Examples with JsonException org.forgerock.json.JsonException used on opensource projects

Example 1 with JsonException

use of org.forgerock.json.JsonException in project OpenAM by OpenRock.

the class OpenAMOpenIdConnectClientRegistrationService method createRegistration.

/**
     * {@inheritDoc}
     */
public JsonValue createRegistration(String accessToken, String deploymentUrl, OAuth2Request request) throws InvalidRedirectUri, InvalidClientMetadata, ServerException, UnsupportedResponseTypeException, AccessDeniedException, NotFoundException, InvalidPostLogoutRedirectUri {
    final OAuth2ProviderSettings providerSettings = providerSettingsFactory.get(request);
    if (!providerSettings.isOpenDynamicClientRegistrationAllowed()) {
        if (!tokenVerifier.verify(request).isValid()) {
            throw new AccessDeniedException("Access Token not valid");
        }
    }
    final JsonValue input = request.getBody();
    //check input to ensure it is valid
    Set<String> inputKeys = input.keys();
    for (String key : inputKeys) {
        OAuth2Constants.ShortClientAttributeNames keyName = fromString(key);
        if (keyName == null) {
            logger.warn("Unknown input given. Key: " + key);
        }
    }
    //create client given input
    ClientBuilder clientBuilder = new ClientBuilder();
    try {
        boolean jwks = false;
        if (input.get(JWKS.getType()).asString() != null) {
            jwks = true;
            try {
                JsonValueBuilder.toJsonValue(input.get(JWKS.getType()).asString());
            } catch (JsonException e) {
                throw new InvalidClientMetadata("jwks must be valid JSON.");
            }
            clientBuilder.setJwks(input.get(JWKS.getType()).asString());
            clientBuilder.setPublicKeySelector(Client.PublicKeySelector.JWKS.getType());
        }
        if (input.get(JWKS_URI.getType()).asString() != null) {
            if (jwks) {
                //allowed to set either jwks or jwks_uri but not both
                throw new InvalidClientMetadata("Must define either jwks or jwks_uri, not both.");
            }
            jwks = true;
            try {
                new URL(input.get(JWKS_URI.getType()).asString());
            } catch (MalformedURLException e) {
                throw new InvalidClientMetadata("jwks_uri must be a valid URL.");
            }
            clientBuilder.setJwksUri(input.get(JWKS_URI.getType()).asString());
            clientBuilder.setPublicKeySelector(Client.PublicKeySelector.JWKS_URI.getType());
        }
        //not spec-defined, this is OpenAM proprietary
        if (input.get(X509.getType()).asString() != null) {
            clientBuilder.setX509(input.get(X509.getType()).asString());
        }
        //drop to this if neither other are set
        if (!jwks) {
            clientBuilder.setPublicKeySelector(Client.PublicKeySelector.X509.getType());
        }
        if (input.get(TOKEN_ENDPOINT_AUTH_METHOD.getType()).asString() != null) {
            if (Client.TokenEndpointAuthMethod.fromString(input.get(TOKEN_ENDPOINT_AUTH_METHOD.getType()).asString()) == null) {
                logger.error("Invalid token_endpoint_auth_method requested.");
                throw new InvalidClientMetadata("Invalid token_endpoint_auth_method requested.");
            }
            clientBuilder.setTokenEndpointAuthMethod(input.get(TOKEN_ENDPOINT_AUTH_METHOD.getType()).asString());
        } else {
            clientBuilder.setTokenEndpointAuthMethod(Client.TokenEndpointAuthMethod.CLIENT_SECRET_BASIC.getType());
        }
        if (input.get(CLIENT_ID.getType()).asString() != null) {
            clientBuilder.setClientID(input.get(CLIENT_ID.getType()).asString());
        } else {
            clientBuilder.setClientID(UUID.randomUUID().toString());
        }
        if (input.get(CLIENT_SECRET.getType()).asString() != null) {
            clientBuilder.setClientSecret(input.get(CLIENT_SECRET.getType()).asString());
        } else {
            clientBuilder.setClientSecret(UUID.randomUUID().toString());
        }
        if (input.get(CLIENT_TYPE.getType()).asString() != null) {
            if (Client.ClientType.fromString(input.get(CLIENT_TYPE.getType()).asString()) != null) {
                clientBuilder.setClientType(input.get(CLIENT_TYPE.getType()).asString());
            } else {
                logger.error("Invalid client_type requested.");
                throw new InvalidClientMetadata("Invalid client_type requested");
            }
        } else {
            clientBuilder.setClientType(Client.ClientType.CONFIDENTIAL.getType());
        }
        if (input.get(DEFAULT_MAX_AGE.getType()).asLong() != null) {
            clientBuilder.setDefaultMaxAge(input.get(DEFAULT_MAX_AGE.getType()).asLong());
            clientBuilder.setDefaultMaxAgeEnabled(true);
        } else {
            clientBuilder.setDefaultMaxAge(Client.MIN_DEFAULT_MAX_AGE);
            clientBuilder.setDefaultMaxAgeEnabled(false);
        }
        List<String> redirectUris = new ArrayList<String>();
        if (input.get(REDIRECT_URIS.getType()).asList() != null) {
