Repository: cxf Updated Branches: refs/heads/master 64a55d27f -> 7b31a2afc
Updating OAuth2 client support code Project: http://git-wip-us.apache.org/repos/asf/cxf/repo Commit: http://git-wip-us.apache.org/repos/asf/cxf/commit/7b31a2af Tree: http://git-wip-us.apache.org/repos/asf/cxf/tree/7b31a2af Diff: http://git-wip-us.apache.org/repos/asf/cxf/diff/7b31a2af Branch: refs/heads/master Commit: 7b31a2afca1ec599100511ce1f7428160618f389 Parents: 64a55d2 Author: Sergey Beryozkin <[email protected]> Authored: Mon May 11 16:56:41 2015 +0100 Committer: Sergey Beryozkin <[email protected]> Committed: Mon May 11 16:56:41 2015 +0100 ---------------------------------------------------------------------- .../oauth2/client/ClientCodeRequestFilter.java | 76 +++++++++++--------- .../oauth2/client/ClientCodeStateManager.java | 8 +-- .../oauth2/client/ClientTokenContext.java | 25 ++----- .../oauth2/client/ClientTokenContextImpl.java | 53 ++++++++++++++ .../client/JoseClientCodeStateManager.java | 16 +++-- .../client/MemoryClientCodeStateManager.java | 11 +-- .../oidc/rp/OidcClientCodeRequestFilter.java | 2 +- .../oidc/rp/OidcClientTokenContext.java | 21 +----- .../oidc/rp/OidcClientTokenContextImpl.java | 41 +++++++++++ 9 files changed, 167 insertions(+), 86 deletions(-) ---------------------------------------------------------------------- http://git-wip-us.apache.org/repos/asf/cxf/blob/7b31a2af/rt/rs/security/oauth-parent/oauth2/src/main/java/org/apache/cxf/rs/security/oauth2/client/ClientCodeRequestFilter.java ---------------------------------------------------------------------- diff --git a/rt/rs/security/oauth-parent/oauth2/src/main/java/org/apache/cxf/rs/security/oauth2/client/ClientCodeRequestFilter.java b/rt/rs/security/oauth-parent/oauth2/src/main/java/org/apache/cxf/rs/security/oauth2/client/ClientCodeRequestFilter.java index 05ee8cd..aa58ba2 100644 --- a/rt/rs/security/oauth-parent/oauth2/src/main/java/org/apache/cxf/rs/security/oauth2/client/ClientCodeRequestFilter.java +++ b/rt/rs/security/oauth-parent/oauth2/src/main/java/org/apache/cxf/rs/security/oauth2/client/ClientCodeRequestFilter.java @@ -84,11 +84,14 @@ public class ClientCodeRequestFilter implements ContainerRequestFilter { } private Response createCodeResponse(ContainerRequestContext rc, SecurityContext sc, UriInfo ui) { + MultivaluedMap<String, String> redirectState = createRedirectState(rc, sc, ui); + String redirectScope = redirectState.getFirst(OAuthConstants.SCOPE); + String theScope = redirectScope != null ? redirectScope : scopes; URI uri = OAuthClientUtils.getAuthorizationURI(authorizationServiceUri, consumer.getKey(), getAbsoluteRedirectUri(ui).toString(), - createRequestState(rc, sc, ui), - scopes); + redirectState.getFirst(OAuthConstants.STATE), + theScope); return Response.seeOther(uri).build(); } @@ -96,45 +99,51 @@ public class ClientCodeRequestFilter implements ContainerRequestFilter { return ui.getBaseUriBuilder().path(relRedirectUri).build(); } protected void processCodeResponse(ContainerRequestContext rc, SecurityContext sc, UriInfo ui) { - MultivaluedMap<String, String> params = ui.getQueryParameters(); + MultivaluedMap<String, String> params = toRequestState(rc, ui); String codeParam = params.getFirst(OAuthConstants.AUTHORIZATION_CODE_VALUE); - AccessTokenGrant grant = new AuthorizationCodeGrant(codeParam, getAbsoluteRedirectUri(ui)); - ClientAccessToken at = OAuthClientUtils.getAccessToken(accessTokenService, - consumer, - grant); - MultivaluedMap<String, String> state = null; - String stateParam = params.getFirst(OAuthConstants.STATE); - if (clientStateManager != null) { - state = clientStateManager.toState(mc, stateParam); - } - ClientTokenContext