Examples with OAuth org.apache.oltu.oauth2.common.OAuth used on opensource projects

Example 31 with OAuth

use of org.apache.oltu.oauth2.common.OAuth in project identity-inbound-auth-oauth by wso2-extensions.

the class TokenResponseTypeHandler method issue.

@Override
public OAuth2AuthorizeRespDTO issue(OAuthAuthzReqMessageContext oauthAuthzMsgCtx) throws IdentityOAuth2Exception {
    OAuthEventInterceptor oAuthEventInterceptorProxy = OAuthComponentServiceHolder.getInstance().getOAuthEventInterceptorProxy();
    if (oAuthEventInterceptorProxy != null && oAuthEventInterceptorProxy.isEnabled()) {
        Map<String, Object> paramMap = new HashMap<>();
        oAuthEventInterceptorProxy.onPreTokenIssue(oauthAuthzMsgCtx, paramMap);
    }
    OAuth2AuthorizeRespDTO respDTO = new OAuth2AuthorizeRespDTO();
    OAuth2AuthorizeReqDTO authorizationReqDTO = oauthAuthzMsgCtx.getAuthorizationReqDTO();
    String scope = OAuth2Util.buildScopeString(oauthAuthzMsgCtx.getApprovedScope());
    respDTO.setCallbackURI(authorizationReqDTO.getCallbackUrl());
    String consumerKey = authorizationReqDTO.getConsumerKey();
    String authorizedUserId = null;
    try {
        authorizedUserId = authorizationReqDTO.getUser().getUserId();
    } catch (UserIdNotFoundException e) {
        throw new IdentityOAuth2Exception("Error occurred while retrieving the user id for user: " + authorizationReqDTO.getUser().getLoggableUserId());
    }
    String oAuthCacheKeyString;
    String responseType = oauthAuthzMsgCtx.getAuthorizationReqDTO().getResponseType();
    String grantType;
    // Loading the stored application data.
    OAuthAppDO oAuthAppDO;
    try {
        oAuthAppDO = OAuth2Util.getAppInformationByClientId(consumerKey);
    } catch (InvalidOAuthClientException e) {
        throw new IdentityOAuth2Exception("Error while retrieving app information for clientId: " + consumerKey, e);
    }
    if (StringUtils.contains(responseType, OAuthConstants.GrantTypes.TOKEN)) {
        grantType = OAuthConstants.GrantTypes.IMPLICIT;
    } else {
        grantType = responseType;
    }
    oAuthCacheKeyString = consumerKey + ":" + authorizedUserId + ":" + scope;
    OAuthCacheKey cacheKey = new OAuthCacheKey(oAuthCacheKeyString);
    String userStoreDomain = null;
    // Select the user store domain when multiple user stores are configured.
    if (OAuth2Util.checkAccessTokenPartitioningEnabled() && OAuth2Util.checkUserNameAssertionEnabled()) {
        userStoreDomain = OAuth2Util.getUserStoreForFederatedUser(authorizationReqDTO.getUser());
    }
    if (log.isDebugEnabled()) {
        log.debug("Service Provider specific expiry time enabled for application : " + consumerKey + ". Application access token expiry time : " + oAuthAppDO.getApplicationAccessTokenExpiryTime() + ", User access token expiry time : " + oAuthAppDO.getUserAccessTokenExpiryTime() + ", Refresh token expiry time : " + oAuthAppDO.getRefreshTokenExpiryTime());
    }
    String refreshToken = null;
    Timestamp refreshTokenIssuedTime = null;
    long refreshTokenValidityPeriodInMillis = 0;
    AccessTokenDO tokenDO = null;
    synchronized ((consumerKey + ":" + authorizedUserId + ":" + scope).intern()) {
        AccessTokenDO existingAccessTokenDO = null;
        // check if valid access token exists in cache
        if (isHashDisabled && cacheEnabled) {
            existingAccessTokenDO = (AccessTokenDO) OAuthCache.getInstance().getValueFromCache(cacheKey);
            if (existingAccessTokenDO != null) {
                if (log.isDebugEnabled()) {
                    log.debug("Retrieved active Access Token for Client Id : " + consumerKey + ", User ID :" + authorizationReqDTO.getUser().getLoggableUserId() + " and Scope : " + scope + " from cache");
                }
                long expireTime = OAuth2Util.getTokenExpireTimeMillis(existingAccessTokenDO);
                if ((expireTime > 0 || expireTime < 0)) {
                    // Return still valid existing access token when JWTTokenIssuer is not used.
                    if (isNotRenewAccessTokenPerRequest(oauthAuthzMsgCtx)) {
                        if (log.isDebugEnabled()) {
                            if (expireTime > 0) {
                                log.debug("Access Token is valid for another " + expireTime + "ms");
                            } else {
                                log.debug("Infinite lifetime Access Token found in cache");
                            }
                        }
                        respDTO.setAccessToken(existingAccessTokenDO.getAccessToken());
                        if (expireTime > 0) {
                            respDTO.setValidityPeriod(expireTime / 1000);
