Examples with HttpException io.jans.ca.server.HttpException used on opensource projects

Example 6 with HttpException

use of io.jans.ca.server.HttpException in project jans by JanssenProject.

the class DiscoveryService method getConnectDiscoveryResponse.

public OpenIdConfigurationResponse getConnectDiscoveryResponse(String opConfigurationEndpoint) {
    validationService.validateOpConfigurationEndpoint(opConfigurationEndpoint);
    try {
        final OpenIdConfigurationResponse r = map.get(opConfigurationEndpoint);
        if (r != null) {
            validationService.isOpHostAllowed(r.getIssuer());
            return r;
        }
        final OpenIdConfigurationClient client = opClientFactory.createOpenIdConfigurationClient(opConfigurationEndpoint);
        client.setExecutor(httpService.getClientEngine());
        final OpenIdConfigurationResponse response = client.execOpenIdConfiguration();
        LOG.trace("Discovery response: {} ", response.getEntity());
        if (StringUtils.isNotBlank(response.getEntity())) {
            map.put(opConfigurationEndpoint, response);
            validationService.isOpHostAllowed(response.getIssuer());
            return response;
        } else {
            LOG.error("No response from discovery!");
        }
    } catch (SSLHandshakeException e) {
        LOG.error(e.getMessage(), e);
        throw new HttpException(ErrorResponseCode.SSL_HANDSHAKE_ERROR);
    } catch (IOException e) {
        LOG.error(e.getMessage(), e);
        throw new WebApplicationException(Response.status(Response.Status.INTERNAL_SERVER_ERROR).entity("Internal server error. Message: " + e.getMessage()).build());
    } catch (Exception e) {
        LOG.error(e.getMessage(), e);
    }
    LOG.error("Unable to fetch discovery information for op_configuration_endpoint: {}", opConfigurationEndpoint);
    throw new HttpException(ErrorResponseCode.NO_CONNECT_DISCOVERY_RESPONSE);
}

Example 7 with HttpException

use of io.jans.ca.server.HttpException in project jans by JanssenProject.

the class UpdateSiteOperation method updateRegisteredClient.

private void updateRegisteredClient(Rp rp, RegisterRequest registerRequest) {
    if (StringUtils.isBlank(rp.getClientRegistrationClientUri())) {
        LOG.error("Registration client url is blank.");
        throw new HttpException(ErrorResponseCode.INVALID_REGISTRATION_CLIENT_URL);
    }
    final RegisterClient registerClient = new RegisterClient(rp.getClientRegistrationClientUri());
    registerClient.setRequest(registerRequest);
    registerClient.setExecutor(getHttpService().getClientEngine());
    final RegisterResponse response = registerClient.exec();
    if (response != null) {
        if (response.getStatus() == 200) {
            LOG.trace("Client updated successfully. for rp - client_id: " + rp.getClientId());
            return;
        } else {
            LOG.error("Response is not OK (200).");
        }
    } else {
        LOG.error("RegisterClient response is null.");
    }
    if (!Strings.isNullOrEmpty(response.getErrorDescription())) {
        LOG.error(response.getErrorDescription());
    }
    throw new RuntimeException("Failed to update client for rp. Details:" + response.getEntity());
}

Example 8 with HttpException

use of io.jans.ca.server.HttpException in project jans by JanssenProject.

the class UpdateSiteOperation method createRegisterClientRequest.

