use of org.forgerock.oauth2.core.ClientRegistration in project OpenAM by OpenRock.
the class OpenAMOpenIdConnectClientRegistrationService method createRegistration.
/**
* {@inheritDoc}
*/
public JsonValue createRegistration(String accessToken, String deploymentUrl, OAuth2Request request) throws InvalidRedirectUri, InvalidClientMetadata, ServerException, UnsupportedResponseTypeException, AccessDeniedException, NotFoundException, InvalidPostLogoutRedirectUri {
final OAuth2ProviderSettings providerSettings = providerSettingsFactory.get(request);
if (!providerSettings.isOpenDynamicClientRegistrationAllowed()) {
if (!tokenVerifier.verify(request).isValid()) {
throw new AccessDeniedException("Access Token not valid");
}
}
final JsonValue input = request.getBody();
//check input to ensure it is valid
Set<String> inputKeys = input.keys();
for (String key : inputKeys) {
OAuth2Constants.ShortClientAttributeNames keyName = fromString(key);
if (keyName == null) {
logger.warn("Unknown input given. Key: " + key);
}
}
//create client given input
ClientBuilder clientBuilder = new ClientBuilder();
try {
boolean jwks = false;
if (input.get(JWKS.getType()).asString() != null) {
jwks = true;
try {
JsonValueBuilder.toJsonValue(input.get(JWKS.getType()).asString());
} catch (JsonException e) {
throw new InvalidClientMetadata("jwks must be valid JSON.");
}
clientBuilder.setJwks(input.get(JWKS.getType()).asString());
clientBuilder.setPublicKeySelector(Client.PublicKeySelector.JWKS.getType());
}
if (input.get(JWKS_URI.getType()).asString() != null) {
if (jwks) {
//allowed to set either jwks or jwks_uri but not both
throw new InvalidClientMetadata("Must define either jwks or jwks_uri, not both.");
}
jwks = true;
try {
new URL(input.get(JWKS_URI.getType()).asString());
} catch (MalformedURLException e) {
throw new InvalidClientMetadata("jwks_uri must be a valid URL.");
}
clientBuilder.setJwksUri(input.get(JWKS_URI.getType()).asString());
clientBuilder.setPublicKeySelector(Client.PublicKeySelector.JWKS_URI.getType());
}
//not spec-defined, this is OpenAM proprietary
if (input.get(X509.getType()).asString() != null) {
clientBuilder.setX509(input.get(X509.getType()).asString());
}
//drop to this if neither other are set
if (!jwks) {
clientBuilder.setPublicKeySelector(Client.PublicKeySelector.X509.getType());
}
if (input.get(TOKEN_ENDPOINT_AUTH_METHOD.getType()).asString() != null) {
if (Client.TokenEndpointAuthMethod.fromString(input.get(TOKEN_ENDPOINT_AUTH_METHOD.getType()).asString()) == null) {
logger.error("Invalid token_endpoint_auth_method requested.");
throw new InvalidClientMetadata("Invalid token_endpoint_auth_method requested.");
}
clientBuilder.setTokenEndpointAuthMethod(input.get(TOKEN_ENDPOINT_AUTH_METHOD.getType()).asString());
} else {
clientBuilder.setTokenEndpointAuthMethod(Client.TokenEndpointAuthMethod.CLIENT_SECRET_BASIC.getType());
}
if (input.get(CLIENT_ID.getType()).asString() != null) {
clientBuilder.setClientID(input.get(CLIENT_ID.getType()).asString());
} else {
clientBuilder.setClientID(UUID.randomUUID().toString());
}
if (input.get(CLIENT_SECRET.getType()).asString() != null) {
clientBuilder.setClientSecret(input.get(CLIENT_SECRET.getType()).asString());
} else {
clientBuilder.setClientSecret(UUID.randomUUID().toString());
}
if (input.get(CLIENT_TYPE.getType()).asString() != null) {
