You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@sling.apache.org by ro...@apache.org on 2024/09/19 09:24:48 UTC
(sling-whiteboard) 01/03: oidc-rp: switch naming from oidc to oauth where it makes sense
This is an automated email from the ASF dual-hosted git repository.
rombert pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/sling-whiteboard.git
commit 0a61fe0cf857fcab555955af5cbe76c901f7667e
Author: Robert Munteanu <ro...@apache.org>
AuthorDate: Thu Sep 19 11:11:06 2024 +0200
oidc-rp: switch naming from oidc to oauth where it makes sense
---
.../{OidcException.java => OAuthException.java} | 10 +--
.../oidc_rp/{OidcToken.java => OAuthToken.java} | 14 ++--
.../extensions/oidc_rp/OAuthTokenRefresher.java | 8 +--
.../{OidcTokenStore.java => OAuthTokenStore.java} | 14 ++--
.../{OidcTokenState.java => OAuthTokens.java} | 4 +-
.../apache/sling/extensions/oidc_rp/OAuthUris.java | 4 +-
.../{OidcTokenState.java => TokenState.java} | 2 +-
.../sling/extensions/oidc_rp/impl/Converter.java | 18 +++++
...nStore.java => JcrUserHomeOAuthTokenStore.java} | 36 +++++-----
...idcStateManager.java => OAuthStateManager.java} | 10 +--
.../oidc_rp/impl/OAuthTokenRefresherImpl.java | 76 +++++++++++-----------
.../oidc_rp/impl/OidcCallbackServlet.java | 21 +++---
.../oidc_rp/impl/OidcEntryPointServlet.java | 6 +-
.../oidc_rp/impl/OidcProviderMetadataRegistry.java | 4 +-
.../oidc_rp/support/OAuthEnabledSlingServlet.java | 24 +++----
.../oidc_rp/impl/OidcConnectionFinderImplTest.java | 60 ++++++++---------
16 files changed, 162 insertions(+), 149 deletions(-)
diff --git a/org.apache.sling.servlets.oidc-rp/src/main/java/org/apache/sling/extensions/oidc_rp/OidcException.java b/org.apache.sling.servlets.oidc-rp/src/main/java/org/apache/sling/extensions/oidc_rp/OAuthException.java
similarity index 81%
rename from org.apache.sling.servlets.oidc-rp/src/main/java/org/apache/sling/extensions/oidc_rp/OidcException.java
rename to org.apache.sling.servlets.oidc-rp/src/main/java/org/apache/sling/extensions/oidc_rp/OAuthException.java
index 060201c7..26eb6b0c 100644
--- a/org.apache.sling.servlets.oidc-rp/src/main/java/org/apache/sling/extensions/oidc_rp/OidcException.java
+++ b/org.apache.sling.servlets.oidc-rp/src/main/java/org/apache/sling/extensions/oidc_rp/OAuthException.java
@@ -16,23 +16,23 @@
*/
package org.apache.sling.extensions.oidc_rp;
-public class OidcException extends RuntimeException {
+public class OAuthException extends RuntimeException {
private static final long serialVersionUID = 1L;
- public OidcException() {
+ public OAuthException() {
super();
}
- public OidcException(String message, Throwable cause) {
+ public OAuthException(String message, Throwable cause) {
super(message, cause);
}
- public OidcException(String message) {
+ public OAuthException(String message) {
super(message);
}
- public OidcException(Throwable cause) {
+ public OAuthException(Throwable cause) {
super(cause);
}
diff --git a/org.apache.sling.servlets.oidc-rp/src/main/java/org/apache/sling/extensions/oidc_rp/OidcToken.java b/org.apache.sling.servlets.oidc-rp/src/main/java/org/apache/sling/extensions/oidc_rp/OAuthToken.java
similarity index 81%
rename from org.apache.sling.servlets.oidc-rp/src/main/java/org/apache/sling/extensions/oidc_rp/OidcToken.java
rename to org.apache.sling.servlets.oidc-rp/src/main/java/org/apache/sling/extensions/oidc_rp/OAuthToken.java
index 906dffcc..8eeadce5 100644
--- a/org.apache.sling.servlets.oidc-rp/src/main/java/org/apache/sling/extensions/oidc_rp/OidcToken.java
+++ b/org.apache.sling.servlets.oidc-rp/src/main/java/org/apache/sling/extensions/oidc_rp/OAuthToken.java
@@ -17,22 +17,22 @@
package org.apache.sling.extensions.oidc_rp;
/**
- * Information about an OIDC token
+ * Information about an OAuth token
*
- * <p>This class encapsulated the known information about and OIDC token. It allows the client to
+ * <p>This class encapsulated the known information about the token. It allows the client to
* make decisions based on the possible states.</p>
*/
-public class OidcToken {
+public class OAuthToken {
- private final OidcTokenState state;
+ private final TokenState state;
private final String value;
- public OidcToken(OidcTokenState state, String value) {
+ public OAuthToken(TokenState state, String value) {
this.state = state;
this.value = value;
}
- public OidcTokenState getState() {
+ public TokenState getState() {
return state;
}
@@ -43,7 +43,7 @@ public class OidcToken {
* @throws IllegalStateException in case the {@link #getState() state} is not {@code OidcTokenState#VALID}.