request = createTokenContext(at); - request.setToken(at); - request.setState(state); - if (clientTokenContextManager != null) { - clientTokenContextManager.setClientTokenContext(mc, request); + if (codeParam != null) { + AccessTokenGrant grant = new AuthorizationCodeGrant(codeParam, getAbsoluteRedirectUri(ui)); + ClientAccessToken at = OAuthClientUtils.getAccessToken(accessTokenService, + consumer, + grant); + ClientTokenContext request = createTokenContext(at); + MultivaluedMap<String, String> state = null; + if (clientStateManager != null) { + state = clientStateManager.fromRedirectState(mc, params); + } + ((ClientTokenContextImpl)request).setToken(at); + ((ClientTokenContextImpl)request).setState(state); + if (clientTokenContextManager != null) { + clientTokenContextManager.setClientTokenContext(mc, request); + } + setClientCodeRequest(request); } - setClientCodeRequest(request); } protected ClientTokenContext createTokenContext(ClientAccessToken at) { - return new ClientTokenContext(); + return new ClientTokenContextImpl(); } private void setClientCodeRequest(ClientTokenContext request) { JAXRSUtils.getCurrentMessage().setContent(ClientTokenContext.class, request); } - private String createRequestState(ContainerRequestContext rc, SecurityContext sc, UriInfo ui) { + private MultivaluedMap<String, String> createRedirectState(ContainerRequestContext rc, SecurityContext sc, + UriInfo ui) { if (clientStateManager == null) { return null; } - MultivaluedMap<String, String> state = new MetadataMap<String, String>(); - state.putAll(ui.getQueryParameters(false)); + return clientStateManager.toRedirectState(mc, toRequestState(rc, ui)); + } + + private MultivaluedMap<String, String> toRequestState(ContainerRequestContext rc, UriInfo ui) { + MultivaluedMap<String, String> requestState = new MetadataMap<String, String>(); + requestState.putAll(ui.getQueryParameters(false)); if (MediaType.APPLICATION_FORM_URLENCODED_TYPE.isCompatible(rc.getMediaType())) { String body = FormUtils.readBody(rc.getEntityStream(), "UTF-8"); - FormUtils.populateMapFromString(state, JAXRSUtils.getCurrentMessage(), body, "UTF-8", false); + FormUtils.populateMapFromString(requestState, JAXRSUtils.getCurrentMessage(), body, "UTF-8", false); } - return clientStateManager.toString(mc, state); + return requestState; } public void setScopeList(List<String> list) { @@ -151,35 +160,34 @@ public class ClientCodeRequestFilter implements ContainerRequestFilter { this.scopes = scopesString; } - public void setStartUri(String startUri) { - this.startUri = startUri; + public void setRelativeStartUri(String relStartUri) { + this.startUri = relStartUri; } public void setAuthorizationServiceUri(String authorizationServiceUri) { this.authorizationServiceUri = authorizationServiceUri; } - public void setRelativeRedirectUri(String redirectUri) { - this.relRedirectUri = redirectUri; + public void setRelativeCompleteUri(String completeUri) { + this.relRedirectUri = completeUri; } public void setAccessTokenService(WebClient accessTokenService) { this.accessTokenService = accessTokenService; } - public void setClientStateManager(ClientCodeStateManager clientStateManager) { - this.clientStateManager = clientStateManager; + public void setClientCodeStateManager(ClientCodeStateManager manager) { + this.clientStateManager = manager; } public void setClientTokenContextManager(ClientTokenContextManager clientTokenContextManager) { this.clientTokenContextManager = clientTokenContextManager; } - public Consumer getConsumer() { - return consumer; - } - public void setConsumer(Consumer consumer) { this.consumer = consumer; } + public Consumer