Examples with IApiOAuthorizationCodeManager org.entando.entando.aps.system.services.oauth2.IApiOAuthorizationCodeManager used on opensource projects

Example 1 with IApiOAuthorizationCodeManager

use of org.entando.entando.aps.system.services.oauth2.IApiOAuthorizationCodeManager in project entando-core by entando.

the class TokenEndpointServlet method validateClientWithAuthorizationCode.

private OAuthResponse validateClientWithAuthorizationCode(HttpServletRequest request) throws Throwable {
    try {
        final OAuthTokenRequest oauthRequest = new OAuthTokenRequest(request);
        IOAuthConsumerManager consumerManager = (IOAuthConsumerManager) ApsWebApplicationUtils.getBean(SystemConstants.OAUTH_CONSUMER_MANAGER, request);
        IApiOAuthorizationCodeManager codeManager = (IApiOAuthorizationCodeManager) ApsWebApplicationUtils.getBean(SystemConstants.OAUTH2_AUTHORIZATION_CODE_MANAGER, request);
        if (oauthRequest.getParam(OAuth.OAUTH_GRANT_TYPE).equals(GrantType.AUTHORIZATION_CODE.toString()) || oauthRequest.getParam(OAuth.OAUTH_GRANT_TYPE).equals(GrantType.REFRESH_TOKEN.toString())) {
            final String clientId = oauthRequest.getClientId();
            final String oauthType = GrantType.AUTHORIZATION_CODE.toString();
            final String authCode = oauthRequest.getParam(OAuth.OAUTH_CODE);
            final String clientSecret = oauthRequest.getClientSecret();
            boolean checkVerifyAccess = codeManager.verifyAccess(clientId, clientSecret, consumerManager);
            if (!checkVerifyAccess) {
                _logger.error(ERROR_AUTHENTICATION_FAILED);
                return null;
            } else if (!codeManager.verifyCode(authCode, request.getRemoteAddr())) {
                _logger.error("OAuth2 authcode does not match or the source of client is different");
                return null;
            }
            return this.registerToken(request, clientId, oauthType, null);
        } else if (oauthRequest.getParam(OAuth.OAUTH_GRANT_TYPE).equals(GrantType.PASSWORD.toString())) {
            final String username = oauthRequest.getUsername();
            final String password = oauthRequest.getPassword();
            final String oauthType = GrantType.PASSWORD.toString();
            IUserManager userManager = (IUserManager) ApsWebApplicationUtils.getBean(SystemConstants.USER_MANAGER, request);
            UserDetails user = userManager.getUser(username, password);
            if (user == null) {
                _logger.error(ERROR_AUTHENTICATION_FAILED);
                return null;
            }
            return this.registerToken(request, username, oauthType, null);
        } else {
            return null;
        }
    } catch (OAuthSystemException e) {
        _logger.error("OAuthSystemException - {} ", e);
        return null;
    } catch (OAuthProblemException e) {
        _logger.error("OAuthProblemException - {} ", e.getError().concat(" ").concat(e.getDescription()));
        _logger.debug("OAuthProblemException - {} ", e);
        return null;
    }
}

Example 2 with IApiOAuthorizationCodeManager

use of org.entando.entando.aps.system.services.oauth2.IApiOAuthorizationCodeManager in project entando-core by entando.

the class AuthEndpointServlet method doGet.

@Override
protected void doGet(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
    OAuthAuthzRequest oauthRequest = null;
    OAuthIssuerImpl oauthIssuerImpl = new OAuthIssuerImpl(new MD5Generator());
    IApiOAuthorizationCodeManager codeManager = (IApiOAuthorizationCodeManager) ApsWebApplicationUtils.getBean(SystemConstants.OAUTH2_AUTHORIZATION_CODE_MANAGER, request);
    try {
        oauthRequest = new OAuthAuthzRequest(request);
        if (validateClient(oauthRequest, request, response)) {
            // build response according to response_type
            String responseType = oauthRequest.getParam(OAuth.OAUTH_RESPONSE_TYPE) == null ? OAuth.OAUTH_RESPONSE_TYPE : oauthRequest.getParam(OAuth.OAUTH_RESPONSE_TYPE);
            OAuthASResponse.OAuthAuthorizationResponseBuilder builder = OAuthASResponse.authorizationResponse(request, HttpServletResponse.SC_FOUND);
            final String authorizationCode = oauthIssuerImpl.authorizationCode();
            final int expires = 3;
            AuthorizationCode authCode = new AuthorizationCode();
            authCode.setAuthorizationCode(authorizationCode);
            // gets a calendar using the default time zone and locale.
            Calendar calendar = Calendar.getInstance();
            calendar.add(Calendar.SECOND, expires);
            authCode.setExpires(calendar.getTimeInMillis());
            authCode.setClientId(oauthRequest.getClientId());
            authCode.setSource(request.getRemoteAddr());
            codeManager.addAuthorizationCode(authCode);
            if (responseType.equals(ResponseType.CODE.toString())) {
                builder.setCode(authorizationCode);
            }
            if (responseType.equals(ResponseType.TOKEN.toString())) {
                builder.setAccessToken(authorizationCode);
                builder.setExpiresIn((long) expires);
            }
            String redirectURI = oauthRequest.getParam(OAuth.OAUTH_REDIRECT_URI);
            final OAuthResponse resp = builder.location(redirectURI).buildQueryMessage();
            final int status = resp.getResponseStatus();
            response.setStatus(status);
            response.sendRedirect(resp.getLocationUri());
        } else {
            logger.warn("OAuth2 authentication failed");
            response.sendError(HttpServletResponse.SC_UNAUTHORIZED);
        }
    } catch (OAuthSystemException ex) {
        logger.error("System exception {} ", ex.getMessage());
        response.sendError(HttpServletResponse.SC_INTERNAL_SERVER_ERROR);
    } catch (OAuthProblemException ex) {
        logger.error("OAuth2 error {} ", ex.getMessage());
        response.sendError(HttpServletResponse.SC_UNAUTHORIZED);
    } catch (IOException e) {
        logger.error("IOException {} ", e);
    }
}