*/
public String getValue() {
- if ( state != OidcTokenState.VALID )
+ if ( state != TokenState.VALID )
throw new IllegalStateException("Can't retrieve a token value when the token state is " + state);
return value;
}
diff --git a/org.apache.sling.servlets.oidc-rp/src/main/java/org/apache/sling/extensions/oidc_rp/OAuthTokenRefresher.java b/org.apache.sling.servlets.oidc-rp/src/main/java/org/apache/sling/extensions/oidc_rp/OAuthTokenRefresher.java
index 3b00215f..00919eca 100644
--- a/org.apache.sling.servlets.oidc-rp/src/main/java/org/apache/sling/extensions/oidc_rp/OAuthTokenRefresher.java
+++ b/org.apache.sling.servlets.oidc-rp/src/main/java/org/apache/sling/extensions/oidc_rp/OAuthTokenRefresher.java
@@ -19,14 +19,14 @@ package org.apache.sling.extensions.oidc_rp;
public interface OAuthTokenRefresher {
/**
- * Refreshes the OIDC tokens based on the supplied refresh token
+ * Refreshes the OAuth tokens based on the supplied refresh token
*
* <p>It is the responsibility of the invoker to persist the returned tokens.</p>
*
* @param connection The connection to start the OIDC flow for
* @param refreshToken An existing refresh token
- * @return OIDC tokens
- * @throws OidcException in case anything goes wrong
+ * @return OAuth tokens
+ * @throws OAuthException in case anything goes wrong
*/
- OidcTokens refreshTokens(OidcConnection connection, String refreshToken) throws OidcException;
+ OAuthTokens refreshTokens(OidcConnection connection, String refreshToken) throws OAuthException;
}
diff --git a/org.apache.sling.servlets.oidc-rp/src/main/java/org/apache/sling/extensions/oidc_rp/OidcTokenStore.java b/org.apache.sling.servlets.oidc-rp/src/main/java/org/apache/sling/extensions/oidc_rp/OAuthTokenStore.java
similarity index 74%
rename from org.apache.sling.servlets.oidc-rp/src/main/java/org/apache/sling/extensions/oidc_rp/OidcTokenStore.java
rename to org.apache.sling.servlets.oidc-rp/src/main/java/org/apache/sling/extensions/oidc_rp/OAuthTokenStore.java
index b5a56297..c44c0e07 100644
--- a/org.apache.sling.servlets.oidc-rp/src/main/java/org/apache/sling/extensions/oidc_rp/OidcTokenStore.java
+++ b/org.apache.sling.servlets.oidc-rp/src/main/java/org/apache/sling/extensions/oidc_rp/OAuthTokenStore.java
@@ -30,18 +30,18 @@ import org.apache.sling.api.resource.ResourceResolver;
// - (?) can we do without exposing the actual tokens?
