Examples with Tokeninfo com.google.api.services.oauth2.model.Tokeninfo used on opensource projects

Example 1 with Tokeninfo

use of com.google.api.services.oauth2.model.Tokeninfo in project styx by spotify.

the class GoogleIdTokenAuth method getServiceAccountIdTokenUsingAccessToken.

private String getServiceAccountIdTokenUsingAccessToken(GoogleCredentials credentials, String targetAudience) throws IOException {
    final Oauth2 oauth2 = new Oauth2.Builder(httpTransport, JSON_FACTORY, null).build();
    final AccessToken accessToken = accessToken(withScopes(credentials, ImmutableList.of("https://www.googleapis.com/auth/userinfo.email")));
    final Tokeninfo info = oauth2.tokeninfo().setAccessToken(accessToken.getTokenValue()).execute();
    final String principal = info.getEmail();
    if (principal == null) {
        throw new IOException("Unable to look up principal email, credentials missing email scope?");
    }
    if (!SERVICE_ACCOUNT_PATTERN.matcher(principal).matches()) {
        throw new IOException("Principal is not a service account, unable to acquire id token: " + principal);
    }
    return getServiceAccountIdTokenUsingAccessToken(credentials, principal, targetAudience);
}

Example 2 with Tokeninfo

use of com.google.api.services.oauth2.model.Tokeninfo in project gatein-portal by Meeds-io.

the class GoogleProcessorImpl method validateTokenAndUpdateScopes.

@Override
public GoogleAccessTokenContext validateTokenAndUpdateScopes(GoogleAccessTokenContext accessTokenContext) {
    GoogleRequest<Tokeninfo> googleRequest = new GoogleRequest<Tokeninfo>() {

        @Override
        protected Tokeninfo invokeRequest(GoogleAccessTokenContext accessTokenContext) throws IOException {
            GoogleTokenResponse tokenData = accessTokenContext.getTokenData();
            Oauth2 oauth2 = getOAuth2InstanceImpl(tokenData);
            GoogleCredential credential = getGoogleCredential(tokenData);
            return oauth2.tokeninfo().setAccessToken(credential.getAccessToken()).execute();
        }

        @Override
        protected OAuthException createException(IOException cause) {
            if (cause instanceof HttpResponseException) {
                return new OAuthException(OAuthExceptionCode.ACCESS_TOKEN_ERROR, "Error when obtaining tokenInfo: " + cause.getMessage(), cause);
            } else {
                return new OAuthException(OAuthExceptionCode.IO_ERROR, "IO Error when obtaining tokenInfo: " + cause.getMessage(), cause);
            }
        }
    };
    Tokeninfo tokenInfo = googleRequest.executeRequest(accessTokenContext, this);
    // If there was an error in the token info, abort.
    if (tokenInfo.containsKey("error")) {
        throw new OAuthException(OAuthExceptionCode.ACCESS_TOKEN_ERROR, "Error during token validation: " + tokenInfo.get("error").toString());
    }
    if (!tokenInfo.getIssuedTo().equals(clientID)) {
        throw new OAuthException(OAuthExceptionCode.ACCESS_TOKEN_ERROR, "Token's client ID does not match app's. clientID from tokenINFO: " + tokenInfo.getIssuedTo());
    }
    if (log.isTraceEnabled()) {
        log.trace("Successfully validated accessToken from google: " + tokenInfo);
    }
    String[] scopes = tokenInfo.getScope().split(" ");
    return new GoogleAccessTokenContext(accessTokenContext.getTokenData(), scopes);
}

Example 3 with Tokeninfo

use of com.google.api.services.oauth2.model.Tokeninfo in project isaac-api by isaacphysics.

the class GoogleAuthenticator method verifyAccessTokenIsValid.

/**
 * This method will contact the identity provider to verify that the token is valid for our application.
 *
 * This check is intended to mitigate against the confused deputy problem; although I suspect the google client
 * might already do this.
 *
 * @param credentials
 *            - the credential object for the token verification.
 * @return true if the token passes our validation false if not.
 */
private boolean verifyAccessTokenIsValid(final Credential credentials) {
    Validate.notNull(credentials, "Credentials cannot be null");
    Oauth2 oauth2 = new Oauth2.Builder(httpTransport, jsonFactory, credentials).setApplicationName(Constants.APPLICATION_NAME).build();
    try {
        Tokeninfo tokeninfo = oauth2.tokeninfo().setAccessToken(credentials.getAccessToken()).execute();
        if (tokeninfo.getAudience().equals(clientSecrets.getDetails().getClientId())) {
            return true;
        }
    } catch (IOException e) {
        log.error("IO error while trying to validate oauth2 security token.");
        e.printStackTrace();
    }
    return false;
}

Example 4 with Tokeninfo

use of com.google.api.services.oauth2.model.Tokeninfo in project dockstore by dockstore.

the class Hoverfly method getFakeTokeninfo.

private static Tokeninfo getFakeTokeninfo(String email) {
    Tokeninfo tokeninfo = new Tokeninfo();
    tokeninfo.setAccessType("offline");
    tokeninfo.setAudience("<fill me in>");
    tokeninfo.setEmail(email);
    // This is in seconds, see Tokeninfo type for more details. Random integer that isn't really used anywhere
    tokeninfo.setExpiresIn(9001);
    tokeninfo.setIssuedTo(tokeninfo.getAudience());
    tokeninfo.setScope("https://www.googleapis.com/auth/userinfo.profile https://www.googleapis.com/auth/userinfo.email");
    tokeninfo.setUserId("tuber");
    tokeninfo.setVerifiedEmail(true);
    return tokeninfo;
}

Example 5 with Tokeninfo

use of com.google.api.services.oauth2.model.Tokeninfo in project dockstore by dockstore.

the class GoogleHelperTest method isValidAudience.

@Test
public void isValidAudience() {
    final DockstoreWebserviceConfiguration config = new DockstoreWebserviceConfiguration();
    config.setGoogleClientID(AUDIENCE1);
    config.getExternalGoogleClientIdPrefixes().add(EXTERNAL_PREFIX);
    GoogleHelper.setConfig(config);
    final Tokeninfo tokeninfo = Mockito.mock(Tokeninfo.class);
    when(tokeninfo.getAudience()).thenReturn(AUDIENCE1).thenReturn(EXTERNAL_AUDIENCE).thenReturn(INVALID_AUDIENCE);
    Assert.assertTrue(GoogleHelper.isValidAudience(tokeninfo));
    Assert.assertTrue(GoogleHelper.isValidAudience(tokeninfo));
    Assert.assertFalse(GoogleHelper.isValidAudience(tokeninfo));
}