[3/7] usergrid git commit: If claims cannot be parsed, fetch new JWT token

[mrusso]

If claims cannot be parsed, fetch new JWT token


Project: http://git-wip-us.apache.org/repos/asf/usergrid/repo
Commit: http://git-wip-us.apache.org/repos/asf/usergrid/commit/e0eb11c7
Tree: http://git-wip-us.apache.org/repos/asf/usergrid/tree/e0eb11c7
Diff: http://git-wip-us.apache.org/repos/asf/usergrid/diff/e0eb11c7

Branch: refs/heads/master
Commit: e0eb11c7dbae05d568ecc9ad9b524a472bfddb0c
Parents: 73de903
Author: Dave Johnson <snoopd...@apache.org>
Authored: Mon Oct 24 14:53:54 2016 -0400
Committer: Michael Russo <mru...@apigee.com>
Committed: Fri Oct 28 12:21:24 2016 -0700

----------------------------------------------------------------------
 .../security/sso/ApigeeSSO2Provider.java        | 55 +++++++++++---------
 1 file changed, 29 insertions(+), 26 deletions(-)
----------------------------------------------------------------------


http://git-wip-us.apache.org/repos/asf/usergrid/blob/e0eb11c7/stack/services/src/main/java/org/apache/usergrid/security/sso/ApigeeSSO2Provider.java
----------------------------------------------------------------------
diff --git 
a/stack/services/src/main/java/org/apache/usergrid/security/sso/ApigeeSSO2Provider.java
 
b/stack/services/src/main/java/org/apache/usergrid/security/sso/ApigeeSSO2Provider.java
index 8ee8e03..27843b5 100644
--- 
a/stack/services/src/main/java/org/apache/usergrid/security/sso/ApigeeSSO2Provider.java
+++ 
b/stack/services/src/main/java/org/apache/usergrid/security/sso/ApigeeSSO2Provider.java
@@ -37,9 +37,7 @@ import org.springframework.beans.factory.annotation.Autowired;
 import javax.ws.rs.client.Client;
 import javax.ws.rs.client.ClientBuilder;
 import java.security.KeyFactory;
-import java.security.NoSuchAlgorithmException;
 import java.security.PublicKey;
-import java.security.spec.InvalidKeySpecException;
 import java.security.spec.X509EncodedKeySpec;
 import java.util.HashMap;
 import java.util.Map;
@@ -146,38 +144,43 @@ public class ApigeeSSO2Provider implements 
ExternalSSOProvider {
         return properties.getProperty(USERGRID_EXTERNAL_PUBLICKEY_URL);
     }
 
-    public Jws<Claims> getClaimsForKeyUrl(String token, PublicKey 
ssoPublicKey) throws NoSuchAlgorithmException, InvalidKeySpecException, 
BadTokenException, ExpiredTokenException {
+    public Jws<Claims> getClaimsForKeyUrl(String token, PublicKey 
ssoPublicKey) throws BadTokenException {
+
         Jws<Claims> claims = null;
 
-        if(ssoPublicKey == null){
-            throw new IllegalArgumentException("Public key must be provided 
with Apigee " +
-                "token in order to verify signature.");
+        if (ssoPublicKey == null) {
+            throw new IllegalArgumentException( "Public key must be provided 
with Apigee JWT " +
+                "token in order to verify signature." );
         }
 
-        try {
-            claims = 
Jwts.parser().setSigningKey(ssoPublicKey).parseClaimsJws(token);
-        } catch (SignatureException se) {
-            if(logger.isDebugEnabled()) {
-                logger.debug("Signature was invalid for Apigee JWT: {} and 
key: {}", token, ssoPublicKey);
-            }
-            throw new BadTokenException("Invalid Apigee SSO token signature");
-        } catch (MalformedJwtException me){
-            if(logger.isDebugEnabled()) {
-                logger.debug("Beginning JSON object section of Apigee JWT 
invalid for token: {}", token);
+        int tries = 0;
+        int maxTries = 2;
+        while ( claims == null && tries++ < maxTries ) {
+            try {
+                claims = Jwts.parser().setSigningKey( ssoPublicKey 
).parseClaimsJws( token );
+
+            } catch (SignatureException se) {
+                logger.warn( "Signature was invalid for Apigee JWT token: {} 
and key: {}", token, ssoPublicKey );
+
+            } catch (ExpiredJwtException e) {
+                final long expiry = Long.valueOf( e.getClaims().get( "exp" 
).toString() );
+                final long expirationDelta = ((System.currentTimeMillis() / 
1000) - expiry) * 1000;
+                logger.info(String.format("Apigee JWT Token expired %d 
milliseconds ago.", expirationDelta));
+
+            } catch (MalformedJwtException me) {
+                logger.error("Malformed JWT token", me);
+                throw new BadTokenException( "Malformed Apigee JWT token", me 
);
+
+            } catch (ArrayIndexOutOfBoundsException aio) {
+                logger.error("Error parsing JWT token", aio);
+                throw new BadTokenException( "Error parsing Apigee JWT token", 
aio );
             }
-            throw new BadTokenException("Malformed Apigee JWT");
-        } catch (ArrayIndexOutOfBoundsException aio){
-            if(logger.isDebugEnabled()) {
-                logger.debug("Signature section of Apigee JWT invalid for 
token: {}", token);
+
+            if ( claims == null ) {
+                this.publicKey =  getPublicKey( getExternalSSOUrl() );
             }
-            throw new BadTokenException("Malformed Apigee JWT");
-        } catch ( ExpiredJwtException e ){
-            final long expiry = 
Long.valueOf(e.getClaims().get("exp").toString());
-            final long expirationDelta = ((System.currentTimeMillis()/1000) - 
expiry)*1000;
-            throw new ExpiredTokenException(String.format("Token expired %d 
milliseconds ago.", expirationDelta ));
         }
 
-
         return claims;
     }