/**
- * Storage for OIDC Tokens
+ * Storage for OAuth Tokens
*
- * <p>This service allows access to storing and retrieving OIDC tokens. It is the responsibility of the caller
+ * <p>This service allows access to storing and retrieving OAuth tokens. It is the responsibility of the caller
* to ensure that the tokens are valid.</p>
*
- * <p>For methods that return {@link OidcToken}, the state must be inspected before attempting to read the value.</p>
+ * <p>For methods that return {@link OAuthToken}, the state must be inspected before attempting to read the value.</p>
*/
-public interface OidcTokenStore {
+public interface OAuthTokenStore {
- OidcToken getAccessToken(OidcConnection connection, ResourceResolver resolver) throws OidcException;
+ OAuthToken getAccessToken(OidcConnection connection, ResourceResolver resolver) throws OAuthException;
- OidcToken getRefreshToken(OidcConnection connection, ResourceResolver resolver) throws OidcException;
+ OAuthToken getRefreshToken(OidcConnection connection, ResourceResolver resolver) throws OAuthException;
- void persistTokens(OidcConnection connection, ResourceResolver resolver, OidcTokens tokens) throws OidcException;
+ void persistTokens(OidcConnection connection, ResourceResolver resolver, OAuthTokens tokens) throws OAuthException;
}
diff --git a/org.apache.sling.servlets.oidc-rp/src/main/java/org/apache/sling/extensions/oidc_rp/OidcTokenState.java b/org.apache.sling.servlets.oidc-rp/src/main/java/org/apache/sling/extensions/oidc_rp/OAuthTokens.java
similarity index 90%
copy from org.apache.sling.servlets.oidc-rp/src/main/java/org/apache/sling/extensions/oidc_rp/OidcTokenState.java
copy to org.apache.sling.servlets.oidc-rp/src/main/java/org/apache/sling/extensions/oidc_rp/OAuthTokens.java
index 5f65851e..a09023b7 100644
--- a/org.apache.sling.servlets.oidc-rp/src/main/java/org/apache/sling/extensions/oidc_rp/OidcTokenState.java
+++ b/org.apache.sling.servlets.oidc-rp/src/main/java/org/apache/sling/extensions/oidc_rp/OAuthTokens.java
@@ -16,6 +16,6 @@
*/
package org.apache.sling.extensions.oidc_rp;
-public enum OidcTokenState {
- VALID, EXPIRED, MISSING;
+public record OAuthTokens(String accessToken, long expiresAt, String refreshToken) {
+
}
diff --git a/org.apache.sling.servlets.oidc-rp/src/main/java/org/apache/sling/extensions/oidc_rp/OAuthUris.java b/org.apache.sling.servlets.oidc-rp/src/main/java/org/apache/sling/extensions/oidc_rp/OAuthUris.java
index e3b7fbf4..9f81c7f9 100644
--- a/org.apache.sling.servlets.oidc-rp/src/main/java/org/apache/sling/extensions/oidc_rp/OAuthUris.java
+++ b/org.apache.sling.servlets.oidc-rp/src/main/java/org/apache/sling/extensions/oidc_rp/OAuthUris.java
@@ -34,9 +34,9 @@ public abstract class OAuthUris {
* @param request The current request
* @param redirectPath The local redirect path to use after completing the OIDC flow
* @return a local URI
- * @throws OidcException in case anything goes wrong
+ * @throws OAuthException in case anything goes wrong
*/
- public static URI getOidcEntryPointUri(OidcConnection connection, SlingHttpServletRequest request, String redirectPath) throws OidcException {
+ public static URI getOidcEntryPointUri(OidcConnection connection, SlingHttpServletRequest request, String redirectPath) throws OAuthException {
StringBuilder uri = new StringBuilder();
uri.append(request.getScheme()).append("://").append(request.getServerName());
boolean needsExplicitPort = ( "https".equals(request.getScheme()) && request.getServerPort() != 443 )
diff --git a/org.apache.sling.servlets.oidc-rp/src/main/java/org/apache/sling/extensions/oidc_rp/OidcTokenState.java b/org.apache.sling.servlets.oidc-rp/src/main/java/org/apache/sling/extensions/oidc_rp/TokenState.java
similarity index 96%
rename from org.apache.sling.servlets.oidc-rp/src/main/java/org/apache/sling/extensions/oidc_rp/OidcTokenState.java
rename to org.apache.sling.servlets.oidc-rp/src/main/java/org/apache/sling/extensions/oidc_rp/TokenState.java
index 5f65851e..8e3664e2 100644
--- a/org.apache.sling.servlets.oidc-rp/src/main/java/org/apache/sling/extensions/oidc_rp/OidcTokenState.java
+++ b/org.apache.sling.servlets.oidc-rp/src/main/java/org/apache/sling/extensions/oidc_rp/TokenState.java
@@ -16,6 +16,6 @@
*/
package org.apache.sling.extensions.oidc_rp;
-public enum OidcTokenState {
+public enum TokenState {
VALID, EXPIRED, MISSING;
}
