Examples with AccessDeniedException org.forgerock.oauth2.core.exceptions.AccessDeniedException used on opensource projects

Example 1 with AccessDeniedException

use of org.forgerock.oauth2.core.exceptions.AccessDeniedException in project OpenAM by OpenRock.

the class OpenAMOpenIdConnectClientRegistrationService method createRegistration.

/**
     * {@inheritDoc}
     */
public JsonValue createRegistration(String accessToken, String deploymentUrl, OAuth2Request request) throws InvalidRedirectUri, InvalidClientMetadata, ServerException, UnsupportedResponseTypeException, AccessDeniedException, NotFoundException, InvalidPostLogoutRedirectUri {
    final OAuth2ProviderSettings providerSettings = providerSettingsFactory.get(request);
    if (!providerSettings.isOpenDynamicClientRegistrationAllowed()) {
        if (!tokenVerifier.verify(request).isValid()) {
            throw new AccessDeniedException("Access Token not valid");
        }
    }
    final JsonValue input = request.getBody();
    //check input to ensure it is valid
    Set<String> inputKeys = input.keys();
    for (String key : inputKeys) {
        OAuth2Constants.ShortClientAttributeNames keyName = fromString(key);
        if (keyName == null) {
            logger.warn("Unknown input given. Key: " + key);
        }
    }
    //create client given input
    ClientBuilder clientBuilder = new ClientBuilder();
    try {
        boolean jwks = false;
        if (input.get(JWKS.getType()).asString() != null) {
            jwks = true;
            try {
                JsonValueBuilder.toJsonValue(input.get(JWKS.getType()).asString());
            } catch (JsonException e) {
                throw new InvalidClientMetadata("jwks must be valid JSON.");
            }
            clientBuilder.setJwks(input.get(JWKS.getType()).asString());
            clientBuilder.setPublicKeySelector(Client.PublicKeySelector.JWKS.getType());
        }
        if (input.get(JWKS_URI.getType()).asString() != null) {
            if (jwks) {
                //allowed to set either jwks or jwks_uri but not both
                throw new InvalidClientMetadata("Must define either jwks or jwks_uri, not both.");
            }
            jwks = true;
            try {
                new URL(input.get(JWKS_URI.getType()).asString());
            } catch (MalformedURLException e) {
                throw new InvalidClientMetadata("jwks_uri must be a valid URL.");
            }
            clientBuilder.setJwksUri(input.get(JWKS_URI.getType()).asString());
            clientBuilder.setPublicKeySelector(Client.PublicKeySelector.JWKS_URI.getType());
        }
        //not spec-defined, this is OpenAM proprietary
        if (input.get(X509.getType()).asString() != null) {
            clientBuilder.setX509(input.get(X509.getType()).asString());
        }
        //drop to this if neither other are set
        if (!jwks) {
            clientBuilder.setPublicKeySelector(Client.PublicKeySelector.X509.getType());
        }
        if (input.get(TOKEN_ENDPOINT_AUTH_METHOD.getType()).asString() != null) {
            if (Client.TokenEndpointAuthMethod.fromString(input.get(TOKEN_ENDPOINT_AUTH_METHOD.getType()).asString()) == null) {
                logger.error("Invalid token_endpoint_auth_method requested.");
                throw new InvalidClientMetadata("Invalid token_endpoint_auth_method requested.");
            }
            clientBuilder.setTokenEndpointAuthMethod(input.get(TOKEN_ENDPOINT_AUTH_METHOD.getType()).asString());
        } else {
            clientBuilder.setTokenEndpointAuthMethod(Client.TokenEndpointAuthMethod.CLIENT_SECRET_BASIC.getType());
        }
        if (input.get(CLIENT_ID.getType()).asString() != null) {
            clientBuilder.setClientID(input.get(CLIENT_ID.getType()).asString());
        } else {
            clientBuilder.setClientID(UUID.randomUUID().toString());
        }
        if (input.get(CLIENT_SECRET.getType()).asString() != null) {
            clientBuilder.setClientSecret(input.get(CLIENT_SECRET.getType()).asString());
        } else {
            clientBuilder.setClientSecret(UUID.randomUUID().toString());
        }
        if (input.get(CLIENT_TYPE.getType()).asString() != null) {
            if (Client.ClientType.fromString(input.get(CLIENT_TYPE.getType()).asString()) != null) {
                clientBuilder.setClientType(input.get(CLIENT_TYPE.getType()).asString());
            } else {
                logger.error("Invalid client_type requested.");
                throw new InvalidClientMetadata("Invalid client_type requested");
            }
        } else {
            clientBuilder.setClientType(Client.ClientType.CONFIDENTIAL.getType());
        }
        if (input.get(DEFAULT_MAX_AGE.getType()).asLong() != null) {
            clientBuilder.setDefaultMaxAge(input.get(DEFAULT_MAX_AGE.getType()).asLong());
            clientBuilder.setDefaultMaxAgeEnabled(true);
        } else {
            clientBuilder.setDefaultMaxAge(Client.MIN_DEFAULT_MAX_AGE);
            clientBuilder.setDefaultMaxAgeEnabled(false);
        }
        List<String> redirectUris = new ArrayList<String>();