            redirectUris = input.get(REDIRECT_URIS.getType()).asList(String.class);
            boolean isValidUris = true;
            for (String redirectUri : redirectUris) {
                try {
                    urlValidator.validate(redirectUri);
                } catch (ValidationException e) {
                    isValidUris = false;
                    logger.error("The redirectUri: " + redirectUri + " is invalid.");
                }
            }
            if (!isValidUris) {
                throw new InvalidRedirectUri();
            }
            clientBuilder.setRedirectionURIs(redirectUris);
        }
        if (input.get(SECTOR_IDENTIFIER_URI.getType()).asString() != null) {
            try {
                URL sectorIdentifier = new URL(input.get(SECTOR_IDENTIFIER_URI.getType()).asString());
                List<String> response = mapper.readValue(sectorIdentifier, List.class);
                if (!response.containsAll(redirectUris)) {
                    logger.error("Request_uris not included in sector_identifier_uri.");
                    throw new InvalidClientMetadata();
                }
            } catch (Exception e) {
                logger.error("Invalid sector_identifier_uri requested.");
                throw new InvalidClientMetadata("Invalid sector_identifier_uri requested.");
            }
            clientBuilder.setSectorIdentifierUri(input.get(SECTOR_IDENTIFIER_URI.getType()).asString());
        }
        List<String> scopes = input.get(SCOPES.getType()).asList(String.class);
        if (scopes != null && !scopes.isEmpty()) {
            if (!containsAllCaseInsensitive(providerSettings.getSupportedScopes(), scopes)) {
                logger.error("Invalid scopes requested.");
                throw new InvalidClientMetadata("Invalid scopes requested");
            }
        } else {
            //if nothing requested, fall back to provider defaults
            scopes = new ArrayList<String>();
            scopes.addAll(providerSettings.getDefaultScopes());
        }
        //regardless, we add openid
        if (!scopes.contains(OPENID)) {
            scopes = new ArrayList<String>(scopes);
            scopes.add(OPENID);
        }
        clientBuilder.setAllowedGrantScopes(scopes);
        List<String> defaultScopes = input.get(DEFAULT_SCOPES.getType()).asList(String.class);
        if (defaultScopes != null) {
            if (containsAllCaseInsensitive(providerSettings.getSupportedScopes(), defaultScopes)) {
                clientBuilder.setDefaultGrantScopes(defaultScopes);
            } else {
                throw new InvalidClientMetadata("Invalid default scopes requested.");
            }
        }
        List<String> clientNames = new ArrayList<String>();
        Set<String> keys = input.keys();
        for (String key : keys) {
            if (key.equals(CLIENT_NAME.getType())) {
                clientNames.add(input.get(key).asString());
            } else if (key.startsWith(CLIENT_NAME.getType())) {
                try {
                    Locale locale = new Locale(key.substring(CLIENT_NAME.getType().length() + 1));
                    clientNames.add(locale.toString() + "|" + input.get(key).asString());
                } catch (Exception e) {
                    logger.error("Invalid locale for client_name.");
                    throw new InvalidClientMetadata("Invalid locale for client_name.");
                }
            }
        }
        if (clientNames != null) {
            clientBuilder.setClientName(clientNames);
        }
        if (input.get(CLIENT_DESCRIPTION.getType()).asList() != null) {
            clientBuilder.setDisplayDescription(input.get(CLIENT_DESCRIPTION.getType()).asList(String.class));
        }
        if (input.get(SUBJECT_TYPE.getType()).asString() != null) {
            if (providerSettings.getSupportedSubjectTypes().contains(input.get(SUBJECT_TYPE.getType()).asString())) {
                clientBuilder.setSubjectType(input.get(SUBJECT_TYPE.getType()).asString());
            } else {
                logger.error("Invalid subject_type requested.");
                throw new InvalidClientMetadata("Invalid subject_type requested");
            }
        } else {
            clientBuilder.setSubjectType(Client.SubjectType.PUBLIC.getType());
        }
        if (input.get(ID_TOKEN_SIGNED_RESPONSE_ALG.getType()).asString() != null) {
            if (containsCaseInsensitive(providerSettings.getSupportedIDTokenSigningAlgorithms(), input.get(ID_TOKEN_SIGNED_RESPONSE_ALG.getType()).asString())) {
                clientBuilder.setIdTokenSignedResponseAlgorithm(input.get(ID_TOKEN_SIGNED_RESPONSE_ALG.getType()).asString());
            } else {
                logger.error("Unsupported id_token_response_signed_alg requested.");
                throw new InvalidClientMetadata("Unsupported id_token_response_signed_alg requested.");
            }
        } else {
            clientBuilder.setIdTokenSignedResponseAlgorithm(ID_TOKEN_SIGNED_RESPONSE_ALG_DEFAULT);
        }
        if (input.get(POST_LOGOUT_REDIRECT_URIS.getType()).asList() != null) {
