Examples with NONCE io.trino.server.security.oauth2.OAuth2Service.NONCE used on opensource projects

Example 1 with NONCE

use of io.trino.server.security.oauth2.OAuth2Service.NONCE in project trino by trinodb.

the class OAuth2Service method startOAuth2Challenge.

public Response startOAuth2Challenge(URI callbackUri, Optional<String> handlerState) {
    Instant challengeExpiration = now().plus(challengeTimeout);
    String state = newJwtBuilder().signWith(stateHmac).setAudience(STATE_AUDIENCE_UI).claim(HANDLER_STATE_CLAIM, handlerState.orElse(null)).setExpiration(Date.from(challengeExpiration)).compact();
    Optional<String> nonce;
    // since this scope is required in order to obtain the ID token which carriers the nonce back to the server
    if (scopes.contains(OPENID_SCOPE)) {
        nonce = Optional.of(randomNonce());
    } else {
        nonce = Optional.empty();
    }
    Response.ResponseBuilder response = Response.seeOther(client.getAuthorizationUri(state, callbackUri, nonce.map(OAuth2Service::hashNonce)));
    nonce.ifPresent(nce -> response.cookie(NonceCookie.create(nce, challengeExpiration)));
    return response.build();
}

Example 2 with NONCE

use of io.trino.server.security.oauth2.OAuth2Service.NONCE in project trino by trinodb.

the class OAuth2Service method finishOAuth2Challenge.

public Response finishOAuth2Challenge(String state, String code, URI callbackUri, Optional<String> nonce) {
    Optional<String> handlerState;
    try {
        Claims stateClaims = parseState(state);
        handlerState = Optional.ofNullable(stateClaims.get(HANDLER_STATE_CLAIM, String.class));
    } catch (ChallengeFailedException | RuntimeException e) {
        LOG.debug(e, "Authentication response could not be verified invalid state: state=%s", state);
        return Response.status(BAD_REQUEST).entity(getInternalFailureHtml("Authentication response could not be verified")).cookie(NonceCookie.delete()).build();
    }
    // Note: the Web UI may be disabled, so REST requests can not redirect to a success or error page inside of the Web UI
    try {
        // fetch access token
        OAuth2Response oauth2Response = client.getOAuth2Response(code, callbackUri);
        Claims parsedToken = validateAndParseOAuth2Response(oauth2Response, nonce).orElseThrow(() -> new ChallengeFailedException("invalid access token"));
        // determine expiration
        Instant validUntil = determineExpiration(oauth2Response.getValidUntil(), parsedToken.getExpiration());
        if (handlerState.isEmpty()) {
            return Response.seeOther(URI.create(UI_LOCATION)).cookie(OAuthWebUiCookie.create(oauth2Response.getAccessToken(), validUntil), NonceCookie.delete()).build();
        }
        tokenHandler.setAccessToken(handlerState.get(), oauth2Response.getAccessToken());
        Response.ResponseBuilder builder = Response.ok(getSuccessHtml());
        if (webUiOAuthEnabled) {
            builder.cookie(OAuthWebUiCookie.create(oauth2Response.getAccessToken(), validUntil));
        }
        return builder.cookie(NonceCookie.delete()).build();
    } catch (ChallengeFailedException | RuntimeException e) {
        LOG.debug(e, "Authentication response could not be verified: state=%s", state);
        handlerState.ifPresent(value -> tokenHandler.setTokenExchangeError(value, format("Authentication response could not be verified: state=%s", value)));
        return Response.status(BAD_REQUEST).cookie(NonceCookie.delete()).entity(getInternalFailureHtml("Authentication response could not be verified")).build();
    }
}