use of org.wso2.carbon.apimgt.rest.integration.tests.store.auth.OAuth in project core-util by WSO2Telco.
the class OAuthApplicationDataStubFactory method passivateObject.
/**
* This is used to clean up the OAuth validation stub and releases to the object pool.
*
* @param o object that needs to be released.
* @throws Exception throws when failed to release to the pool
*/
@Override
public void passivateObject(Object o) throws Exception {
if (o instanceof OAuthAdminServiceStub) {
OAuthAdminServiceStub stub = (OAuthAdminServiceStub) o;
stub._getServiceClient().cleanupTransport();
}
}
use of org.wso2.carbon.apimgt.rest.integration.tests.store.auth.OAuth in project airavata by apache.
the class DefaultOAuthClient method validateAccessToken.
/**
* Validates the OAuth 2.0 access token
*
* @param accessToken
* @return
* @throws Exception
*/
public OAuth2TokenValidationResponseDTO validateAccessToken(String accessToken) throws AiravataSecurityException {
try {
OAuth2TokenValidationRequestDTO oauthReq = new OAuth2TokenValidationRequestDTO();
OAuth2TokenValidationRequestDTO_OAuth2AccessToken token = new OAuth2TokenValidationRequestDTO_OAuth2AccessToken();
token.setIdentifier(accessToken);
token.setTokenType(BEARER_TOKEN_TYPE);
oauthReq.setAccessToken(token);
return stub.validate(oauthReq);
} catch (RemoteException e) {
logger.error(e.getMessage(), e);
throw new AiravataSecurityException("Error in validating the OAuth access token.");
}
}
use of org.wso2.carbon.apimgt.rest.integration.tests.store.auth.OAuth in project airavata by apache.
the class SecureClient method main.
public static void main(String[] args) throws Exception {
Scanner scanner = new Scanner(System.in);
// register client or use existing client
System.out.println("");
System.out.println("Please select from the following options:");
System.out.println("1. Register the client as an OAuth application.");
System.out.println("2. Client is already registered. Use the existing credentials.");
String opInput = scanner.next();
int option = Integer.valueOf(opInput.trim());
String consumerId = null;
String consumerSecret = null;
if (option == 1) {
// register OAuth application - this happens once during initialization of the gateway.
/**
**********************Start obtaining input from user****************************
*/
System.out.println("");
System.out.println("Registering an OAuth application representing the client....");
System.out.println("Please enter following information as you prefer, or use defaults.");
System.out.println("OAuth application name: (default:" + Properties.appName + ", press 'd' to use default value.)");
String appNameInput = scanner.next();
String appName = null;
if (appNameInput.trim().equals("d")) {
appName = Properties.appName;
} else {
appName = appNameInput.trim();
}
System.out.println("Consumer Id: (default:" + Properties.consumerID + ", press 'd' to use default value.)");
String consumerIdInput = scanner.next();
if (consumerIdInput.trim().equals("d")) {
consumerId = Properties.consumerID;
} else {
consumerId = consumerIdInput.trim();
}
System.out.println("Consumer Secret: (default:" + Properties.consumerSecret + ", press 'd' to use default value.)");
String consumerSecInput = scanner.next();
if (consumerSecInput.trim().equals("d")) {
consumerSecret = Properties.consumerSecret;
} else {
consumerSecret = consumerSecInput.trim();
}
/**
********************* Perform registration of the client as an OAuth app**************************
*/
try {
ConfigurationContext configContext = ConfigurationContextFactory.createConfigurationContextFromFileSystem(null, null);
OAuthAppRegisteringClient authAppRegisteringClient = new OAuthAppRegisteringClient(Properties.oauthAuthzServerURL, Properties.adminUserName, Properties.adminPassword, configContext);
OAuthConsumerAppDTO appDTO = authAppRegisteringClient.registerApplication(appName, consumerId, consumerSecret);
/**
******************* Complete registering the client **********************************************
*/
System.out.println("");
System.out.println("Registered OAuth app successfully. Following is app's details:");
System.out.println("App Name: " + appDTO.getApplicationName());
System.out.println("Consumer ID: " + appDTO.getOauthConsumerKey());
System.out.println("Consumer Secret: " + appDTO.getOauthConsumerSecret());
System.out.println("");
} catch (AiravataSecurityException e) {
e.printStackTrace();
throw e;
} catch (Exception e) {
e.printStackTrace();
throw e;
}
} else if (option == 2) {
System.out.println("");
System.out.println("Enter Consumer Id: ");
consumerId = scanner.next().trim();
System.out.println("Enter Consumer Secret: ");