private RegisterRequest createRegisterClientRequest(Rp rp, UpdateSiteParams params) {
    final RegisterRequest request = RegisterRequestMapper.createRegisterRequest(rp);
    // force update
    request.setHttpMethod(HttpMethod.PUT);
    if (params.getResponseTypes() != null && !params.getResponseTypes().isEmpty()) {
        request.setResponseTypesStrings(params.getResponseTypes());
    }
    if (params.getRptAsJwt() != null) {
        request.setRptAsJwt(params.getRptAsJwt());
    }
    if (params.getGrantType() != null && !params.getGrantType().isEmpty()) {
        request.setGrantTypes(params.getGrantType().stream().map(item -> GrantType.fromString(item)).collect(Collectors.toList()));
    }
    Set<String> redirectUris = Sets.newLinkedHashSet();
    if (params.getRedirectUris() != null && !params.getRedirectUris().isEmpty()) {
        if (!params.getRedirectUris().stream().allMatch(uri -> Utils.isValidUrl(uri))) {
            throw new HttpException(ErrorResponseCode.INVALID_REDIRECT_URI);
        }
        redirectUris.addAll(params.getRedirectUris());
        List<String> redirectUriList = Lists.newArrayList(redirectUris);
        request.setRedirectUris(redirectUriList);
    }
    if (params.getAcrValues() != null && !params.getAcrValues().isEmpty()) {
        request.setDefaultAcrValues(params.getAcrValues());
    }
    if (params.getClaimsRedirectUri() != null && !params.getClaimsRedirectUri().isEmpty()) {
        request.setClaimsRedirectUris(params.getClaimsRedirectUri());
    }
    if (params.getAccessTokenAsJwt() != null) {
        request.setAccessTokenAsJwt(params.getAccessTokenAsJwt());
    }
    if (params.getAccessTokenSigningAlg() != null) {
        SignatureAlgorithm signatureAlgorithms = SignatureAlgorithm.fromString(params.getAccessTokenSigningAlg());
        if (signatureAlgorithms == null) {
            LOG.error("Received invalid algorithm in `access_token_signing_alg` property. Value: " + params.getAccessTokenSigningAlg());
            throw new HttpException(ErrorResponseCode.INVALID_SIGNATURE_ALGORITHM);
        }
        request.setAccessTokenSigningAlg(signatureAlgorithms);
    }
    if (!Strings.isNullOrEmpty(params.getClientJwksUri())) {
        request.setJwksUri(params.getClientJwksUri());
    }
    if (params.getPostLogoutRedirectUris() != null && !params.getPostLogoutRedirectUris().isEmpty()) {
        request.setPostLogoutRedirectUris(Lists.newArrayList(params.getPostLogoutRedirectUris()));
    }
    if (params.getContacts() != null) {
        request.setContacts(params.getContacts());
    }
    if (params.getScope() != null) {
        request.setScope(params.getScope());
    }
    if (!Strings.isNullOrEmpty(params.getClientSectorIdentifierUri())) {
        request.setSectorIdentifierUri(params.getClientSectorIdentifierUri());
    }
    if (!Strings.isNullOrEmpty(params.getClientFrontchannelLogoutUri())) {
        request.setFrontChannelLogoutUri(params.getClientFrontchannelLogoutUri());
    }
    if (params.getClientRequestUris() != null && !params.getClientRequestUris().isEmpty()) {
        request.setRequestUris(params.getClientRequestUris());
    }
    if (params.getClientTokenEndpointAuthSigningAlg() != null) {
        SignatureAlgorithm signatureAlgorithms = SignatureAlgorithm.fromString(params.getClientTokenEndpointAuthSigningAlg());
        if (signatureAlgorithms == null) {
            LOG.error("Received invalid algorithm in `client_token_endpoint_auth_signing_alg` property. Value: " + params.getClientTokenEndpointAuthSigningAlg());
            throw new HttpException(ErrorResponseCode.INVALID_SIGNATURE_ALGORITHM);
        }
        request.setTokenEndpointAuthSigningAlg(SignatureAlgorithm.fromString(params.getClientTokenEndpointAuthSigningAlg()));
    }
    if (!Strings.isNullOrEmpty(params.getClientName())) {
        request.setClientName(params.getClientName());
    }
    if (!Strings.isNullOrEmpty(params.getLogoUri())) {
        request.setLogoUri(params.getLogoUri());
    }
    if (!Strings.isNullOrEmpty(params.getClientUri())) {
        request.setClientUri(params.getClientUri());
    }
    if (!Strings.isNullOrEmpty(params.getPolicyUri())) {
        request.setPolicyUri(params.getPolicyUri());
    }
    if (params.getFrontChannelLogoutSessionRequired() != null) {
        request.setFrontChannelLogoutSessionRequired(params.getFrontChannelLogoutSessionRequired());
