Examples with AuthorizationGrant org.xdi.oxauth.model.common.AuthorizationGrant used on opensource projects

Example 6 with AuthorizationGrant

use of org.xdi.oxauth.model.common.AuthorizationGrant in project oxAuth by GluuFederation.

the class EndSessionRestWebServiceImpl method auditLogging.

private void auditLogging(HttpServletRequest request, Pair<SessionState, AuthorizationGrant> pair) {
    SessionState sessionState = pair.getFirst();
    AuthorizationGrant authorizationGrant = pair.getSecond();
    OAuth2AuditLog oAuth2AuditLog = new OAuth2AuditLog(ServerUtil.getIpAddress(request), Action.SESSION_DESTROYED);
    oAuth2AuditLog.setSuccess(true);
    if (authorizationGrant != null) {
        oAuth2AuditLog.setClientId(authorizationGrant.getClientId());
        oAuth2AuditLog.setScope(StringUtils.join(authorizationGrant.getScopes(), " "));
        oAuth2AuditLog.setUsername(authorizationGrant.getUserId());
    } else {
        oAuth2AuditLog.setClientId(sessionState.getPermissionGrantedMap().getClientIds(true).toString());
        oAuth2AuditLog.setScope(sessionState.getSessionAttributes().get(AuthorizeRequestParam.SCOPE));
        oAuth2AuditLog.setUsername(sessionState.getUserDn());
    }
    applicationAuditLogger.sendMessage(oAuth2AuditLog);
}

Example 7 with AuthorizationGrant

use of org.xdi.oxauth.model.common.AuthorizationGrant in project oxAuth by GluuFederation.

the class TokenRestWebServiceImpl method requestAccessToken.