getConsumer() { + return consumer; + } } http://git-wip-us.apache.org/repos/asf/cxf/blob/7b31a2af/rt/rs/security/oauth-parent/oauth2/src/main/java/org/apache/cxf/rs/security/oauth2/client/ClientCodeStateManager.java ---------------------------------------------------------------------- diff --git a/rt/rs/security/oauth-parent/oauth2/src/main/java/org/apache/cxf/rs/security/oauth2/client/ClientCodeStateManager.java b/rt/rs/security/oauth-parent/oauth2/src/main/java/org/apache/cxf/rs/security/oauth2/client/ClientCodeStateManager.java index 54c4479..ef17828 100644 --- a/rt/rs/security/oauth-parent/oauth2/src/main/java/org/apache/cxf/rs/security/oauth2/client/ClientCodeStateManager.java +++ b/rt/rs/security/oauth-parent/oauth2/src/main/java/org/apache/cxf/rs/security/oauth2/client/ClientCodeStateManager.java @@ -23,8 +23,8 @@ import javax.ws.rs.core.MultivaluedMap; import org.apache.cxf.jaxrs.ext.MessageContext; public interface ClientCodeStateManager { - String toString(MessageContext mc, - MultivaluedMap<String, String> state); - MultivaluedMap<String, String> toState(MessageContext mc, - String stateParam); + MultivaluedMap<String, String> toRedirectState(MessageContext mc, + MultivaluedMap<String, String> requestState); + MultivaluedMap<String, String> fromRedirectState(MessageContext mc, + MultivaluedMap<String, String> redirectState); } http://git-wip-us.apache.org/repos/asf/cxf/blob/7b31a2af/rt/rs/security/oauth-parent/oauth2/src/main/java/org/apache/cxf/rs/security/oauth2/client/ClientTokenContext.java ---------------------------------------------------------------------- diff --git a/rt/rs/security/oauth-parent/oauth2/src/main/java/org/apache/cxf/rs/security/oauth2/client/ClientTokenContext.java b/rt/rs/security/oauth-parent/oauth2/src/main/java/org/apache/cxf/rs/security/oauth2/client/ClientTokenContext.java index db42f8e..e517287 100644 --- a/rt/rs/security/oauth-parent/oauth2/src/main/java/org/apache/cxf/rs/security/oauth2/client/ClientTokenContext.java +++ b/rt/rs/security/oauth-parent/oauth2/src/main/java/org/apache/cxf/rs/security/oauth2/client/ClientTokenContext.java @@ -24,25 +24,8 @@ import javax.ws.rs.core.MultivaluedMap; import org.apache.cxf.rs.security.oauth2.common.ClientAccessToken; -public class ClientTokenContext implements Serializable { - private static final long serialVersionUID = -3501237730333195311L; - private ClientAccessToken token; - private MultivaluedMap<String, String> state; - - public ClientAccessToken getToken() { - return token; - } - - public void setToken(ClientAccessToken token) { - this.token = token; - } - - public MultivaluedMap<String, String> getState() { - return state; - } - - public void setState(MultivaluedMap<String, String> state) { - this.state = state; - } - +public interface ClientTokenContext extends Serializable { + ClientAccessToken getToken(); + MultivaluedMap<String, String> getState(); + <T> T getState(Class<T> stateClass); } http://git-wip-us.apache.org/repos/asf/cxf/blob/7b31a2af/rt/rs/security/oauth-parent/oauth2/src/main/java/org/apache/cxf/rs/security/oauth2/client/ClientTokenContextImpl.java ---------------------------------------------------------------------- diff --git a/rt/rs/security/oauth-parent/oauth2/src/main/java/org/apache/cxf/rs/security/oauth2/client/ClientTokenContextImpl.java b/rt/rs/security/oauth-parent/oauth2/src/main/java/org/apache/cxf/rs/security/oauth2/client/ClientTokenContextImpl.java new file mode 100644 index 0000000..da69b18 --- /dev/null +++ b/rt/rs/security/oauth-parent/oauth2/src/main/java/org/apache/cxf/rs/security/oauth2/client/ClientTokenContextImpl.java @@ -0,0 +1,53 @@ +/** + * Licensed to the Apache