diff --git a/org.apache.sling.servlets.oidc-rp/src/main/java/org/apache/sling/extensions/oidc_rp/impl/Converter.java b/org.apache.sling.servlets.oidc-rp/src/main/java/org/apache/sling/extensions/oidc_rp/impl/Converter.java
index 449a2380..506972f1 100644
--- a/org.apache.sling.servlets.oidc-rp/src/main/java/org/apache/sling/extensions/oidc_rp/impl/Converter.java
+++ b/org.apache.sling.servlets.oidc-rp/src/main/java/org/apache/sling/extensions/oidc_rp/impl/Converter.java
@@ -16,10 +16,12 @@
*/
package org.apache.sling.extensions.oidc_rp.impl;
+import org.apache.sling.extensions.oidc_rp.OAuthTokens;
import org.apache.sling.extensions.oidc_rp.OidcTokens;
import com.nimbusds.oauth2.sdk.token.BearerAccessToken;
import com.nimbusds.oauth2.sdk.token.RefreshToken;
+import com.nimbusds.oauth2.sdk.token.Tokens;
import com.nimbusds.openid.connect.sdk.token.OIDCTokens;
public class Converter {
@@ -46,6 +48,22 @@ public class Converter {
return new OidcTokens(accessToken, expiresAt, refreshToken, idToken);
}
+ public static OAuthTokens toSlingOAuthTokens(OIDCTokens nimbusTokens) {
+ String accessToken = nimbusTokens.getAccessToken() != null ? nimbusTokens.getAccessToken().getValue() : null;
+ long expiresAt = nimbusTokens.getAccessToken() != null ? nimbusTokens.getAccessToken().getLifetime() : 0;
+ String refreshToken = nimbusTokens.getRefreshToken() != null ? nimbusTokens.getRefreshToken().getValue() : null;
+
+ return new OAuthTokens(accessToken, expiresAt, refreshToken);
+ }
+
+ public static OAuthTokens toSlingOAuthTokens(Tokens oAuthTokens) {
+ String accessToken = oAuthTokens.getAccessToken() != null ? oAuthTokens.getAccessToken().getValue() : null;
+ long expiresAt = oAuthTokens.getAccessToken() != null ? oAuthTokens.getAccessToken().getLifetime() : 0;
+ String refreshToken = oAuthTokens.getRefreshToken() != null ? oAuthTokens.getRefreshToken().getValue() : null;
+
+ return new OAuthTokens(accessToken, expiresAt, refreshToken);
+ }
+
private Converter() {
}
diff --git a/org.apache.sling.servlets.oidc-rp/src/main/java/org/apache/sling/extensions/oidc_rp/impl/JcrUserHomeOidcTokenStore.java b/org.apache.sling.servlets.oidc-rp/src/main/java/org/apache/sling/extensions/oidc_rp/impl/JcrUserHomeOAuthTokenStore.java
similarity index 79%
rename from org.apache.sling.servlets.oidc-rp/src/main/java/org/apache/sling/extensions/oidc_rp/impl/JcrUserHomeOidcTokenStore.java
rename to org.apache.sling.servlets.oidc-rp/src/main/java/org/apache/sling/extensions/oidc_rp/impl/JcrUserHomeOAuthTokenStore.java
index f4c578d3..b7fd2a02 100644
--- a/org.apache.sling.servlets.oidc-rp/src/main/java/org/apache/sling/extensions/oidc_rp/impl/JcrUserHomeOidcTokenStore.java
+++ b/org.apache.sling.servlets.oidc-rp/src/main/java/org/apache/sling/extensions/oidc_rp/impl/JcrUserHomeOAuthTokenStore.java
@@ -29,18 +29,18 @@ import javax.jcr.Value;
import org.apache.jackrabbit.api.security.user.User;
import org.apache.sling.api.resource.ResourceResolver;
+import org.apache.sling.extensions.oidc_rp.OAuthException;
+import org.apache.sling.extensions.oidc_rp.OAuthToken;
+import org.apache.sling.extensions.oidc_rp.OAuthTokenStore;
+import org.apache.sling.extensions.oidc_rp.OAuthTokens;
import org.apache.sling.extensions.oidc_rp.OidcConnection;
-import org.apache.sling.extensions.oidc_rp.OidcException;
-import org.apache.sling.extensions.oidc_rp.OidcToken;
-import org.apache.sling.extensions.oidc_rp.OidcTokenState;
-import org.apache.sling.extensions.oidc_rp.OidcTokenStore;
-import org.apache.sling.extensions.oidc_rp.OidcTokens;
+import org.apache.sling.extensions.oidc_rp.TokenState;
import org.osgi.service.component.annotations.Component;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
-@Component(service = { OidcTokenStore.class } )
-public class JcrUserHomeOidcTokenStore implements OidcTokenStore {
+@Component(service = { OAuthTokenStore.class } )
+public class JcrUserHomeOAuthTokenStore implements OAuthTokenStore {
// TODO - expires_at
private static final String PROPERTY_NAME_EXPIRES_AT = "expiresAt";
@@ -50,7 +50,7 @@ public class JcrUserHomeOidcTokenStore implements OidcTokenStore {
private final Logger logger = LoggerFactory.getLogger(getClass());
@Override
- public OidcToken getAccessToken(OidcConnection connection, ResourceResolver resolver) {
+ public OAuthToken getAccessToken(OidcConnection connection, ResourceResolver resolver) {
try {
User user = resolver.adaptTo(User.class);