consumerSecret = scanner.next().trim();
}
// obtain OAuth access token
/**
**********************Start obtaining input from user****************************
*/
System.out.println("");
System.out.println("Please select the preferred grant type: (or press d to use the default option" + Properties.grantType + ")");
System.out.println("1. Resource Owner Password Credential.");
System.out.println("2. Client Credential.");
String grantTypeInput = scanner.next().trim();
int grantType = 0;
if (grantTypeInput.equals("d")) {
grantType = Properties.grantType;
} else {
grantType = Integer.valueOf(grantTypeInput);
}
String userName = null;
String password = null;
if (grantType == 1) {
System.out.println("Obtaining OAuth access token via 'Resource Owner Password' grant type....");
System.out.println("Please enter following information as you prefer, or use defaults.");
System.out.println("End user's name: (default:" + Properties.userName + ", press 'd' to use default value.)");
String userNameInput = scanner.next();
if (userNameInput.trim().equals("d")) {
userName = Properties.userName;
} else {
userName = userNameInput.trim();
}
System.out.println("End user's password: (default:" + Properties.password + ", press 'd' to use default value.)");
String passwordInput = scanner.next();
if (passwordInput.trim().equals("d")) {
password = Properties.password;
} else {
password = passwordInput.trim();
}
} else if (grantType == 2) {
System.out.println("");
System.out.println("Please enter the user name to be passed: ");
String userNameInput = scanner.next();
userName = userNameInput.trim();
System.out.println("");
System.out.println("Obtaining OAuth access token via 'Client Credential' grant type...' grant type....");
}
/**
*************************** Finish obtaining input from user******************************************
*/
try {
// obtain the OAuth token for the specified end user.
String accessToken = new OAuthTokenRetrievalClient().retrieveAccessToken(consumerId, consumerSecret, userName, password, grantType);
System.out.println("");
System.out.println("OAuth access token is: " + accessToken);
// invoke Airavata API by the SecureClient, on behalf of the user.
System.out.println("");
System.out.println("Invoking Airavata API...");
System.out.println("Enter the access token to be used: (default:" + accessToken + ", press 'd' to use default value.)");
String accessTokenInput = scanner.next();
String acTk = null;
if (accessTokenInput.trim().equals("d")) {
acTk = accessToken;
} else {
acTk = accessTokenInput.trim();
}
// obtain as input, the method to be invoked
System.out.println("");
System.out.println("Enter the number corresponding to the method to be invoked: ");
System.out.println("1. getAPIVersion");
System.out.println("2. getAllAppModules");
System.out.println("3. addGateway");
String methodNumberString = scanner.next();
int methodNumber = Integer.valueOf(methodNumberString.trim());
Airavata.Client client = createAiravataClient(Properties.SERVER_HOST, Properties.SERVER_PORT);
AuthzToken authzToken = new AuthzToken();
authzToken.setAccessToken(acTk);
Map<String, String> claimsMap = new HashMap<>();
claimsMap.put("userName", userName);
claimsMap.put("email", "hasini@gmail.com");
authzToken.setClaimsMap(claimsMap);
if (methodNumber == 1) {
String version = client.getAPIVersion(authzToken);
System.out.println("");
System.out.println("Airavata API version: " + version);
System.out.println("");
} else if (methodNumber == 2) {
System.out.println("");
System.out.println("Enter the gateway id: ");
String gatewayId = scanner.next().trim();
List<ApplicationModule> appModules = client.getAllAppModules(authzToken, gatewayId);
System.out.println("Output of getAllAppModuels: ");
for (ApplicationModule appModule : appModules) {
System.out.println(appModule.getAppModuleName());
}
System.out.println("");
System.out.println("");
} else if (methodNumber == 3) {
System.out.println("");
System.out.println("Enter the gateway id: ");
String gatewayId = scanner.next().trim();
Gateway gateway = new Gateway(gatewayId, GatewayApprovalStatus.REQUESTED);
gateway.setDomain("airavata.org");
gateway.setEmailAddress("airavata@apache.org");
gateway.setGatewayName("airavataGW");
String output = client.addGateway(authzToken, gateway);
System.out.println("");
System.out.println("Output of addGateway: " + output);
System.out.println("");
}
} catch (InvalidRequestException e) {
e.printStackTrace();
} catch (TException e) {
e.printStackTrace();
} catch (AiravataSecurityException e) {
e.printStackTrace();
}
}
use of org.wso2.carbon.apimgt.rest.integration.tests.store.auth.OAuth in project airavata by apache.
