Examples with URIFactory com.predic8.membrane.core.util.URIFactory used on opensource projects

Example 6 with URIFactory

use of com.predic8.membrane.core.util.URIFactory in project service-proxy by membrane.

the class IllegalCharactersInURLTest method doit.

@Test
public void doit() throws Exception {
    URIFactory uriFactory = new URIFactory(true);
    Response res = new HttpClient().call(new Request.Builder().method("GET").url(uriFactory, "http://localhost:3027/foo{}").body("").buildExchange()).getResponse();
    Assert.assertEquals(200, res.getStatusCode());
}

Example 7 with URIFactory

use of com.predic8.membrane.core.util.URIFactory in project service-proxy by membrane.

the class RevocationEndpointProcessor method process.

@Override
public Outcome process(Exchange exc) throws Exception {
    Map<String, String> params = URLParamUtil.getParams(uriFactory, exc);
    if (!params.containsKey("token")) {
        exc.setResponse(OAuth2Util.createParameterizedJsonErrorResponse(exc, jsonGen, "error", "invalid_request"));
        return Outcome.RETURN;
    }
    SessionManager.Session session = authServer.getSessionFinder().getSessionForToken(params.get("token"));
    if (session == null) {
        // token doesnt exist -> token is already invalid
        exc.setResponse(Response.ok().bodyEmpty().build());
        return Outcome.RETURN;
    }
    Client client;
    Map<String, String> userAttributes = session.getUserAttributes();
    synchronized (userAttributes) {
        try {
            client = authServer.getClientList().getClient(userAttributes.get(ParamNames.CLIENT_ID));
        } catch (Exception e) {
            // This should never happen
            exc.setResponse(Response.ok().bodyEmpty().build());
            return Outcome.RETURN;
        }
    }
    String paramClientId = params.get(ParamNames.CLIENT_ID);
    String paramClientSecret = params.get(ParamNames.CLIENT_SECRET);
    if ((paramClientId != null && !client.getClientId().equals(paramClientId)) || (paramClientSecret != null && !client.getClientSecret().equals(paramClientSecret))) {
        exc.setResponse(OAuth2Util.createParameterizedJsonErrorResponse(exc, jsonGen, "error", "invalid_grant"));
        return Outcome.RETURN;
    }
    try {
        authServer.getTokenGenerator().invalidateToken(params.get("token"), client.getClientId(), client.getClientSecret());
    } catch (Exception e) {
        exc.setResponse(OAuth2Util.createParameterizedJsonErrorResponse(exc, jsonGen, "error", "invalid_grant"));
        return Outcome.RETURN;
    }
    synchronized (session) {
        session.clear();
    }
    synchronized (authServer.getSessionManager()) {
        authServer.getSessionManager().removeSession(session);
    }
    synchronized (authServer.getSessionFinder()) {
        authServer.getSessionFinder().removeSessionForToken(params.get("token"));
    }
    exc.setResponse(Response.ok().bodyEmpty().build());
    return Outcome.RETURN;
}

Example 8 with URIFactory

use of com.predic8.membrane.core.util.URIFactory in project service-proxy by membrane.

the class OAuth2ResourceInterceptor method handleRequest.