                        } else {
                            respDTO.setValidityPeriod(Long.MAX_VALUE / 1000);
                        }
                        respDTO.setScope(oauthAuthzMsgCtx.getApprovedScope());
                        respDTO.setTokenType(existingAccessTokenDO.getTokenType());
                        // We only need to deal with id_token and user attributes if the request is OIDC
                        if (isOIDCRequest(oauthAuthzMsgCtx)) {
                            buildIdToken(oauthAuthzMsgCtx, respDTO);
                        }
                        triggerPostListeners(oauthAuthzMsgCtx, existingAccessTokenDO, respDTO);
                        return respDTO;
                    }
                } else {
                    long refreshTokenExpiryTime = OAuth2Util.getRefreshTokenExpireTimeMillis(existingAccessTokenDO);
                    if (refreshTokenExpiryTime < 0 || refreshTokenExpiryTime > 0) {
                        if (log.isDebugEnabled()) {
                            log.debug("Access token has expired, But refresh token is still valid. User existing " + "refresh token.");
                        }
                        refreshToken = existingAccessTokenDO.getRefreshToken();
                        refreshTokenIssuedTime = existingAccessTokenDO.getRefreshTokenIssuedTime();
                        refreshTokenValidityPeriodInMillis = existingAccessTokenDO.getRefreshTokenValidityPeriodInMillis();
                    }
                    // Token is expired. Clear it from cache
                    OAuthCache.getInstance().clearCacheEntry(cacheKey);
                    if (log.isDebugEnabled()) {
                        log.debug("Access Token is expired. Therefore cleared it from cache and marked it as" + " expired in database");
                    }
                }
            } else {
                if (log.isDebugEnabled()) {
                    log.debug("No active access token found in cache for Client ID : " + consumerKey + ", User " + "ID" + " : " + authorizationReqDTO.getUser().getLoggableUserId() + " and Scope : " + scope);
                }
            }
        }
        // in the database
        if (isHashDisabled && existingAccessTokenDO == null) {
            existingAccessTokenDO = OAuthTokenPersistenceFactory.getInstance().getAccessTokenDAO().getLatestAccessToken(consumerKey, authorizationReqDTO.getUser(), userStoreDomain, scope, false);
            if (existingAccessTokenDO != null) {
                if (log.isDebugEnabled()) {
                    log.debug("Retrieved latest Access Token for Client ID : " + consumerKey + ", User ID :" + authorizationReqDTO.getUser().getLoggableUserId() + " and Scope : " + scope + " from database");
                }
                long expiryTime = OAuth2Util.getTokenExpireTimeMillis(existingAccessTokenDO);
                long refreshTokenExpiryTime = OAuth2Util.getRefreshTokenExpireTimeMillis(existingAccessTokenDO);
                if (OAuthConstants.TokenStates.TOKEN_STATE_ACTIVE.equals(existingAccessTokenDO.getTokenState()) && (expiryTime > 0 || expiryTime < 0)) {
                    // Return still valid existing access token when JWTTokenIssuer is not used.
                    if (isNotRenewAccessTokenPerRequest(oauthAuthzMsgCtx)) {
                        // token is active and valid
                        if (log.isDebugEnabled()) {
                            if (expiryTime > 0) {
                                log.debug("Access token is valid for another " + expiryTime + "ms");
                            } else {
                                log.debug("Infinite lifetime Access Token found in cache");
                            }
                        }
                        if (cacheEnabled) {
                            OAuthCache.getInstance().addToCache(cacheKey, existingAccessTokenDO);
                            if (log.isDebugEnabled()) {
                                log.debug("Access Token was added to cache for cache key : " + cacheKey.getCacheKeyString());
                            }
                        }
                        respDTO.setAccessToken(existingAccessTokenDO.getAccessToken());
                        if (expiryTime > 0) {
                            respDTO.setValidityPeriod(expiryTime / 1000);
                        } else {
                            respDTO.setValidityPeriod(Long.MAX_VALUE / 1000);
                        }
                        respDTO.setScope(oauthAuthzMsgCtx.getApprovedScope());
                        respDTO.setTokenType(existingAccessTokenDO.getTokenType());