@Override
public Response requestAccessToken(String grantType, String code, String redirectUri, String username, String password, String scope, String assertion, String refreshToken, String oxAuthExchangeToken, String clientId, String clientSecret, String codeVerifier, HttpServletRequest request, SecurityContext sec) {
    log.debug("Attempting to request access token: grantType = {}, code = {}, redirectUri = {}, username = {}, refreshToken = {}, " + "clientId = {}, ExtraParams = {}, isSecure = {}, codeVerifier = {}", grantType, code, redirectUri, username, refreshToken, clientId, request.getParameterMap(), sec.isSecure(), codeVerifier);
    OAuth2AuditLog oAuth2AuditLog = new OAuth2AuditLog(ServerUtil.getIpAddress(request), Action.TOKEN_REQUEST);
    oAuth2AuditLog.setClientId(clientId);
    oAuth2AuditLog.setUsername(username);
    oAuth2AuditLog.setScope(scope);
    // it may be encoded in uma case
    scope = ServerUtil.urlDecode(scope);
    ResponseBuilder builder = Response.ok();
    try {
        log.debug("Starting to validate request parameters");
        if (!TokenParamsValidator.validateParams(grantType, code, redirectUri, username, password, scope, assertion, refreshToken, oxAuthExchangeToken)) {
            log.trace("Failed to validate request parameters");
            builder = error(400, TokenErrorResponseType.INVALID_REQUEST);
        } else {
            log.trace("Request parameters are right");
            GrantType gt = GrantType.fromString(grantType);
            log.debug("Grant type: '{}'", gt);
            SessionClient sessionClient = identity.getSetSessionClient();
            Client client = null;
            if (sessionClient != null) {
                client = sessionClient.getClient();
                log.debug("Get sessionClient: '{}'", sessionClient);
            }
            if (client != null) {
                log.debug("Get client from session: '{}'", client.getClientId());
            }
            if (gt == GrantType.AUTHORIZATION_CODE) {
                if (client == null) {
                    return response(error(400, TokenErrorResponseType.INVALID_GRANT));
                }
                log.debug("Attempting to find authorizationCodeGrant by clinetId: '{}', code: '{}'", client.getClientId(), code);
                AuthorizationCodeGrant authorizationCodeGrant = authorizationGrantList.getAuthorizationCodeGrant(client.getClientId(), code);
                log.trace("AuthorizationCodeGrant : '{}'", authorizationCodeGrant);
                if (authorizationCodeGrant != null) {
                    validatePKCE(authorizationCodeGrant, codeVerifier);
                    authorizationCodeGrant.setIsCachedWithNoPersistence(false);
                    authorizationCodeGrant.save();
                    AccessToken accToken = authorizationCodeGrant.createAccessToken();
                    log.debug("Issuing access token: {}", accToken.getCode());
                    RefreshToken reToken = authorizationCodeGrant.createRefreshToken();
                    if (scope != null && !scope.isEmpty()) {
                        scope = authorizationCodeGrant.checkScopesPolicy(scope);
                    }
                    IdToken idToken = null;
                    if (authorizationCodeGrant.getScopes().contains("openid")) {
                        String nonce = authorizationCodeGrant.getNonce();
                        boolean includeIdTokenClaims = Boolean.TRUE.equals(appConfiguration.getLegacyIdTokenClaims());
                        idToken = authorizationCodeGrant.createIdToken(nonce, null, accToken, authorizationCodeGrant, includeIdTokenClaims);
                    }
                    builder.entity(getJSonResponse(accToken, accToken.getTokenType(), accToken.getExpiresIn(), reToken, scope, idToken));
                    oAuth2AuditLog.updateOAuth2AuditLog(authorizationCodeGrant, true);
                    grantService.removeByCode(authorizationCodeGrant.getAuthorizationCode().getCode(), authorizationCodeGrant.getClientId());
                } else {
                    log.debug("AuthorizationCodeGrant is empty by clinetId: '{}', code: '{}'", client.getClientId(), code);
                    // if authorization code is not found then code was already used = remove all grants with this auth code
                    grantService.removeAllByAuthorizationCode(code);
                    builder = error(400, TokenErrorResponseType.INVALID_GRANT);
                }
            } else if (gt == GrantType.REFRESH_TOKEN) {
                if (client == null) {
                    return response(error(401, TokenErrorResponseType.INVALID_GRANT));
                }
                AuthorizationGrant authorizationGrant = authorizationGrantList.getAuthorizationGrantByRefreshToken(client.getClientId(), refreshToken);
                if (authorizationGrant != null) {
                    AccessToken accToken = authorizationGrant.createAccessToken();
                    /*
                        The authorization server MAY issue a new refresh token, in which case
                        the client MUST discard the old refresh token and replace it with the
                        new refresh token.
                        */
                    RefreshToken reToken = authorizationGrant.createRefreshToken();
                    grantService.removeByCode(refreshToken, client.getClientId());
                    if (scope != null && !scope.isEmpty()) {
                        scope = authorizationGrant.checkScopesPolicy(scope);
                    }
                    builder.entity(getJSonResponse(accToken, accToken.getTokenType(), accToken.getExpiresIn(), reToken, scope, null));
                    oAuth2AuditLog.updateOAuth2AuditLog(authorizationGrant, true);
                } else {
                    builder = error(401, TokenErrorResponseType.INVALID_GRANT);
                }
            } else if (gt == GrantType.CLIENT_CREDENTIALS) {
                if (client == null) {
                    return response(error(401, TokenErrorResponseType.INVALID_GRANT));
                }
                // TODO: fix the user arg
                ClientCredentialsGrant clientCredentialsGrant = authorizationGrantList.createClientCredentialsGrant(new User(), client);
                AccessToken accessToken = clientCredentialsGrant.createAccessToken();
                if (scope != null && !scope.isEmpty()) {
                    scope = clientCredentialsGrant.checkScopesPolicy(scope);
                }
                IdToken idToken = null;
                if (clientCredentialsGrant.getScopes().contains("openid")) {
                    boolean includeIdTokenClaims = Boolean.TRUE.equals(appConfiguration.getLegacyIdTokenClaims());
                    idToken = clientCredentialsGrant.createIdToken(null, null, null, clientCredentialsGrant, includeIdTokenClaims);
                }
                oAuth2AuditLog.updateOAuth2AuditLog(clientCredentialsGrant, true);
                builder.entity(getJSonResponse(accessToken, accessToken.getTokenType(), accessToken.getExpiresIn(), null, scope, idToken));
            } else if (gt == GrantType.RESOURCE_OWNER_PASSWORD_CREDENTIALS) {
                if (client == null) {
                    log.error("Invalid client", new RuntimeException("Client is empty"));
                    return response(error(401, TokenErrorResponseType.INVALID_CLIENT));
                }
                User user = null;
                if (authenticationFilterService.isEnabled()) {
                    String userDn = authenticationFilterService.processAuthenticationFilters(request.getParameterMap());
                    if (StringHelper.isNotEmpty(userDn)) {
                        user = userService.getUserByDn(userDn);
                    }
                }
                if (user == null) {
                    boolean authenticated = authenticationService.authenticate(username, password);
                    if (authenticated) {
                        user = authenticationService.getAuthenticatedUser();
                    }
                }
                if (user != null) {
                    ResourceOwnerPasswordCredentialsGrant resourceOwnerPasswordCredentialsGrant = authorizationGrantList.createResourceOwnerPasswordCredentialsGrant(user, client);
                    AccessToken accessToken = resourceOwnerPasswordCredentialsGrant.createAccessToken();
                    RefreshToken reToken = resourceOwnerPasswordCredentialsGrant.createRefreshToken();
                    if (scope != null && !scope.isEmpty()) {
                        scope = resourceOwnerPasswordCredentialsGrant.checkScopesPolicy(scope);
                    }
                    IdToken idToken = null;
                    if (resourceOwnerPasswordCredentialsGrant.getScopes().contains("openid")) {
                        boolean includeIdTokenClaims = Boolean.TRUE.equals(appConfiguration.getLegacyIdTokenClaims());
                        idToken = resourceOwnerPasswordCredentialsGrant.createIdToken(null, null, null, resourceOwnerPasswordCredentialsGrant, includeIdTokenClaims);
                    }
                    oAuth2AuditLog.updateOAuth2AuditLog(resourceOwnerPasswordCredentialsGrant, true);
                    builder.entity(getJSonResponse(accessToken, accessToken.getTokenType(), accessToken.getExpiresIn(), reToken, scope, idToken));
                } else {
                    log.error("Invalid user", new RuntimeException("User is empty"));
                    builder = error(401, TokenErrorResponseType.INVALID_CLIENT);
                }
            } else if (gt == GrantType.EXTENSION) {
                builder = error(501, TokenErrorResponseType.INVALID_GRANT);
            } else if (gt == GrantType.OXAUTH_EXCHANGE_TOKEN) {
                AuthorizationGrant authorizationGrant = authorizationGrantList.getAuthorizationGrantByAccessToken(oxAuthExchangeToken);
                if (authorizationGrant != null) {
                    final AccessToken accessToken = authorizationGrant.createLongLivedAccessToken();
                    oAuth2AuditLog.updateOAuth2AuditLog(authorizationGrant, true);
                    builder.entity(getJSonResponse(accessToken, accessToken.getTokenType(), accessToken.getExpiresIn(), null, null, null));
                } else {
                    builder = error(401, TokenErrorResponseType.INVALID_GRANT);
                }
            }
        }
    } catch (WebApplicationException e) {
        throw e;
    } catch (SignatureException e) {
        builder = Response.status(500);
        log.error(e.getMessage(), e);
    } catch (StringEncrypter.EncryptionException e) {
        builder = Response.status(500);
        log.error(e.getMessage(), e);
    } catch (InvalidJwtException e) {
        builder = Response.status(500);
        log.error(e.getMessage(), e);
    } catch (InvalidJweException e) {
        builder = Response.status(500);
        log.error(e.getMessage(), e);
    } catch (Exception e) {
        builder = Response.status(500);
        log.error(e.getMessage(), e);
    }
    applicationAuditLogger.sendMessage(oAuth2AuditLog);
    return response(builder);
}