            List<String> logoutRedirectUris = input.get(POST_LOGOUT_REDIRECT_URIS.getType()).asList(String.class);
            boolean isValidUris = true;
            for (String logoutRedirectUri : logoutRedirectUris) {
                try {
                    urlValidator.validate(logoutRedirectUri);
                } catch (ValidationException e) {
                    isValidUris = false;
                    logger.error("The post_logout_redirect_uris: {} is invalid.", logoutRedirectUri);
                }
            }
            if (!isValidUris) {
                throw new InvalidPostLogoutRedirectUri();
            }
            clientBuilder.setPostLogoutRedirectionURIs(logoutRedirectUris);
        }
        if (input.get(REGISTRATION_ACCESS_TOKEN.getType()).asString() != null) {
            clientBuilder.setAccessToken(input.get(REGISTRATION_ACCESS_TOKEN.getType()).asString());
        } else {
            clientBuilder.setAccessToken(accessToken);
        }
        if (input.get(CLIENT_SESSION_URI.getType()).asString() != null) {
            clientBuilder.setClientSessionURI(input.get(CLIENT_SESSION_URI.getType()).asString());
        }
        if (input.get(APPLICATION_TYPE.getType()).asString() != null) {
            if (Client.ApplicationType.fromString(input.get(APPLICATION_TYPE.getType()).asString()) != null) {
                clientBuilder.setApplicationType(Client.ApplicationType.WEB.getType());
            } else {
                logger.error("Invalid application_type requested.");
                throw new InvalidClientMetadata("Invalid application_type requested.");
            }
        } else {
            clientBuilder.setApplicationType(DEFAULT_APPLICATION_TYPE);
        }
        if (input.get(DISPLAY_NAME.getType()).asList() != null) {
            clientBuilder.setDisplayName(input.get(DISPLAY_NAME.getType()).asList(String.class));
        }
        if (input.get(RESPONSE_TYPES.getType()).asList() != null) {
            final List<String> clientResponseTypeList = input.get(RESPONSE_TYPES.getType()).asList(String.class);
            final List<String> typeList = new ArrayList<String>();
            for (String responseType : clientResponseTypeList) {
                typeList.addAll(Arrays.asList(responseType.split(" ")));
            }
            if (containsAllCaseInsensitive(providerSettings.getAllowedResponseTypes().keySet(), typeList)) {
                clientBuilder.setResponseTypes(clientResponseTypeList);
            } else {
                logger.error("Invalid response_types requested.");
                throw new InvalidClientMetadata("Invalid response_types requested.");
            }
        } else {
            List<String> defaultResponseTypes = new ArrayList<String>();
            defaultResponseTypes.add("code");
            clientBuilder.setResponseTypes(defaultResponseTypes);
        }
        if (input.get(AUTHORIZATION_CODE_LIFE_TIME.getType()).asLong() != null) {
            clientBuilder.setAuthorizationCodeLifeTime(input.get(AUTHORIZATION_CODE_LIFE_TIME.getType()).asLong());
        } else {
            clientBuilder.setAuthorizationCodeLifeTime(0L);
        }
        if (input.get(ACCESS_TOKEN_LIFE_TIME.getType()).asLong() != null) {
            clientBuilder.setAccessTokenLifeTime(input.get(ACCESS_TOKEN_LIFE_TIME.getType()).asLong());
        } else {
            clientBuilder.setAccessTokenLifeTime(0L);
        }
        if (input.get(REFRESH_TOKEN_LIFE_TIME.getType()).asLong() != null) {
            clientBuilder.setRefreshTokenLifeTime(input.get(REFRESH_TOKEN_LIFE_TIME.getType()).asLong());
        } else {
            clientBuilder.setRefreshTokenLifeTime(0L);
        }
        if (input.get(JWT_TOKEN_LIFE_TIME.getType()).asLong() != null) {
            clientBuilder.setJwtTokenLifeTime(input.get(JWT_TOKEN_LIFE_TIME.getType()).asLong());
        } else {
            clientBuilder.setJwtTokenLifeTime(0L);
        }
        if (input.get(CONTACTS.getType()).asList() != null) {
            clientBuilder.setContacts(input.get(CONTACTS.getType()).asList(String.class));
        }
    } catch (JsonValueException e) {
        logger.error("Unable to build client.", e);
        throw new InvalidClientMetadata();
    }
    Client client = clientBuilder.createClient();
    // See OPENAM-3604 and http://openid.net/specs/openid-connect-registration-1_0.html#ClientRegistration
    if (providerSettings.isRegistrationAccessTokenGenerationEnabled() && !client.hasAccessToken()) {
        client.setAccessToken(createRegistrationAccessToken(client, request));
    }
    clientDAO.create(client, request);
    // have some visibility on who is registering clients.
    if (logger.isInfoEnabled()) {
        logger.info("Registered OpenID Connect client: " + client.getClientID() + ", name=" + client.getClientName() + ", type=" + client.getClientType());
    }
    Map<String, Object> response = client.asMap();
    response = convertClientReadResponseFormat(response);
    response.put(REGISTRATION_CLIENT_URI, deploymentUrl + "/oauth2/connect/register?client_id=" + client.getClientID());
    response.put(EXPIRES_AT, 0);
    return new JsonValue(response);
}