@@ -61,41 +61,41 @@ public class JcrUserHomeOidcTokenStore implements OidcTokenStore {
logger.info("Token for {} expired at {}, marking as expired", connection.name(), expiresCal);
// refresh token is present, mark as expired
- return new OidcToken(OidcTokenState.EXPIRED, null);
+ return new OAuthToken(TokenState.EXPIRED, null);
}
}
return getToken(connection, user, PROPERTY_NAME_ACCESS_TOKEN);
} catch (RepositoryException e) {
- throw new OidcException(e);
+ throw new OAuthException(e);
}
}
- private OidcToken getToken(OidcConnection connection, User user, String propertyName) throws RepositoryException {
+ private OAuthToken getToken(OidcConnection connection, User user, String propertyName) throws RepositoryException {
Value[] tokenValue = user.getProperty(propertyPath(connection, propertyName));
if ( tokenValue == null )
- return new OidcToken(OidcTokenState.MISSING, null);
+ return new OAuthToken(TokenState.MISSING, null);
if ( tokenValue.length != 1)
- throw new OidcException(String.format("Unexpected value count %d for token property %s" , tokenValue.length, propertyName));
+ throw new OAuthException(String.format("Unexpected value count %d for token property %s" , tokenValue.length, propertyName));
- return new OidcToken(OidcTokenState.VALID, tokenValue[0].getString());
+ return new OAuthToken(TokenState.VALID, tokenValue[0].getString());
}
@Override
- public OidcToken getRefreshToken(OidcConnection connection, ResourceResolver resolver) {
+ public OAuthToken getRefreshToken(OidcConnection connection, ResourceResolver resolver) {
try {
User user = resolver.adaptTo(User.class);
return getToken(connection, user, PROPERTY_NAME_REFRESH_TOKEN);
} catch (RepositoryException e) {
- throw new OidcException(e);
+ throw new OAuthException(e);
}
}
@Override
- public void persistTokens(OidcConnection connection, ResourceResolver resolver, OidcTokens tokens) {
+ public void persistTokens(OidcConnection connection, ResourceResolver resolver, OAuthTokens tokens) {
try {
User currentUser = resolver.adaptTo(User.class);
Session session = resolver.adaptTo(Session.class);
@@ -124,7 +124,7 @@ public class JcrUserHomeOidcTokenStore implements OidcTokenStore {
session.save();
} catch (RepositoryException e) {
- throw new OidcException(e);
+ throw new OAuthException(e);
}
}
diff --git a/org.apache.sling.servlets.oidc-rp/src/main/java/org/apache/sling/extensions/oidc_rp/impl/OidcStateManager.java b/org.apache.sling.servlets.oidc-rp/src/main/java/org/apache/sling/extensions/oidc_rp/impl/OAuthStateManager.java
similarity index 93%
rename from org.apache.sling.servlets.oidc-rp/src/main/java/org/apache/sling/extensions/oidc_rp/impl/OidcStateManager.java
rename to org.apache.sling.servlets.oidc-rp/src/main/java/org/apache/sling/extensions/oidc_rp/impl/OAuthStateManager.java
index aa06ad5c..186f94c9 100644
--- a/org.apache.sling.servlets.oidc-rp/src/main/java/org/apache/sling/extensions/oidc_rp/impl/OidcStateManager.java
+++ b/org.apache.sling.servlets.oidc-rp/src/main/java/org/apache/sling/extensions/oidc_rp/impl/OAuthStateManager.java
@@ -33,9 +33,9 @@ import com.nimbusds.oauth2.sdk.id.State;
* DocumentNodeStore cluster or external state store.</p>
*
*/
-class OidcStateManager {
+class OAuthStateManager {
- private static final String SESSION_ATTRIBUTE_KEY_PREFIX = OidcStateManager.class.getName();
+ private static final String SESSION_ATTRIBUTE_KEY_PREFIX = OAuthStateManager.class.getName();
static final String PARAMETER_NAME_REDIRECT = "redirect";
static final String PARAMETER_NAME_CONNECTION = "connection";
@@ -45,12 +45,12 @@ class OidcStateManager {
private final HttpServletRequest request;
- private OidcStateManager(HttpServletRequest request) {
+ private OAuthStateManager(HttpServletRequest request) {
this.request = request;
}
- static OidcStateManager stateFor(HttpServletRequest request) {
- return new OidcStateManager(request);
+ static OAuthStateManager stateFor(HttpServletRequest request) {
+ return new OAuthStateManager(request);
}
public void registerState(State state) {
diff --git a/org.apache.sling.servlets.oidc-rp/src/main/java/org/apache/sling/extensions/oidc_rp/impl/OAuthTokenRefresherImpl.java b/org.apache.sling.servlets.oidc-rp/src/main/java/org/apache/sling/extensions/oidc_rp/impl/OAuthTokenRefresherImpl.java
index 47b25bbf..3826871e 100644
--- a/org.apache.sling.servlets.oidc-rp/src/main/java/org/apache/sling/extensions/oidc_rp/impl/OAuthTokenRefresherImpl.java
