Examples with ExtractResult org.dcache.gplazma.oidc.ExtractResult used on opensource projects

Example 1 with ExtractResult

use of org.dcache.gplazma.oidc.ExtractResult in project dcache by dCache.

the class QueryUserInfoEndpoint method extract.

@Override
public ExtractResult extract(String token) throws AuthenticationException {
    Stopwatch userinfoLookupTiming = Stopwatch.createStarted();
    List<LookupResult> allResults;
    try {
        allResults = userInfoCache.get(token);
    } catch (ExecutionException e) {
        Throwable cause = e.getCause();
        Throwables.throwIfInstanceOf(cause, AuthenticationException.class);
        Throwables.throwIfUnchecked(cause);
        if (cause instanceof InterruptedException) {
            throw new AuthenticationException("Shutting down");
        }
        throw new RuntimeException("Unexpected exception", e);
    }
    if (LOG.isDebugEnabled()) {
        LOG.debug("Doing user-info lookup against {} OPs took {}", allResults.size(), TimeUtils.describe(userinfoLookupTiming.elapsed()).orElse("no time"));
    }
    List<LookupResult> successfulResults = allResults.stream().filter(LookupResult::isSuccess).collect(Collectors.toList());
    if (successfulResults.isEmpty()) {
        if (allResults.size() == 1) {
            LookupResult result = allResults.get(0);
            throw new AuthenticationException("OpenId Validation failed for " + result.getIdentityProvider().getName() + ": " + result.getError());
        } else {
            String randomId = randomId();
            String errors = allResults.stream().map(r -> "[" + r.getIdentityProvider().getName() + ": " + r.getError() + "]").collect(Collectors.joining(", "));
            LOG.warn("OpenId Validation Failure ({}): {}", randomId, errors);
            throw new AuthenticationException("OpenId Validation Failed check [log entry #" + randomId + "]");
        }
    }
    if (successfulResults.size() > 1) {
        String names = successfulResults.stream().map(LookupResult::getIdentityProvider).map(IdentityProvider::getName).collect(Collectors.joining(", "));
        LOG.warn("Multiple OpenID-Connect endpoints accepted access token: {}", names);
        throw new AuthenticationException("Multiple OPs accepted token.");
    }
    var result = successfulResults.get(0);
    return new ExtractResult(result.getIdentityProvider(), result.getClaims());
}

Example 2 with ExtractResult

use of org.dcache.gplazma.oidc.ExtractResult in project dcache by dCache.

the class OfflineJwtVerificationTest method shouldAcceptNonExpiredUnembargoedTokenFromTrustedOp.

@Test
public void shouldAcceptNonExpiredUnembargoedTokenFromTrustedOp() throws Exception {
    given(anIp("EXAMPLE").withEndpoint("https://oidc.example.org/"));
    given(anOfflineJwtVerification().withEmptyAudienceTargetProperty().withIssuer(anIssuer().withIp(identityProvider)));
    given(aJwt().withPayloadClaim("iss", "https://oidc.example.org/").withPayloadClaim("nbf", Instant.now().minus(5, MINUTES)).withPayloadClaim("exp", Instant.now().plus(5, MINUTES)).withPayloadClaim("sub", "paul"));
    ExtractResult result = verification.extract(jwt);
    assertThat(result.idp(), is(sameInstance(identityProvider)));
    assertThat(result.claims(), hasEntry("iss", jsonString("https://oidc.example.org/")));
    assertThat(result.claims(), hasEntry("sub", jsonString("paul")));
    assertThat(result.claims(), hasKey("nbf"));
    assertThat(result.claims(), hasKey("exp"));
}

Example 3 with ExtractResult

use of org.dcache.gplazma.oidc.ExtractResult in project dcache by dCache.

the class OfflineJwtVerificationTest method shouldAcceptUnembargoedTokenFromTrustedOp.

@Test
public void shouldAcceptUnembargoedTokenFromTrustedOp() throws Exception {
    given(anIp("EXAMPLE").withEndpoint("https://oidc.example.org/"));
    given(anOfflineJwtVerification().withEmptyAudienceTargetProperty().withIssuer(anIssuer().withIp(identityProvider)));
    given(aJwt().withPayloadClaim("iss", "https://oidc.example.org/").withPayloadClaim("nbf", Instant.now().minus(5, MINUTES)).withPayloadClaim("sub", "paul"));
    ExtractResult result = verification.extract(jwt);
    assertThat(result.idp(), is(sameInstance(identityProvider)));
    assertThat(result.claims(), hasEntry("iss", jsonString("https://oidc.example.org/")));
    assertThat(result.claims(), hasEntry("sub", jsonString("paul")));
    assertThat(result.claims(), hasKey("nbf"));
}

Example 4 with ExtractResult

use of org.dcache.gplazma.oidc.ExtractResult in project dcache by dCache.

the class OfflineJwtVerificationTest method shouldAcceptNonExpiredTokenFromTrustedOp.

@Test
public void shouldAcceptNonExpiredTokenFromTrustedOp() throws Exception {
    given(anIp("EXAMPLE").withEndpoint("https://oidc.example.org/"));
    given(anOfflineJwtVerification().withEmptyAudienceTargetProperty().withIssuer(anIssuer().withIp(identityProvider)));
    given(aJwt().withPayloadClaim("iss", "https://oidc.example.org/").withPayloadClaim("exp", Instant.now().plus(5, MINUTES)).withPayloadClaim("sub", "paul"));
    ExtractResult result = verification.extract(jwt);
    assertThat(result.idp(), is(sameInstance(identityProvider)));
    assertThat(result.claims(), hasEntry("iss", jsonString("https://oidc.example.org/")));
    assertThat(result.claims(), hasEntry("sub", jsonString("paul")));
    assertThat(result.claims(), hasKey("exp"));
}

Example 5 with ExtractResult

use of org.dcache.gplazma.oidc.ExtractResult in project dcache by dCache.

the class OfflineJwtVerification method extract.

@Override
public ExtractResult extract(String token) throws AuthenticationException, UnableToProcess {
    if (!JsonWebToken.isCompatibleFormat(token)) {
        throw new UnableToProcess("token not JWT");
    }
    try {
        var jwt = checkValid(new JsonWebToken(token));
        var issuer = issuerOf(jwt);
        return new ExtractResult(issuer.getIdentityProvider(), jwt.getPayloadMap());
    } catch (IOException e) {
        throw new UnableToProcess(e.getMessage());
    }
}