Software Foundation (ASF) under one + * or more contributor license agreements. See the NOTICE file + * distributed with this work for additional information + * regarding copyright ownership. The ASF licenses this file + * to you under the Apache License, Version 2.0 (the + * "License"); you may not use this file except in compliance + * with the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + */ +package org.apache.cxf.rs.security.oauth2.client; + +import javax.ws.rs.core.MultivaluedMap; + +import org.apache.cxf.rs.security.oauth2.common.ClientAccessToken; + +public class ClientTokenContextImpl implements ClientTokenContext { + private static final long serialVersionUID = -3501237730333195311L; + private ClientAccessToken token; + private MultivaluedMap<String, String> state; + + public ClientAccessToken getToken() { + return token; + } + + public void setToken(ClientAccessToken token) { + this.token = token; + } + + public MultivaluedMap<String, String> getState() { + return state; + } + + public void setState(MultivaluedMap<String, String> state) { + this.state = state; + } + + @SuppressWarnings("unchecked") + public <T> T getState(Class<T> cls) { + if (MultivaluedMap.class == cls) { + return (T)state; + } + return null; + } +} http://git-wip-us.apache.org/repos/asf/cxf/blob/7b31a2af/rt/rs/security/oauth-parent/oauth2/src/main/java/org/apache/cxf/rs/security/oauth2/client/JoseClientCodeStateManager.java ---------------------------------------------------------------------- diff --git a/rt/rs/security/oauth-parent/oauth2/src/main/java/org/apache/cxf/rs/security/oauth2/client/JoseClientCodeStateManager.java b/rt/rs/security/oauth-parent/oauth2/src/main/java/org/apache/cxf/rs/security/oauth2/client/JoseClientCodeStateManager.java index e3ed11c..c3a7df4 100644 --- a/rt/rs/security/oauth-parent/oauth2/src/main/java/org/apache/cxf/rs/security/oauth2/client/JoseClientCodeStateManager.java +++ b/rt/rs/security/oauth-parent/oauth2/src/main/java/org/apache/cxf/rs/security/oauth2/client/JoseClientCodeStateManager.java @@ -26,6 +26,7 @@ import javax.ws.rs.core.MultivaluedMap; import org.apache.cxf.common.util.StringUtils; import org.apache.cxf.helpers.CastUtils; import org.apache.cxf.jaxrs.ext.MessageContext; +import org.apache.cxf.jaxrs.impl.MetadataMap; import org.apache.cxf.jaxrs.provider.json.JsonMapObjectReaderWriter; import org.apache.cxf.rs.security.jose.jwe.JweDecryptionProvider; import org.apache.cxf.rs.security.jose.jwe.JweEncryptionProvider; @@ -36,6 +37,7 @@ import org.apache.cxf.rs.security.jose.jws.JwsSignatureProvider; import org.apache.cxf.rs.security.jose.jws.JwsSignatureVerifier; import org.apache.cxf.rs.security.jose.jws.JwsUtils; import org.apache.cxf.rs.security.jose.jws.NoneJwsSignatureProvider; +import org.apache.cxf.rs.security.oauth2.utils.OAuthConstants; public class JoseClientCodeStateManager implements ClientCodeStateManager { @@ -45,9 +47,10 @@ public class JoseClientCodeStateManager implements ClientCodeStateManager { private JwsSignatureVerifier signatureVerifier; private JsonMapObjectReaderWriter jsonp = new JsonMapObjectReaderWriter(); @Override - public String toString(MessageContext mc, MultivaluedMap<String, String> state) { + public MultivaluedMap<String, String> toRedirectState(MessageContext mc, + MultivaluedMap<String, String> requestState) { - Map<String, Object> stateMap = CastUtils.cast((Map<?, ?>)state); + Map<String, Object> stateMap = CastUtils.cast((Map<?, ?