Example 8 with AuthorizationGrant

use of org.xdi.oxauth.model.common.AuthorizationGrant in project oxAuth by GluuFederation.

the class UmaValidationService method validateAuthorization.

private AuthorizationGrant validateAuthorization(String authorization, UmaScopeType umaScopeType) {
    log.trace("Validate authorization: {}", authorization);
    if (StringHelper.isEmpty(authorization)) {
        throw new WebApplicationException(Response.status(UNAUTHORIZED).entity(errorResponseFactory.getUmaJsonErrorResponse(UNAUTHORIZED_CLIENT)).build());
    }
    String token = tokenService.getTokenFromAuthorizationParameter(authorization);
    if (StringHelper.isEmpty(token)) {
        log.debug("Token is invalid");
        throw new WebApplicationException(Response.status(UNAUTHORIZED).entity(errorResponseFactory.getUmaJsonErrorResponse(UNAUTHORIZED_CLIENT)).build());
    }
    AuthorizationGrant authorizationGrant = authorizationGrantList.getAuthorizationGrantByAccessToken(token);
    if (authorizationGrant == null) {
        throw new WebApplicationException(Response.status(UNAUTHORIZED).entity(errorResponseFactory.getUmaJsonErrorResponse(ACCESS_DENIED)).build());
    }
    if (!authorizationGrant.isValid()) {
        throw new WebApplicationException(Response.status(UNAUTHORIZED).entity(errorResponseFactory.getUmaJsonErrorResponse(INVALID_TOKEN)).build());
    }
    Set<String> scopes = authorizationGrant.getScopes();
    if (!scopes.contains(umaScopeType.getValue())) {
        throw new WebApplicationException(Response.status(Response.Status.NOT_ACCEPTABLE).entity(errorResponseFactory.getUmaJsonErrorResponse(UmaErrorResponseType.INVALID_CLIENT_SCOPE)).build());
    }
    return authorizationGrant;
}

Example 9 with AuthorizationGrant

use of org.xdi.oxauth.model.common.AuthorizationGrant in project oxAuth by GluuFederation.

the class AuthorizeRestWebServiceImpl method requestAuthorization.

