Examples with RegisterRequestMessage org.xdi.oxauth.model.fido.u2f.protocol.RegisterRequestMessage used on opensource projects

Example 1 with RegisterRequestMessage

use of org.xdi.oxauth.model.fido.u2f.protocol.RegisterRequestMessage in project oxAuth by GluuFederation.

the class U2fRegistrationWS method finishRegistration.

@POST
@Produces({ "application/json" })
public Response finishRegistration(@FormParam("username") String userName, @FormParam("tokenResponse") String registerResponseString) {
    String sessionState = null;
    try {
        log.debug("Finishing registration for username '{}' with response '{}'", userName, registerResponseString);
        RegisterResponse registerResponse = ServerUtil.jsonMapperWithWrapRoot().readValue(registerResponseString, RegisterResponse.class);
        String requestId = registerResponse.getRequestId();
        RegisterRequestMessageLdap registerRequestMessageLdap = u2fRegistrationService.getRegisterRequestMessageByRequestId(requestId);
        if (registerRequestMessageLdap == null) {
            throw new WebApplicationException(Response.status(Response.Status.FORBIDDEN).entity(errorResponseFactory.getJsonErrorResponse(U2fErrorResponseType.SESSION_EXPIRED)).build());
        }
        u2fRegistrationService.removeRegisterRequestMessage(registerRequestMessageLdap);
        String foundUserInum = registerRequestMessageLdap.getUserInum();
        RegisterRequestMessage registerRequestMessage = registerRequestMessageLdap.getRegisterRequestMessage();
        DeviceRegistrationResult deviceRegistrationResult = u2fRegistrationService.finishRegistration(registerRequestMessage, registerResponse, foundUserInum);
        // If sessionState is not empty update session
        sessionState = registerRequestMessageLdap.getSessionState();
        if (StringHelper.isNotEmpty(sessionState)) {
            log.debug("There is session state. Setting session state attributes");
            boolean oneStep = StringHelper.isEmpty(foundUserInum);
            userSessionStateService.updateUserSessionStateOnFinishRequest(sessionState, foundUserInum, deviceRegistrationResult, true, oneStep);
        }
        RegisterStatus registerStatus = new RegisterStatus(Constants.RESULT_SUCCESS, requestId);
        // Convert manually to avoid possible conflict between resteasy providers, e.g. jettison, jackson
        final String entity = ServerUtil.asJson(registerStatus);
        return Response.status(Response.Status.OK).entity(entity).cacheControl(ServerUtil.cacheControl(true)).build();
    } catch (Exception ex) {
        log.error("Exception happened", ex);
        try {
            // If sessionState is not empty update session
            if (StringHelper.isNotEmpty(sessionState)) {
                log.debug("There is session state. Setting session state status to 'declined'");
                userSessionStateService.updateUserSessionStateOnError(sessionState);
            }
        } catch (Exception ex2) {
            log.error("Failed to update session state status", ex2);
        }
        if (ex instanceof WebApplicationException) {
            throw (WebApplicationException) ex;
        }
        if (ex instanceof BadInputException) {
            throw new WebApplicationException(Response.status(Response.Status.FORBIDDEN).entity(errorResponseFactory.getErrorResponse(U2fErrorResponseType.INVALID_REQUEST)).build());
        }
        throw new WebApplicationException(Response.status(Response.Status.INTERNAL_SERVER_ERROR).entity(errorResponseFactory.getJsonErrorResponse(U2fErrorResponseType.SERVER_ERROR)).build());
    }
}

Example 2 with RegisterRequestMessage

use of org.xdi.oxauth.model.fido.u2f.protocol.RegisterRequestMessage in project oxAuth by GluuFederation.

the class U2fRegistrationWS method startRegistration.

