Examples with ServerException org.forgerock.oauth2.core.exceptions.ServerException used on opensource projects

Example 1 with ServerException

use of org.forgerock.oauth2.core.exceptions.ServerException in project OpenAM by OpenRock.

the class OpenAMOpenIdConnectClientRegistrationService method createRegistration.

/**
     * {@inheritDoc}
     */
public JsonValue createRegistration(String accessToken, String deploymentUrl, OAuth2Request request) throws InvalidRedirectUri, InvalidClientMetadata, ServerException, UnsupportedResponseTypeException, AccessDeniedException, NotFoundException, InvalidPostLogoutRedirectUri {
    final OAuth2ProviderSettings providerSettings = providerSettingsFactory.get(request);
    if (!providerSettings.isOpenDynamicClientRegistrationAllowed()) {
        if (!tokenVerifier.verify(request).isValid()) {
            throw new AccessDeniedException("Access Token not valid");
        }
    }
    final JsonValue input = request.getBody();
    //check input to ensure it is valid
    Set<String> inputKeys = input.keys();
    for (String key : inputKeys) {
        OAuth2Constants.ShortClientAttributeNames keyName = fromString(key);
        if (keyName == null) {
            logger.warn("Unknown input given. Key: " + key);
        }
    }
    //create client given input
    ClientBuilder clientBuilder = new ClientBuilder();
    try {
        boolean jwks = false;
        if (input.get(JWKS.getType()).asString() != null) {
            jwks = true;
            try {
                JsonValueBuilder.toJsonValue(input.get(JWKS.getType()).asString());
            } catch (JsonException e) {
                throw new InvalidClientMetadata("jwks must be valid JSON.");
            }
            clientBuilder.setJwks(input.get(JWKS.getType()).asString());
            clientBuilder.setPublicKeySelector(Client.PublicKeySelector.JWKS.getType());
        }
        if (input.get(JWKS_URI.getType()).asString() != null) {
            if (jwks) {
                //allowed to set either jwks or jwks_uri but not both
                throw new InvalidClientMetadata("Must define either jwks or jwks_uri, not both.");
            }
            jwks = true;
            try {
                new URL(input.get(JWKS_URI.getType()).asString());
            } catch (MalformedURLException e) {
                throw new InvalidClientMetadata("jwks_uri must be a valid URL.");
            }
            clientBuilder.setJwksUri(input.get(JWKS_URI.getType()).asString());
            clientBuilder.setPublicKeySelector(Client.PublicKeySelector.JWKS_URI.getType());
        }
        //not spec-defined, this is OpenAM proprietary
        if (input.get(X509.getType()).asString() != null) {
            clientBuilder.setX509(input.get(X509.getType()).asString());
        }
        //drop to this if neither other are set
        if (!jwks) {
            clientBuilder.setPublicKeySelector(Client.PublicKeySelector.X509.getType());
        }
        if (input.get(TOKEN_ENDPOINT_AUTH_METHOD.getType()).asString() != null) {
            if (Client.TokenEndpointAuthMethod.fromString(input.get(TOKEN_ENDPOINT_AUTH_METHOD.getType()).asString()) == null) {
                logger.error("Invalid token_endpoint_auth_method requested.");
                throw new InvalidClientMetadata("Invalid token_endpoint_auth_method requested.");
            }
            clientBuilder.setTokenEndpointAuthMethod(input.get(TOKEN_ENDPOINT_AUTH_METHOD.getType()).asString());
        } else {
            clientBuilder.setTokenEndpointAuthMethod(Client.TokenEndpointAuthMethod.CLIENT_SECRET_BASIC.getType());
        }
        if (input.get(CLIENT_ID.getType()).asString() != null) {
            clientBuilder.setClientID(input.get(CLIENT_ID.getType()).asString());
        } else {
            clientBuilder.setClientID(UUID.randomUUID().toString());
        }
        if (input.get(CLIENT_SECRET.getType()).asString() != null) {
            clientBuilder.setClientSecret(input.get(CLIENT_SECRET.getType()).asString());
        } else {
            clientBuilder.setClientSecret(UUID.randomUUID().toString());
        }
        if (input.get(CLIENT_TYPE.getType()).asString() != null) {
            if (Client.ClientType.fromString(input.get(CLIENT_TYPE.getType()).asString()) != null) {
                clientBuilder.setClientType(input.get(CLIENT_TYPE.getType()).asString());
            } else {
                logger.error("Invalid client_type requested.");
                throw new InvalidClientMetadata("Invalid client_type requested");
            }
        } else {
            clientBuilder.setClientType(Client.ClientType.CONFIDENTIAL.getType());
        }
        if (input.get(DEFAULT_MAX_AGE.getType()).asLong() != null) {
            clientBuilder.setDefaultMaxAge(input.get(DEFAULT_MAX_AGE.getType()).asLong());
            clientBuilder.setDefaultMaxAgeEnabled(true);
        } else {
            clientBuilder.setDefaultMaxAge(Client.MIN_DEFAULT_MAX_AGE);
            clientBuilder.setDefaultMaxAgeEnabled(false);
        }
        List<String> redirectUris = new ArrayList<String>();
        if (input.get(REDIRECT_URIS.getType()).asList() != null) {