                        // we only need to deal with id_token and user attributes if the request is OIDC
                        if (isOIDCRequest(oauthAuthzMsgCtx)) {
                            buildIdToken(oauthAuthzMsgCtx, respDTO);
                        }
                        triggerPostListeners(oauthAuthzMsgCtx, existingAccessTokenDO, respDTO);
                        return respDTO;
                    }
                } else {
                    if (log.isDebugEnabled() && IdentityUtil.isTokenLoggable(IdentityConstants.IdentityTokens.ACCESS_TOKEN)) {
                        log.debug("Access Token is " + existingAccessTokenDO.getTokenState());
                    }
                    String tokenState = existingAccessTokenDO.getTokenState();
                    if (OAuthConstants.TokenStates.TOKEN_STATE_ACTIVE.equals(tokenState)) {
                        // Token is expired. If refresh token is still valid, use it.
                        if (refreshTokenExpiryTime > 0 || refreshTokenExpiryTime < 0) {
                            if (log.isDebugEnabled()) {
                                log.debug("Access token has expired, But refresh token is still valid. User " + "existing refresh token.");
                            }
                            refreshToken = existingAccessTokenDO.getRefreshToken();
                            refreshTokenIssuedTime = existingAccessTokenDO.getRefreshTokenIssuedTime();
                            refreshTokenValidityPeriodInMillis = existingAccessTokenDO.getRefreshTokenValidityPeriodInMillis();
                        }
                        if (log.isDebugEnabled()) {
                            log.debug("Marked Access Token as expired");
                        }
                    } else {
                        // Token is revoked or inactive
                        if (log.isDebugEnabled()) {
                            log.debug("Access Token is " + existingAccessTokenDO.getTokenState());
                        }
                    }
                }
            } else {
                if (log.isDebugEnabled()) {
                    log.debug("No access token found in database for Client ID : " + consumerKey + ", User ID : " + authorizationReqDTO.getUser().getLoggableUserId() + " and Scope : " + scope);
                }
            }
        }
        if (log.isDebugEnabled()) {
            log.debug("Issuing a new access token for client id: " + consumerKey + ", user : " + authorizationReqDTO.getUser().getLoggableUserId() + "and scope : " + scope);
        }
        Timestamp timestamp = new Timestamp(new Date().getTime());
        // if reusing existing refresh token, use its original issued time
        if (refreshTokenIssuedTime == null) {
            refreshTokenIssuedTime = timestamp;
        }
        // Default token validity Period
        long validityPeriodInMillis = OAuthServerConfiguration.getInstance().getUserAccessTokenValidityPeriodInSeconds() * 1000;
        if (oAuthAppDO.getUserAccessTokenExpiryTime() != 0) {
            validityPeriodInMillis = oAuthAppDO.getUserAccessTokenExpiryTime() * 1000;
        }
        // if a VALID validity period is set through the callback, then use it
        long callbackValidityPeriod = oauthAuthzMsgCtx.getValidityPeriod();
        if ((callbackValidityPeriod != OAuthConstants.UNASSIGNED_VALIDITY_PERIOD) && callbackValidityPeriod > 0) {
            validityPeriodInMillis = callbackValidityPeriod * 1000;
        }
        // otherwise use existing refresh token's validity period
        if (refreshTokenValidityPeriodInMillis == 0) {
            if (oAuthAppDO.getRefreshTokenExpiryTime() != 0) {
                refreshTokenValidityPeriodInMillis = oAuthAppDO.getRefreshTokenExpiryTime() * 1000;
            } else {
                refreshTokenValidityPeriodInMillis = OAuthServerConfiguration.getInstance().getRefreshTokenValidityPeriodInSeconds() * 1000;
            }
        }
        // issue a new access token
        String accessToken;
        // set the validity period. this is needed by downstream handlers.
        // if this is set before - then this will override it by the calculated new value.
        oauthAuthzMsgCtx.setValidityPeriod(validityPeriodInMillis);
        // set the refresh token validity period. this is needed by downstream handlers.
        // if this is set before - then this will override it by the calculated new value.
        oauthAuthzMsgCtx.setRefreshTokenvalidityPeriod(refreshTokenValidityPeriodInMillis);
        // set access token issued time.this is needed by downstream handlers.
        oauthAuthzMsgCtx.setAccessTokenIssuedTime(timestamp.getTime());
