Examples with JEEContext org.pac4j.jee.context.JEEContext used on opensource projects

Example 26 with JEEContext

use of org.pac4j.jee.context.JEEContext in project cas by apereo.

the class OAuth20AuthorizeEndpointController method prepareAccessTokenRequestContext.

/**
 * Build access token request context.
 *
 * @param authzRequest      the authz request
 * @param registeredService the registered service
 * @param context           the context
 * @param service           the service
 * @param authentication    the authentication
 * @return the access token request context
 * @throws Exception the exception
 */
protected AccessTokenRequestContext prepareAccessTokenRequestContext(final OAuth20AuthorizationRequest authzRequest, final OAuthRegisteredService registeredService, final JEEContext context, final Service service, final Authentication authentication) throws Exception {
    var payloadBuilder = AccessTokenRequestContext.builder();
    if (authzRequest.isSingleSignOnSessionRequired()) {
        val tgt = getConfigurationContext().fetchTicketGrantingTicketFrom(context);
        payloadBuilder = payloadBuilder.ticketGrantingTicket(tgt);
    }
    val redirectUri = getConfigurationContext().getRequestParameterResolver().resolveRequestParameter(context, OAuth20Constants.REDIRECT_URI).map(String::valueOf).orElse(StringUtils.EMPTY);
    val grantType = context.getRequestParameter(OAuth20Constants.GRANT_TYPE).map(String::valueOf).orElseGet(OAuth20GrantTypes.AUTHORIZATION_CODE::getType).toUpperCase();
    val scopes = getConfigurationContext().getRequestParameterResolver().resolveRequestScopes(context);
    val codeChallenge = context.getRequestParameter(OAuth20Constants.CODE_CHALLENGE).map(String::valueOf).orElse(StringUtils.EMPTY);
    val challengeMethodsSupported = getConfigurationContext().getCasProperties().getAuthn().getOidc().getDiscovery().getCodeChallengeMethodsSupported();
    val codeChallengeMethod = context.getRequestParameter(OAuth20Constants.CODE_CHALLENGE_METHOD).map(String::valueOf).filter(challengeMethodsSupported::contains).orElse(StringUtils.EMPTY).toUpperCase();
    val userProfile = OAuth20Utils.getAuthenticatedUserProfile(context, getConfigurationContext().getSessionStore());
    val claims = getConfigurationContext().getRequestParameterResolver().resolveRequestClaims(context);
    val holder = payloadBuilder.service(service).authentication(authentication).registeredService(registeredService).grantType(getConfigurationContext().getRequestParameterResolver().resolveGrantType(context)).responseType(getConfigurationContext().getRequestParameterResolver().resolveResponseType(context)).codeChallenge(codeChallenge).codeChallengeMethod(codeChallengeMethod).scopes(scopes).clientId(authzRequest.getClientId()).redirectUri(redirectUri).userProfile(userProfile).claims(claims).responseMode(getConfigurationContext().getRequestParameterResolver().resolveResponseModeType(context)).build();
    context.getRequestParameters().keySet().forEach(key -> context.getRequestParameter(key).ifPresent(value -> holder.getParameters().put(key, value)));
    LOGGER.debug("Building authorization response for grant type [{}] with scopes [{}] for client id [{}]", grantType, scopes, authzRequest.getClientId());
    return holder;
}

Example 27 with JEEContext

use of org.pac4j.jee.context.JEEContext in project cas by apereo.

the class OAuth20AuthorizeEndpointController method buildAuthorizationForRequest.

/**
 * Build callback url for request string.
 *
 * @param registeredService the registered service
 * @param context           the context
 * @param service           the service
 * @param authentication    the authentication
 * @return the model and view
 */
protected ModelAndView buildAuthorizationForRequest(final OAuthRegisteredService registeredService, final JEEContext context, final Service service, final Authentication authentication) {
    val registeredBuilders = getConfigurationContext().getOauthAuthorizationResponseBuilders().getObject();
    val authzRequest = registeredBuilders.stream().filter(BeanSupplier::isNotProxy).sorted(OrderComparator.INSTANCE).map(builder -> toAuthorizationRequest(registeredService, context, service, authentication, builder)).filter(Objects::nonNull).filter(Optional::isPresent).findFirst().orElseThrow(() -> new IllegalArgumentException("Unable to build authorization request")).get().build();
    val payload = Optional.ofNullable(authzRequest.getAccessTokenRequest()).orElseGet(Unchecked.supplier(() -> prepareAccessTokenRequestContext(authzRequest, registeredService, context, service, authentication)));
    return registeredBuilders.stream().filter(BeanSupplier::isNotProxy).sorted(OrderComparator.INSTANCE).filter(b -> b.supports(authzRequest)).findFirst().map(Unchecked.function(builder -> {
        if (authzRequest.isSingleSignOnSessionRequired() && payload.getTicketGrantingTicket() == null) {
            val message = String.format("Missing ticket-granting-ticket for client id [%s] and service [%s]", authzRequest.getClientId(), registeredService.getName());
            LOGGER.error(message);
            return OAuth20Utils.produceErrorView(new PreventedException(message));
        }
        return builder.build(payload);
    })).orElseGet(() -> OAuth20Utils.produceErrorView(new PreventedException("Could not build the callback response")));
}

Example 28 with JEEContext

use of org.pac4j.jee.context.JEEContext in project cas by apereo.

the class OAuth20IntrospectionEndpointController method handlePostRequest.

