                // need to check clientId first so that we can load the client to check other fields
                                if (request.getClientId() == null) {
                                        request.setClientId(encryptedJWT.getJWTClaimsSet().getStringClaim(CLIENT_ID));
                                }

                                ClientDetailsEntity client = clientDetailsService.loadClientByClientId(request.getClientId());

                                if (client == null) {
                                        throw new InvalidClientException("Client not found: " + request.getClientId());
                                }


                        }


                        /*
                         * NOTE: Claims inside the request object always take precedence over those in the parameter map.
                         */

                        // now that we've got the JWT, and it's been parsed, validated, and/or decrypted, we can process the claims

                        JWTClaimsSet claims = jwt.getJWTClaimsSet();

                        Set<String> responseTypes = OAuth2Utils.parseParameterList(claims.getStringClaim(RESPONSE_TYPE));
                        if (!responseTypes.isEmpty()) {
                                if (!responseTypes.equals(request.getResponseTypes())) {
                                        logger.info("Mismatch between request object and regular parameter for response_type, using request object");
                                }
                                request.setResponseTypes(responseTypes);
                        }

                        String redirectUri = claims.getStringClaim(REDIRECT_URI);
                        if (redirectUri != null) {
                                if (!redirectUri.equals(request.getRedirectUri())) {
                                        logger.info("Mismatch between request object and regular parameter for redirect_uri, using request object");
                                }
                                request.setRedirectUri(redirectUri);
                        }

                        String state = claims.getStringClaim(STATE);
                        if(state != null) {
                                if (!state.equals(request.getState())) {
                                        logger.info("Mismatch between request object and regular parameter for state, using request object");
                                }
                                request.setState(state);
                        }

                        String nonce = claims.getStringClaim(NONCE);
                        if(nonce != null) {
                                if (!nonce.equals(request.getExtensions().get(NONCE))) {
                                        logger.info("Mismatch between request object and regular parameter for nonce, using request object");
                                }
                                request.getExtensions().put(NONCE, nonce);
                        }

                        String display = claims.getStringClaim(DISPLAY);
                        if (display != null) {
                                if (!display.equals(request.getExtensions().get(DISPLAY))) {
                                        logger.info("Mismatch between request object and regular parameter for display, using request object");
                                }
                                request.getExtensions().put(DISPLAY, display);
                        }

                        String prompt = claims.getStringClaim(PROMPT);
                        if (prompt != null) {
                                if (!prompt.equals(request.getExtensions().get(PROMPT))) {
                                        logger.info("Mismatch between request object and regular parameter for prompt, using request object");
                                }
                                request.getExtensions().put(PROMPT, prompt);
                        }

                        Set<String> scope = OAuth2Utils.parseParameterList(claims.getStringClaim(SCOPE));
                        if (!scope.isEmpty()) {
                                if (!scope.equals(request.getScope())) {
                                        logger.info("Mismatch between request object and regular parameter for scope, using request object");
                                }
                                request.setScope(scope);
                        }

                        JsonObject claimRequest = parseClaimRequest(claims.getStringClaim(CLAIMS));
                        if (claimRequest != null) {
                                Serializable claimExtension = request.getExtensions().get(CLAIMS);
                                if (claimExtension == null || !claimRequest.equals(parseClaimRequest(claimExtension.toString()))) {
                                        logger.info("Mismatch between request object and regular parameter for claims, using request object");
                                }
                                // we save the string because the object might not be a Java Serializable, and we can parse it easily enough anyway
                                request.getExtensions().put(CLAIMS, claimRequest.toString());
                        }

                        String loginHint = claims.getStringClaim(LOGIN_HINT);
                        if (loginHint != null) {
                                if (!loginHint.equals(request.getExtensions().get(LOGIN_HINT))) {
                                        logger.info("Mistmatch between request object and regular parameter for login_hint, using requst object");
                                }
                                request.getExtensions().put(LOGIN_HINT, loginHint);
                        }

                } catch (ParseException e) {
                        logger.error("ParseException while parsing RequestObject:", e);
                }
        }

メンバ詳解

clientDetailsService

ClientDetailsEntityService org.mitre.openid.connect.request.ConnectOAuth2RequestFactory.clientDetailsService

private

encryptionService

JWTEncryptionAndDecryptionService org.mitre.openid.connect.request.ConnectOAuth2RequestFactory.encryptionService

private

logger

final Logger org.mitre.openid.connect.request.ConnectOAuth2RequestFactory.logger = LoggerFactory.getLogger(ConnectOAuth2RequestFactory.class)

staticprivate

Logger for this class

parser

JsonParser org.mitre.openid.connect.request.ConnectOAuth2RequestFactory.parser = new JsonParser()

private

validators

ClientKeyCacheService org.mitre.openid.connect.request.ConnectOAuth2RequestFactory.validators

private

---

このクラス詳解は次のファイルから抽出されました:

• D:/AppData/OpenId/mitreid-connect/src/openid-connect-server/src/main/java/org/mitre/openid/connect/request/ConnectOAuth2RequestFactory.java