Examples with OBErrorException com.forgerock.openbanking.exceptions.OBErrorException used on opensource projects

Example 6 with OBErrorException

use of com.forgerock.openbanking.exceptions.OBErrorException in project openbanking-aspsp by OpenBankingToolkit.

the class RSEndpointWrapper method execute.

public ResponseEntity execute(R main) throws OBErrorResponseException {
    log.info("execute method");
    try {
        log.debug("execute() Apply filters");
        applyFilters();
        if (additionalFilter != null) {
            additionalFilter.filter(this);
        }
        log.debug("execute() Filters applied");
        log.info("execute() Call main lambda");
        ResponseEntity response = run(main);
        String tan = rsEndpointWrapperService.getTan();
        // TODO: Does this mean we create jwsSignatures for all responses to RS calls? We don't need to sign
        // requests to accounts endpoints, although I guess it doesn't hurt if we do. Just wasteful in terms of
        // processing time etc.
        String jwsSignature = rsEndpointWrapperService.generateDetachedJws(response, obVersion, tan, xFapiFinancialId);
        return ResponseEntity.status(response.getStatusCode()).header("x-jws-signature", jwsSignature).body(response.getBody());
    } catch (OBErrorException e) {
        log.warn("Verification failed", e);
        throw new OBErrorResponseException(e.getObriErrorType().getHttpStatus(), OBRIErrorResponseCategory.REQUEST_FILTER, e.getOBError());
    } catch (JsonProcessingException e) {
        log.warn("Failed to process JSON response", e);
        throw new OBErrorResponseException(HttpStatus.INTERNAL_SERVER_ERROR, OBRIErrorResponseCategory.REQUEST_FILTER, SERVER_ERROR.toOBError1());
    }
}

Example 7 with OBErrorException

use of com.forgerock.openbanking.exceptions.OBErrorException in project openbanking-aspsp by OpenBankingToolkit.

the class RSEndpointWrapper method verifyMatlsFromAccessToken.

// This method ensures that the certificate used for MATLS to access the endpoint belongs to the same
// organisation that the access token provided in the request authorization header was issued to.
public void verifyMatlsFromAccessToken() throws OBErrorException {
    try {
        log.debug("verifyMatlsFromAccessToken() called");
        String oauth2ClientId = accessToken.getJWTClaimsSet().getAudience().get(0);
        // MTLS check. We verify that the certificate is associated with the expected AISP ID
        Optional<Tpp> tpp = this.tppStoreService.findByClientId(oauth2ClientId);
        UserDetails currentUser = (UserDetails) ((Authentication) principal).getPrincipal();
        if (tpp.isPresent()) {
            String authorisationNumberFromTppRecord = tpp.get().getAuthorisationNumber();
            if (!currentUser.getUsername().equals(authorisationNumberFromTppRecord)) {
                log.warn("TPP ID from account token {} is not the one associated with the certificate {}", oauth2ClientId, currentUser.getUsername());
                throw new OBErrorException(OBRIErrorType.MATLS_TPP_AUTHENTICATION_INVALID_FROM_ACCESS_TOKEN, currentUser.getUsername(), oauth2ClientId);
            }
        }
        this.oAuth2ClientId = oauth2ClientId;
        log.info("TPP AuthorizationNumber {} has been verified against X509 certificate (MTLS)", currentUser.getUsername());
    } catch (ParseException e) {
        log.warn("Access token {} doesn't look to be a JWT. You need to enable stateless", authorization);
        throw new OBErrorException(OBRIErrorType.ACCESS_TOKEN_INVALID_FORMAT);
    }
}

Example 8 with OBErrorException

use of com.forgerock.openbanking.exceptions.OBErrorException in project openbanking-aspsp by OpenBankingToolkit.

the class DetachedJwsVerifierTest method shouldFailToVerifyB64HeaderGivenVersionBefore3_1_4AndB64HeaderIsTrue.