        // set refresh token issued time.this is needed by downstream handlers.
        oauthAuthzMsgCtx.setRefreshTokenIssuedTime(refreshTokenIssuedTime.getTime());
        try {
            OauthTokenIssuer oauthIssuerImpl = OAuth2Util.getOAuthTokenIssuerForOAuthApp(oAuthAppDO);
            accessToken = oauthIssuerImpl.accessToken(oauthAuthzMsgCtx);
            // regenerate only if refresh token is null
            if (refreshToken == null) {
                refreshToken = oauthIssuerImpl.refreshToken(oauthAuthzMsgCtx);
            }
        } catch (OAuthSystemException e) {
            throw new IdentityOAuth2Exception("Error occurred while generating access token and refresh token", e);
        }
        if (OAuth2Util.checkUserNameAssertionEnabled()) {
            accessToken = OAuth2Util.addUsernameToToken(authorizationReqDTO.getUser(), accessToken);
            refreshToken = OAuth2Util.addUsernameToToken(authorizationReqDTO.getUser(), refreshToken);
        }
        AccessTokenDO newAccessTokenDO = new AccessTokenDO(consumerKey, authorizationReqDTO.getUser(), oauthAuthzMsgCtx.getApprovedScope(), timestamp, refreshTokenIssuedTime, validityPeriodInMillis, refreshTokenValidityPeriodInMillis, OAuthConstants.UserType.APPLICATION_USER);
        newAccessTokenDO.setAccessToken(accessToken);
        newAccessTokenDO.setRefreshToken(refreshToken);
        newAccessTokenDO.setTokenState(OAuthConstants.TokenStates.TOKEN_STATE_ACTIVE);
        newAccessTokenDO.setGrantType(grantType);
        String tokenId = UUID.randomUUID().toString();
        newAccessTokenDO.setTokenId(tokenId);
        oauthAuthzMsgCtx.addProperty(OAuth2Util.ACCESS_TOKEN_DO, newAccessTokenDO);
        // Persist the access token in database
        try {
            OAuthTokenPersistenceFactory.getInstance().getAccessTokenDAO().insertAccessToken(accessToken, authorizationReqDTO.getConsumerKey(), newAccessTokenDO, existingAccessTokenDO, userStoreDomain);
            deactivateCurrentAuthorizationCode(newAccessTokenDO.getAuthorizationCode(), newAccessTokenDO.getTokenId());
            if (!accessToken.equals(newAccessTokenDO.getAccessToken())) {
                // Using latest active token.
                accessToken = newAccessTokenDO.getAccessToken();
                refreshToken = newAccessTokenDO.getRefreshToken();
            }
        } catch (IdentityException e) {
            throw new IdentityOAuth2Exception("Error occurred while storing new access token : " + accessToken, e);
        }
        tokenDO = newAccessTokenDO;
        if (log.isDebugEnabled()) {
            log.debug("Persisted Access Token for " + "Client ID : " + authorizationReqDTO.getConsumerKey() + ", Authorized User : " + authorizationReqDTO.getUser().getLoggableUserId() + ", Timestamp : " + timestamp + ", Validity period (s) : " + newAccessTokenDO.getValidityPeriod() + ", Scope : " + OAuth2Util.buildScopeString(oauthAuthzMsgCtx.getApprovedScope()) + ", Callback URL : " + authorizationReqDTO.getCallbackUrl() + ", Token State : " + OAuthConstants.TokenStates.TOKEN_STATE_ACTIVE + " and User Type : " + OAuthConstants.UserType.APPLICATION_USER);
        }
        // Add the access token to the cache, if cacheEnabled and the hashing oauth key feature turn on.
        if (isHashDisabled && cacheEnabled) {
            OAuthCache.getInstance().addToCache(cacheKey, newAccessTokenDO);
            // Adding AccessTokenDO to improve validation performance
            OAuthCacheKey accessTokenCacheKey = new OAuthCacheKey(accessToken);
            OAuthCache.getInstance().addToCache(accessTokenCacheKey, newAccessTokenDO);
            if (log.isDebugEnabled()) {
                log.debug("Access Token was added to OAuthCache for cache key : " + cacheKey.getCacheKeyString());
                log.debug("Access Token was added to OAuthCache for cache key : " + accessTokenCacheKey.getCacheKeyString());
            }
        }
        if (StringUtils.contains(responseType, ResponseType.TOKEN.toString())) {
            respDTO.setAccessToken(accessToken);
            if (validityPeriodInMillis > 0) {
                respDTO.setValidityPeriod(newAccessTokenDO.getValidityPeriod());
            } else {
                respDTO.setValidityPeriod(Long.MAX_VALUE / 1000);
            }
            respDTO.setScope(newAccessTokenDO.getScope());
            respDTO.setTokenType(newAccessTokenDO.getTokenType());
        }
    }
    // we only need to deal with id_token and user attributes if the request is OIDC
    if (isOIDCRequest(oauthAuthzMsgCtx)) {
        buildIdToken(oauthAuthzMsgCtx, respDTO);
    }
    triggerPostListeners(oauthAuthzMsgCtx, tokenDO, respDTO);
    return respDTO;
}