    }
    if (!Strings.isNullOrEmpty(params.getTosUri())) {
        request.setTosUri(params.getTosUri());
    }
    if (!Strings.isNullOrEmpty(params.getJwks())) {
        request.setJwks(params.getJwks());
    }
    if (!Strings.isNullOrEmpty(params.getIdTokenBindingCnf())) {
        request.setIdTokenTokenBindingCnf(params.getIdTokenBindingCnf());
    }
    if (!Strings.isNullOrEmpty(params.getTlsClientAuthSubjectDn())) {
        request.setTlsClientAuthSubjectDn(params.getTlsClientAuthSubjectDn());
    }
    if (!Strings.isNullOrEmpty(params.getSubjectType())) {
        SubjectType subjectType = SubjectType.fromString(params.getSubjectType());
        if (subjectType == null) {
            LOG.error("Received invalid values in `subject_type` property. Value: " + params.getSubjectType());
            throw new HttpException(ErrorResponseCode.INVALID_SUBJECT_TYPE);
        }
        request.setSubjectType(subjectType);
    }
    if (params.getRunIntrospectionScriptBeforeAccessTokenAsJwtCreationAndIncludeClaims() != null) {
        request.setRunIntrospectionScriptBeforeAccessTokenAsJwtCreationAndIncludeClaims(params.getRunIntrospectionScriptBeforeAccessTokenAsJwtCreationAndIncludeClaims());
    }
    if (!Strings.isNullOrEmpty(params.getIdTokenSignedResponseAlg())) {
        SignatureAlgorithm signatureAlgorithms = SignatureAlgorithm.fromString(params.getIdTokenSignedResponseAlg());
        if (signatureAlgorithms == null) {
            LOG.error("Received invalid algorithm in `id_token_signed_response_alg` property. Value: " + params.getIdTokenSignedResponseAlg());
            throw new HttpException(ErrorResponseCode.INVALID_SIGNATURE_ALGORITHM);
        }
        if (signatureAlgorithms == SignatureAlgorithm.NONE && !getConfigurationService().getConfiguration().getAcceptIdTokenWithoutSignature()) {
            LOG.error("`ID_TOKEN` without signature is not allowed. To allow `ID_TOKEN` without signature set `accept_id_token_without_signature` field to 'true' in client-api-server.yml.");
            throw new HttpException(ErrorResponseCode.ID_TOKEN_WITHOUT_SIGNATURE_NOT_ALLOWED);
        }
        request.setIdTokenSignedResponseAlg(signatureAlgorithms);
    }
    if (!Strings.isNullOrEmpty(params.getIdTokenEncryptedResponseAlg())) {
        KeyEncryptionAlgorithm keyEncryptionAlgorithms = KeyEncryptionAlgorithm.fromName(params.getIdTokenEncryptedResponseAlg());
        if (keyEncryptionAlgorithms == null) {
            LOG.error("Received invalid algorithm in `id_token_encrypted_response_alg` property. Value: " + params.getIdTokenEncryptedResponseAlg());
            throw new HttpException(ErrorResponseCode.INVALID_KEY_ENCRYPTION_ALGORITHM);
        }
        request.setIdTokenEncryptedResponseAlg(keyEncryptionAlgorithms);
    }
    if (!Strings.isNullOrEmpty(params.getIdTokenEncryptedResponseEnc())) {
        BlockEncryptionAlgorithm blockEncryptionAlgorithms = BlockEncryptionAlgorithm.fromName(params.getIdTokenEncryptedResponseEnc());
        if (blockEncryptionAlgorithms == null) {
            LOG.error("Received invalid algorithm in `id_token_encrypted_response_enc` property. Value: " + params.getIdTokenEncryptedResponseEnc());
            throw new HttpException(ErrorResponseCode.INVALID_BLOCK_ENCRYPTION_ALGORITHM);
        }
        request.setIdTokenEncryptedResponseEnc(blockEncryptionAlgorithms);
    }
    if (!Strings.isNullOrEmpty(params.getUserInfoSignedResponseAlg())) {
        SignatureAlgorithm signatureAlgorithms = SignatureAlgorithm.fromString(params.getUserInfoSignedResponseAlg());
        if (signatureAlgorithms == null) {
            LOG.error("Received invalid algorithm in `user_info_signed_response_alg` property. Value: " + params.getUserInfoSignedResponseAlg());
            throw new HttpException(ErrorResponseCode.INVALID_SIGNATURE_ALGORITHM);
        }
        request.setUserInfoSignedResponseAlg(signatureAlgorithms);
    }
    if (!Strings.isNullOrEmpty(params.getUserInfoEncryptedResponseAlg())) {
        KeyEncryptionAlgorithm keyEncryptionAlgorithms = KeyEncryptionAlgorithm.fromName(params.getUserInfoEncryptedResponseAlg());
        if (keyEncryptionAlgorithms == null) {
            LOG.error("Received invalid algorithm in `user_info_encrypted_response_alg` property. Value: " + params.getUserInfoEncryptedResponseAlg());
            throw new HttpException(ErrorResponseCode.INVALID_KEY_ENCRYPTION_ALGORITHM);