/**
 * Handle post request.
 *
 * @param request  the request
 * @param response the response
 * @return the response entity
 */
@PostMapping(value = '/' + OAuth20Constants.BASE_OAUTH20_URL + '/' + OAuth20Constants.INTROSPECTION_URL)
public ResponseEntity<OAuth20IntrospectionAccessTokenResponse> handlePostRequest(final HttpServletRequest request, final HttpServletResponse response) {
    ResponseEntity<OAuth20IntrospectionAccessTokenResponse> result;
    try {
        val authExtractor = new BasicAuthExtractor();
        val context = new JEEContext(request, response);
        val credentialsResult = authExtractor.extract(context, getConfigurationContext().getSessionStore());
        if (credentialsResult.isEmpty()) {
            LOGGER.warn("Unable to locate and extract credentials from the request");
            return buildUnauthorizedResponseEntity(OAuth20Constants.INVALID_CLIENT, true);
        }
        val credentials = (UsernamePasswordCredentials) credentialsResult.get();
        val service = OAuth20Utils.getRegisteredOAuthServiceByClientId(getConfigurationContext().getServicesManager(), credentials.getUsername());
        if (service == null) {
            LOGGER.warn("Unable to locate service definition by client id [{}]", credentials.getUsername());
            return buildUnauthorizedResponseEntity(OAuth20Constants.INVALID_CLIENT, true);
        }
        val validationError = validateIntrospectionRequest(service, credentials, request);
        if (validationError.isPresent()) {
            result = validationError.get();
        } else {
            val accessToken = StringUtils.defaultIfBlank(request.getParameter(OAuth20Constants.TOKEN), request.getParameter(OAuth20Constants.ACCESS_TOKEN));
            LOGGER.debug("Located access token [{}] in the request", accessToken);
            OAuth20Token ticket = null;
            try {
                val token = extractAccessTokenFrom(accessToken);
                ticket = getConfigurationContext().getCentralAuthenticationService().getTicket(token, OAuth20Token.class);
            } catch (final InvalidTicketException e) {
                LOGGER.trace(e.getMessage(), e);
                LOGGER.info("Unable to fetch access token [{}]: [{}]", accessToken, e.getMessage());
            }
            val introspect = createIntrospectionValidResponse(ticket);
            introspect.setToken(accessToken);
            result = new ResponseEntity<>(introspect, HttpStatus.OK);
        }
    } catch (final Exception e) {
        LoggingUtils.error(LOGGER, e);
        result = new ResponseEntity<>(HttpStatus.INTERNAL_SERVER_ERROR);
    }
    return result;
}

Example 29 with JEEContext

use of org.pac4j.jee.context.JEEContext in project cas by apereo.

the class OAuth20HandlerInterceptorAdapter method clientNeedAuthentication.

/**
 * Is the client requesting is a OAuth "public" client?
 * An OAuth "public" client is one that does not define a secret like a mobile application.
 *
 * @param request  the request
 * @param response the response
 * @return true/false
 */
protected boolean clientNeedAuthentication(final HttpServletRequest request, final HttpServletResponse response) {
    val clientId = requestParameterResolver.getObject().resolveClientIdAndClientSecret(new JEEContext(request, response), this.sessionStore.getObject()).getLeft();
    if (clientId.isEmpty()) {
        return true;
    }
    val registeredService = OAuth20Utils.getRegisteredOAuthServiceByClientId(servicesManager.getObject(), clientId);
    return registeredService == null || OAuth20Utils.doesServiceNeedAuthentication(registeredService);
}

Example 30 with JEEContext

use of org.pac4j.jee.context.JEEContext in project cas by apereo.

the class OAuth20HandlerInterceptorAdapter method requestRequiresAuthentication.

/**
 * Request requires authentication.
 *
 * @param request  the request
 * @param response the response
 * @return true/false
 */
protected boolean requestRequiresAuthentication(final HttpServletRequest request, final HttpServletResponse response) {
    val context = new JEEContext(request, response);
    val revokeTokenRequest = isRevokeTokenRequest(request, response);
    if (revokeTokenRequest) {
        return clientNeedAuthentication(request, response);
    }
    val accessTokenRequest = isAccessTokenRequest(request, response);
    val extractor = extractAccessTokenGrantRequest(context);
    if (!accessTokenRequest) {
        if (extractor.isPresent()) {
            val ext = extractor.get();
            return ext.requestMustBeAuthenticated();
        }
    } else {
        if (extractor.isPresent()) {
            val ext = extractor.get();
            return ext.getResponseType() != OAuth20ResponseTypes.DEVICE_CODE;
        }
    }
    return false;
}