Example 32 with OAuth

use of org.apache.oltu.oauth2.common.OAuth in project identity-inbound-auth-oauth by wso2-extensions.

the class OAuth2AuthzEndpoint method getTokenBinder.

private Optional<TokenBinder> getTokenBinder(String clientId) throws OAuthSystemException {
    OAuthAppDO oAuthAppDO;
    try {
        oAuthAppDO = OAuth2Util.getAppInformationByClientId(clientId);
    } catch (IdentityOAuth2Exception | InvalidOAuthClientException e) {
        throw new OAuthSystemException("Failed to retrieve OAuth application with client id: " + clientId, e);
    }
    if (oAuthAppDO == null || StringUtils.isBlank(oAuthAppDO.getTokenBindingType())) {
        return Optional.empty();
    }
    OAuth2Service oAuth2Service = getOAuth2Service();
    List<TokenBinder> supportedTokenBinders = oAuth2Service.getSupportedTokenBinders();
    if (supportedTokenBinders == null || supportedTokenBinders.isEmpty()) {
        return Optional.empty();
    }
    return supportedTokenBinders.stream().filter(t -> t.getBindingType().equals(oAuthAppDO.getTokenBindingType())).findAny();
}

Example 33 with OAuth

use of org.apache.oltu.oauth2.common.OAuth in project identity-inbound-auth-oauth by wso2-extensions.

the class EndpointUtil method setConsentRequiredScopesToOAuthParams.