public Response requestAuthorization(String scope, String responseType, String clientId, String redirectUri, String state, String respMode, String nonce, String display, String prompt, Integer maxAge, String uiLocalesStr, String idTokenHint, String loginHint, String acrValuesStr, String amrValuesStr, String request, String requestUri, String requestSessionState, String sessionState, String accessToken, String method, String originHeaders, String codeChallenge, String codeChallengeMethod, String customRespHeaders, HttpServletRequest httpRequest, HttpServletResponse httpResponse, SecurityContext securityContext) {
    // it may be encoded in uma case
    scope = ServerUtil.urlDecode(scope);
    OAuth2AuditLog oAuth2AuditLog = new OAuth2AuditLog(ServerUtil.getIpAddress(httpRequest), Action.USER_AUTHORIZATION);
    oAuth2AuditLog.setClientId(clientId);
    oAuth2AuditLog.setScope(scope);
    // ATTENTION : please do not add more parameter in this debug method because it will not work with Seam 2.2.2.Final ,
    // there is limit of 10 parameters (hardcoded), see: org.jboss.seam.core.Interpolator#interpolate
    log.debug("Attempting to request authorization: " + "responseType = {}, clientId = {}, scope = {}, redirectUri = {}, nonce = {}, " + "state = {}, request = {}, isSecure = {}, requestSessionState = {}, sessionState = {}", responseType, clientId, scope, redirectUri, nonce, state, request, securityContext.isSecure(), requestSessionState, sessionState);
    log.debug("Attempting to request authorization: " + "acrValues = {}, amrValues = {}, originHeaders = {}, codeChallenge = {}, codeChallengeMethod = {}", acrValuesStr, amrValuesStr, originHeaders, codeChallenge, codeChallengeMethod);
    ResponseBuilder builder = Response.ok();
    List<String> uiLocales = null;
    if (StringUtils.isNotBlank(uiLocalesStr)) {
        uiLocales = Util.splittedStringAsList(uiLocalesStr, " ");
    }
    List<ResponseType> responseTypes = ResponseType.fromString(responseType, " ");
    List<Prompt> prompts = Prompt.fromString(prompt, " ");
    List<String> acrValues = Util.splittedStringAsList(acrValuesStr, " ");
    List<String> amrValues = Util.splittedStringAsList(amrValuesStr, " ");
    ResponseMode responseMode = ResponseMode.getByValue(respMode);
    SessionState sessionUser = identity.getSessionState();
    User user = sessionUser != null && StringUtils.isNotBlank(sessionUser.getUserDn()) ? userService.getUserByDn(sessionUser.getUserDn()) : null;
    try {
        Map<String, String> customResponseHeaders = Util.jsonObjectArrayStringAsMap(customRespHeaders);
        sessionStateService.assertAuthenticatedSessionCorrespondsToNewRequest(sessionUser, acrValuesStr);
        if (!AuthorizeParamsValidator.validateParams(responseType, clientId, prompts, nonce, request, requestUri)) {
            if (clientId != null && redirectUri != null && redirectionUriService.validateRedirectionUri(clientId, redirectUri) != null) {
                RedirectUri redirectUriResponse = new RedirectUri(redirectUri, responseTypes, responseMode);
                redirectUriResponse.parseQueryString(errorResponseFactory.getErrorAsQueryString(AuthorizeErrorResponseType.INVALID_REQUEST, state));
                builder = RedirectUtil.getRedirectResponseBuilder(redirectUriResponse, httpRequest);
            } else {
                // 400
                builder = Response.status(Response.Status.BAD_REQUEST.getStatusCode());
                builder.entity(errorResponseFactory.getErrorAsJson(AuthorizeErrorResponseType.INVALID_REQUEST, state));
            }
        } else {
            Client client = clientService.getClient(clientId);
            if (CollectionUtils.isEmpty(acrValues) && client != null && !ArrayUtils.isEmpty(client.getDefaultAcrValues())) {
                acrValues = new ArrayList<String>();
                acrValues.addAll(Arrays.asList(client.getDefaultAcrValues()));
            }
            JwtAuthorizationRequest jwtAuthorizationRequest = null;
            if (client != null) {
                List<String> scopes = new ArrayList<String>();
                if (StringHelper.isNotEmpty(scope)) {
                    Set<String> grantedScopes = scopeChecker.checkScopesPolicy(client, scope);
                    scopes.addAll(grantedScopes);
                }
                // Validate redirectUri
                redirectUri = redirectionUriService.validateRedirectionUri(clientId, redirectUri);
                boolean validRedirectUri = redirectUri != null;
                if (AuthorizeParamsValidator.validateResponseTypes(responseTypes, client)) {
                    if (validRedirectUri) {
                        if (StringUtils.isNotBlank(accessToken)) {
                            AuthorizationGrant authorizationGrant = authorizationGrantList.getAuthorizationGrantByAccessToken(accessToken);
                            if (authorizationGrant == null) {
                                RedirectUri redirectUriResponse = new RedirectUri(redirectUri, responseTypes, responseMode);
                                redirectUriResponse.parseQueryString(errorResponseFactory.getErrorAsQueryString(AuthorizeErrorResponseType.ACCESS_DENIED, state));
                                builder = RedirectUtil.getRedirectResponseBuilder(redirectUriResponse, httpRequest);
                                applicationAuditLogger.sendMessage(oAuth2AuditLog);
                                return builder.build();
                            } else {
                                oAuth2AuditLog.setUsername(authorizationGrant.getUserId());
                                user = userService.getUser(authorizationGrant.getUserId());
                                sessionUser = sessionStateService.generateAuthenticatedSessionState(user.getDn(), prompt);
                                sessionUser.addPermission(client.getClientId(), true);
                            }
                        }
                        if (StringUtils.isNotBlank(requestUri)) {
                            boolean validRequestUri = false;
                            try {
                                URI reqUri = new URI(requestUri);
                                String reqUriHash = reqUri.getFragment();
                                String reqUriWithoutFragment = reqUri.getScheme() + ":" + reqUri.getSchemeSpecificPart();
                                ClientRequest clientRequest = new ClientRequest(reqUriWithoutFragment);
                                clientRequest.setHttpMethod(HttpMethod.GET);
                                ClientResponse<String> clientResponse = clientRequest.get(String.class);
                                int status = clientResponse.getStatus();
                                if (status == 200) {
                                    request = clientResponse.getEntity(String.class);
                                    if (StringUtils.isBlank(reqUriHash)) {
                                        validRequestUri = true;
                                    } else {
                                        String hash = Base64Util.base64urlencode(JwtUtil.getMessageDigestSHA256(request));
                                        validRequestUri = StringUtils.equals(reqUriHash, hash);
                                    }
                                }
                                if (validRequestUri) {
                                    requestUri = null;
                                } else {
                                    RedirectUri redirectUriResponse = new RedirectUri(redirectUri, responseTypes, responseMode);
                                    redirectUriResponse.parseQueryString(errorResponseFactory.getErrorAsQueryString(AuthorizeErrorResponseType.INVALID_REQUEST_URI, state));
                                    builder = RedirectUtil.getRedirectResponseBuilder(redirectUriResponse, httpRequest);
                                    applicationAuditLogger.sendMessage(oAuth2AuditLog);
                                    return builder.build();
                                }