the class DefaultAiravataSecurityManager method isUserAuthorized.
public boolean isUserAuthorized(AuthzToken authzToken, Map<String, String> metaData) throws AiravataSecurityException {
try {
String subject = authzToken.getClaimsMap().get(Constants.USER_NAME);
String accessToken = authzToken.getAccessToken();
String gatewayId = authzToken.getClaimsMap().get(Constants.GATEWAY_ID);
String action = metaData.get(Constants.API_METHOD_NAME);
// if the authz cache is enabled, check in the cache if the authz decision is cached and if so, what the status is
if (ServerSettings.isAuthzCacheEnabled()) {
// obtain an instance of AuthzCacheManager implementation.
AuthzCacheManager authzCacheManager = AuthzCacheManagerFactory.getAuthzCacheManager();
// check in the cache
AuthzCachedStatus authzCachedStatus = authzCacheManager.getAuthzCachedStatus(new AuthzCacheIndex(subject, gatewayId, accessToken, action));
if (AuthzCachedStatus.AUTHORIZED.equals(authzCachedStatus)) {
logger.debug("Authz decision for: (" + subject + ", " + accessToken + ", " + action + ") is retrieved from cache.");
return true;
} else if (AuthzCachedStatus.NOT_AUTHORIZED.equals(authzCachedStatus)) {
logger.debug("Authz decision for: (" + subject + ", " + accessToken + ", " + action + ") is retrieved from cache.");
return false;
} else if (AuthzCachedStatus.NOT_CACHED.equals(authzCachedStatus)) {
logger.debug("Authz decision for: (" + subject + ", " + accessToken + ", " + action + ") is not in the cache. " + "Obtaining it from the authorization server.");
CredentialStoreService.Client csClient = getCredentialStoreServiceClient();
GatewayResourceProfile gwrp = getRegistryServiceClient().getGatewayResourceProfile(gatewayId);
PasswordCredential credential = csClient.getPasswordCredential(gwrp.getIdentityServerPwdCredToken(), gwrp.getGatewayID());
String username = credential.getLoginUserName();
if (gwrp.getIdentityServerTenant() != null && !gwrp.getIdentityServerTenant().isEmpty())
username = username + "@" + gwrp.getIdentityServerTenant();
String password = credential.getPassword();
// talk to Authorization Server, obtain the decision, cache it and return the result.
ConfigurationContext configContext = ConfigurationContextFactory.createConfigurationContextFromFileSystem(null, null);
// initialize SSL context with the trust store that contains the public cert of WSO2 Identity Server.
TrustStoreManager trustStoreManager = new TrustStoreManager();
trustStoreManager.initializeTrustStoreManager(ServerSettings.getTrustStorePath(), ServerSettings.getTrustStorePassword());
DefaultOAuthClient oauthClient = new DefaultOAuthClient(ServerSettings.getRemoteAuthzServerUrl(), username, password, configContext);
OAuth2TokenValidationResponseDTO validationResponse = oauthClient.validateAccessToken(authzToken.getAccessToken());
if (validationResponse.getValid()) {
String authorizedUserName = validationResponse.getAuthorizedUser();
if (authorizedUserName.contains("@")) {
authorizedUserName = authorizedUserName.split("@")[0];
}
if (subject.contains("@")) {
subject = subject.split("@")[0];
}
// cannot impersonate users
if (!authorizedUserName.toLowerCase().equals(subject.toLowerCase()))
return false;
long expiryTimestamp = validationResponse.getExpiryTime();
// check for fine grained authorization for the API invocation, based on XACML.
