Examples with IntrospectionResponse com.authlete.common.dto.IntrospectionResponse used on opensource projects

Example 1 with IntrospectionResponse

use of com.authlete.common.dto.IntrospectionResponse in project java-oauth-server by authlete.

the class ObbUtils method validateAccessToken.

public static IntrospectionResponse validateAccessToken(String outgoingInteractionId, String code, AuthleteApi authleteApi, HttpServletRequest request, String... requiredScopes) {
    // Extract the access token from the Authorization header.
    String accessToken = extractAccessToken(request);
    // Extract the client certificate.
    String clientCertificate = CertificateUtils.extract(request);
    // Extract information required to validate any DPoP proof
    String dpop = request.getHeader("DPoP");
    String htm = request.getMethod();
    // This assumes that jetty has the correct incoming url; if running behind a reverse proxy it is important that
    // the jetty ForwardedRequestCustomizer is enabled and that the reverse proxy sets the relevants headers so
    // that jetty can determine the original url - e.g. in apache "RequestHeader set X-Forwarded-Proto https" is
    // required
    String htu = request.getRequestURL().toString();
    IntrospectionResponse response;
    try {
        // Call Authlete's /api/auth/introspection API.
        response = callIntrospection(authleteApi, accessToken, requiredScopes, dpop, htm, htu, clientCertificate);
    } catch (AuthleteApiException e) {
        // Failed to call Authlete's /api/auth/interaction API.
        e.printStackTrace();
        throw internalServerErrorException(outgoingInteractionId, code, e.getMessage());
    }
    // 'action' in the response denotes the next action which
    // this service implementation should take.
    Action action = response.getAction();
    // If the protected resource endpoint conforms to RFC 6750,
    // response.getResponseContent() can be used. However, the
    // protected resource endpoints of Open Banking Brasil behave
    // differently in error cases.
    String detail = response.getResultMessage();
    // Dispatch according to the action.
    switch(action) {
        case INTERNAL_SERVER_ERROR:
            // 500 Internal Server Error
            throw internalServerErrorException(outgoingInteractionId, code, detail);
        case BAD_REQUEST:
            // 400 Bad Request
            throw badRequestException(outgoingInteractionId, code, detail);
        case UNAUTHORIZED:
            // 401 Unauthorized
            throw unauthorizedException(outgoingInteractionId, code, detail);
        case FORBIDDEN:
            // 403 Forbidden
            throw forbiddenException(outgoingInteractionId, code, detail);
        case OK:
            // Return access token information.
            return response;
        default:
            // Unknown action. This never happens.
            throw unknownAction(outgoingInteractionId, code, action);
    }
}

Example 2 with IntrospectionResponse

use of com.authlete.common.dto.IntrospectionResponse in project java-oauth-server by authlete.

the class ConsentsEndpoint method delete.

@DELETE
@Path("{consentId}")
public Response delete(@Context HttpServletRequest request, @HeaderParam(X_FAPI_INTERACTION_ID) String incomingInteractionId, @PathParam("consentId") String consentId) {
    String code = "Consent Delete";
    // Compute a value for the "x-fapi-interaction-id" HTTP response header.
    String outgoingInteractionId = ObbUtils.computeOutgoingInteractionId(code, incomingInteractionId);
    // Validate the access token.
    AuthleteApi authleteApi = AuthleteApiFactory.getDefaultApi();
    IntrospectionResponse info = ObbUtils.validateAccessToken(outgoingInteractionId, code, authleteApi, request, "consents");
    // Find "consent".
    Consent consent = ConsentDao.getInstance().read(consentId);
    // Validate the consent.
    validateConsent(outgoingInteractionId, code, consent, info);
    // Delete the refresh token associated with the consent.
    deleteRefreshToken(outgoingInteractionId, code, authleteApi, consent.getRefreshToken());
    // Delete the consent.
    ConsentDao.getInstance().delete(consentId);
    // Build a successful response.
    return ObbUtils.noContent(outgoingInteractionId);
}

Example 3 with IntrospectionResponse

use of com.authlete.common.dto.IntrospectionResponse in project java-oauth-server by authlete.

the class AccountsEndpoint method read.

@GET
public Response read(@Context HttpServletRequest request, @HeaderParam(X_FAPI_INTERACTION_ID) String incomingInteractionId) {
    String code = "Accounts Read";
    // Compute a value for the "x-fapi-interaction-id" HTTP response header.
    String outgoingInteractionId = ObbUtils.computeOutgoingInteractionId(code, incomingInteractionId);
    // Validate the access token.
    AuthleteApi authleteApi = AuthleteApiFactory.getDefaultApi();
    IntrospectionResponse info = ObbUtils.validateAccessToken(outgoingInteractionId, code, authleteApi, request, "accounts");
    // Make sure that the access token has a "consent:{consentId}" scope.
    ensureConsentScope(outgoingInteractionId, code, info);
    // Build a response body.
    ResponseAccountList body = buildResponseBody();
    // Build a successful response.
    return ObbUtils.ok(outgoingInteractionId, body);
}

Example 4 with IntrospectionResponse

use of com.authlete.common.dto.IntrospectionResponse in project java-oauth-server by authlete.

the class ConsentsEndpoint method read.

@GET
@Path("{consentId}")
public Response read(@Context HttpServletRequest request, @HeaderParam(X_FAPI_INTERACTION_ID) String incomingInteractionId, @PathParam("consentId") String consentId) {
    String code = "Consent Read";
    // Compute a value for the "x-fapi-interaction-id" HTTP response header.
    String outgoingInteractionId = ObbUtils.computeOutgoingInteractionId(code, incomingInteractionId);
    // Validate the access token.
    AuthleteApi authleteApi = AuthleteApiFactory.getDefaultApi();
    IntrospectionResponse info = ObbUtils.validateAccessToken(outgoingInteractionId, code, authleteApi, request, "consents");
    // Find "consent".
    Consent consent = ConsentDao.getInstance().read(consentId);
    // Validate the consent.
    validateConsent(outgoingInteractionId, code, consent, info);
    // Build a response body.
    ResponseConsent rc = ResponseConsent.create(consent);
    // Build a successful response.
    return ObbUtils.ok(outgoingInteractionId, rc);
}

Example 5 with IntrospectionResponse

use of com.authlete.common.dto.IntrospectionResponse in project java-oauth-server by authlete.

the class ConsentsEndpoint method create.

@POST
@Consumes(MediaType.APPLICATION_JSON)
public Response create(@Context HttpServletRequest request, @HeaderParam(X_FAPI_INTERACTION_ID) String incomingInteractionId, CreateConsent createConsent) {
    String code = "Consent Create";
    // Compute a value for the "x-fapi-interaction-id" HTTP response header.
    String outgoingInteractionId = ObbUtils.computeOutgoingInteractionId(code, incomingInteractionId);
    // Validate the access token.
    AuthleteApi authleteApi = AuthleteApiFactory.getDefaultApi();
    IntrospectionResponse info = ObbUtils.validateAccessToken(outgoingInteractionId, code, authleteApi, request, "consents");
    // Validate the input.
    validateCreateConsent(outgoingInteractionId, code, createConsent);
    // Create "consent".
    Consent consent = ConsentDao.getInstance().create(createConsent, info.getClientId());
    // Build a response body.
    ResponseConsent rc = ResponseConsent.create(consent);
    // Build a successful response.
    return ObbUtils.created(outgoingInteractionId, rc);
}