                            } catch (URISyntaxException e) {
                                log.error(e.getMessage(), e);
                            } catch (UnknownHostException e) {
                                log.error(e.getMessage(), e);
                            } catch (ConnectException e) {
                                log.error(e.getMessage(), e);
                            } catch (Exception e) {
                                log.error(e.getMessage(), e);
                            }
                        }
                        boolean invalidOpenidRequestObject = false;
                        if (StringUtils.isNotBlank(request)) {
                            try {
                                jwtAuthorizationRequest = new JwtAuthorizationRequest(appConfiguration, request, client);
                                if (!jwtAuthorizationRequest.getResponseTypes().containsAll(responseTypes) || !responseTypes.containsAll(jwtAuthorizationRequest.getResponseTypes())) {
                                    throw new InvalidJwtException("The responseType parameter is not the same in the JWT");
                                } else if (jwtAuthorizationRequest.getClientId() != null && !jwtAuthorizationRequest.getClientId().equals(clientId)) {
                                    throw new InvalidJwtException("The clientId parameter is not the same in the JWT");
                                } else if (!jwtAuthorizationRequest.getScopes().containsAll(scopes) || !scopes.containsAll(jwtAuthorizationRequest.getScopes())) {
                                    throw new InvalidJwtException("The scope parameter is not the same in the JWT");
                                } else if (jwtAuthorizationRequest.getRedirectUri() != null && !jwtAuthorizationRequest.getRedirectUri().equals(redirectUri)) {
                                    throw new InvalidJwtException("The redirectUri parameter is not the same in the JWT");
                                } else if (jwtAuthorizationRequest.getState() != null && StringUtils.isNotBlank(state) && !jwtAuthorizationRequest.getState().equals(state)) {
                                    throw new InvalidJwtException("The state parameter is not the same in the JWT");
                                } else if (jwtAuthorizationRequest.getNonce() != null && StringUtils.isNotBlank(nonce) && !jwtAuthorizationRequest.getNonce().equals(nonce)) {
                                    throw new InvalidJwtException("The nonce parameter is not the same in the JWT");
                                } else if (jwtAuthorizationRequest.getDisplay() != null && StringUtils.isNotBlank(display) && !jwtAuthorizationRequest.getDisplay().getParamName().equals(display)) {
                                    throw new InvalidJwtException("The display parameter is not the same in the JWT");
                                } else if (!jwtAuthorizationRequest.getPrompts().isEmpty() && !prompts.isEmpty() && !jwtAuthorizationRequest.getPrompts().containsAll(prompts)) {
                                    throw new InvalidJwtException("The prompt parameter is not the same in the JWT");
                                } else if (jwtAuthorizationRequest.getIdTokenMember() != null && jwtAuthorizationRequest.getIdTokenMember().getMaxAge() != null && maxAge != null && !jwtAuthorizationRequest.getIdTokenMember().getMaxAge().equals(maxAge)) {
                                    throw new InvalidJwtException("The maxAge parameter is not the same in the JWT");
                                }
                            } catch (InvalidJwtException e) {
                                invalidOpenidRequestObject = true;
                                log.debug("Invalid JWT authorization request. Exception = {}, Message = {}", e, e.getClass().getName(), e.getMessage());
                            } catch (Exception e) {
                                invalidOpenidRequestObject = true;
                                log.debug("Invalid JWT authorization request. Exception = {}, Message = {}", e, e.getClass().getName(), e.getMessage());
                            }
                        }
                        if (invalidOpenidRequestObject) {
                            RedirectUri redirectUriResponse = new RedirectUri(redirectUri, responseTypes, responseMode);
                            redirectUriResponse.parseQueryString(errorResponseFactory.getErrorAsQueryString(AuthorizeErrorResponseType.INVALID_OPENID_REQUEST_OBJECT, state));
                            builder = RedirectUtil.getRedirectResponseBuilder(redirectUriResponse, httpRequest);
                        } else {
                            AuthorizationGrant authorizationGrant = null;
                            RedirectUri redirectUriResponse = new RedirectUri(redirectUri, responseTypes, responseMode);
                            if (jwtAuthorizationRequest != null && jwtAuthorizationRequest.getIdTokenMember() != null) {
                                Claim userIdClaim = jwtAuthorizationRequest.getIdTokenMember().getClaim(JwtClaimName.SUBJECT_IDENTIFIER);
                                if (userIdClaim != null && userIdClaim.getClaimValue() != null && userIdClaim.getClaimValue().getValue() != null) {
                                    String userIdClaimValue = userIdClaim.getClaimValue().getValue();
                                    if (user != null) {
                                        String userId = user.getUserId();
                                        if (!userId.equalsIgnoreCase(userIdClaimValue)) {
                                            redirectUriResponse.parseQueryString(errorResponseFactory.getErrorAsQueryString(AuthorizeErrorResponseType.USER_MISMATCHED, state));
                                            builder = RedirectUtil.getRedirectResponseBuilder(redirectUriResponse, httpRequest);
                                            applicationAuditLogger.sendMessage(oAuth2AuditLog);
                                            return builder.build();
                                        }
                                    }
                                }
                            }
                            if (user == null) {
                                identity.logout();
                                if (prompts.contains(Prompt.NONE)) {
                                    if (authenticationFilterService.isEnabled()) {
                                        Map<String, String> params;
                                        if (method.equals(HttpMethod.GET)) {
                                            params = QueryStringDecoder.decode(httpRequest.getQueryString());
                                        } else {
                                            params = getGenericRequestMap(httpRequest);
                                        }
                                        String userDn = authenticationFilterService.processAuthenticationFilters(params);
                                        if (userDn != null) {
                                            Map<String, String> genericRequestMap = getGenericRequestMap(httpRequest);
                                            Map<String, String> parameterMap = Maps.newHashMap(genericRequestMap);
                                            Map<String, String> requestParameterMap = authenticationService.getAllowedParameters(parameterMap);
                                            sessionUser = sessionStateService.generateAuthenticatedSessionState(userDn, prompt);
                                            sessionUser.setSessionAttributes(requestParameterMap);
                                            sessionStateService.createSessionStateCookie(sessionUser.getId(), httpResponse);
                                            sessionStateService.updateSessionState(sessionUser);
                                            user = userService.getUserByDn(sessionUser.getUserDn());
                                        } else {