        }
        request.setUserInfoEncryptedResponseAlg(keyEncryptionAlgorithms);
    }
    if (!Strings.isNullOrEmpty(params.getUserInfoEncryptedResponseEnc())) {
        BlockEncryptionAlgorithm blockEncryptionAlgorithms = BlockEncryptionAlgorithm.fromName(params.getUserInfoEncryptedResponseEnc());
        if (blockEncryptionAlgorithms == null) {
            LOG.error("Received invalid algorithm in `user_info_encrypted_response_enc` property. Value: " + params.getUserInfoEncryptedResponseEnc());
            throw new HttpException(ErrorResponseCode.INVALID_BLOCK_ENCRYPTION_ALGORITHM);
        }
        request.setUserInfoEncryptedResponseEnc(blockEncryptionAlgorithms);
    }
    if (!Strings.isNullOrEmpty(params.getRequestObjectSigningAlg())) {
        SignatureAlgorithm signatureAlgorithms = SignatureAlgorithm.fromString(params.getRequestObjectSigningAlg());
        if (signatureAlgorithms == null) {
            LOG.error("Received invalid algorithm in `request_object_signing_alg` property. Value: " + params.getRequestObjectSigningAlg());
            throw new HttpException(ErrorResponseCode.INVALID_SIGNATURE_ALGORITHM);
        }
        request.setRequestObjectSigningAlg(signatureAlgorithms);
    }
    if (!Strings.isNullOrEmpty(params.getRequestObjectEncryptionAlg())) {
        KeyEncryptionAlgorithm keyEncryptionAlgorithms = KeyEncryptionAlgorithm.fromName(params.getRequestObjectEncryptionAlg());
        if (keyEncryptionAlgorithms == null) {
            LOG.error("Received invalid algorithm in `request_object_encryption_alg` property. Value: " + params.getRequestObjectEncryptionAlg());
            throw new HttpException(ErrorResponseCode.INVALID_KEY_ENCRYPTION_ALGORITHM);
        }
        request.setRequestObjectEncryptionAlg(keyEncryptionAlgorithms);
    }
    if (!Strings.isNullOrEmpty(params.getRequestObjectEncryptionEnc())) {
        BlockEncryptionAlgorithm blockEncryptionAlgorithms = BlockEncryptionAlgorithm.fromName(params.getRequestObjectEncryptionEnc());
        if (blockEncryptionAlgorithms == null) {
            LOG.error("Received invalid algorithm in `request_object_encryption_enc` property. Value: " + params.getRequestObjectEncryptionEnc());
            throw new HttpException(ErrorResponseCode.INVALID_BLOCK_ENCRYPTION_ALGORITHM);
        }
        request.setRequestObjectEncryptionEnc(blockEncryptionAlgorithms);
    }
    if (params.getDefaultMaxAge() != null && NumberUtils.isNumber(params.getDefaultMaxAge().toString())) {
        request.setDefaultMaxAge(params.getDefaultMaxAge());
    }
    if (params.getRequireAuthTime() != null) {
        request.setRequireAuthTime(params.getRequireAuthTime());
    }
    if (!Strings.isNullOrEmpty(params.getInitiateLoginUri())) {
        request.setInitiateLoginUri(params.getInitiateLoginUri());
    }
    if (params.getAuthorizedOrigins() != null && !params.getAuthorizedOrigins().isEmpty()) {
        request.setAuthorizedOrigins(params.getAuthorizedOrigins());
    }
    if (params.getAccessTokenLifetime() != null && NumberUtils.isNumber(params.getAccessTokenLifetime().toString())) {
        request.setAccessTokenLifetime(params.getAccessTokenLifetime());
    }
    if (!Strings.isNullOrEmpty(params.getSoftwareId())) {
        request.setSoftwareId(params.getSoftwareId());
    }
    if (!Strings.isNullOrEmpty(params.getSoftwareVersion())) {
        request.setSoftwareVersion(params.getSoftwareVersion());
    }
    if (!Strings.isNullOrEmpty(params.getSoftwareStatement())) {
        request.setSoftwareStatement(params.getSoftwareStatement());
    }
    if (params.getAllowSpontaneousScopes() != null) {
        request.setAllowSpontaneousScopes(params.getAllowSpontaneousScopes());
    }
    if (CollectionUtils.isNotEmpty(params.getSpontaneousScopes())) {
        request.setSpontaneousScopes(params.getSpontaneousScopes());
    }
    if (params.getCustomAttributes() != null && !params.getCustomAttributes().isEmpty()) {
        params.getCustomAttributes().entrySet().removeIf(entry -> entry.getKey().contains("oxAuthTrustedClient"));
        params.getCustomAttributes().entrySet().stream().forEach(e -> {
            request.addCustomAttribute(e.getKey(), e.getValue());
        });
    }
    if (StringUtils.isNotBlank(rp.getRpId())) {
        request.addCustomAttribute("rp_id", rp.getRpId());
    }
    return request;
}