            redirectUris = input.get(REDIRECT_URIS.getType()).asList(String.class);
            boolean isValidUris = true;
            for (String redirectUri : redirectUris) {
                try {
                    urlValidator.validate(redirectUri);
                } catch (ValidationException e) {
                    isValidUris = false;
                    logger.error("The redirectUri: " + redirectUri + " is invalid.");
                }
            }
            if (!isValidUris) {
                throw new InvalidRedirectUri();
            }
            clientBuilder.setRedirectionURIs(redirectUris);
        }
        if (input.get(SECTOR_IDENTIFIER_URI.getType()).asString() != null) {
            try {
                URL sectorIdentifier = new URL(input.get(SECTOR_IDENTIFIER_URI.getType()).asString());
                List<String> response = mapper.readValue(sectorIdentifier, List.class);
                if (!response.containsAll(redirectUris)) {
                    logger.error("Request_uris not included in sector_identifier_uri.");
                    throw new InvalidClientMetadata();
                }
            } catch (Exception e) {
                logger.error("Invalid sector_identifier_uri requested.");
                throw new InvalidClientMetadata("Invalid sector_identifier_uri requested.");
            }
            clientBuilder.setSectorIdentifierUri(input.get(SECTOR_IDENTIFIER_URI.getType()).asString());
        }
        List<String> scopes = input.get(SCOPES.getType()).asList(String.class);
        if (scopes != null && !scopes.isEmpty()) {
            if (!containsAllCaseInsensitive(providerSettings.getSupportedScopes(), scopes)) {
                logger.error("Invalid scopes requested.");
                throw new InvalidClientMetadata("Invalid scopes requested");
            }
        } else {
            //if nothing requested, fall back to provider defaults
            scopes = new ArrayList<String>();
            scopes.addAll(providerSettings.getDefaultScopes());
        }
        //regardless, we add openid
        if (!scopes.contains(OPENID)) {
            scopes = new ArrayList<String>(scopes);
            scopes.add(OPENID);
        }
        clientBuilder.setAllowedGrantScopes(scopes);
        List<String> defaultScopes = input.get(DEFAULT_SCOPES.getType()).asList(String.class);
        if (defaultScopes != null) {
            if (containsAllCaseInsensitive(providerSettings.getSupportedScopes(), defaultScopes)) {
                clientBuilder.setDefaultGrantScopes(defaultScopes);
            } else {
                throw new InvalidClientMetadata("Invalid default scopes requested.");
            }
        }
        List<String> clientNames = new ArrayList<String>();
        Set<String> keys = input.keys();
        for (String key : keys) {
            if (key.equals(CLIENT_NAME.getType())) {
                clientNames.add(input.get(key).asString());
            } else if (key.startsWith(CLIENT_NAME.getType())) {
                try {
                    Locale locale = new Locale(key.substring(CLIENT_NAME.getType().length() + 1));
                    clientNames.add(locale.toString() + "|" + input.get(key).asString());
                } catch (Exception e) {
                    logger.error("Invalid locale for client_name.");
                    throw new InvalidClientMetadata("Invalid locale for client_name.");
                }
            }
        }
        if (clientNames != null) {
            clientBuilder.setClientName(clientNames);
        }
        if (input.get(CLIENT_DESCRIPTION.getType()).asList() != null) {
            clientBuilder.setDisplayDescription(input.get(CLIENT_DESCRIPTION.getType()).asList(String.class));
        }
        if (input.get(SUBJECT_TYPE.getType()).asString() != null) {
            if (providerSettings.getSupportedSubjectTypes().contains(input.get(SUBJECT_TYPE.getType()).asString())) {
                clientBuilder.setSubjectType(input.get(SUBJECT_TYPE.getType()).asString());
            } else {
                logger.error("Invalid subject_type requested.");
                throw new InvalidClientMetadata("Invalid subject_type requested");
            }
        } else {
            clientBuilder.setSubjectType(Client.SubjectType.PUBLIC.getType());
        }
        if (input.get(ID_TOKEN_SIGNED_RESPONSE_ALG.getType()).asString() != null) {
            if (containsCaseInsensitive(providerSettings.getSupportedIDTokenSigningAlgorithms(), input.get(ID_TOKEN_SIGNED_RESPONSE_ALG.getType()).asString())) {
                clientBuilder.setIdTokenSignedResponseAlgorithm(input.get(ID_TOKEN_SIGNED_RESPONSE_ALG.getType()).asString());
            } else {
                logger.error("Unsupported id_token_response_signed_alg requested.");
                throw new InvalidClientMetadata("Unsupported id_token_response_signed_alg requested.");
            }
        } else {
            clientBuilder.setIdTokenSignedResponseAlgorithm(ID_TOKEN_SIGNED_RESPONSE_ALG_DEFAULT);
        }
        if (input.get(POST_LOGOUT_REDIRECT_URIS.getType()).asList() != null) {
