Examples with INVALID_REQUEST_OBJECT org.keycloak.OAuthErrorException.INVALID_REQUEST_OBJECT used on opensource projects

Example 1 with INVALID_REQUEST_OBJECT

use of org.keycloak.OAuthErrorException.INVALID_REQUEST_OBJECT in project keycloak by keycloak.

the class SecureRequestObjectExecutor method executeOnAuthorizationRequest.

private void executeOnAuthorizationRequest(AuthorizationRequestContext context) throws ClientPolicyException {
    logger.trace("Authz Endpoint - authz request");
    MultivaluedMap<String, String> params = context.getRequestParameters();
    if (params == null) {
        logger.trace("request parameter not exist.");
        throwClientPolicyException(OAuthErrorException.INVALID_REQUEST, "Missing parameters", context);
    }
    String requestParam = params.getFirst(OIDCLoginProtocol.REQUEST_PARAM);
    String requestUriParam = params.getFirst(OIDCLoginProtocol.REQUEST_URI_PARAM);
    // check whether whether request object exists
    if (requestParam == null && requestUriParam == null) {
        logger.trace("request object not exist.");
        throwClientPolicyException(OAuthErrorException.INVALID_REQUEST, "Missing parameter: 'request' or 'request_uri'", context);
    }
    JsonNode requestObject = (JsonNode) session.getAttribute(AuthzEndpointRequestParser.AUTHZ_REQUEST_OBJECT);
    // check whether request object exists
    if (requestObject == null || requestObject.isEmpty()) {
        logger.trace("request object not exist.");
        throwClientPolicyException(OAuthErrorException.INVALID_REQUEST, "Invalid parameter: : 'request' or 'request_uri'", context);
    }
    // check whether scope exists in both query parameter and request object
    if (params.getFirst(OIDCLoginProtocol.SCOPE_PARAM) == null && requestObject.get(OIDCLoginProtocol.SCOPE_PARAM) == null) {
        logger.trace("scope object not exist.");
        throwClientPolicyException(OAuthErrorException.INVALID_REQUEST, "Parameter 'scope' missing in the request parameters or in 'request' object", context);
    }
    // check whether "exp" claim exists
    if (requestObject.get("exp") == null) {
        logger.trace("exp claim not incuded.");
        throwClientPolicyException(INVALID_REQUEST_OBJECT, "Missing parameter in the 'request' object: exp", context);
    }
    // check whether request object not expired
    long exp = requestObject.get("exp").asLong();
    if (Time.currentTime() > exp) {
        // TODO: Time.currentTime() is int while exp is long...
        logger.trace("request object expired.");
        throw new ClientPolicyException(INVALID_REQUEST_OBJECT, "Request Expired");
    }
    // while needed for FAPI 1.0 Advanced security profile
    if (Optional.ofNullable(configuration.isVerifyNbf()).orElse(Boolean.FALSE).booleanValue()) {
        // check whether "nbf" claim exists
        if (requestObject.get("nbf") == null) {
            logger.trace("nbf claim not incuded.");
            throwClientPolicyException(INVALID_REQUEST_OBJECT, "Missing parameter in the 'request' object: nbf", context);
        }
        // check whether request object not yet being processed
        long nbf = requestObject.get("nbf").asLong();
        if (Time.currentTime() < nbf) {
            // TODO: Time.currentTime() is int while nbf is long...
            logger.trace("request object not yet being processed.");
            throwClientPolicyException(INVALID_REQUEST_OBJECT, "Request not yet being processed", context);
        }
        // check whether request object's available period is short
        int availablePeriod = Optional.ofNullable(configuration.getAvailablePeriod()).orElse(DEFAULT_AVAILABLE_PERIOD).intValue();
        if (exp - nbf > availablePeriod) {
            logger.trace("request object's available period is long.");
            throwClientPolicyException(INVALID_REQUEST_OBJECT, "Request's available period is long", context);
        }
    }
    // check whether "aud" claim exists
    List<String> aud = new ArrayList<String>();
    JsonNode audience = requestObject.get("aud");
    if (audience == null) {
        logger.trace("aud claim not incuded.");
        throwClientPolicyException(INVALID_REQUEST_OBJECT, "Missing parameter in the 'request' object: aud", context);
    }
    if (audience.isArray()) {
        for (JsonNode node : audience) aud.add(node.asText());
    } else {
        aud.add(audience.asText());
    }
    if (aud.isEmpty()) {
        logger.trace("aud claim not incuded.");
        throwClientPolicyException(INVALID_REQUEST_OBJECT, "Missing parameter value in the 'request' object: aud", context);
    }
    // check whether "aud" claim points to this keycloak as authz server
    String iss = Urls.realmIssuer(session.getContext().getUri().getBaseUri(), session.getContext().getRealm().getName());
    if (!aud.contains(iss)) {
        logger.trace("aud not points to the intended realm.");
        throwClientPolicyException(INVALID_REQUEST_OBJECT, "Invalid parameter in the 'request' object: aud", context);
    }
    // confirm whether all parameters in query string are included in the request object, and have the same values
    // argument "request" are parameters overridden by parameters in request object
    Optional<String> incorrectParam = AuthzEndpointRequestParser.KNOWN_REQ_PARAMS.stream().filter(param -> params.containsKey(param)).filter(param -> !isSameParameterIncluded(param, params.getFirst(param), requestObject)).findFirst();
    if (incorrectParam.isPresent()) {
        logger.warnf("Parameter '%s' does not have same value in 'request' object and in request parameters", incorrectParam.get());
        throwClientPolicyException(OAuthErrorException.INVALID_REQUEST, "Invalid parameter. Parameters in 'request' object not matching with request parameters", context);
    }
    Boolean encryptionRequired = Optional.ofNullable(configuration.isEncryptionRequired()).orElse(Boolean.FALSE);
    if (encryptionRequired && session.getAttribute(AuthzEndpointRequestParser.AUTHZ_REQUEST_OBJECT_ENCRYPTED) == null) {
        logger.trace("request object's not encrypted.");
        throw new ClientPolicyException(INVALID_REQUEST_OBJECT, "Request object not encrypted");
    }
    logger.trace("Passed.");
}