Example 9 with HttpException

use of io.jans.ca.server.HttpException in project jans by JanssenProject.

the class GetAccessTokenByRefreshTokenOperation method execute.

@Override
public IOpResponse execute(GetAccessTokenByRefreshTokenParams params) {
    try {
        validate(params);
        final Rp rp = getRp();
        final TokenClient tokenClient = new TokenClient(getDiscoveryService().getConnectDiscoveryResponse(rp).getTokenEndpoint());
        tokenClient.setExecutor(getHttpService().getClientEngine());
        final TokenResponse tokenResponse = tokenClient.execRefreshToken(scopeAsString(params), params.getRefreshToken(), rp.getClientId(), rp.getClientSecret());
        if (tokenResponse != null) {
            if (Util.allNotBlank(tokenResponse.getAccessToken())) {
                GetClientTokenResponse response = new GetClientTokenResponse();
                response.setAccessToken(tokenResponse.getAccessToken());
                response.setExpiresIn(tokenResponse.getExpiresIn());
                response.setRefreshToken(tokenResponse.getRefreshToken());
                response.setScope(Utils.stringToList(tokenResponse.getScope()));
                return response;
            } else {
                LOG.error("access_token is blank in response, params: " + params + ", response: " + tokenResponse);
                LOG.error("Please check AS logs for more details (oxauth.log for CE).");
            }
        } else {
            LOG.error("No response from TokenClient");
        }
    } catch (HttpException e) {
        throw e;
    } catch (Exception e) {
        LOG.error(e.getMessage(), e);
    }
    throw HttpException.internalError();
}

Example 10 with HttpException

use of io.jans.ca.server.HttpException in project jans by JanssenProject.

the class GetAuthorizationUrlOperation method execute.