            List<String> logoutRedirectUris = input.get(POST_LOGOUT_REDIRECT_URIS.getType()).asList(String.class);
            boolean isValidUris = true;
            for (String logoutRedirectUri : logoutRedirectUris) {
                try {
                    urlValidator.validate(logoutRedirectUri);
                } catch (ValidationException e) {
                    isValidUris = false;
                    logger.error("The post_logout_redirect_uris: {} is invalid.", logoutRedirectUri);
                }
            }
            if (!isValidUris) {
                throw new InvalidPostLogoutRedirectUri();
            }
            clientBuilder.setPostLogoutRedirectionURIs(logoutRedirectUris);
        }
        if (input.get(REGISTRATION_ACCESS_TOKEN.getType()).asString() != null) {
            clientBuilder.setAccessToken(input.get(REGISTRATION_ACCESS_TOKEN.getType()).asString());
        } else {
            clientBuilder.setAccessToken(accessToken);
        }
        if (input.get(CLIENT_SESSION_URI.getType()).asString() != null) {
            clientBuilder.setClientSessionURI(input.get(CLIENT_SESSION_URI.getType()).asString());
        }
        if (input.get(APPLICATION_TYPE.getType()).asString() != null) {
            if (Client.ApplicationType.fromString(input.get(APPLICATION_TYPE.getType()).asString()) != null) {
                clientBuilder.setApplicationType(Client.ApplicationType.WEB.getType());
            } else {
                logger.error("Invalid application_type requested.");
                throw new InvalidClientMetadata("Invalid application_type requested.");
            }
        } else {
            clientBuilder.setApplicationType(DEFAULT_APPLICATION_TYPE);
        }
        if (input.get(DISPLAY_NAME.getType()).asList() != null) {
            clientBuilder.setDisplayName(input.get(DISPLAY_NAME.getType()).asList(String.class));
        }
        if (input.get(RESPONSE_TYPES.getType()).asList() != null) {
            final List<String> clientResponseTypeList = input.get(RESPONSE_TYPES.getType()).asList(String.class);
            final List<String> typeList = new ArrayList<String>();
            for (String responseType : clientResponseTypeList) {
                typeList.addAll(Arrays.asList(responseType.split(" ")));
            }
            if (containsAllCaseInsensitive(providerSettings.getAllowedResponseTypes().keySet(), typeList)) {
                clientBuilder.setResponseTypes(clientResponseTypeList);
            } else {
                logger.error("Invalid response_types requested.");
                throw new InvalidClientMetadata("Invalid response_types requested.");
            }
        } else {
            List<String> defaultResponseTypes = new ArrayList<String>();
            defaultResponseTypes.add("code");
            clientBuilder.setResponseTypes(defaultResponseTypes);
        }
        if (input.get(AUTHORIZATION_CODE_LIFE_TIME.getType()).asLong() != null) {
            clientBuilder.setAuthorizationCodeLifeTime(input.get(AUTHORIZATION_CODE_LIFE_TIME.getType()).asLong());
        } else {
            clientBuilder.setAuthorizationCodeLifeTime(0L);
        }
        if (input.get(ACCESS_TOKEN_LIFE_TIME.getType()).asLong() != null) {
            clientBuilder.setAccessTokenLifeTime(input.get(ACCESS_TOKEN_LIFE_TIME.getType()).asLong());
        } else {
            clientBuilder.setAccessTokenLifeTime(0L);
        }
        if (input.get(REFRESH_TOKEN_LIFE_TIME.getType()).asLong() != null) {
            clientBuilder.setRefreshTokenLifeTime(input.get(REFRESH_TOKEN_LIFE_TIME.getType()).asLong());
        } else {
            clientBuilder.setRefreshTokenLifeTime(0L);
        }
        if (input.get(JWT_TOKEN_LIFE_TIME.getType()).asLong() != null) {
            clientBuilder.setJwtTokenLifeTime(input.get(JWT_TOKEN_LIFE_TIME.getType()).asLong());
        } else {
            clientBuilder.setJwtTokenLifeTime(0L);
        }
        if (input.get(CONTACTS.getType()).asList() != null) {
            clientBuilder.setContacts(input.get(CONTACTS.getType()).asList(String.class));
        }
    } catch (JsonValueException e) {
        logger.error("Unable to build client.", e);
        throw new InvalidClientMetadata();
    }
    Client client = clientBuilder.createClient();
    // See OPENAM-3604 and http://openid.net/specs/openid-connect-registration-1_0.html#ClientRegistration
    if (providerSettings.isRegistrationAccessTokenGenerationEnabled() && !client.hasAccessToken()) {
        client.setAccessToken(createRegistrationAccessToken(client, request));
    }
    clientDAO.create(client, request);
    // have some visibility on who is registering clients.
    if (logger.isInfoEnabled()) {
        logger.info("Registered OpenID Connect client: " + client.getClientID() + ", name=" + client.getClientName() + ", type=" + client.getClientType());
    }
    Map<String, Object> response = client.asMap();
    response = convertClientReadResponseFormat(response);
    response.put(REGISTRATION_CLIENT_URI, deploymentUrl + "/oauth2/connect/register?client_id=" + client.getClientID());
    response.put(EXPIRES_AT, 0);
    return new JsonValue(response);
}