@Test
public void shouldFailToVerifyB64HeaderGivenVersionBefore3_1_4AndB64HeaderIsTrue() throws Exception {
    // Given
    String detachedJws = "eyJiNjQiOnRydWUsImh0dHA6XC9cL29wZW5iYW5raW5nLm9yZy51a1wvaWF0IjoxNTk4NDMwMDA4LCJodHRwOlwvXC9vcGVuYmFua2luZy5vcmcudWtcL3RhbiI6Im9wZW5iYW5raW5nLm9yZy51ayIsImNyaXQiOlsiYjY0IiwiaHR0cDpcL1wvb3BlbmJhbmtpbmcub3JnLnVrXC9pYXQiLCJodHRwOlwvXC9vcGVuYmFua2luZy5vcmcudWtcL3RhbiIsImh0dHA6XC9cL29wZW5iYW5raW5nLm9yZy51a1wvaXNzIl0sImtpZCI6InRfSXU2eFhZRXQyeGh3TUFzX3JsYWNHeGtFWSIsImh0dHA6XC9cL29wZW5iYW5raW5nLm9yZy51a1wvaXNzIjoiaHR0cDpcL1wvb3BlbmJhbmtpbmcub3JnLnVrXC9pYXQiLCJhbGciOiJQUzI1NiJ9..yfhofJGNJfseVOEhCKanjxHlxlnMCdBKOy9HQFvMf7ZmEpkp2DiKKHJeK1LzDHYOo6WtkImIWwuTS3VvzBPrn7-z83CqM-BHZRzI-_E2I7EzaOzr8We4PtBVDk4wgwSxZW5Q0MPM-WcKgAMPskqrCVXMHLce2AcVsK6bivpi8mdSlA0rVj5FXhXw75-_fuWz8-2GY4xNF0h5YH7Tk4qpQsdpFhgpiagT29ujDcX46g5rF9mA8hUWqtJQE5yoF64S_lBUf4c_R1K1NyG5IwT-GbIoECF-epK5ybNLuD_ZfTfLcWVLI8rav0dRpiI0rdg5-upuB94H-npx1k1KsRXqSA";
    HttpServletRequest request = setupHttpServletRequestMock();
    // When
    OBErrorException exception = catchThrowableOfType(() -> detachedJwsVerifier.verifyDetachedJws(detachedJws, OBVersion.v3_1_3, request, OAUTH2_CLIENT_ID), OBErrorException.class);
    // Then
    assertThat(exception).hasMessage("Invalid detached signature " + detachedJws + ". Reason: b64 claim header not set to false");
}

Example 9 with OBErrorException

use of com.forgerock.openbanking.exceptions.OBErrorException in project openbanking-aspsp by OpenBankingToolkit.

the class DetachedJwsVerifierTest method shouldFailToVerifyDetachedJwsGivenVerificationEnabledAndJwsIsNull.

@Test
public void shouldFailToVerifyDetachedJwsGivenVerificationEnabledAndJwsIsNull() throws IOException {
    // Given
    HttpServletRequest request = mock(HttpServletRequest.class);
    // When
    OBErrorException exception = catchThrowableOfType(() -> detachedJwsVerifier.verifyDetachedJws(null, OBVersion.v3_1_3, request, OAUTH2_CLIENT_ID), OBErrorException.class);
    // Then
    assertThat(exception).hasMessage("Invalid detached signature null. Reason: Not provided");
}

Example 10 with OBErrorException

use of com.forgerock.openbanking.exceptions.OBErrorException in project openbanking-aspsp by OpenBankingToolkit.

the class FakeDataApiController method generateFakeData.

@Override
public ResponseEntity generateFakeData(@RequestParam("userId") String userId, @RequestParam("username") String username, @RequestParam(name = "profile", required = false) String profile) throws OBErrorException {
    log.debug("generateFakeData called for userId/username '{}:{}', with profile '{}' ", userId, username, profile);
    if (RANDOM_PROFILE_ID.equals(profile)) {
        log.debug("generateFakeData() generating random data");
        return ResponseEntity.status(HttpStatus.CREATED).body(generateRandomData(userId, username));
    } else {
        log.debug("generateFakeData() generating from profile '{}'", profile);
        Optional<DataConfigurationProperties.DataTemplateProfile> any = dataConfig.getProfiles().stream().filter(t -> t.getId().equals(profile)).findAny();
        if (!any.isPresent()) {
            throw new OBErrorException(OBRIErrorType.DATA_INVALID_REQUEST, "Profile '" + profile + "' doesn't exist.");
        }
        DataConfigurationProperties.DataTemplateProfile dataTemplateProfile = any.get();
        FRUserData template = getTemplate(dataTemplateProfile.getTemplate(), username);
        template.setUserName(username);
        return dataController.importUserData(template);
    }
}