                                            redirectUriResponse.parseQueryString(errorResponseFactory.getErrorAsQueryString(AuthorizeErrorResponseType.LOGIN_REQUIRED, state));
                                            builder = RedirectUtil.getRedirectResponseBuilder(redirectUriResponse, httpRequest);
                                            applicationAuditLogger.sendMessage(oAuth2AuditLog);
                                            return builder.build();
                                        }
                                    } else {
                                        redirectUriResponse.parseQueryString(errorResponseFactory.getErrorAsQueryString(AuthorizeErrorResponseType.LOGIN_REQUIRED, state));
                                        builder = RedirectUtil.getRedirectResponseBuilder(redirectUriResponse, httpRequest);
                                        applicationAuditLogger.sendMessage(oAuth2AuditLog);
                                        return builder.build();
                                    }
                                } else {
                                    if (prompts.contains(Prompt.LOGIN)) {
                                        endSession(sessionState, httpRequest, httpResponse);
                                        sessionState = null;
                                        prompts.remove(Prompt.LOGIN);
                                    }
                                    redirectToAuthorizationPage(redirectUriResponse, responseTypes, scope, clientId, redirectUri, state, responseMode, nonce, display, prompts, maxAge, uiLocales, idTokenHint, loginHint, acrValues, amrValues, request, requestUri, originHeaders, codeChallenge, codeChallengeMethod, sessionState);
                                    builder = RedirectUtil.getRedirectResponseBuilder(redirectUriResponse, httpRequest);
                                    applicationAuditLogger.sendMessage(oAuth2AuditLog);
                                    return builder.build();
                                }
                            }
                            oAuth2AuditLog.setUsername(user.getUserId());
                            ClientAuthorizations clientAuthorizations = clientAuthorizationsService.findClientAuthorizations(user.getAttribute("inum"), client.getClientId());
                            if (clientAuthorizations != null && clientAuthorizations.getScopes() != null && Arrays.asList(clientAuthorizations.getScopes()).containsAll(scopes)) {
                                sessionUser.addPermission(clientId, true);
                            }
                            if (prompts.contains(Prompt.NONE) && client.getTrustedClient()) {
                                sessionUser.addPermission(clientId, true);
                            }
                            if (prompts.contains(Prompt.LOGIN)) {
                                endSession(sessionState, httpRequest, httpResponse);
                                sessionState = null;
                                prompts.remove(Prompt.LOGIN);
                                redirectToAuthorizationPage(redirectUriResponse, responseTypes, scope, clientId, redirectUri, state, responseMode, nonce, display, prompts, maxAge, uiLocales, idTokenHint, loginHint, acrValues, amrValues, request, requestUri, originHeaders, codeChallenge, codeChallengeMethod, sessionState);
                                builder = RedirectUtil.getRedirectResponseBuilder(redirectUriResponse, httpRequest);
                                applicationAuditLogger.sendMessage(oAuth2AuditLog);
                                return builder.build();
                            }
                            if (prompts.contains(Prompt.CONSENT) || !sessionUser.isPermissionGrantedForClient(clientId)) {
                                prompts.remove(Prompt.CONSENT);
                                redirectToAuthorizationPage(redirectUriResponse, responseTypes, scope, clientId, redirectUri, state, responseMode, nonce, display, prompts, maxAge, uiLocales, idTokenHint, loginHint, acrValues, amrValues, request, requestUri, originHeaders, codeChallenge, codeChallengeMethod, sessionState);
                                builder = RedirectUtil.getRedirectResponseBuilder(redirectUriResponse, httpRequest);
                                applicationAuditLogger.sendMessage(oAuth2AuditLog);
                                return builder.build();
                            }
                            // OXAUTH-37 : Validate authentication max age
                            boolean validAuthenticationMaxAge = true;
                            Integer authenticationMaxAge = null;
                            if (maxAge != null) {
                                authenticationMaxAge = maxAge;
                            } else if (!invalidOpenidRequestObject && jwtAuthorizationRequest != null && jwtAuthorizationRequest.getIdTokenMember() != null && jwtAuthorizationRequest.getIdTokenMember().getMaxAge() != null) {
                                authenticationMaxAge = jwtAuthorizationRequest.getIdTokenMember().getMaxAge();
                            }
                            GregorianCalendar now = new GregorianCalendar(TimeZone.getTimeZone("UTC"));
                            GregorianCalendar userAuthenticationTime = new GregorianCalendar(TimeZone.getTimeZone("UTC"));
                            userAuthenticationTime.setTime(sessionUser.getAuthenticationTime());
                            if (authenticationMaxAge != null) {
                                userAuthenticationTime.add(Calendar.SECOND, authenticationMaxAge);
                                validAuthenticationMaxAge = userAuthenticationTime.after(now);
                            } else if (client.getDefaultMaxAge() != null) {
                                userAuthenticationTime.add(Calendar.SECOND, client.getDefaultMaxAge());
                                validAuthenticationMaxAge = userAuthenticationTime.after(now);
                            }
                            if (!validAuthenticationMaxAge) {
                                endSession(sessionState, httpRequest, httpResponse);
                                sessionState = null;
                                redirectToAuthorizationPage(redirectUriResponse, responseTypes, scope, clientId, redirectUri, state, responseMode, nonce, display, prompts, maxAge, uiLocales, idTokenHint, loginHint, acrValues, amrValues, request, requestUri, originHeaders, codeChallenge, codeChallengeMethod, sessionState);
                                builder = RedirectUtil.getRedirectResponseBuilder(redirectUriResponse, httpRequest);
                                applicationAuditLogger.sendMessage(oAuth2AuditLog);
                                return builder.build();
                            }
                            AuthorizationCode authorizationCode = null;
                            if (responseTypes.contains(ResponseType.CODE)) {
                                authorizationGrant = authorizationGrantList.createAuthorizationCodeGrant(user, client, sessionUser.getAuthenticationTime());
                                authorizationGrant.setNonce(nonce);
                                authorizationGrant.setJwtAuthorizationRequest(jwtAuthorizationRequest);
                                authorizationGrant.setScopes(scopes);
                                authorizationGrant.setCodeChallenge(codeChallenge);
                                authorizationGrant.setCodeChallengeMethod(codeChallengeMethod);
                                // Store acr_values
                                authorizationGrant.setAcrValues(acrValuesStr);
                                authorizationGrant.setSessionDn(sessionUser.getDn());
                                // call save after object modification!!!
                                authorizationGrant.save();
                                authorizationCode = authorizationGrant.getAuthorizationCode();