if (Client.ClientType.fromString(input.get(CLIENT_TYPE.getType()).asString()) != null) {
clientBuilder.setClientType(input.get(CLIENT_TYPE.getType()).asString());
} else {
logger.error("Invalid client_type requested.");
throw new InvalidClientMetadata("Invalid client_type requested");
}
} else {
clientBuilder.setClientType(Client.ClientType.CONFIDENTIAL.getType());
}
if (input.get(DEFAULT_MAX_AGE.getType()).asLong() != null) {
clientBuilder.setDefaultMaxAge(input.get(DEFAULT_MAX_AGE.getType()).asLong());
clientBuilder.setDefaultMaxAgeEnabled(true);
} else {
clientBuilder.setDefaultMaxAge(Client.MIN_DEFAULT_MAX_AGE);
clientBuilder.setDefaultMaxAgeEnabled(false);
}
List<String> redirectUris = new ArrayList<String>();
if (input.get(REDIRECT_URIS.getType()).asList() != null) {
redirectUris = input.get(REDIRECT_URIS.getType()).asList(String.class);
boolean isValidUris = true;
for (String redirectUri : redirectUris) {
try {
urlValidator.validate(redirectUri);
} catch (ValidationException e) {
isValidUris = false;
logger.error("The redirectUri: " + redirectUri + " is invalid.");
}
}
if (!isValidUris) {
throw new InvalidRedirectUri();
}
clientBuilder.setRedirectionURIs(redirectUris);
}
if (input.get(SECTOR_IDENTIFIER_URI.getType()).asString() != null) {
try {
URL sectorIdentifier = new URL(input.get(SECTOR_IDENTIFIER_URI.getType()).asString());
List<String> response = mapper.readValue(sectorIdentifier, List.class);
if (!response.containsAll(redirectUris)) {
logger.error("Request_uris not included in sector_identifier_uri.");
throw new InvalidClientMetadata();
}
} catch (Exception e) {
logger.error("Invalid sector_identifier_uri requested.");
throw new InvalidClientMetadata("Invalid sector_identifier_uri requested.");
}
clientBuilder.setSectorIdentifierUri(input.get(SECTOR_IDENTIFIER_URI.getType()).asString());
}
List<String> scopes = input.get(SCOPES.getType()).asList(String.class);
if (scopes != null && !scopes.isEmpty()) {
if (!containsAllCaseInsensitive(providerSettings.getSupportedScopes(), scopes)) {
logger.error("Invalid scopes requested.");
throw new InvalidClientMetadata("Invalid scopes requested");
}
} else {
//if nothing requested, fall back to provider defaults
scopes = new ArrayList<String>();
scopes.addAll(providerSettings.getDefaultScopes());
}
//regardless, we add openid
if (!scopes.contains(OPENID)) {
scopes = new ArrayList<String>(scopes);
scopes.add(OPENID);
}
clientBuilder.setAllowedGrantScopes(scopes);
List<String> defaultScopes = input.get(DEFAULT_SCOPES.getType()).asList(String.class);
if (defaultScopes != null) {
if (containsAllCaseInsensitive(providerSettings.getSupportedScopes(), defaultScopes)) {
clientBuilder.setDefaultGrantScopes(defaultScopes);
} else {
throw new InvalidClientMetadata("Invalid default scopes requested.");
}
}
List<String> clientNames = new ArrayList<String>();
Set<String> keys = input.keys();
for (String key : keys) {
if (key.equals(CLIENT_NAME.getType())) {
clientNames.add(input.get(key).asString());
} else if (key.startsWith(CLIENT_NAME.getType())) {
try {
Locale locale = new Locale(key.substring(CLIENT_NAME.getType().length() + 1));
clientNames.add(locale.toString() + "|" + input.get(key).asString());
} catch (Exception e) {
logger.error("Invalid locale for client_name.");
throw new InvalidClientMetadata("Invalid locale for client_name.");
}
}
}
if (clientNames != null) {