private static void setConsentRequiredScopesToOAuthParams(AuthenticatedUser user, OAuth2Parameters params) throws OAuthSystemException {
    try {
        String consentRequiredScopes = StringUtils.EMPTY;
        List<String> allowedOAuthScopes = getAllowedOAuthScopes(params);
        if (user != null && !isPromptContainsConsent(params)) {
            String userId = getUserIdOfAuthenticatedUser(user);
            String appId = getAppIdFromClientId(params.getClientId());
            OAuth2ScopeConsentResponse existingUserConsent = oAuth2ScopeService.getUserConsentForApp(userId, appId, IdentityTenantUtil.getTenantId(user.getTenantDomain()));
            if (existingUserConsent != null) {
                if (CollectionUtils.isNotEmpty(existingUserConsent.getApprovedScopes())) {
                    allowedOAuthScopes.removeAll(existingUserConsent.getApprovedScopes());
                }
            }
        }
        if (CollectionUtils.isNotEmpty(allowedOAuthScopes)) {
            // Filter out internal scopes to be validated.
            String[] requestedScopes = Oauth2ScopeUtils.getRequestedScopes(allowedOAuthScopes.toArray(new String[0]));
            if (ArrayUtils.isNotEmpty(requestedScopes)) {
                // Remove the filtered internal scopes from the allowedOAuthScopes list.
                allowedOAuthScopes.removeAll(Arrays.asList(requestedScopes));
                JDBCPermissionBasedInternalScopeValidator scopeValidator = new JDBCPermissionBasedInternalScopeValidator();
                String[] validatedScope = scopeValidator.validateScope(requestedScopes, user, params.getClientId());
                // Filter out requested scopes from the validated scope array.
                for (String scope : requestedScopes) {
                    if (ArrayUtils.contains(validatedScope, scope)) {
                        allowedOAuthScopes.add(scope);
                    }
                }
            }
            params.setConsentRequiredScopes(new HashSet<>(allowedOAuthScopes));
            consentRequiredScopes = String.join(" ", allowedOAuthScopes).trim();
        }
        if (log.isDebugEnabled()) {
            log.debug("Consent required scopes : " + consentRequiredScopes + " for request from client : " + params.getClientId());
        }
    } catch (IdentityOAuth2ScopeException e) {
        throw new OAuthSystemException("Error occurred while retrieving user consents OAuth scopes.");
    }
}

Example 34 with OAuth

use of org.apache.oltu.oauth2.common.OAuth in project identity-inbound-auth-oauth by wso2-extensions.

the class EndpointUtilTest method testGetUserConsentURL.

