Examples with InsufficientScopeException org.springframework.security.oauth2.common.exceptions.InsufficientScopeException used on opensource projects

Example 1 with InsufficientScopeException

use of org.springframework.security.oauth2.common.exceptions.InsufficientScopeException in project spring-security-oauth by spring-projects.

the class ScopeVoter method vote.

public int vote(Authentication authentication, Object object, Collection<ConfigAttribute> attributes) {
    int result = ACCESS_ABSTAIN;
    if (!(authentication instanceof OAuth2Authentication)) {
        return result;
    }
    for (ConfigAttribute attribute : attributes) {
        if (denyAccess.equals(attribute.getAttribute())) {
            return ACCESS_DENIED;
        }
    }
    OAuth2Request clientAuthentication = ((OAuth2Authentication) authentication).getOAuth2Request();
    for (ConfigAttribute attribute : attributes) {
        if (this.supports(attribute)) {
            result = ACCESS_DENIED;
            Set<String> scopes = clientAuthentication.getScope();
            for (String scope : scopes) {
                if (attribute.getAttribute().toUpperCase().equals((scopePrefix + scope).toUpperCase())) {
                    return ACCESS_GRANTED;
                }
            }
            if (result == ACCESS_DENIED && throwException) {
                InsufficientScopeException failure = new InsufficientScopeException("Insufficient scope for this resource", Collections.singleton(attribute.getAttribute().substring(scopePrefix.length())));
                throw new AccessDeniedException(failure.getMessage(), failure);
            }
        }
    }
    return result;
}

Example 2 with InsufficientScopeException

use of org.springframework.security.oauth2.common.exceptions.InsufficientScopeException in project spring-security-oauth by spring-projects.

the class AdminEndpointsTests method testRevokeTokenByUser.

@Test
@OAuth2ContextConfiguration(ResourceOwnerWriteOnly.class)
public void testRevokeTokenByUser() throws Exception {
    OAuth2AccessToken token = context.getAccessToken();
    String tokenValueBeforeDeletion = token.getValue();
    HttpHeaders headers = new HttpHeaders();
    headers.setAccept(Arrays.asList(MediaType.APPLICATION_JSON));
    HttpEntity<?> request = new HttpEntity<Void>(headers);
    assertEquals(HttpStatus.NO_CONTENT, serverRunning.getRestTemplate().exchange(serverRunning.getUrl("/sparklr2/oauth/users/{user}/tokens/{token}"), HttpMethod.DELETE, request, Void.class, "marissa", token.getValue()).getStatusCode());
    try {
        // The request above will delete the oauth token so that the next request will initially fail. However,
        // the failure will be detected and a new access token will be obtained.  The new access token
        // only has "write" scope and the requested resource needs "read" scope.  So, an insufficient_scope
        // exception should be thrown.
        ResponseEntity<String> result = serverRunning.getForString("/sparklr2/oauth/clients/my-client-with-registered-redirect/users/marissa/tokens", headers);
        fail("Should have thrown an exception");
        assertNotNull(result);
    } catch (InsufficientScopeException ex) {
        assertEquals(HttpStatus.FORBIDDEN.value(), ex.getHttpErrorCode());
        assertEquals("insufficient_scope", ex.getOAuth2ErrorCode());
        String secondTokenWithWriteOnlyScope = context.getOAuth2ClientContext().getAccessToken().getValue();
        assertNotNull(secondTokenWithWriteOnlyScope);
        assertFalse(secondTokenWithWriteOnlyScope.equals(tokenValueBeforeDeletion));
    }
}

Example 3 with InsufficientScopeException

use of org.springframework.security.oauth2.common.exceptions.InsufficientScopeException in project spring-security-oauth by spring-projects.

the class AuthorizationCodeProviderTests method testInsufficientScopeInResourceRequest.

@Test
@OAuth2ContextConfiguration(resource = MyClientWithRegisteredRedirect.class, initialize = false)
public void testInsufficientScopeInResourceRequest() throws Exception {
    AuthorizationCodeResourceDetails resource = (AuthorizationCodeResourceDetails) context.getResource();
    resource.setScope(Arrays.asList("trust"));
    approveAccessTokenGrant("http://anywhere?key=value", true);
    assertNotNull(context.getAccessToken());
    try {
        serverRunning.getForString("/sparklr2/photos?format=json");
        fail("Should have thrown exception");
    } catch (InsufficientScopeException ex) {
    // ignore / all good
    }
}

Example 4 with InsufficientScopeException

use of org.springframework.security.oauth2.common.exceptions.InsufficientScopeException in project spring-security-oauth by spring-projects.

the class ClientScopeVoter method vote.

public int vote(Authentication authentication, Object object, Collection<ConfigAttribute> attributes) {
    int result = ACCESS_ABSTAIN;
    if (!(authentication instanceof OAuth2Authentication)) {
        return result;
    }
    OAuth2Authentication oauth2Authentication = (OAuth2Authentication) authentication;
    OAuth2Request clientAuthentication = oauth2Authentication.getOAuth2Request();
    ClientDetails client = clientDetailsService.loadClientByClientId(clientAuthentication.getClientId());
    Set<String> scopes = clientAuthentication.getScope();
    if (oauth2Authentication.isClientOnly() && clientAuthoritiesAreScopes) {
        scopes = AuthorityUtils.authorityListToSet(clientAuthentication.getAuthorities());
    }
    for (ConfigAttribute attribute : attributes) {
        if (this.supports(attribute)) {
            result = ACCESS_GRANTED;
            for (String scope : scopes) {
                if (!client.getScope().contains(scope)) {
                    result = ACCESS_DENIED;
                    break;
                }
            }
            if (result == ACCESS_DENIED && throwException) {
                InsufficientScopeException failure = new InsufficientScopeException("Insufficient scope for this resource", client.getScope());
                throw new AccessDeniedException(failure.getMessage(), failure);
            }
            return result;
        }
    }
    return result;
}

Example 5 with InsufficientScopeException

use of org.springframework.security.oauth2.common.exceptions.InsufficientScopeException in project spring-security-oauth by spring-projects.

the class AuthorizationCodeProviderTests method testInsufficientScopeInResourceRequest.

@Test
@OAuth2ContextConfiguration(resource = MyClientWithRegisteredRedirect.class, initialize = false)
public void testInsufficientScopeInResourceRequest() throws Exception {
    AuthorizationCodeResourceDetails resource = (AuthorizationCodeResourceDetails) context.getResource();
    resource.setScope(Arrays.asList("trust"));
    approveAccessTokenGrant("http://anywhere?key=value", true);
    assertNotNull(context.getAccessToken());
    try {
        http.getForString("/admin/beans");
        fail("Should have thrown exception");
    } catch (InsufficientScopeException ex) {
        assertTrue("Wrong summary: " + ex, ex.getSummary().contains("scope=\"read"));
    }
}