Examples with OrcidUnauthorizedException org.orcid.core.exception.OrcidUnauthorizedException used on opensource projects

Example 11 with OrcidUnauthorizedException

use of org.orcid.core.exception.OrcidUnauthorizedException in project ORCID-Source by ORCID.

the class OrcidSecurityManagerImpl method getOrcidFromToken.

@Override
public String getOrcidFromToken() {
    OAuth2Authentication oAuth2Authentication = getOAuth2Authentication();
    if (oAuth2Authentication == null) {
        throw new OrcidUnauthorizedException("No OAuth2 authentication found");
    }
    checkScopes(ScopePathType.AUTHENTICATE);
    Authentication userAuthentication = oAuth2Authentication.getUserAuthentication();
    if (userAuthentication != null) {
        Object principal = userAuthentication.getPrincipal();
        if (principal instanceof ProfileEntity) {
            ProfileEntity profileEntity = (ProfileEntity) principal;
            return profileEntity.getId();
        } else {
            throw new OrcidUnauthorizedException("Missing user authentication");
        }
    } else {
        throw new IllegalStateException("Non client credential scope found in client request");
    }
}

Example 12 with OrcidUnauthorizedException

use of org.orcid.core.exception.OrcidUnauthorizedException in project ORCID-Source by ORCID.

the class OrcidSecurityManagerImpl method isMyToken.

private void isMyToken(String orcid) {
    OAuth2Authentication oAuth2Authentication = getOAuth2Authentication();
    if (oAuth2Authentication == null) {
        throw new OrcidUnauthorizedException("No OAuth2 authentication found");
    }
    // Verify the client is not a public client
    checkClientType();
    String clientId = sourceManager.retrieveSourceOrcid();
    ProfileEntity profile = profileEntityCacheManager.retrieve(orcid);
    Authentication userAuthentication = oAuth2Authentication.getUserAuthentication();
    if (userAuthentication != null) {
        Object principal = userAuthentication.getPrincipal();
        if (principal instanceof ProfileEntity) {
            ProfileEntity profileEntity = (ProfileEntity) principal;
            if (!orcid.equals(profileEntity.getId())) {
                throw new OrcidUnauthorizedException("Access token is for a different record");
            }
        } else {
            throw new OrcidUnauthorizedException("Missing user authentication");
        }
    } else if (isNonClientCredentialScope(oAuth2Authentication) && !clientIsProfileSource(clientId, profile)) {
        throw new IllegalStateException("Non client credential scope found in client request");
    }
}

Example 13 with OrcidUnauthorizedException

use of org.orcid.core.exception.OrcidUnauthorizedException in project ORCID-Source by ORCID.

the class OrcidSecurityManagerImpl method checkAndFilter.

@Override
public void checkAndFilter(String orcid, WorkBulk workBulk, ScopePathType scopePathType) {
    isMyToken(orcid);
    List<BulkElement> bulkElements = workBulk.getBulk();
    List<BulkElement> filteredElements = new ArrayList<>();
    for (int i = 0; i < bulkElements.size(); i++) {
        BulkElement element = bulkElements.get(i);
        if (element instanceof OrcidError) {
            filteredElements.add(element);
            continue;
        }
        try {
            checkAndFilter(orcid, (Work) element, scopePathType, true);
            filteredElements.add(element);
        } catch (Exception e) {
            if (e instanceof OrcidUnauthorizedException) {
                throw e;
            }
            OrcidError error = orcidCoreExceptionMapper.getV3OrcidError(e);
            filteredElements.add(error);
        }
    }
    workBulk.setBulk(filteredElements);
}

Example 14 with OrcidUnauthorizedException

use of org.orcid.core.exception.OrcidUnauthorizedException in project ORCID-Source by ORCID.

the class MemberV3ApiServiceDelegator_BiogrphyTest method testReadPublicScope_Biography.

@Test
public void testReadPublicScope_Biography() {
    SecurityContextTestUtils.setUpSecurityContext(ORCID, ScopePathType.READ_PUBLIC);
    Response r = serviceDelegator.viewBiography(ORCID);
    assertNotNull(r);
    assertEquals(Biography.class.getName(), r.getEntity().getClass().getName());
    try {
        // Bio for 0000-0000-0000-0002 should be limited
        String otherOrcid = "0000-0000-0000-0002";
        r = serviceDelegator.viewBiography(otherOrcid);
        fail();
    } catch (OrcidUnauthorizedException e) {
    }
}

Example 15 with OrcidUnauthorizedException

use of org.orcid.core.exception.OrcidUnauthorizedException in project ORCID-Source by ORCID.

the class SelfServiceController method checkAccess.

private void checkAccess(String memberId) {
    List<String> usersAuthorizedAccountIds = salesForceManager.retrieveAccountIdsByOrcid(sourceManager.retrieveSourceOrcid());
    MemberDetails memberDetails = salesForceManager.retrieveDetails(memberId);
    if (!(usersAuthorizedAccountIds.contains(memberId) || usersAuthorizedAccountIds.contains(memberDetails.getMember().getConsortiumLeadId()))) {
        throw new OrcidUnauthorizedException("You are not authorized for account ID = " + memberId);
    }
}