@Override
public IOpResponse execute(GetAuthorizationUrlParams params) throws Exception {
    final Rp rp = getRp();
    String authorizationEndpoint = getDiscoveryService().getConnectDiscoveryResponse(rp).getAuthorizationEndpoint();
    List<String> scope = Lists.newArrayList();
    if (params.getScope() != null && !params.getScope().isEmpty()) {
        scope.addAll(params.getScope());
    } else if (rp.getScope() != null) {
        scope.addAll(rp.getScope());
    }
    if (StringUtils.isNotBlank(params.getRedirectUri()) && !Utils.isValidUrl(params.getRedirectUri())) {
        throw new HttpException(ErrorResponseCode.INVALID_REDIRECT_URI);
    }
    if (StringUtils.isNotBlank(params.getRedirectUri()) && !rp.getRedirectUris().contains(params.getRedirectUri())) {
        throw new HttpException(ErrorResponseCode.REDIRECT_URI_IS_NOT_REGISTERED);
    }
    List<String> responseTypes = Lists.newArrayList();
    if (params.getResponseTypes() != null && !params.getResponseTypes().isEmpty() && rp.getResponseTypes().containsAll(params.getResponseTypes())) {
        responseTypes.addAll(params.getResponseTypes());
    } else {
        responseTypes.addAll(rp.getResponseTypes());
    }
    String state = StringUtils.isNotBlank(params.getState()) ? getStateService().putState(getStateService().encodeExpiredObject(params.getState(), ExpiredObjectType.STATE)) : getStateService().generateState();
    String nonce = StringUtils.isNotBlank(params.getNonce()) ? getStateService().putNonce(getStateService().encodeExpiredObject(params.getNonce(), ExpiredObjectType.NONCE)) : getStateService().generateNonce();
    String clientId = getConfigurationService().getConfiguration().getEncodeClientIdInAuthorizationUrl() ? Utils.encode(rp.getClientId()) : rp.getClientId();
    String redirectUri = StringUtils.isNotBlank(params.getRedirectUri()) ? params.getRedirectUri() : rp.getRedirectUri();
    authorizationEndpoint += "?response_type=" + Utils.joinAndUrlEncode(responseTypes);
    authorizationEndpoint += "&client_id=" + clientId;
    authorizationEndpoint += "&redirect_uri=" + redirectUri;
    authorizationEndpoint += "&scope=" + Utils.joinAndUrlEncode(scope);
    authorizationEndpoint += "&state=" + state;
    authorizationEndpoint += "&nonce=" + nonce;
    String acrValues = Utils.joinAndUrlEncode(acrValues(rp, params)).trim();
    if (!Strings.isNullOrEmpty(acrValues)) {
        authorizationEndpoint += "&acr_values=" + acrValues;
    }
    if (!Strings.isNullOrEmpty(params.getPrompt())) {
        authorizationEndpoint += "&prompt=" + params.getPrompt();
    }
    if (!Strings.isNullOrEmpty(params.getHostedDomain())) {
        authorizationEndpoint += "&hd=" + params.getHostedDomain();
    }
    if (params.getCustomParameters() != null && !params.getCustomParameters().isEmpty()) {
        authorizationEndpoint += "&" + AuthorizeRequestParam.CUSTOM_RESPONSE_HEADERS + "=" + Utils.encode(Util.mapAsString(params.getCustomParameters()));
    }
    if (params.getParams() != null && !params.getParams().isEmpty()) {
        authorizationEndpoint += "&" + Utils.mapAsStringWithEncodedValues(params.getParams());
    }
    return new GetAuthorizationUrlResponse(authorizationEndpoint);
}