        if (input.get(REDIRECT_URIS.getType()).asList() != null) {
            redirectUris = input.get(REDIRECT_URIS.getType()).asList(String.class);
            boolean isValidUris = true;
            for (String redirectUri : redirectUris) {
                try {
                    urlValidator.validate(redirectUri);
                } catch (ValidationException e) {
                    isValidUris = false;
                    logger.error("The redirectUri: " + redirectUri + " is invalid.");
                }
            }
            if (!isValidUris) {
                throw new InvalidRedirectUri();
            }
            clientBuilder.setRedirectionURIs(redirectUris);
        }
        if (input.get(SECTOR_IDENTIFIER_URI.getType()).asString() != null) {
            try {
                URL sectorIdentifier = new URL(input.get(SECTOR_IDENTIFIER_URI.getType()).asString());
                List<String> response = mapper.readValue(sectorIdentifier, List.class);
                if (!response.containsAll(redirectUris)) {
                    logger.error("Request_uris not included in sector_identifier_uri.");
                    throw new InvalidClientMetadata();
                }
            } catch (Exception e) {
                logger.error("Invalid sector_identifier_uri requested.");
                throw new InvalidClientMetadata("Invalid sector_identifier_uri requested.");
            }
            clientBuilder.setSectorIdentifierUri(input.get(SECTOR_IDENTIFIER_URI.getType()).asString());
        }
        List<String> scopes = input.get(SCOPES.getType()).asList(String.class);
        if (scopes != null && !scopes.isEmpty()) {
            if (!containsAllCaseInsensitive(providerSettings.getSupportedScopes(), scopes)) {
                logger.error("Invalid scopes requested.");
                throw new InvalidClientMetadata("Invalid scopes requested");
            }
        } else {
            //if nothing requested, fall back to provider defaults
            scopes = new ArrayList<String>();
            scopes.addAll(providerSettings.getDefaultScopes());
        }
        //regardless, we add openid
        if (!scopes.contains(OPENID)) {
            scopes = new ArrayList<String>(scopes);
            scopes.add(OPENID);
        }
        clientBuilder.setAllowedGrantScopes(scopes);
        List<String> defaultScopes = input.get(DEFAULT_SCOPES.getType()).asList(String.class);
        if (defaultScopes != null) {
            if (containsAllCaseInsensitive(providerSettings.getSupportedScopes(), defaultScopes)) {
                clientBuilder.setDefaultGrantScopes(defaultScopes);
            } else {
                throw new InvalidClientMetadata("Invalid default scopes requested.");
            }
        }
        List<String> clientNames = new ArrayList<String>();
        Set<String> keys = input.keys();
        for (String key : keys) {
            if (key.equals(CLIENT_NAME.getType())) {
                clientNames.add(input.get(key).asString());
            } else if (key.startsWith(CLIENT_NAME.getType())) {
                try {
                    Locale locale = new Locale(key.substring(CLIENT_NAME.getType().length() + 1));
                    clientNames.add(locale.toString() + "|" + input.get(key).asString());
                } catch (Exception e) {
                    logger.error("Invalid locale for client_name.");
                    throw new InvalidClientMetadata("Invalid locale for client_name.");
                }
            }
        }
        if (clientNames != null) {
            clientBuilder.setClientName(clientNames);
        }
        if (input.get(CLIENT_DESCRIPTION.getType()).asList() != null) {
            clientBuilder.setDisplayDescription(input.get(CLIENT_DESCRIPTION.getType()).asList(String.class));
        }
        if (input.get(SUBJECT_TYPE.getType()).asString() != null) {
            if (providerSettings.getSupportedSubjectTypes().contains(input.get(SUBJECT_TYPE.getType()).asString())) {
                clientBuilder.setSubjectType(input.get(SUBJECT_TYPE.getType()).asString());
            } else {
                logger.error("Invalid subject_type requested.");
                throw new InvalidClientMetadata("Invalid subject_type requested");
            }
        } else {
            clientBuilder.setSubjectType(Client.SubjectType.PUBLIC.getType());
        }
        if (input.get(ID_TOKEN_SIGNED_RESPONSE_ALG.getType()).asString() != null) {
            if (containsCaseInsensitive(providerSettings.getSupportedIDTokenSigningAlgorithms(), input.get(ID_TOKEN_SIGNED_RESPONSE_ALG.getType()).asString())) {
                clientBuilder.setIdTokenSignedResponseAlgorithm(input.get(ID_TOKEN_SIGNED_RESPONSE_ALG.getType()).asString());
            } else {
                logger.error("Unsupported id_token_response_signed_alg requested.");
                throw new InvalidClientMetadata("Unsupported id_token_response_signed_alg requested.");
            }
        } else {
            clientBuilder.setIdTokenSignedResponseAlgorithm(ID_TOKEN_SIGNED_RESPONSE_ALG_DEFAULT);
        }
        if (input.get(POST_LOGOUT_REDIRECT_URIS.getType()).asList() != null) {