@GET
@Produces({ "application/json" })
public Response startRegistration(@QueryParam("username") String userName, @QueryParam("application") String appId, @QueryParam("session_state") String sessionState, @QueryParam("enrollment_code") String enrollmentCode) {
    // Parameter username is deprecated. We uses it only to determine is it's one or two step workflow
    try {
        log.debug("Startig registration with username '{}' for appId '{}'. session_state '{}', enrollment_code '{}'", userName, appId, sessionState, enrollmentCode);
        String userInum = null;
        boolean sessionBasedEnrollment = false;
        boolean twoStep = StringHelper.isNotEmpty(userName);
        if (twoStep) {
            boolean removeEnrollment = false;
            if (StringHelper.isNotEmpty(sessionState)) {
                boolean valid = u2fValidationService.isValidSessionState(userName, sessionState);
                if (!valid) {
                    throw new BadInputException(String.format("session_state '%s' is invalid", sessionState));
                }
                sessionBasedEnrollment = true;
            } else if (StringHelper.isNotEmpty(enrollmentCode)) {
                boolean valid = u2fValidationService.isValidEnrollmentCode(userName, enrollmentCode);
                if (!valid) {
                    throw new BadInputException(String.format("enrollment_code '%s' is invalid", enrollmentCode));
                }
                removeEnrollment = true;
            } else {
                throw new BadInputException(String.format("session_state or enrollment_code is mandatory"));
            }
            User user = userService.getUser(userName);
            userInum = userService.getUserInum(user);
            if (StringHelper.isEmpty(userInum)) {
                throw new BadInputException(String.format("Failed to find user '%s' in LDAP", userName));
            }
            if (removeEnrollment) {
                // We allow to use enrollment code only one time
                user.setAttribute(U2fConstants.U2F_ENROLLMENT_CODE_ATTRIBUTE, (String) null);
                userService.updateUser(user);
            }
        }
        if (sessionBasedEnrollment) {
            List<DeviceRegistration> deviceRegistrations = deviceRegistrationService.findUserDeviceRegistrations(userInum, appId);
            if (deviceRegistrations.size() > 0 && !isCurrentAuthenticationLevelCorrespondsToU2fLevel(sessionState)) {
                throw new RegistrationNotAllowed(String.format("It's not possible to start registration with user_name and session_state becuase user '%s' has already enrolled device", userName));
            }
        }
        RegisterRequestMessage registerRequestMessage = u2fRegistrationService.builRegisterRequestMessage(appId, userInum);
        u2fRegistrationService.storeRegisterRequestMessage(registerRequestMessage, userInum, sessionState);
        // Convert manually to avoid possible conflict between resteasy providers, e.g. jettison, jackson
        final String entity = ServerUtil.asJson(registerRequestMessage);
        return Response.status(Response.Status.OK).entity(entity).cacheControl(ServerUtil.cacheControl(true)).build();
    } catch (Exception ex) {
        log.error("Exception happened", ex);
        if (ex instanceof WebApplicationException) {
            throw (WebApplicationException) ex;
        }
        if (ex instanceof RegistrationNotAllowed) {
            throw new WebApplicationException(Response.status(Response.Status.NOT_ACCEPTABLE).entity(errorResponseFactory.getErrorResponse(U2fErrorResponseType.REGISTRATION_NOT_ALLOWED)).build());
        }
        throw new WebApplicationException(Response.status(Response.Status.INTERNAL_SERVER_ERROR).entity(errorResponseFactory.getJsonErrorResponse(U2fErrorResponseType.SERVER_ERROR)).build());
    }
}

Example 3 with RegisterRequestMessage

use of org.xdi.oxauth.model.fido.u2f.protocol.RegisterRequestMessage in project oxAuth by GluuFederation.

the class RegistrationService method builRegisterRequestMessage.

public RegisterRequestMessage builRegisterRequestMessage(String appId, String userInum) {
    if (applicationService.isValidateApplication()) {
        applicationService.checkIsValid(appId);
    }
    List<AuthenticateRequest> authenticateRequests = new ArrayList<AuthenticateRequest>();
    List<RegisterRequest> registerRequests = new ArrayList<RegisterRequest>();
    boolean twoStep = StringHelper.isNotEmpty(userInum);
    if (twoStep) {
        // In two steps we expects not empty userInum
        List<DeviceRegistration> deviceRegistrations = deviceRegistrationService.findUserDeviceRegistrations(userInum, appId);
        for (DeviceRegistration deviceRegistration : deviceRegistrations) {
            if (!deviceRegistration.isCompromised()) {
                try {
                    AuthenticateRequest authenticateRequest = u2fAuthenticationService.startAuthentication(appId, deviceRegistration);
                    authenticateRequests.add(authenticateRequest);
                } catch (DeviceCompromisedException ex) {
                    log.error("Faield to authenticate device", ex);
                }
            }
        }
    }
    RegisterRequest request = startRegistration(appId);
    registerRequests.add(request);
    return new RegisterRequestMessage(authenticateRequests, registerRequests);
}