clientBuilder.setClientName(clientNames);
}
if (input.get(CLIENT_DESCRIPTION.getType()).asList() != null) {
clientBuilder.setDisplayDescription(input.get(CLIENT_DESCRIPTION.getType()).asList(String.class));
}
if (input.get(SUBJECT_TYPE.getType()).asString() != null) {
if (providerSettings.getSupportedSubjectTypes().contains(input.get(SUBJECT_TYPE.getType()).asString())) {
clientBuilder.setSubjectType(input.get(SUBJECT_TYPE.getType()).asString());
} else {
logger.error("Invalid subject_type requested.");
throw new InvalidClientMetadata("Invalid subject_type requested");
}
} else {
clientBuilder.setSubjectType(Client.SubjectType.PUBLIC.getType());
}
if (input.get(ID_TOKEN_SIGNED_RESPONSE_ALG.getType()).asString() != null) {
if (containsCaseInsensitive(providerSettings.getSupportedIDTokenSigningAlgorithms(), input.get(ID_TOKEN_SIGNED_RESPONSE_ALG.getType()).asString())) {
clientBuilder.setIdTokenSignedResponseAlgorithm(input.get(ID_TOKEN_SIGNED_RESPONSE_ALG.getType()).asString());
} else {
logger.error("Unsupported id_token_response_signed_alg requested.");
throw new InvalidClientMetadata("Unsupported id_token_response_signed_alg requested.");
}
} else {
clientBuilder.setIdTokenSignedResponseAlgorithm(ID_TOKEN_SIGNED_RESPONSE_ALG_DEFAULT);
}
if (input.get(POST_LOGOUT_REDIRECT_URIS.getType()).asList() != null) {
List<String> logoutRedirectUris = input.get(POST_LOGOUT_REDIRECT_URIS.getType()).asList(String.class);
boolean isValidUris = true;
for (String logoutRedirectUri : logoutRedirectUris) {
try {
urlValidator.validate(logoutRedirectUri);
} catch (ValidationException e) {
isValidUris = false;
logger.error("The post_logout_redirect_uris: {} is invalid.", logoutRedirectUri);
}
}
if (!isValidUris) {
throw new InvalidPostLogoutRedirectUri();
}
clientBuilder.setPostLogoutRedirectionURIs(logoutRedirectUris);
}
if (input.get(REGISTRATION_ACCESS_TOKEN.getType()).asString() != null) {
clientBuilder.setAccessToken(input.get(REGISTRATION_ACCESS_TOKEN.getType()).asString());
} else {
clientBuilder.setAccessToken(accessToken);
}
if (input.get(CLIENT_SESSION_URI.getType()).asString() != null) {
clientBuilder.setClientSessionURI(input.get(CLIENT_SESSION_URI.getType()).asString());
}
if (input.get(APPLICATION_TYPE.getType()).asString() != null) {
if (Client.ApplicationType.fromString(input.get(APPLICATION_TYPE.getType()).asString()) != null) {
clientBuilder.setApplicationType(Client.ApplicationType.WEB.getType());
} else {
logger.error("Invalid application_type requested.");
throw new InvalidClientMetadata("Invalid application_type requested.");
}
} else {
clientBuilder.setApplicationType(DEFAULT_APPLICATION_TYPE);
}
if (input.get(DISPLAY_NAME.getType()).asList() != null) {
clientBuilder.setDisplayName(input.get(DISPLAY_NAME.getType()).asList(String.class));
}
if (input.get(RESPONSE_TYPES.getType()).asList() != null) {
final List<String> clientResponseTypeList = input.get(RESPONSE_TYPES.getType()).asList(String.class);
final List<String> typeList = new ArrayList<String>();
for (String responseType : clientResponseTypeList) {
typeList.addAll(Arrays.asList(responseType.split(" ")));
}
if (containsAllCaseInsensitive(providerSettings.getAllowedResponseTypes().keySet(), typeList)) {
clientBuilder.setResponseTypes(clientResponseTypeList);
} else {
logger.error("Invalid response_types requested.");