            List<String> logoutRedirectUris = input.get(POST_LOGOUT_REDIRECT_URIS.getType()).asList(String.class);
            boolean isValidUris = true;
            for (String logoutRedirectUri : logoutRedirectUris) {
                try {
                    urlValidator.validate(logoutRedirectUri);
                } catch (ValidationException e) {
                    isValidUris = false;
                    logger.error("The post_logout_redirect_uris: {} is invalid.", logoutRedirectUri);
                }
            }
            if (!isValidUris) {
                throw new InvalidPostLogoutRedirectUri();
            }
            clientBuilder.setPostLogoutRedirectionURIs(logoutRedirectUris);
        }
        if (input.get(REGISTRATION_ACCESS_TOKEN.getType()).asString() != null) {
            clientBuilder.setAccessToken(input.get(REGISTRATION_ACCESS_TOKEN.getType()).asString());
        } else {
            clientBuilder.setAccessToken(accessToken);
        }
        if (input.get(CLIENT_SESSION_URI.getType()).asString() != null) {
            clientBuilder.setClientSessionURI(input.get(CLIENT_SESSION_URI.getType()).asString());
        }
        if (input.get(APPLICATION_TYPE.getType()).asString() != null) {
            if (Client.ApplicationType.fromString(input.get(APPLICATION_TYPE.getType()).asString()) != null) {
                clientBuilder.setApplicationType(Client.ApplicationType.WEB.getType());
            } else {
                logger.error("Invalid application_type requested.");
                throw new InvalidClientMetadata("Invalid application_type requested.");
            }
        } else {
            clientBuilder.setApplicationType(DEFAULT_APPLICATION_TYPE);
        }
        if (input.get(DISPLAY_NAME.getType()).asList() != null) {
            clientBuilder.setDisplayName(input.get(DISPLAY_NAME.getType()).asList(String.class));
        }
        if (input.get(RESPONSE_TYPES.getType()).asList() != null) {
            final List<String> clientResponseTypeList = input.get(RESPONSE_TYPES.getType()).asList(String.class);
            final List<String> typeList = new ArrayList<String>();
            for (String responseType : clientResponseTypeList) {
                typeList.addAll(Arrays.asList(responseType.split(" ")));
            }
            if (containsAllCaseInsensitive(providerSettings.getAllowedResponseTypes().keySet(), typeList)) {
                clientBuilder.setResponseTypes(clientResponseTypeList);
            } else {
                logger.error("Invalid response_types requested.");
                throw new InvalidClientMetadata("Invalid response_types requested.");
            }
        } else {
            List<String> defaultResponseTypes = new ArrayList<String>();
            defaultResponseTypes.add("code");
            clientBuilder.setResponseTypes(defaultResponseTypes);
        }
        if (input.get(AUTHORIZATION_CODE_LIFE_TIME.getType()).asLong() != null) {
            clientBuilder.setAuthorizationCodeLifeTime(input.get(AUTHORIZATION_CODE_LIFE_TIME.getType()).asLong());
        } else {
            clientBuilder.setAuthorizationCodeLifeTime(0L);
        }
        if (input.get(ACCESS_TOKEN_LIFE_TIME.getType()).asLong() != null) {
            clientBuilder.setAccessTokenLifeTime(input.get(ACCESS_TOKEN_LIFE_TIME.getType()).asLong());
        } else {
            clientBuilder.setAccessTokenLifeTime(0L);
        }
        if (input.get(REFRESH_TOKEN_LIFE_TIME.getType()).asLong() != null) {
            clientBuilder.setRefreshTokenLifeTime(input.get(REFRESH_TOKEN_LIFE_TIME.getType()).asLong());
        } else {
            clientBuilder.setRefreshTokenLifeTime(0L);
        }
        if (input.get(JWT_TOKEN_LIFE_TIME.getType()).asLong() != null) {
            clientBuilder.setJwtTokenLifeTime(input.get(JWT_TOKEN_LIFE_TIME.getType()).asLong());
        } else {
            clientBuilder.setJwtTokenLifeTime(0L);
        }
        if (input.get(CONTACTS.getType()).asList() != null) {
            clientBuilder.setContacts(input.get(CONTACTS.getType()).asList(String.class));
        }
    } catch (JsonValueException e) {
        logger.error("Unable to build client.", e);
        throw new InvalidClientMetadata();
    }
    Client client = clientBuilder.createClient();
    // See OPENAM-3604 and http://openid.net/specs/openid-connect-registration-1_0.html#ClientRegistration
    if (providerSettings.isRegistrationAccessTokenGenerationEnabled() && !client.hasAccessToken()) {
        client.setAccessToken(createRegistrationAccessToken(client, request));
    }
    clientDAO.create(client, request);
    // have some visibility on who is registering clients.
    if (logger.isInfoEnabled()) {
        logger.info("Registered OpenID Connect client: " + client.getClientID() + ", name=" + client.getClientName() + ", type=" + client.getClientType());
    }
    Map<String, Object> response = client.asMap();
    response = convertClientReadResponseFormat(response);
    response.put(REGISTRATION_CLIENT_URI, deploymentUrl + "/oauth2/connect/register?client_id=" + client.getClientID());
    response.put(EXPIRES_AT, 0);
    return new JsonValue(response);
}