Example 2 with JsonException

use of org.forgerock.json.JsonException in project OpenAM by OpenRock.

the class PrincipalFromSessionImpl method parsePrincipalFromResponse.

private Principal parsePrincipalFromResponse(String response) throws TokenValidationException {
    JsonValue responseJson;
    try {
        responseJson = JsonValueBuilder.toJsonValue(response);
    } catch (JsonException e) {
        String message = "Exception caught getting the text of the json principal from session response: " + e;
        throw new TokenValidationException(ResourceException.INTERNAL_ERROR, message, e);
    }
    JsonValue principalIdJsonValue = responseJson.get(ID);
    if (!principalIdJsonValue.isString()) {
        String message = "Principal from session response does not contain " + ID + " string entry. The obtained entry: " + principalIdJsonValue.toString() + "; The response: " + responseJson.toString();
        throw new TokenValidationException(ResourceException.INTERNAL_ERROR, message);
    }
    return new STSPrincipal(principalIdJsonValue.asString());
}

Example 3 with JsonException

use of org.forgerock.json.JsonException in project OpenAM by OpenRock.

the class AMTokenParserImpl method getSessionFromAuthNResponse.

@Override
public String getSessionFromAuthNResponse(String authNResponse) throws TokenValidationException {
    JsonValue responseJson;
    try {
        responseJson = JsonValueBuilder.toJsonValue(authNResponse);
    } catch (JsonException e) {
        String message = "Exception caught getting the text of the json authN response: " + e;
        throw new TokenValidationException(ResourceException.INTERNAL_ERROR, message, e);
    }
    JsonValue sessionIdJsonValue = responseJson.get(TOKEN_ID);
    if (!sessionIdJsonValue.isString()) {
        String message = "REST authN response does not contain " + TOKEN_ID + " string entry. The obtained entry: " + sessionIdJsonValue.toString() + "; The response: " + responseJson.toString();
        throw new TokenValidationException(ResourceException.INTERNAL_ERROR, message);
    }
    return sessionIdJsonValue.asString();
}

Example 4 with JsonException

use of org.forgerock.json.JsonException in project OpenAM by OpenRock.

the class SmsJsonConverter method toJson.