Example 2 with ServerException

use of org.forgerock.oauth2.core.exceptions.ServerException in project OpenAM by OpenRock.

the class CodeResponseType method createToken.

public CoreToken createToken(Token accessToken, Map<String, Object> data) throws NotFoundException {
    final Set<String> scope = (Set<String>) data.get(OAuth2Constants.CoreTokenParams.SCOPE);
    final OAuth2Request request = requestFactory.create(Request.getCurrent());
    final ResourceOwner resourceOwner = ownerAuthenticator.authenticate(request, true);
    final String clientId = (String) data.get(OAuth2Constants.CoreTokenParams.CLIENT_ID);
    final String redirectUri = (String) data.get(OAuth2Constants.CoreTokenParams.REDIRECT_URI);
    final String nonce = (String) data.get(OAuth2Constants.Custom.NONCE);
    final String codeChallenge = (String) data.get(OAuth2Constants.Custom.CODE_CHALLENGE);
    final String codeChallengeMethod = (String) data.get(OAuth2Constants.Custom.CODE_CHALLENGE_METHOD);
    try {
        final Map.Entry<String, Token> tokenEntry = handler.handle(null, scope, resourceOwner, clientId, redirectUri, nonce, request, codeChallenge, codeChallengeMethod);
        return new LegacyAuthorizationTokenAdapter((AuthorizationCode) tokenEntry.getValue());
    } catch (ServerException e) {
        throw OAuthProblemException.OAuthError.SERVER_ERROR.handle(Request.getCurrent(), e.getMessage());
    }
}

Example 3 with ServerException

use of org.forgerock.oauth2.core.exceptions.ServerException in project OpenAM by OpenRock.

the class IDTokenResponseType method createToken.

public CoreToken createToken(org.forgerock.oauth2.core.Token accessToken, Map<String, Object> data) throws NotFoundException {
    final OAuth2Request request = requestFactory.create(Request.getCurrent());
    final ResourceOwner resourceOwner = ownerAuthenticator.authenticate(request, true);
    final String clientId = (String) data.get(OAuth2Constants.CoreTokenParams.CLIENT_ID);
    final String nonce = (String) data.get(OAuth2Constants.Custom.NONCE);
    final String codeChallenge = (String) data.get(OAuth2Constants.Custom.CODE_CHALLENGE);
    final String codeChallengeMethod = (String) data.get(OAuth2Constants.Custom.CODE_CHALLENGE_METHOD);
    try {
        final Map.Entry<String, Token> tokenEntry = handler.handle(null, null, resourceOwner, clientId, null, nonce, request, codeChallenge, codeChallengeMethod);
        return new LegacyJwtTokenAdapter((OpenIdConnectToken) tokenEntry.getValue());
    } catch (InvalidClientException e) {
        throw OAuthProblemException.OAuthError.INVALID_CLIENT.handle(Request.getCurrent(), e.getMessage());
    } catch (ServerException e) {
        throw OAuthProblemException.OAuthError.SERVER_ERROR.handle(Request.getCurrent(), e.getMessage());
    }
}