+++ b/org.apache.sling.servlets.oidc-rp/src/main/java/org/apache/sling/extensions/oidc_rp/impl/OAuthTokenRefresherImpl.java
@@ -19,14 +19,15 @@ package org.apache.sling.extensions.oidc_rp.impl;
import java.io.IOException;
import java.net.URI;
+import org.apache.sling.extensions.oidc_rp.OAuthException;
import org.apache.sling.extensions.oidc_rp.OAuthTokenRefresher;
+import org.apache.sling.extensions.oidc_rp.OAuthTokens;
import org.apache.sling.extensions.oidc_rp.OidcConnection;
-import org.apache.sling.extensions.oidc_rp.OidcException;
-import org.apache.sling.extensions.oidc_rp.OidcTokens;
import org.osgi.service.component.annotations.Activate;
import org.osgi.service.component.annotations.Component;
import org.osgi.service.component.annotations.Reference;
+import com.nimbusds.oauth2.sdk.AccessTokenResponse;
import com.nimbusds.oauth2.sdk.AuthorizationGrant;
import com.nimbusds.oauth2.sdk.ParseException;
import com.nimbusds.oauth2.sdk.RefreshTokenGrant;
@@ -37,8 +38,7 @@ import com.nimbusds.oauth2.sdk.auth.ClientSecretBasic;
import com.nimbusds.oauth2.sdk.auth.Secret;
import com.nimbusds.oauth2.sdk.id.ClientID;
import com.nimbusds.oauth2.sdk.token.RefreshToken;
-import com.nimbusds.openid.connect.sdk.OIDCTokenResponse;
-import com.nimbusds.openid.connect.sdk.token.OIDCTokens;
+import com.nimbusds.oauth2.sdk.token.Tokens;
@Component
public class OAuthTokenRefresherImpl implements OAuthTokenRefresher {
@@ -51,42 +51,42 @@ public class OAuthTokenRefresherImpl implements OAuthTokenRefresher {
}
@Override
- public OidcTokens refreshTokens(OidcConnection connection, String refreshToken2) {
- return Converter.toApiOidcTokens(refreshTokensInternal(connection, refreshToken2));
+ public OAuthTokens refreshTokens(OidcConnection connection, String refreshToken2) {
+ return Converter.toSlingOAuthTokens(refreshTokensInternal(connection, refreshToken2));
}
- public OIDCTokens refreshTokensInternal(OidcConnection connection, String refreshToken2) {
+ public Tokens refreshTokensInternal(OidcConnection connection, String refreshToken2) {
- try {
- // Construct the grant from the saved refresh token
- RefreshToken refreshToken = new RefreshToken(refreshToken2);
- AuthorizationGrant refreshTokenGrant = new RefreshTokenGrant(refreshToken);
-
- // The credentials to authenticate the client at the token endpoint
- ClientID clientID = new ClientID(connection.clientId());
- Secret clientSecret = new Secret(connection.clientSecret());
- ClientAuthentication clientAuth = new ClientSecretBasic(clientID, clientSecret);
-
- // The token endpoint
- URI tokenEndpoint = providerMetadataRegistry.getProviderMetadata(connection.baseUrl()).getTokenEndpointURI();
-
- // Make the token request
- TokenRequest request = new TokenRequest(tokenEndpoint, clientAuth, refreshTokenGrant);
-
- OIDCTokenResponse response = OIDCTokenResponse.parse(request.toHTTPRequest().send());
-
- if (! response.indicatesSuccess()) {
- // We got an error response...
- TokenErrorResponse errorResponse = response.toErrorResponse();
- throw new OidcException("Failed refreshing the access token " + errorResponse.getErrorObject().getCode() + " : " + errorResponse.getErrorObject().getDescription());
- }
-
- OIDCTokenResponse successResponse = response.toSuccessResponse();
-
- // Get the access token, the refresh token may be updated
- return successResponse.getOIDCTokens();
- } catch (ParseException |IOException e) {
- throw new OidcException(e);
- }
+ try {
+ // Construct the grant from the saved refresh token
+ RefreshToken refreshToken = new RefreshToken(refreshToken2);
+ AuthorizationGrant refreshTokenGrant = new RefreshTokenGrant(refreshToken);
+
+ // The credentials to authenticate the client at the token endpoint
+ ClientID clientID = new ClientID(connection.clientId());
+ Secret clientSecret = new Secret(connection.clientSecret());
+ ClientAuthentication clientAuth = new ClientSecretBasic(clientID, clientSecret);
+
+ // The token endpoint
+ URI tokenEndpoint = providerMetadataRegistry.getProviderMetadata(connection.baseUrl()).getTokenEndpointURI();
+
+ // Make the token request
+ TokenRequest request = new TokenRequest(tokenEndpoint, clientAuth, refreshTokenGrant);
+
+ AccessTokenResponse response = AccessTokenResponse.parse(request.toHTTPRequest().send());
+
+ if (! response.indicatesSuccess()) {
+ // We got an error response...