throw new InvalidClientMetadata("Invalid response_types requested.");
}
} else {
List<String> defaultResponseTypes = new ArrayList<String>();
defaultResponseTypes.add("code");
clientBuilder.setResponseTypes(defaultResponseTypes);
}
if (input.get(AUTHORIZATION_CODE_LIFE_TIME.getType()).asLong() != null) {
clientBuilder.setAuthorizationCodeLifeTime(input.get(AUTHORIZATION_CODE_LIFE_TIME.getType()).asLong());
} else {
clientBuilder.setAuthorizationCodeLifeTime(0L);
}
if (input.get(ACCESS_TOKEN_LIFE_TIME.getType()).asLong() != null) {
clientBuilder.setAccessTokenLifeTime(input.get(ACCESS_TOKEN_LIFE_TIME.getType()).asLong());
} else {
clientBuilder.setAccessTokenLifeTime(0L);
}
if (input.get(REFRESH_TOKEN_LIFE_TIME.getType()).asLong() != null) {
clientBuilder.setRefreshTokenLifeTime(input.get(REFRESH_TOKEN_LIFE_TIME.getType()).asLong());
} else {
clientBuilder.setRefreshTokenLifeTime(0L);
}
if (input.get(JWT_TOKEN_LIFE_TIME.getType()).asLong() != null) {
clientBuilder.setJwtTokenLifeTime(input.get(JWT_TOKEN_LIFE_TIME.getType()).asLong());
} else {
clientBuilder.setJwtTokenLifeTime(0L);
}
if (input.get(CONTACTS.getType()).asList() != null) {
clientBuilder.setContacts(input.get(CONTACTS.getType()).asList(String.class));
}
} catch (JsonValueException e) {
logger.error("Unable to build client.", e);
throw new InvalidClientMetadata();
}
Client client = clientBuilder.createClient();
// See OPENAM-3604 and http://openid.net/specs/openid-connect-registration-1_0.html#ClientRegistration
if (providerSettings.isRegistrationAccessTokenGenerationEnabled() && !client.hasAccessToken()) {
client.setAccessToken(createRegistrationAccessToken(client, request));
}
clientDAO.create(client, request);
// have some visibility on who is registering clients.
if (logger.isInfoEnabled()) {
logger.info("Registered OpenID Connect client: " + client.getClientID() + ", name=" + client.getClientName() + ", type=" + client.getClientType());
}
Map<String, Object> response = client.asMap();
response = convertClientReadResponseFormat(response);
response.put(REGISTRATION_CLIENT_URI, deploymentUrl + "/oauth2/connect/register?client_id=" + client.getClientID());
response.put(EXPIRES_AT, 0);
return new JsonValue(response);
}
use of org.forgerock.oauth2.core.ClientRegistration in project OpenAM by OpenRock.
the class OpenAMClientRegistrationTest method setup.
@BeforeMethod
public void setup() throws Exception {
MockitoAnnotations.initMocks(this);
ClientAuthenticationFailureFactory failureFactory = mock(ClientAuthenticationFailureFactory.class);
clientRegistration = new OpenAMClientRegistration(amIdentity, new PEMDecoder(), resolver, providerSettings, failureFactory);
}
use of org.forgerock.oauth2.core.ClientRegistration in project OpenAM by OpenRock.
the class IdTokenClaimGathererTest method mockClientRegistrationStore.
private ClientRegistrationStore mockClientRegistrationStore() throws InvalidClientException, NotFoundException {
ClientRegistrationStore clientRegistrationStore = mock(ClientRegistrationStore.class);
given(clientRegistrationStore.get("CLIENT_ID", oAuth2Request)).willReturn(clientRegistration);
given(clientRegistration.getClientSecret()).willReturn("CLIENT_SECRET");
return clientRegistrationStore;
}
use of org.forgerock.oauth2.core.ClientRegistration in project OpenAM by OpenRock.
the class OpenAMScopeValidator method getUserInfo.