public boolean handleRequest(Exchange exc, String state, String publicURL, Session session) throws Exception {
    String path = uriFactory.create(exc.getDestinations().get(0)).getPath();
    if (path == null)
        return false;
    if (path.endsWith("/oauth2callback")) {
        try {
            Map<String, String> params = URLParamUtil.getParams(uriFactory, exc);
            String state2 = params.get("state");
            if (state2 == null)
                throw new RuntimeException("No CSRF token.");
            Map<String, String> param = URLParamUtil.parseQueryString(state2);
            if (param == null || !param.containsKey("security_token"))
                throw new RuntimeException("No CSRF token.");
            boolean csrfMatch = false;
            for (String state3 : stateToOriginalUrl.keySet()) if (param.get("security_token").equals(state3))
                csrfMatch = true;
            if (!csrfMatch)
                throw new RuntimeException("CSRF token mismatch.");
            Request originalRequest = stateToOriginalUrl.get(param.get("security_token"));
            String url = originalRequest.getUri();
            if (url == null)
                url = "/";
            stateToOriginalUrl.remove(state2);
            if (log.isDebugEnabled())
                log.debug("CSRF token match.");
            String code = params.get("code");
            if (code == null)
                throw new RuntimeException("No code received.");
            Exchange e = new Request.Builder().post(auth.getTokenEndpoint()).header(Header.CONTENT_TYPE, "application/x-www-form-urlencoded").header(Header.ACCEPT, "application/json").header(Header.USER_AGENT, Constants.USERAGENT).body("code=" + code + "&client_id=" + auth.getClientId() + "&client_secret=" + auth.getClientSecret() + "&redirect_uri=" + publicURL + "oauth2callback" + "&grant_type=authorization_code").buildExchange();
            LogInterceptor logi = null;
            if (log.isDebugEnabled()) {
                logi = new LogInterceptor();
                logi.setHeaderOnly(false);
                logi.handleRequest(e);
            }
            Response response = auth.doRequest(e);
            if (response.getStatusCode() != 200) {
                response.getBody().read();
                throw new RuntimeException("Authentication server returned " + response.getStatusCode() + ".");
            }
            if (log.isDebugEnabled())
                logi.handleResponse(e);
            HashMap<String, String> json = Util.parseSimpleJSONResponse(response);
            if (!json.containsKey("access_token"))
                throw new RuntimeException("No access_token received.");
            // and also "scope": "", "token_type": "bearer"
            String token = (String) json.get("access_token");
            OAuth2AnswerParameters oauth2Answer = new OAuth2AnswerParameters();
            synchronized (session) {
                // saving for logout
                session.getUserAttributes().put("access_token", token);
            }
            oauth2Answer.setAccessToken(token);
            oauth2Answer.setTokenType(json.get("token_type"));
            oauth2Answer.setExpiration(json.get("expires_in"));
            oauth2Answer.setRefreshToken(json.get("refresh_token"));
            oauth2Answer.setReceivedAt(LocalDateTime.now());
            if (json.containsKey("id_token")) {
                if (idTokenIsValid(json.get("id_token")))
                    oauth2Answer.setIdToken(json.get("id_token"));
                else
                    oauth2Answer.setIdToken("INVALID");
            }
            validTokens.put(token, true);
            Exchange e2 = new Request.Builder().get(auth.getUserInfoEndpoint()).header("Authorization", json.get("token_type") + " " + token).header("User-Agent", Constants.USERAGENT).header(Header.ACCEPT, "application/json").buildExchange();
            if (log.isDebugEnabled()) {
                logi.setHeaderOnly(false);
                logi.handleRequest(e2);
            }
            Response response2 = auth.doRequest(e2);
            if (log.isDebugEnabled())
                logi.handleResponse(e2);
            if (response2.getStatusCode() != 200) {
                statistics.accessTokenInvalid();
                throw new RuntimeException("User data could not be retrieved.");
            }
            statistics.accessTokenValid();
            HashMap<String, String> json2 = Util.parseSimpleJSONResponse(response2);
            oauth2Answer.setUserinfo(json2);
            session.getUserAttributes().put(OAUTH2_ANSWER, oauth2Answer.serialize());
            processUserInfo(json2, session);
            exc.setRequest(originalRequest);
            return true;
        } catch (Exception e) {
            exc.setResponse(Response.badRequest().body(e.getMessage()).build());
            return true;
        }
    }
    return false;
}

Example 9 with URIFactory

use of com.predic8.membrane.core.util.URIFactory in project service-proxy by membrane.

the class Test method main.

public static void main(String[] args) throws Exception {
    URIFactory uriFactory = new URIFactory();
    uriFactory.setAllowIllegalCharacters(true);
    Response res = new HttpClient().call(new Request.Builder().get(uriFactory, "http://localhost:2000/a.{/").buildExchange()).getResponse();
    System.out.println(res.getStatusCode());
    System.out.println(res.getStartLine());
}