+ TokenErrorResponse errorResponse = response.toErrorResponse();
+ throw new OAuthException("Failed refreshing the access token " + errorResponse.getErrorObject().getCode() + " : " + errorResponse.getErrorObject().getDescription());
+ }
+
+ AccessTokenResponse successResponse = response.toSuccessResponse();
+
+ // Get the access token, the refresh token may be updated
+ return successResponse.getTokens();
+ } catch (ParseException |IOException e) {
+ throw new OAuthException(e);
+ }
}
}
diff --git a/org.apache.sling.servlets.oidc-rp/src/main/java/org/apache/sling/extensions/oidc_rp/impl/OidcCallbackServlet.java b/org.apache.sling.servlets.oidc-rp/src/main/java/org/apache/sling/extensions/oidc_rp/impl/OidcCallbackServlet.java
index 565058ce..c182a677 100644
--- a/org.apache.sling.servlets.oidc-rp/src/main/java/org/apache/sling/extensions/oidc_rp/impl/OidcCallbackServlet.java
+++ b/org.apache.sling.servlets.oidc-rp/src/main/java/org/apache/sling/extensions/oidc_rp/impl/OidcCallbackServlet.java
@@ -38,9 +38,9 @@ import org.apache.sling.api.SlingHttpServletRequest;
import org.apache.sling.api.SlingHttpServletResponse;
import org.apache.sling.api.servlets.SlingAllMethodsServlet;
import org.apache.sling.auth.core.AuthConstants;
+import org.apache.sling.extensions.oidc_rp.OAuthTokenStore;
+import org.apache.sling.extensions.oidc_rp.OAuthTokens;
import org.apache.sling.extensions.oidc_rp.OidcConnection;
-import org.apache.sling.extensions.oidc_rp.OidcTokenStore;
-import org.apache.sling.extensions.oidc_rp.OidcTokens;
import org.apache.sling.servlets.annotations.SlingServletPaths;
import org.osgi.service.component.annotations.Activate;
import org.osgi.service.component.annotations.Component;
@@ -74,7 +74,7 @@ public class OidcCallbackServlet extends SlingAllMethodsServlet {
private final Logger logger = LoggerFactory.getLogger(getClass());
private final Map<String, OidcConnection> connections;
- private final OidcTokenStore tokenStore;
+ private final OAuthTokenStore tokenStore;
private final OidcProviderMetadataRegistry metadataRegistry;
static String getCallbackUri(HttpServletRequest request) {
@@ -88,7 +88,7 @@ public class OidcCallbackServlet extends SlingAllMethodsServlet {
}
@Activate
- public OidcCallbackServlet(@Reference(policyOption = GREEDY) List<OidcConnection> connections, @Reference OidcTokenStore tokenStore,
+ public OidcCallbackServlet(@Reference(policyOption = GREEDY) List<OidcConnection> connections, @Reference OAuthTokenStore tokenStore,
@Reference OidcProviderMetadataRegistry metadataRegistry) {
this.connections = connections.stream()
.collect(Collectors.toMap( OidcConnection::name, Function.identity()));
@@ -105,18 +105,18 @@ public class OidcCallbackServlet extends SlingAllMethodsServlet {
requestURL.append('?').append(request.getQueryString());
AuthenticationResponse authResponse = AuthenticationResponseParser.parse(new URI(requestURL.toString()));
- OidcStateManager stateManager = OidcStateManager.stateFor(request);
+ OAuthStateManager stateManager = OAuthStateManager.stateFor(request);
if ( authResponse.getState() == null || !stateManager.isValidState(authResponse.getState()))
throw new ServletException("Failed state check");
if ( response instanceof AuthenticationErrorResponse )
throw new ServletException(authResponse.toErrorResponse().getErrorObject().toString());
- Optional<String> redirect = stateManager.getStateAttribute(authResponse.getState(), OidcStateManager.PARAMETER_NAME_REDIRECT);
+ Optional<String> redirect = stateManager.getStateAttribute(authResponse.getState(), OAuthStateManager.PARAMETER_NAME_REDIRECT);
String authCode = authResponse.toSuccessResponse().getAuthorizationCode().getValue();
- Optional<String> desiredConnectionName = stateManager.getStateAttribute(authResponse.getState(), OidcStateManager.PARAMETER_NAME_CONNECTION);
+ Optional<String> desiredConnectionName = stateManager.getStateAttribute(authResponse.getState(), OAuthStateManager.PARAMETER_NAME_CONNECTION);
stateManager.unregisterState(authResponse.getState());
if ( desiredConnectionName.isEmpty() ) {
logger.warn("Did not find any connection in stateManager");
@@ -157,12 +157,7 @@ public class OidcCallbackServlet extends SlingAllMethodsServlet {
return;
}
- // TODO - additional validations for the id_token
- // - does the 'aud' claim match the client id of our connection
- // - nonce validation (?)