Example 4 with ServerException

use of org.forgerock.oauth2.core.exceptions.ServerException in project OpenAM by OpenRock.

the class TokenResource method getExpiryDate.

private String getExpiryDate(JsonValue token, Context context) throws CoreTokenException, InternalServerErrorException, NotFoundException {
    OAuth2ProviderSettings oAuth2ProviderSettings;
    final String realm = getAttributeValue(token, "realm");
    try {
        oAuth2ProviderSettings = oAuth2ProviderSettingsFactory.get(realm);
    } catch (org.forgerock.oauth2.core.exceptions.NotFoundException e) {
        throw new NotFoundException(e.getMessage());
    }
    try {
        if (token.isDefined("refreshToken")) {
            if (oAuth2ProviderSettings.issueRefreshTokensOnRefreshingToken()) {
                return getIndefinitelyString(context);
            } else {
                //Use refresh token expiry
                JsonValue refreshToken = tokenStore.read(getAttributeValue(token, "refreshToken"));
                long expiryTimeInMilliseconds = Long.parseLong(getAttributeValue(refreshToken, EXPIRE_TIME_KEY));
                if (expiryTimeInMilliseconds == -1) {
                    return getIndefinitelyString(context);
                }
                return getDateFormat(context).format(new Date(expiryTimeInMilliseconds));
            }
        } else {
            //Use access token expiry
            long expiryTimeInMilliseconds = Long.parseLong(getAttributeValue(token, EXPIRE_TIME_KEY));
            return getDateFormat(context).format(new Date(expiryTimeInMilliseconds));
        }
    } catch (ServerException | SMSException | SSOException e) {
        throw new InternalServerErrorException(e);
    }
}

Example 5 with ServerException

use of org.forgerock.oauth2.core.exceptions.ServerException in project OpenAM by OpenRock.

the class OAuth2UserApplications method query.

/**
     * Allows users to query OAuth2 applications that they have given their consent access to and that have active
     * access and/or refresh tokens.
     *
     * <p>Applications consist of an id, a name (the client id), a set of scopes and an expiry time. The scopes field
     * is the union of the scopes of the individual access/refresh tokens. The expiry time is the time when the last
     * access/refresh token will expire, or null if the server is configured to allow tokens to be refreshed
     * indefinitely.</p>
     *
     * @param context The request context.
     * @param queryHandler The query handler.
     * @param request Unused but necessary for used of the {@link @Query} annotation.
     * @return A promise of a query response.
     */
@Query
public Promise<QueryResponse, ResourceException> query(Context context, QueryResourceHandler queryHandler, QueryRequest request) {
    String userId = contextHelper.getUserId(context);
    String realm = contextHelper.getRealm(context);
    try {
        QueryFilter<CoreTokenField> queryFilter = getQueryFilter(userId, realm);
        JsonValue tokens = tokenStore.query(queryFilter);
        Map<String, Set<JsonValue>> applicationTokensMap = new HashMap<>();
        for (JsonValue token : tokens) {
            String clientId = getAttributeValue(token, CLIENT_ID.getOAuthField());
            Set<JsonValue> applicationTokens = applicationTokensMap.get(clientId);
            if (applicationTokens == null) {
                applicationTokens = new HashSet<>();
                applicationTokensMap.put(clientId, applicationTokens);
            }
            applicationTokens.add(token);
        }
        for (Map.Entry<String, Set<JsonValue>> applicationTokens : applicationTokensMap.entrySet()) {
            ResourceResponse resource = getResourceResponse(context, applicationTokens.getKey(), applicationTokens.getValue());
            queryHandler.handleResource(resource);
        }
        return Promises.newResultPromise(Responses.newQueryResponse());
    } catch (CoreTokenException | ServerException | InvalidClientException | NotFoundException e) {
        debug.message("Failed to query OAuth2 clients for user {}", userId, e);
        return new InternalServerErrorException(e).asPromise();
    } catch (InternalServerErrorException e) {
        debug.message("Failed to query OAuth2 clients for user {}", userId, e);
        return e.asPromise();
    }
}