>)requestState); String json = jsonp.toJson(stateMap); JwsCompactProducer producer = new JwsCompactProducer(json); @@ -58,11 +61,16 @@ public class JoseClientCodeStateManager implements ClientCodeStateManager { if (theEncryptionProvider != null) { stateParam = theEncryptionProvider.encrypt(StringUtils.toBytesUTF8(stateParam), null); } - return stateParam; + MultivaluedMap<String, String> map = new MetadataMap<String, String>(); + map.putSingle(OAuthConstants.STATE, stateParam); + return map; } @Override - public MultivaluedMap<String, String> toState(MessageContext mc, String stateParam) { + public MultivaluedMap<String, String> fromRedirectState(MessageContext mc, + MultivaluedMap<String, String> redirectState) { + + String stateParam = redirectState.getFirst(OAuthConstants.STATE); JweDecryptionProvider jwe = getInitializedDecryptionProvider(); if (jwe != null) { http://git-wip-us.apache.org/repos/asf/cxf/blob/7b31a2af/rt/rs/security/oauth-parent/oauth2/src/main/java/org/apache/cxf/rs/security/oauth2/client/MemoryClientCodeStateManager.java ---------------------------------------------------------------------- diff --git a/rt/rs/security/oauth-parent/oauth2/src/main/java/org/apache/cxf/rs/security/oauth2/client/MemoryClientCodeStateManager.java b/rt/rs/security/oauth-parent/oauth2/src/main/java/org/apache/cxf/rs/security/oauth2/client/MemoryClientCodeStateManager.java index f6a23b2..5e5b316 100644 --- a/rt/rs/security/oauth-parent/oauth2/src/main/java/org/apache/cxf/rs/security/oauth2/client/MemoryClientCodeStateManager.java +++ b/rt/rs/security/oauth-parent/oauth2/src/main/java/org/apache/cxf/rs/security/oauth2/client/MemoryClientCodeStateManager.java @@ -23,21 +23,24 @@ import java.util.concurrent.ConcurrentHashMap; import javax.ws.rs.core.MultivaluedMap; import org.apache.cxf.jaxrs.ext.MessageContext; +import org.apache.cxf.jaxrs.impl.MetadataMap; public class MemoryClientCodeStateManager implements ClientCodeStateManager { private ConcurrentHashMap<String, MultivaluedMap<String, String>> map = new ConcurrentHashMap<String, MultivaluedMap<String, String>>(); @Override - public String toString(MessageContext mc, MultivaluedMap<String, String> state) { + public MultivaluedMap<String, String> toRedirectState(MessageContext mc, + MultivaluedMap<String, String> requestState) { String name = mc.getSecurityContext().getUserPrincipal().getName(); String hashCode = Integer.toString(name.hashCode()); - map.put(hashCode, state); - return hashCode; + map.put(hashCode, requestState); + return new MetadataMap<String, String>(); } @Override - public MultivaluedMap<String, String> toState(MessageContext mc, String stateParam) { + public MultivaluedMap<String, String> fromRedirectState(MessageContext mc, + MultivaluedMap<String, String> redirectState) { String name = mc.getSecurityContext().getUserPrincipal().getName(); String hashCode = Integer.toString(name.hashCode()); return map.remove(hashCode); http://git-wip-us.apache.org/repos/asf/cxf/blob/7b31a2af/rt/rs/security/sso/oidc/src/main/java/org/apache/cxf/rs/security/oidc/rp/OidcClientCodeRequestFilter.java ---------------------------------------------------------------------- diff --git a/rt/rs/security/sso/oidc/src/main/java/org/apache/cxf/rs/security/oidc/rp/OidcClientCodeRequestFilter.java b/rt/rs/security/sso/oidc/src/main/java/org/apache/cxf/rs/security/oidc/rp/OidcClientCodeRequestFilter.java index f5f9cc5..f40f921 100644 --- a/rt/rs/security/sso/oidc/src/main/java/org/apache/cxf/rs/security/oidc/rp/OidcClientCodeRequestFilter.java +++ b/rt/rs/security/sso/oidc/src/main/java/org/apache/cxf/rs/security/oidc/rp/OidcClientCodeRequestFilter.java @@ -27,7 +27,7 @@ public class OidcClientCodeRequestFilter extends ClientCodeRequestFilter { private UserInfoClient userInfoClient; @Override protected ClientTokenContext createTokenContext(ClientAccessToken