Examples with PushedAuthorizationRequestContext org.keycloak.protocol.oidc.par.clientpolicy.context.PushedAuthorizationRequestContext used on opensource projects

Example 1 with PushedAuthorizationRequestContext

use of org.keycloak.protocol.oidc.par.clientpolicy.context.PushedAuthorizationRequestContext in project keycloak by keycloak.

the class ParEndpoint method request.

@Path("/")
@POST
@Consumes(MediaType.APPLICATION_FORM_URLENCODED)
@Produces(MediaType.APPLICATION_JSON)
public Response request() {
    ProfileHelper.requireFeature(Profile.Feature.PAR);
    cors = Cors.add(httpRequest).auth().allowedMethods("POST").auth().exposedHeaders(Cors.ACCESS_CONTROL_ALLOW_METHODS);
    event.event(EventType.PUSHED_AUTHORIZATION_REQUEST);
    checkSsl();
    checkRealm();
    authorizeClient();
    if (httpRequest.getDecodedFormParameters().containsKey(REQUEST_URI_PARAM)) {
        throw throwErrorResponseException(OAuthErrorException.INVALID_REQUEST, "It is not allowed to include request_uri to PAR.", Response.Status.BAD_REQUEST);
    }
    try {
        authorizationRequest = AuthorizationEndpointRequestParserProcessor.parseRequest(event, session, client, httpRequest.getDecodedFormParameters());
    } catch (Exception e) {
        throw throwErrorResponseException(OAuthErrorException.INVALID_REQUEST_OBJECT, e.getMessage(), Response.Status.BAD_REQUEST);
    }
    AuthorizationEndpointChecker checker = new AuthorizationEndpointChecker().event(event).client(client).realm(realm).request(authorizationRequest).session(session);
    try {
        checker.checkRedirectUri();
    } catch (AuthorizationEndpointChecker.AuthorizationCheckException ex) {
        throw throwErrorResponseException(OAuthErrorException.INVALID_REQUEST, "Invalid parameter: redirect_uri", Response.Status.BAD_REQUEST);
    }
    try {
        checker.checkResponseType();
    } catch (AuthorizationEndpointChecker.AuthorizationCheckException ex) {
        if (ex.getError().equals(OAuthErrorException.UNSUPPORTED_RESPONSE_TYPE)) {
            throw throwErrorResponseException(OAuthErrorException.INVALID_REQUEST, "Unsupported response type", Response.Status.BAD_REQUEST);
        } else {
            ex.throwAsCorsErrorResponseException(cors);
        }
    }
    try {
        checker.checkValidScope();
    } catch (AuthorizationEndpointChecker.AuthorizationCheckException ex) {
        // PAR throws this as "invalid_request" error
        throw throwErrorResponseException(OAuthErrorException.INVALID_REQUEST, ex.getErrorDescription(), Response.Status.BAD_REQUEST);
    }
    try {
        checker.checkInvalidRequestMessage();
        checker.checkOIDCRequest();
        checker.checkOIDCParams();
        checker.checkPKCEParams();
    } catch (AuthorizationEndpointChecker.AuthorizationCheckException ex) {
        ex.throwAsCorsErrorResponseException(cors);
    }
    try {
        session.clientPolicy().triggerOnEvent(new PushedAuthorizationRequestContext(authorizationRequest, httpRequest.getDecodedFormParameters()));
    } catch (ClientPolicyException cpe) {
        throw throwErrorResponseException(cpe.getError(), cpe.getErrorDetail(), Response.Status.BAD_REQUEST);
    }
    Map<String, String> params = new HashMap<>();
    UUID key = UUID.randomUUID();
    String requestUri = REQUEST_URI_PREFIX + key.toString();
    int expiresIn = realm.getParPolicy().getRequestUriLifespan();
    httpRequest.getDecodedFormParameters().forEach((k, v) -> {
        // PAR store only accepts Map so that MultivaluedMap needs to be converted to Map.
        String singleValue = String.valueOf(v).replace("[", "").replace("]", "");
        params.put(k, singleValue);
    });
    params.put(PAR_CREATED_TIME, String.valueOf(System.currentTimeMillis()));
    PushedAuthzRequestStoreProvider parStore = session.getProvider(PushedAuthzRequestStoreProvider.class);
    parStore.put(key, expiresIn, params);
    ParResponse parResponse = new ParResponse(requestUri, expiresIn);
    session.getProvider(SecurityHeadersProvider.class).options().allowEmptyContentType();
    return cors.builder(Response.status(Response.Status.CREATED).entity(parResponse).type(MediaType.APPLICATION_JSON_TYPE)).build();
}