Example 2 with AccessDeniedException

use of org.forgerock.oauth2.core.exceptions.AccessDeniedException in project OpenAM by OpenRock.

the class OpenAMResourceOwnerSessionValidator method authenticationRequired.

private ResourceOwnerAuthenticationRequired authenticationRequired(OAuth2Request request) throws AccessDeniedException, URISyntaxException, ServerException, NotFoundException, UnsupportedEncodingException {
    OAuth2ProviderSettings providerSettings = providerSettingsFactory.get(request);
    Template loginUrlTemplate = providerSettings.getCustomLoginUrlTemplate();
    removeLoginPrompt(request.<Request>getRequest());
    String gotoUrl = request.<Request>getRequest().getResourceRef().toString();
    if (request.getParameter(USER_CODE) != null) {
        gotoUrl += (gotoUrl.indexOf('?') > -1 ? "&" : "?") + USER_CODE + "=" + request.getParameter(USER_CODE);
    }
    String acrValues = request.getParameter(ACR_VALUES);
    String realm = request.getParameter(OAuth2Constants.Custom.REALM);
    String moduleName = request.getParameter(MODULE);
    String serviceName = request.getParameter(SERVICE);
    String locale = getRequestLocale(request);
    URI loginUrl;
    if (loginUrlTemplate != null) {
        loginUrl = buildCustomLoginUrl(loginUrlTemplate, gotoUrl, acrValues, realm, moduleName, serviceName, locale);
    } else {
        loginUrl = buildDefaultLoginUrl(request, gotoUrl, acrValues, realm, moduleName, serviceName, locale);
    }
    return new ResourceOwnerAuthenticationRequired(loginUrl);
}

Example 3 with AccessDeniedException

use of org.forgerock.oauth2.core.exceptions.AccessDeniedException in project OpenAM by OpenRock.

the class OpenAMResourceOwnerSessionValidator method setCurrentAcr.

/**
     * If the user is already logged in when the OAuth2 request comes in with an acr_values parameter, we
     * look to see if they've already matched one. If they have, we set the acr value on the request.
     */
private void setCurrentAcr(SSOToken token, OAuth2Request request, String acrValuesStr) throws NotFoundException, ServerException, SSOException, AccessDeniedException, UnsupportedEncodingException, URISyntaxException, ResourceOwnerAuthenticationRequired {
    String serviceUsed = token.getProperty(ISAuthConstants.SERVICE);
    Set<String> acrValues = new HashSet<>(Arrays.asList(acrValuesStr.split("\\s+")));
    OAuth2ProviderSettings settings = providerSettingsFactory.get(request);
    Map<String, AuthenticationMethod> acrMap = settings.getAcrMapping();
    boolean matched = false;
    for (String acr : acrValues) {
        if (acrMap.containsKey(acr)) {
            if (serviceUsed.equals(acrMap.get(acr).getName())) {
                final Request req = request.getRequest();
                req.getResourceRef().addQueryParameter(OAuth2Constants.JWTTokenParams.ACR, acr);
                matched = true;
            }
        }
    }
    if (!matched) {
        throw authenticationRequired(request, token);
    }
}

Example 4 with AccessDeniedException

use of org.forgerock.oauth2.core.exceptions.AccessDeniedException in project OpenAM by OpenRock.

the class AuthorizationServiceImpl method authorize.