/**
* {@inheritDoc}
*/
public UserInfoClaims getUserInfo(AccessToken token, OAuth2Request request) throws UnauthorizedClientException, NotFoundException {
Map<String, Object> response = new HashMap<>();
Bindings scriptVariables = new SimpleBindings();
SSOToken ssoToken = getUsersSession(request);
String realm;
Set<String> scopes;
AMIdentity id;
OAuth2ProviderSettings providerSettings = providerSettingsFactory.get(request);
Map<String, Set<String>> requestedClaimsValues = gatherRequestedClaims(providerSettings, request, token);
try {
if (token != null) {
OpenIdConnectClientRegistration clientRegistration;
try {
clientRegistration = clientRegistrationStore.get(token.getClientId(), request);
} catch (InvalidClientException e) {
logger.message("Unable to retrieve client from store.");
throw new NotFoundException("No valid client registration found.");
}
final String subId = clientRegistration.getSubValue(token.getResourceOwnerId(), providerSettings);
//data comes from token when we have one
realm = token.getRealm();
scopes = token.getScope();
id = identityManager.getResourceOwnerIdentity(token.getResourceOwnerId(), realm);
response.put(OAuth2Constants.JWTTokenParams.SUB, subId);
response.put(OAuth2Constants.JWTTokenParams.UPDATED_AT, getUpdatedAt(token.getResourceOwnerId(), token.getRealm(), request));
} else {
//otherwise we're simply reading claims into the id_token, so grab it from the request/ssoToken
realm = DNMapper.orgNameToRealmName(ssoToken.getProperty(ISAuthConstants.ORGANIZATION));
id = identityManager.getResourceOwnerIdentity(ssoToken.getProperty(ISAuthConstants.USER_ID), realm);
String scopeStr = request.getParameter(OAuth2Constants.Params.SCOPE);
scopes = splitScope(scopeStr);
}
scriptVariables.put(OAuth2Constants.ScriptParams.SCOPES, getScriptFriendlyScopes(scopes));
scriptVariables.put(OAuth2Constants.ScriptParams.IDENTITY, id);
scriptVariables.put(OAuth2Constants.ScriptParams.LOGGER, logger);
scriptVariables.put(OAuth2Constants.ScriptParams.CLAIMS, response);
scriptVariables.put(OAuth2Constants.ScriptParams.SESSION, ssoToken);
scriptVariables.put(OAuth2Constants.ScriptParams.REQUESTED_CLAIMS, requestedClaimsValues);
ScriptObject script = getOIDCClaimsExtensionScript(realm);
try {
return scriptEvaluator.evaluateScript(script, scriptVariables);
} catch (ScriptException e) {
logger.message("Error running OIDC claims script", e);
throw new ServerException("Error running OIDC claims script: " + e.getMessage());
}
} catch (ServerException e) {
//API does not allow ServerExceptions to be thrown!
throw new NotFoundException(e.getMessage());
} catch (SSOException e) {
throw new NotFoundException(e.getMessage());
}
}
use of org.forgerock.oauth2.core.ClientRegistration in project OpenAM by OpenRock.
the class OpenAMTokenStore method createAuthorizationCode.
/**
* {@inheritDoc}
*/
public AuthorizationCode createAuthorizationCode(Set<String> scope, ResourceOwner resourceOwner, String clientId, String redirectUri, String nonce, OAuth2Request request, String codeChallenge, String codeChallengeMethod) throws ServerException, NotFoundException {
logger.message("DefaultOAuthTokenStoreImpl::Creating Authorization code");
OpenIdConnectClientRegistration clientRegistration = getClientRegistration(clientId, request);
final OAuth2ProviderSettings providerSettings = providerSettingsFactory.get(request);
final String code = UUID.randomUUID().toString();
long expiryTime = 0;
if (clientRegistration == null) {
expiryTime = providerSettings.getAuthorizationCodeLifetime() + System.currentTimeMillis();
} else {
expiryTime = clientRegistration.getAuthorizationCodeLifeTime(providerSettings) + System.currentTimeMillis();
}
final String ssoTokenId = getSsoTokenId(request);
final OpenAMAuthorizationCode authorizationCode = new OpenAMAuthorizationCode(code, resourceOwner.getId(), clientId, redirectUri, scope, getClaimsFromRequest(request), expiryTime, nonce, realmNormaliser.normalise(request.<String>getParameter(REALM)), getAuthModulesFromSSOToken(request), getAuthenticationContextClassReferenceFromRequest(request), ssoTokenId, codeChallenge, codeChallengeMethod);
// Store in CTS
try {
tokenStore.create(authorizationCode);
if (auditLogger.isAuditLogEnabled()) {
String[] obs = { "CREATED_AUTHORIZATION_CODE", authorizationCode.toString() };
auditLogger.logAccessMessage("CREATED_AUTHORIZATION_CODE", obs, null);
}
} catch (CoreTokenException e) {
if (auditLogger.isAuditLogEnabled()) {
String[] obs = { "FAILED_CREATE_AUTHORIZATION_CODE", authorizationCode.toString() };
auditLogger.logErrorMessage("FAILED_CREATE_AUTHORIZATION_CODE", obs, null);
}
logger.error("Unable to create authorization code " + authorizationCode.getTokenInfo(), e);
throw new ServerException("Could not create token in CTS");
}
request.setToken(AuthorizationCode.class, authorizationCode);
return authorizationCode;
}
Aggregations