Examples with Subject com.nimbusds.oauth2.sdk.id.Subject used on opensource projects

Example 66 with Subject

use of com.nimbusds.oauth2.sdk.id.Subject in project di-authentication-api by alphagov.

the class TokenGeneratorHelper method generateIDToken.

public static SignedJWT generateIDToken(String clientId, Subject subject, String issuerUrl, JWK signingKey, Date expiryDate) {
    IDTokenClaimsSet idTokenClaims = new IDTokenClaimsSet(new Issuer(issuerUrl), subject, List.of(new Audience(clientId)), expiryDate, new Date());
    try {
        JWSSigner signer;
        JWSHeader.Builder jwsHeaderBuilder;
        if (signingKey instanceof RSAKey) {
            signer = new RSASSASigner(signingKey.toRSAKey());
            jwsHeaderBuilder = new JWSHeader.Builder(JWSAlgorithm.RS512);
        } else if (signingKey instanceof ECKey) {
            signer = new ECDSASigner(signingKey.toECKey());
            jwsHeaderBuilder = new JWSHeader.Builder(JWSAlgorithm.ES256);
        } else {
            throw new RuntimeException("Invalid JWKKey");
        }
        var signedJWT = new SignedJWT(jwsHeaderBuilder.keyID(signingKey.getKeyID()).build(), idTokenClaims.toJWTClaimsSet());
        signedJWT.sign(signer);
        return signedJWT;
    } catch (JOSEException | ParseException e) {
        throw new RuntimeException(e);
    }
}

Example 67 with Subject

use of com.nimbusds.oauth2.sdk.id.Subject in project di-authentication-api by alphagov.

the class TokenService method generateRefreshTokenResponse.

public OIDCTokenResponse generateRefreshTokenResponse(String clientID, Subject internalSubject, List<String> scopes, Subject subject) {
    AccessToken accessToken = generateAndStoreAccessToken(clientID, internalSubject, scopes, subject, null);
    RefreshToken refreshToken = generateAndStoreRefreshToken(clientID, internalSubject, scopes, subject);
    return new OIDCTokenResponse(new OIDCTokens(accessToken, refreshToken));
}

Example 68 with Subject

use of com.nimbusds.oauth2.sdk.id.Subject in project di-authentication-api by alphagov.

the class TokenService method generateIDToken.

private SignedJWT generateIDToken(String clientId, Subject subject, Map<String, Object> additionalTokenClaims, AccessTokenHash accessTokenHash, String vot, boolean isDocAppJourney) {
    LOG.info("Generating IdToken");
    URI trustMarkUri = buildURI(configService.getOidcApiBaseURL().get(), "/trustmark");
    Date expiryDate = NowHelper.nowPlus(configService.getIDTokenExpiry(), ChronoUnit.SECONDS);
    IDTokenClaimsSet idTokenClaims = new IDTokenClaimsSet(new Issuer(configService.getOidcApiBaseURL().get()), subject, List.of(new Audience(clientId)), expiryDate, NowHelper.now());
    idTokenClaims.setAccessTokenHash(accessTokenHash);
    idTokenClaims.putAll(additionalTokenClaims);
    if (!isDocAppJourney) {
        idTokenClaims.setClaim("vot", vot);
    }
    idTokenClaims.setClaim("vtm", trustMarkUri.toString());
    try {
        return generateSignedJWT(idTokenClaims.toJWTClaimsSet(), Optional.empty());
    } catch (com.nimbusds.oauth2.sdk.ParseException e) {
        LOG.error("Error when trying to parse IDTokenClaims to JWTClaimSet", e);
        throw new RuntimeException(e);
    }
}

Example 69 with Subject

use of com.nimbusds.oauth2.sdk.id.Subject in project di-authentication-api by alphagov.

the class TokenService method generateAndStoreAccessToken.

private AccessToken generateAndStoreAccessToken(String clientId, Subject internalSubject, List<String> scopes, Subject subject, OIDCClaimsRequest claimsRequest) {
    LOG.info("Generating AccessToken");
    Date expiryDate = NowHelper.nowPlus(configService.getAccessTokenExpiry(), ChronoUnit.SECONDS);
    var jwtID = UUID.randomUUID().toString();
    LOG.info("AccessToken being created with JWTID: {}", jwtID);
    JWTClaimsSet.Builder claimSetBuilder = new JWTClaimsSet.Builder().claim("scope", scopes).issuer(configService.getOidcApiBaseURL().get()).expirationTime(expiryDate).issueTime(NowHelper.now()).claim("client_id", clientId).subject(subject.getValue()).jwtID(jwtID);
    if (Objects.nonNull(claimsRequest)) {
        claimSetBuilder.claim("claims", claimsRequest.getUserInfoClaimsRequest().getEntries().stream().map(ClaimsSetRequest.Entry::getClaimName).collect(Collectors.toList()));
    }
    SignedJWT signedJWT = generateSignedJWT(claimSetBuilder.build(), Optional.empty());
    AccessToken accessToken = new BearerAccessToken(signedJWT.serialize());
    try {
        redisConnectionService.saveWithExpiry(ACCESS_TOKEN_PREFIX + clientId + "." + subject.getValue(), objectMapper.writeValueAsString(new AccessTokenStore(accessToken.getValue(), internalSubject.getValue())), configService.getAccessTokenExpiry());
    } catch (JsonException e) {
        LOG.error("Unable to save access token to Redis");
        throw new RuntimeException(e);
    }
    return accessToken;
}

Example 70 with Subject

use of com.nimbusds.oauth2.sdk.id.Subject in project di-authentication-api by alphagov.

the class LoginHandlerTest method shouldReturn200IfMigratedUserHasBeenProcessesSuccessfully.

@Test
void shouldReturn200IfMigratedUserHasBeenProcessesSuccessfully() throws JsonProcessingException, Json.JsonException {
    when(configurationService.getTermsAndConditionsVersion()).thenReturn("1.0");
    String legacySubjectId = new Subject().getValue();
    UserProfile userProfile = generateUserProfile(legacySubjectId);
    when(authenticationService.getUserProfileByEmailMaybe(EMAIL)).thenReturn(Optional.of(userProfile));
    userCredentials.setPassword(null);
    when(userMigrationService.processMigratedUser(userCredentials, PASSWORD)).thenReturn(true);
    when(clientSession.getAuthRequestParams()).thenReturn(generateAuthRequest().toParameters());
    usingValidSession();
    APIGatewayProxyRequestEvent event = new APIGatewayProxyRequestEvent();
    event.setHeaders(Map.of("Session-Id", session.getSessionId()));
    event.setBody(format("{ \"password\": \"%s\", \"email\": \"%s\" }", PASSWORD, EMAIL));
    APIGatewayProxyResponseEvent result = handler.handleRequest(event, context);
    assertThat(result, hasStatus(200));
    LoginResponse response = objectMapper.readValue(result.getBody(), LoginResponse.class);
    assertThat(response.getLatestTermsAndConditionsAccepted(), equalTo(true));
    assertThat(response.getRedactedPhoneNumber(), equalTo(RedactPhoneNumberHelper.redactPhoneNumber(PHONE_NUMBER)));
    verify(sessionService).save(argThat(session -> session.isNewAccount() == Session.AccountState.EXISTING));
}