DefaultXACMLPEP entitlementClient = new DefaultXACMLPEP(ServerSettings.getRemoteAuthzServerUrl(), username, password, configContext);
boolean authorizationDecision = entitlementClient.getAuthorizationDecision(authzToken, metaData);
// cache the authorization decision
authzCacheManager.addToAuthzCache(new AuthzCacheIndex(subject, gatewayId, accessToken, action), new AuthzCacheEntry(authorizationDecision, expiryTimestamp, System.currentTimeMillis()));
return authorizationDecision;
} else {
return false;
}
} else {
// undefined status returned from the authz cache manager
throw new AiravataSecurityException("Error in reading from the authorization cache.");
}
} else {
CredentialStoreService.Client csClient = getCredentialStoreServiceClient();
GatewayResourceProfile gwrp = getRegistryServiceClient().getGatewayResourceProfile(gatewayId);
PasswordCredential credential = csClient.getPasswordCredential(gwrp.getIdentityServerPwdCredToken(), gwrp.getGatewayID());
String username = credential.getLoginUserName();
if (gwrp.getIdentityServerTenant() != null && !gwrp.getIdentityServerTenant().isEmpty())
username = username + "@" + gwrp.getIdentityServerTenant();
String password = credential.getPassword();
// talk to Authorization Server, obtain the decision and return the result (authz cache is not enabled).
ConfigurationContext configContext = ConfigurationContextFactory.createConfigurationContextFromFileSystem(null, null);
// initialize SSL context with the trust store that contains the public cert of WSO2 Identity Server.
TrustStoreManager trustStoreManager = new TrustStoreManager();
trustStoreManager.initializeTrustStoreManager(ServerSettings.getTrustStorePath(), ServerSettings.getTrustStorePassword());
DefaultOAuthClient oauthClient = new DefaultOAuthClient(ServerSettings.getRemoteAuthzServerUrl(), username, password, configContext);
OAuth2TokenValidationResponseDTO validationResponse = oauthClient.validateAccessToken(authzToken.getAccessToken());
boolean isOAuthTokenValid = validationResponse.getValid();
// if XACML based authorization is enabled, check for role based authorization for the API invocation
DefaultXACMLPEP entitlementClient = new DefaultXACMLPEP(ServerSettings.getRemoteAuthzServerUrl(), username, password, configContext);
boolean authorizationDecision = entitlementClient.getAuthorizationDecision(authzToken, metaData);
return (isOAuthTokenValid && authorizationDecision);
}
} catch (AxisFault axisFault) {
logger.error(axisFault.getMessage(), axisFault);
throw new AiravataSecurityException("Error in initializing the configuration context for creating the OAuth validation client.");
} catch (ApplicationSettingsException e) {
logger.error(e.getMessage(), e);
throw new AiravataSecurityException("Error in reading OAuth server configuration.");
} catch (RegistryServiceException e) {
logger.error(e.getMessage(), e);
throw new AiravataSecurityException("Error in accessing AppCatalog.");
} catch (TException e) {
logger.error(e.getMessage(), e);
throw new AiravataSecurityException("Error in connecting to Credential Store Service.");
}
}
use of org.wso2.carbon.apimgt.rest.integration.tests.store.auth.OAuth in project product-iots by wso2.
the class OAuthUtil method getOAuthTokenPair.
public static JSONObject getOAuthTokenPair(String backendHTTPURL, String backendHTTPSURL) throws Exception {
String AuthString = "Basic YWRtaW46YWRtaW4=";
RestClient client = new RestClient(backendHTTPURL, Constants.APPLICATION_JSON, AuthString);
HttpResponse oAuthData = client.post(Constants.APIApplicationRegistration.API_APP_REGISTRATION_ENDPOINT, Constants.APIApplicationRegistration.API_APP_REGISTRATION_PAYLOAD);
JSONObject jsonObj = new JSONObject(oAuthData.getData());
String clientId = jsonObj.get(Constants.OAUTH_CLIENT_ID).toString();
String clientSecret = jsonObj.get(Constants.OAUTH_CLIENT_SECRET).toString();
byte[] bytesEncoded = Base64.encodeBase64((clientId + ":" + clientSecret).getBytes());
String basicAuthString = "Basic " + new String(bytesEncoded);
// Initiate a RestClient to get OAuth token
client = new RestClient(backendHTTPSURL, Constants.APPLICATION_URL_ENCODED, basicAuthString);
oAuthData = client.post(Constants.APIApplicationRegistration.TOKEN_ENDPOINT, Constants.APIApplicationRegistration.OAUTH_TOKEN_PAYLOAD);
jsonObj = new JSONObject(oAuthData.getData());
return jsonObj;
}
Aggregations