                                redirectUriResponse.addResponseParameter("code", authorizationCode.getCode());
                            }
                            AccessToken newAccessToken = null;
                            if (responseTypes.contains(ResponseType.TOKEN)) {
                                if (authorizationGrant == null) {
                                    authorizationGrant = authorizationGrantList.createImplicitGrant(user, client, sessionUser.getAuthenticationTime());
                                    authorizationGrant.setNonce(nonce);
                                    authorizationGrant.setJwtAuthorizationRequest(jwtAuthorizationRequest);
                                    authorizationGrant.setScopes(scopes);
                                    // Store acr_values
                                    authorizationGrant.setAcrValues(acrValuesStr);
                                    authorizationGrant.setSessionDn(sessionUser.getDn());
                                    // call save after object modification!!!
                                    authorizationGrant.save();
                                }
                                newAccessToken = authorizationGrant.createAccessToken();
                                redirectUriResponse.addResponseParameter(AuthorizeResponseParam.ACCESS_TOKEN, newAccessToken.getCode());
                                redirectUriResponse.addResponseParameter(AuthorizeResponseParam.TOKEN_TYPE, newAccessToken.getTokenType().toString());
                                redirectUriResponse.addResponseParameter(AuthorizeResponseParam.EXPIRES_IN, newAccessToken.getExpiresIn() + "");
                            }
                            if (responseTypes.contains(ResponseType.ID_TOKEN)) {
                                boolean includeIdTokenClaims = Boolean.TRUE.equals(appConfiguration.getLegacyIdTokenClaims());
                                if (authorizationGrant == null) {
                                    includeIdTokenClaims = true;
                                    authorizationGrant = authorizationGrantList.createAuthorizationGrant(user, client, sessionUser.getAuthenticationTime());
                                    authorizationGrant.setNonce(nonce);
                                    authorizationGrant.setJwtAuthorizationRequest(jwtAuthorizationRequest);
                                    authorizationGrant.setScopes(scopes);
                                    // Store authentication acr values
                                    authorizationGrant.setAcrValues(acrValuesStr);
                                    authorizationGrant.setSessionDn(sessionUser.getDn());
                                    // call save after object modification, call is asynchronous!!!
                                    authorizationGrant.save();
                                }
                                IdToken idToken = authorizationGrant.createIdToken(nonce, authorizationCode, newAccessToken, authorizationGrant, includeIdTokenClaims);
                                redirectUriResponse.addResponseParameter(AuthorizeResponseParam.ID_TOKEN, idToken.getCode());
                            }
                            if (authorizationGrant != null && StringHelper.isNotEmpty(acrValuesStr)) {
                                redirectUriResponse.addResponseParameter(AuthorizeResponseParam.ACR_VALUES, acrValuesStr);
                            }
                            //if (Boolean.valueOf(requestSessionState) && StringUtils.isBlank(sessionState) &&
                            if (sessionUser.getId() == null) {
                                final SessionState newSessionUser = sessionStateService.generateAuthenticatedSessionState(sessionUser.getUserDn(), prompt);
                                String newSessionState = newSessionUser.getId();
                                sessionUser.setId(newSessionState);
                                log.trace("newSessionState = {}", newSessionState);
                            }
                            redirectUriResponse.addResponseParameter(AuthorizeResponseParam.SESSION_STATE, sessionUser.getId());
                            redirectUriResponse.addResponseParameter(AuthorizeResponseParam.STATE, state);
                            if (scope != null && !scope.isEmpty()) {
                                scope = authorizationGrant.checkScopesPolicy(scope);
                                redirectUriResponse.addResponseParameter(AuthorizeResponseParam.SCOPE, scope);
                            }
                            clientService.updatAccessTime(client, false);
                            oAuth2AuditLog.setSuccess(true);
                            builder = RedirectUtil.getRedirectResponseBuilder(redirectUriResponse, httpRequest);
                            if (appConfiguration.getCustomHeadersWithAuthorizationResponse()) {
                                for (String key : customResponseHeaders.keySet()) {
                                    builder.header(key, customResponseHeaders.get(key));
                                }
                            }
                        }
                    } else {
                        // Invalid redirectUri
                        builder = error(Response.Status.BAD_REQUEST, AuthorizeErrorResponseType.INVALID_REQUEST_REDIRECT_URI, // 400
                        state);
                    }
                } else {
                    // Invalid responseTypes
                    // 400
                    builder = Response.status(Response.Status.BAD_REQUEST.getStatusCode());
                    builder.entity(errorResponseFactory.getErrorAsJson(AuthorizeErrorResponseType.UNSUPPORTED_RESPONSE_TYPE, state));
                }
            } else {
                builder = error(Response.Status.UNAUTHORIZED, AuthorizeErrorResponseType.UNAUTHORIZED_CLIENT, state);
            }
        }
    //        } catch (AcrChangedException e) {
    //            builder = Response.status(Response.Status.UNAUTHORIZED).entity("Session already exist with ACR that is different " +
    //                    "than the one send with this authorization request. Please perform logout in order to login with another ACR. ACR: " + acrValuesStr);
    //            log.error(e.getMessage(), e);
    } catch (AcrChangedException e) {
        // Acr changed
        log.error("ACR is changed, please use prompt=login in order to alter existing session.");
        log.error(e.getMessage(), e);
        RedirectUri redirectUriResponse = new RedirectUri(redirectUri, responseTypes, responseMode);
        redirectUriResponse.parseQueryString(errorResponseFactory.getErrorAsQueryString(AuthorizeErrorResponseType.SESSION_SELECTION_REQUIRED, state));
        redirectUriResponse.addResponseParameter("hint", "Use prompt=login in order to alter existing session.");
        applicationAuditLogger.sendMessage(oAuth2AuditLog);
        return RedirectUtil.getRedirectResponseBuilder(redirectUriResponse, httpRequest).build();
    } catch (EntryPersistenceException e) {
        // Invalid clientId
        builder = error(Response.Status.UNAUTHORIZED, AuthorizeErrorResponseType.UNAUTHORIZED_CLIENT, state);
        log.error(e.getMessage(), e);
    } catch (SignatureException e) {
        // 500
        builder = Response.status(Response.Status.INTERNAL_SERVER_ERROR.getStatusCode());
        log.error(e.getMessage(), e);
    } catch (StringEncrypter.EncryptionException e) {
        // 500
        builder = Response.status(Response.Status.INTERNAL_SERVER_ERROR.getStatusCode());
        log.error(e.getMessage(), e);
    } catch (InvalidJwtException e) {
        // 500
        builder = Response.status(Response.Status.INTERNAL_SERVER_ERROR.getStatusCode());
        log.error(e.getMessage(), e);
    } catch (Exception e) {
        // 500
        builder = Response.status(Response.Status.INTERNAL_SERVER_ERROR.getStatusCode());
        log.error(e.getMessage(), e);
    }
    applicationAuditLogger.sendMessage(oAuth2AuditLog);
    return builder.build();
}