/**
     * {@inheritDoc}
     */
public AuthorizationToken authorize(OAuth2Request request) throws ResourceOwnerAuthenticationRequired, ResourceOwnerConsentRequired, InvalidClientException, UnsupportedResponseTypeException, RedirectUriMismatchException, InvalidRequestException, AccessDeniedException, ServerException, LoginRequiredException, BadRequestException, InteractionRequiredException, ResourceOwnerConsentRequiredException, InvalidScopeException, NotFoundException {
    final OAuth2ProviderSettings providerSettings = providerSettingsFactory.get(request);
    for (final AuthorizeRequestValidator requestValidator : requestValidators) {
        requestValidator.validateRequest(request);
    }
    final String clientId = request.getParameter(CLIENT_ID);
    final ClientRegistration clientRegistration = clientRegistrationStore.get(clientId, request);
    final Set<String> scope = Utils.splitScope(request.<String>getParameter(SCOPE));
    //plugin point
    final Set<String> validatedScope = providerSettings.validateAuthorizationScope(clientRegistration, scope, request);
    // is resource owner authenticated?
    final ResourceOwner resourceOwner = resourceOwnerSessionValidator.validate(request);
    final boolean consentSaved = providerSettings.isConsentSaved(resourceOwner, clientRegistration.getClientId(), validatedScope);
    //plugin point
    final boolean haveConsent = consentVerifier.verify(consentSaved, request, clientRegistration);
    if (!haveConsent) {
        String localeParameter = request.getParameter(LOCALE);
        String uiLocaleParameter = request.getParameter(UI_LOCALES);
        Locale locale = getLocale(uiLocaleParameter, localeParameter);
        if (locale == null) {
            locale = request.getLocale();
        }
        UserInfoClaims userInfo = null;
        try {
            userInfo = providerSettings.getUserInfo(request.getToken(AccessToken.class), request);
        } catch (UnauthorizedClientException e) {
            logger.debug("Couldn't get user info - continuing to display consent page without claims.", e);
        }
        String clientName = clientRegistration.getDisplayName(locale);
        if (clientName == null) {
            clientName = clientRegistration.getClientId();
            logger.warn("Client does not have a display name or client name set. using client ID {} for display", clientName);
        }
        final String displayDescription = clientRegistration.getDisplayDescription(locale);
        final String clientDescription = displayDescription == null ? "" : displayDescription;
        final Map<String, String> scopeDescriptions = getScopeDescriptions(validatedScope, clientRegistration.getScopeDescriptions(locale));
        final Map<String, String> claimDescriptions = getClaimDescriptions(userInfo.getValues(), clientRegistration.getClaimDescriptions(locale));
        throw new ResourceOwnerConsentRequired(clientName, clientDescription, scopeDescriptions, claimDescriptions, userInfo, resourceOwner.getName(providerSettings));
    }
    return tokenIssuer.issueTokens(request, clientRegistration, resourceOwner, scope, providerSettings);
}

Example 5 with AccessDeniedException

use of org.forgerock.oauth2.core.exceptions.AccessDeniedException in project OpenAM by OpenRock.

the class DeviceCodeVerificationResource method saveConsent.

private void saveConsent(OAuth2Request request) throws NotFoundException, ServerException, InvalidScopeException, AccessDeniedException, ResourceOwnerAuthenticationRequired, InteractionRequiredException, BadRequestException, LoginRequiredException, InvalidClientException {
    OAuth2ProviderSettings providerSettings = providerSettingsFactory.get(request);
    ResourceOwner resourceOwner = resourceOwnerSessionValidator.validate(request);
    ClientRegistration clientRegistration = clientRegistrationStore.get(request.<String>getParameter(CLIENT_ID), request);
    Set<String> scope = Utils.splitScope(request.<String>getParameter(SCOPE));
    Set<String> validatedScope = providerSettings.validateAuthorizationScope(clientRegistration, scope, request);
    providerSettings.saveConsent(resourceOwner, clientRegistration.getClientId(), validatedScope);
}