@Test(dataProvider = "provideDataForUserConsentURL")
public void testGetUserConsentURL(Object oAuth2ParamObject, boolean isOIDC, boolean cacheEntryExists, boolean throwError, String queryString, boolean isDebugEnabled) throws Exception {
    setMockedLog(isDebugEnabled);
    OAuth2Parameters parameters = (OAuth2Parameters) oAuth2ParamObject;
    mockStatic(OAuthServerConfiguration.class);
    when(OAuthServerConfiguration.getInstance()).thenReturn(mockedOAuthServerConfiguration);
    EndpointUtil.setOauthServerConfiguration(mockedOAuthServerConfiguration);
    when(mockedOAuthServerConfiguration.isDropUnregisteredScopes()).thenReturn(false);
    EndpointUtil.setOAuth2ScopeService(oAuth2ScopeService);
    when(oAuth2ScopeService.getUserConsentForApp(anyString(), anyString(), anyInt())).thenReturn(oAuth2ScopeConsentResponse);
    mockStatic(OAuth2Util.class);
    mockStatic(OAuth2Util.OAuthURL.class);
    when(OAuth2Util.OAuthURL.getOIDCConsentPageUrl()).thenReturn(OIDC_CONSENT_PAGE_URL);
    when(OAuth2Util.OAuthURL.getOAuth2ConsentPageUrl()).thenReturn(OAUTH2_CONSENT_PAGE_URL);
    mockStatic(IdentityTenantUtil.class);
    when(IdentityTenantUtil.getTenantId(anyString())).thenReturn(MultitenantConstants.SUPER_TENANT_ID);
    mockStatic(FrameworkUtils.class);
    when(FrameworkUtils.resolveUserIdFromUsername(anyInt(), anyString(), anyString())).thenReturn("sample");
    when(FrameworkUtils.getRedirectURLWithFilteredParams(anyString(), anyMap())).then(i -> i.getArgumentAt(0, String.class));
    mockStatic(OAuth2Util.class);
    spy(EndpointUtil.class);
    doReturn("sampleId").when(EndpointUtil.class, "getAppIdFromClientId", anyString());
    mockStatic(SessionDataCache.class);
    when(SessionDataCache.getInstance()).thenReturn(mockedSessionDataCache);
    if (cacheEntryExists) {
        when(mockedSessionDataCache.getValueFromCache(any(SessionDataCacheKey.class))).thenReturn(mockedSessionDataCacheEntry);
        when(mockedSessionDataCacheEntry.getQueryString()).thenReturn(queryString);
        when(mockedSessionDataCacheEntry.getLoggedInUser()).thenReturn(user);
        when(mockedSessionDataCacheEntry.getEndpointParams()).thenReturn(new HashMap<>());
    } else {
        when(mockedSessionDataCache.getValueFromCache(any(SessionDataCacheKey.class))).thenReturn(null);
    }
    EndpointUtil.setOAuthAdminService(mockedOAuthAdminService);
    when(mockedOAuthAdminService.getScopeNames()).thenReturn(new String[0]);
    JDBCPermissionBasedInternalScopeValidator scopeValidatorSpy = PowerMockito.spy(new JDBCPermissionBasedInternalScopeValidator());
    doNothing().when(scopeValidatorSpy, method(JDBCPermissionBasedInternalScopeValidator.class, "endTenantFlow")).withNoArguments();
    when(scopeValidatorSpy, method(JDBCPermissionBasedInternalScopeValidator.class, "getUserAllowedScopes", AuthenticatedUser.class, String[].class, String.class)).withArguments(any(AuthenticatedUser.class), any(), anyString()).thenReturn(getScopeList());
    PowerMockito.whenNew(JDBCPermissionBasedInternalScopeValidator.class).withNoArguments().thenReturn(scopeValidatorSpy);
    String consentUrl;
    try {
        consentUrl = EndpointUtil.getUserConsentURL(parameters, username, sessionDataKey, isOIDC);
        if (isOIDC) {
            Assert.assertTrue(consentUrl.contains(OIDC_CONSENT_PAGE_URL), "Incorrect consent page url for OIDC");
        } else {
            Assert.assertTrue(consentUrl.contains(OAUTH2_CONSENT_PAGE_URL), "Incorrect consent page url for OAuth");
        }
        Assert.assertTrue(consentUrl.contains(URLEncoder.encode(username, "UTF-8")), "loggedInUser parameter value is not found in url");
        Assert.assertTrue(consentUrl.contains(URLEncoder.encode("TestApplication", "ISO-8859-1")), "application parameter value is not found in url");
        List<NameValuePair> nameValuePairList = URLEncodedUtils.parse(consentUrl, StandardCharsets.UTF_8);
        Optional<NameValuePair> optionalScope = nameValuePairList.stream().filter(nameValuePair -> nameValuePair.getName().equals("scope")).findAny();
        Assert.assertTrue(optionalScope.isPresent());
        NameValuePair scopeNameValuePair = optionalScope.get();
        String[] scopeArray = scopeNameValuePair.getValue().split(" ");
        Assert.assertTrue(ArrayUtils.contains(scopeArray, "scope2"), "scope parameter value " + "is not found in url");
        Assert.assertTrue(ArrayUtils.contains(scopeArray, "internal_login"), "internal_login " + "scope parameter value is not found in url");
        Assert.assertFalse(ArrayUtils.contains(scopeArray, "SYSTEM"), "SYSTEM scope" + "parameter should not contain in the url.");
        if (queryString != null && cacheEntryExists) {
            Assert.assertTrue(consentUrl.contains(queryString), "spQueryParams value is not found in url");
        }
    } catch (OAuthSystemException e) {
        Assert.assertTrue(e.getMessage().contains("Error while retrieving the application name"));
    }
}