Example 10 with AuthorizationGrant

use of org.xdi.oxauth.model.common.AuthorizationGrant in project oxAuth by GluuFederation.

the class LogoutAction method processExternalAuthenticatorLogOut.

private ExternalLogoutResult processExternalAuthenticatorLogOut(SessionState sessionState) {
    if ((sessionState != null) && sessionState.getSessionAttributes().containsKey(EXTERNAL_LOGOUT)) {
        log.debug("Detected callback from external system. Resuming logout.");
        return ExternalLogoutResult.SUCCESS;
    }
    AuthorizationGrant authorizationGrant = authorizationGrantList.getAuthorizationGrantByIdToken(idTokenHint);
    if (authorizationGrant == null) {
        Boolean endSessionWithAccessToken = appConfiguration.getEndSessionWithAccessToken();
        if ((endSessionWithAccessToken != null) && endSessionWithAccessToken) {
            authorizationGrant = authorizationGrantList.getAuthorizationGrantByAccessToken(idTokenHint);
        }
    }
    if ((authorizationGrant == null) && (sessionState == null)) {
        return ExternalLogoutResult.FAILURE;
    }
    String acrValues;
    if (authorizationGrant == null) {
        acrValues = sessionStateService.getAcr(sessionState);
    } else {
        acrValues = authorizationGrant.getAcrValues();
    }
    boolean isExternalAuthenticatorLogoutPresent = StringHelper.isNotEmpty(acrValues);
    if (isExternalAuthenticatorLogoutPresent) {
        log.debug("Attemptinmg to execute logout method of '{}' external authenticator.", acrValues);
        CustomScriptConfiguration customScriptConfiguration = externalAuthenticationService.getCustomScriptConfigurationByName(acrValues);
        if (customScriptConfiguration == null) {
            log.error("Failed to get ExternalAuthenticatorConfiguration. acr_values: {}", acrValues);
            return ExternalLogoutResult.FAILURE;
        } else {
            boolean scriptExternalLogoutResult = externalAuthenticationService.executeExternalLogout(customScriptConfiguration, null);
            ExternalLogoutResult externalLogoutResult = scriptExternalLogoutResult ? ExternalLogoutResult.SUCCESS : ExternalLogoutResult.FAILURE;
            log.debug("Logout result is '{}' for session '{}', userDn: '{}'", externalLogoutResult, sessionState.getId(), sessionState.getUserDn());
            int apiVersion = externalAuthenticationService.executeExternalGetApiVersion(customScriptConfiguration);
            if (apiVersion < 3) {
                // Not support redirect to external system at logout
                return externalLogoutResult;
            }
            log.trace("According to API version script supports logout redirects");
            String logoutExternalUrl = externalAuthenticationService.getLogoutExternalUrl(customScriptConfiguration, null);
            log.debug("External logout result is '{}' for user '{}'", logoutExternalUrl, sessionState.getUserDn());
            if (StringHelper.isEmpty(logoutExternalUrl)) {
                return externalLogoutResult;
            }
            // Store in session parameters needed to call end_session
            try {
                storeLogoutParametersInSession(sessionState);
            } catch (IOException ex) {
                log.debug("Failed to persist logout parameters in session", ex);
                return ExternalLogoutResult.FAILURE;
            }
            // Redirect to external URL
            facesService.redirectToExternalURL(logoutExternalUrl);
            return ExternalLogoutResult.REDIRECT;
        }
    } else {
        return ExternalLogoutResult.SUCCESS;
    }
}