/**
     * Will validate the Map representation of the service configuration against the serviceSchema and return a
     * corresponding JSON representation
     *
     * @param attributeValuePairs The schema attribute values.
     * @param realm The realm, or null if global.
     * @return Json representation of attributeValuePairs
     */
public JsonValue toJson(String realm, Map<String, Set<String>> attributeValuePairs) {
    if (!initialised) {
        init();
    }
    final boolean validAttributes;
    try {
        if (realm == null) {
            validAttributes = schema.validateAttributes(attributeValuePairs);
        } else {
            validAttributes = schema.validateAttributes(attributeValuePairs, realm);
        }
    } catch (SMSException e) {
        debug.error("schema validation threw an exception while validating the attributes: realm=" + realm + " attributes: " + attributeValuePairs, e);
        throw new JsonException("Unable to validate attributes", e);
    }
    JsonValue parentJson = json(new HashMap<String, Object>());
    if (validAttributes) {
        for (String attributeName : attributeValuePairs.keySet()) {
            String jsonResourceName = attributeNameToResourceName.get(attributeName);
            String name;
            if (jsonResourceName != null) {
                name = jsonResourceName;
            } else {
                name = attributeName;
            }
            AttributeSchema attributeSchema = schema.getAttributeSchema(attributeName);
            if (shouldBeIgnored(attributeName)) {
                continue;
            }
            AttributeSchema.Type type = attributeSchema.getType();
            final Set<String> object = attributeValuePairs.get(attributeName);
            Object jsonAttributeValue = null;
            if (type == null) {
                throw new JsonException("Type not defined.");
            }
            AttributeSchemaConverter attributeSchemaConverter = attributeSchemaConverters.get(name);
            if (isASingleValue(type)) {
                if (!object.isEmpty()) {
                    jsonAttributeValue = attributeSchemaConverter.toJson(object.iterator().next());
                }
            } else if (containsMultipleValues(type)) {
                if (isAMap(attributeSchema.getUIType())) {
                    Map<String, Object> map = new HashMap<String, Object>();
                    Iterator<String> itr = object.iterator();
                    while (itr.hasNext()) {
                        Pair<String, String> entry = nameValueParser.parse(itr.next());
                        map.put(entry.getFirst(), attributeSchemaConverter.toJson(entry.getSecond()));
                    }
                    jsonAttributeValue = map;
                } else {
                    List<Object> list = new ArrayList<Object>();
                    Iterator<String> itr = object.iterator();
                    while (itr.hasNext()) {
                        list.add(attributeSchemaConverter.toJson(itr.next()));
                    }
                    jsonAttributeValue = list;
                }
            }
            String sectionName = attributeNameToSection.get(attributeName);
            if (sectionName != null) {
                parentJson.putPermissive(new JsonPointer("/" + sectionName + "/" + name), jsonAttributeValue);
            } else {
                parentJson.put(name, jsonAttributeValue);
            }
        }
    } else {
        throw new JsonException("Invalid attributes");
    }
    return parentJson;
}

Example 5 with JsonException

use of org.forgerock.json.JsonException in project OpenAM by OpenRock.

the class SmsJsonConverter method fromJson.

/**
     * Will validate the Json representation of the service configuration against the serviceSchema for a realm,
     * and return a corresponding Map representation.
     *
     * @param jsonValue The request body.
     * @param realm The realm, or null if global.
     * @return Map representation of jsonValue
     */
public Map<String, Set<String>> fromJson(String realm, JsonValue jsonValue) throws JsonException, BadRequestException {
    if (!initialised) {
        init();
    }
    Map<String, Set<String>> result = new HashMap<>();
    if (jsonValue == null || jsonValue.isNull()) {
        return result;
    }
    Map<String, Object> translatedAttributeValuePairs = getTranslatedAttributeValuePairs(jsonValue.asMap());
    for (String attributeName : translatedAttributeValuePairs.keySet()) {
        // Ignore _id field used to name resource when creating
        if (ResourceResponse.FIELD_CONTENT_ID.equals(attributeName)) {
            continue;
        }
        if (shouldNotBeUpdated(attributeName)) {
            throw new BadRequestException("Invalid attribute, '" + attributeName + "', specified");
        }
        if (shouldBeIgnored(attributeName)) {
            continue;
        }
        final Object attributeValue = translatedAttributeValuePairs.get(attributeName);
        Set<String> value = new HashSet<>();
        if (attributeValue instanceof HashMap) {
            final HashMap<String, Object> attributeMap = (HashMap<String, Object>) attributeValue;
            for (String name : attributeMap.keySet()) {
                value.add("[" + name + "]=" + convertJsonToString(attributeName, attributeMap.get(name)));
            }
        } else if (attributeValue instanceof List) {
            List<Object> attributeArray = (ArrayList<Object>) attributeValue;
            for (Object val : attributeArray) {
                value.add(convertJsonToString(attributeName, val));
            }
        } else {
            value.add(convertJsonToString(attributeName, attributeValue));
        }
        result.put(attributeName, value);
    }
    try {
        if (result.isEmpty() || (realm == null && schema.validateAttributes(result)) || (realm != null && schema.validateAttributes(result, realm))) {
            return result;
        } else {
            throw new JsonException("Invalid attributes");
        }
    } catch (InvalidAttributeValueException e) {
        throw new BadRequestException(e.getLocalizedMessage(), e);
    } catch (SMSException e) {
        throw new JsonException("Unable to validate attributes", e);
    }
}