Example 35 with OAuth

use of org.apache.oltu.oauth2.common.OAuth in project identity-inbound-auth-oauth by wso2-extensions.

the class OAuth2AuthzEndpoint method handleSuccessAuthorization.

private OAuthResponse handleSuccessAuthorization(OAuthMessage oAuthMessage, OIDCSessionState sessionState, OAuth2Parameters oauth2Params, String responseType, OAuth2AuthorizeRespDTO authzRespDTO) throws OAuthSystemException {
    OAuthASResponse.OAuthAuthorizationResponseBuilder builder = OAuthASResponse.authorizationResponse(oAuthMessage.getRequest(), HttpServletResponse.SC_FOUND);
    // all went okay
    if (isAuthorizationCodeExists(authzRespDTO)) {
        // Get token binder if it is enabled for the client.
        Optional<TokenBinder> tokenBinderOptional = getTokenBinder(oauth2Params.getClientId());
        String tokenBindingValue = null;
        if (tokenBinderOptional.isPresent()) {
            TokenBinder tokenBinder = tokenBinderOptional.get();
            tokenBindingValue = tokenBinder.getOrGenerateTokenBindingValue(oAuthMessage.getRequest());
            tokenBinder.setTokenBindingValueForResponse(oAuthMessage.getResponse(), tokenBindingValue);
            if (LoggerUtils.isDiagnosticLogsEnabled()) {
                Map<String, Object> params = new HashMap<>();
                params.put("clientId", oauth2Params.getClientId());
                params.put("tokenBindingValue", tokenBindingValue);
                Map<String, Object> configs = new HashMap<>();
                configs.put("tokenBinderType", tokenBinder.getBindingType());
                LoggerUtils.triggerDiagnosticLogEvent(OAuthConstants.LogConstants.OAUTH_INBOUND_SERVICE, params, OAuthConstants.LogConstants.SUCCESS, "Successfully generated token binding value.", "generate-token-binding-value", configs);
            }
        }
        setAuthorizationCode(oAuthMessage, authzRespDTO, builder, tokenBindingValue);
    }
    if (isResponseTypeNotIdTokenOrNone(responseType, authzRespDTO)) {
        setAccessToken(authzRespDTO, builder);
        setScopes(authzRespDTO, builder);
    }
    if (isIdTokenExists(authzRespDTO)) {
        setIdToken(authzRespDTO, builder);
        oAuthMessage.setProperty(OIDC_SESSION_ID, authzRespDTO.getOidcSessionId());
    }
    if (StringUtils.isNotBlank(oauth2Params.getState())) {
        builder.setParam(OAuth.OAUTH_STATE, oauth2Params.getState());
    }
    String redirectURL = authzRespDTO.getCallbackURI();
    OAuthResponse oauthResponse;
    if (RESPONSE_MODE_FORM_POST.equals(oauth2Params.getResponseMode())) {
        oauthResponse = handleFormPostMode(oAuthMessage, builder, redirectURL);
    } else {
        oauthResponse = builder.location(redirectURL).buildQueryMessage();
    }
    if (LoggerUtils.isDiagnosticLogsEnabled()) {
        Map<String, Object> params = new HashMap<>();
        params.put("clientId", oauth2Params.getClientId());
        params.put("responseMode", oauth2Params.getResponseMode());
        params.put("redirectUrl", redirectURL);
        LoggerUtils.triggerDiagnosticLogEvent(OAuthConstants.LogConstants.OAUTH_INBOUND_SERVICE, params, OAuthConstants.LogConstants.SUCCESS, "Successfully generated oauth response.", "generate-response", null);
    }
    sessionState.setAuthenticated(true);
    return oauthResponse;
}