at) { - OidcClientTokenContext ctx = new OidcClientTokenContext(); + OidcClientTokenContextImpl ctx = new OidcClientTokenContextImpl(); ctx.setIdToken(userInfoClient.getIdToken(at, getConsumer().getKey())); ctx.setUserInfo(userInfoClient.getUserInfo(at, ctx.getIdToken())); return ctx; http://git-wip-us.apache.org/repos/asf/cxf/blob/7b31a2af/rt/rs/security/sso/oidc/src/main/java/org/apache/cxf/rs/security/oidc/rp/OidcClientTokenContext.java ---------------------------------------------------------------------- diff --git a/rt/rs/security/sso/oidc/src/main/java/org/apache/cxf/rs/security/oidc/rp/OidcClientTokenContext.java b/rt/rs/security/sso/oidc/src/main/java/org/apache/cxf/rs/security/oidc/rp/OidcClientTokenContext.java index 696879c..5a1e136 100644 --- a/rt/rs/security/sso/oidc/src/main/java/org/apache/cxf/rs/security/oidc/rp/OidcClientTokenContext.java +++ b/rt/rs/security/sso/oidc/src/main/java/org/apache/cxf/rs/security/oidc/rp/OidcClientTokenContext.java @@ -18,26 +18,11 @@ */ package org.apache.cxf.rs.security.oidc.rp; -import java.io.Serializable; - import org.apache.cxf.rs.security.oauth2.client.ClientTokenContext; import org.apache.cxf.rs.security.oidc.common.IdToken; import org.apache.cxf.rs.security.oidc.common.UserInfo; -public class OidcClientTokenContext extends ClientTokenContext implements Serializable { - private static final long serialVersionUID = 117239739331303618L; - private IdToken idToken; - private UserInfo userInfo; - public IdToken getIdToken() { - return idToken; - } - public void setIdToken(IdToken idToken) { - this.idToken = idToken; - } - public UserInfo getUserInfo() { - return userInfo; - } - public void setUserInfo(UserInfo userInfo) { - this.userInfo = userInfo; - } +public interface OidcClientTokenContext extends ClientTokenContext { + IdToken getIdToken(); + UserInfo getUserInfo(); } http://git-wip-us.apache.org/repos/asf/cxf/blob/7b31a2af/rt/rs/security/sso/oidc/src/main/java/org/apache/cxf/rs/security/oidc/rp/OidcClientTokenContextImpl.java ---------------------------------------------------------------------- diff --git a/rt/rs/security/sso/oidc/src/main/java/org/apache/cxf/rs/security/oidc/rp/OidcClientTokenContextImpl.java b/rt/rs/security/sso/oidc/src/main/java/org/apache/cxf/rs/security/oidc/rp/OidcClientTokenContextImpl.java new file mode 100644 index 0000000..47164a7 --- /dev/null +++ b/rt/rs/security/sso/oidc/src/main/java/org/apache/cxf/rs/security/oidc/rp/OidcClientTokenContextImpl.java @@ -0,0 +1,41 @@ +/** + * Licensed to the Apache Software Foundation (ASF) under one + * or more contributor license agreements. See the NOTICE file + * distributed with this work for additional information + * regarding copyright ownership. The ASF licenses this file + * to you under the Apache License, Version 2.0 (the + * "License"); you may not use this file except in compliance + * with the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + */ +package org.apache.cxf.rs.security.oidc.rp; + +import org.apache.cxf.rs.security.oauth2.client.ClientTokenContextImpl; +import org.apache.cxf.rs.security.oidc.common.IdToken; +import org.apache.cxf.rs.security.oidc.common.UserInfo; + +public class OidcClientTokenContextImpl extends ClientTokenContextImpl implements OidcClientTokenContext { + private static final long serialVersionUID = 117239739331303618L; + private IdToken idToken; + private UserInfo userInfo; + public IdToken getIdToken() { + return idToken; + } + public void setIdToken(IdToken idToken) { + this.idToken = idToken; + } + public UserInfo getUserInfo() { + return userInfo; + } + public void setUserInfo(UserInfo userInfo) { + this.userInfo = userInfo; + } +}