- // - iat/exp validation (?)
-
- OidcTokens tokens = Converter.toApiOidcTokens(tokenResponse.getOIDCTokens());
+ OAuthTokens tokens = Converter.toSlingOAuthTokens(tokenResponse.getOIDCTokens());
tokenStore.persistTokens(connection, request.getResourceResolver(), tokens);
diff --git a/org.apache.sling.servlets.oidc-rp/src/main/java/org/apache/sling/extensions/oidc_rp/impl/OidcEntryPointServlet.java b/org.apache.sling.servlets.oidc-rp/src/main/java/org/apache/sling/extensions/oidc_rp/impl/OidcEntryPointServlet.java
index cdf856c0..3f9366bf 100644
--- a/org.apache.sling.servlets.oidc-rp/src/main/java/org/apache/sling/extensions/oidc_rp/impl/OidcEntryPointServlet.java
+++ b/org.apache.sling.servlets.oidc-rp/src/main/java/org/apache/sling/extensions/oidc_rp/impl/OidcEntryPointServlet.java
@@ -16,8 +16,8 @@
*/
package org.apache.sling.extensions.oidc_rp.impl;
-import static org.apache.sling.extensions.oidc_rp.impl.OidcStateManager.PARAMETER_NAME_CONNECTION;
-import static org.apache.sling.extensions.oidc_rp.impl.OidcStateManager.PARAMETER_NAME_REDIRECT;
+import static org.apache.sling.extensions.oidc_rp.impl.OAuthStateManager.PARAMETER_NAME_CONNECTION;
+import static org.apache.sling.extensions.oidc_rp.impl.OAuthStateManager.PARAMETER_NAME_REDIRECT;
import static org.osgi.service.component.annotations.ReferencePolicyOption.GREEDY;
import java.io.IOException;
@@ -108,7 +108,7 @@ public class OidcEntryPointServlet extends SlingAllMethodsServlet {
// Generate random state string to securely pair the callback to this request
State state = new State();
- OidcStateManager stateManager = OidcStateManager.stateFor(request);
+ OAuthStateManager stateManager = OAuthStateManager.stateFor(request);
stateManager.registerState(state);
stateManager.putAttribute(state, PARAMETER_NAME_CONNECTION, connection.name());
if ( request.getParameter(PARAMETER_NAME_REDIRECT) != null )
diff --git a/org.apache.sling.servlets.oidc-rp/src/main/java/org/apache/sling/extensions/oidc_rp/impl/OidcProviderMetadataRegistry.java b/org.apache.sling.servlets.oidc-rp/src/main/java/org/apache/sling/extensions/oidc_rp/impl/OidcProviderMetadataRegistry.java
index 66a2c4c3..8c4c885d 100644
--- a/org.apache.sling.servlets.oidc-rp/src/main/java/org/apache/sling/extensions/oidc_rp/impl/OidcProviderMetadataRegistry.java
+++ b/org.apache.sling.servlets.oidc-rp/src/main/java/org/apache/sling/extensions/oidc_rp/impl/OidcProviderMetadataRegistry.java
@@ -21,7 +21,7 @@ import java.net.URI;
import java.util.concurrent.ConcurrentHashMap;
import java.util.concurrent.ConcurrentMap;
-import org.apache.sling.extensions.oidc_rp.OidcException;
+import org.apache.sling.extensions.oidc_rp.OAuthException;
import org.osgi.service.component.annotations.Component;
import com.nimbusds.oauth2.sdk.GeneralException;
@@ -47,7 +47,7 @@ public class OidcProviderMetadataRegistry {
try {
return OIDCProviderMetadata.resolve(new Issuer(s));
} catch (GeneralException | IOException e) {
- throw new OidcException(e);
+ throw new OAuthException(e);
}
});
}
diff --git a/org.apache.sling.servlets.oidc-rp/src/main/java/org/apache/sling/extensions/oidc_rp/support/OAuthEnabledSlingServlet.java b/org.apache.sling.servlets.oidc-rp/src/main/java/org/apache/sling/extensions/oidc_rp/support/OAuthEnabledSlingServlet.java
index 9693e60a..ff3750db 100644
--- a/org.apache.sling.servlets.oidc-rp/src/main/java/org/apache/sling/extensions/oidc_rp/support/OAuthEnabledSlingServlet.java
+++ b/org.apache.sling.servlets.oidc-rp/src/main/java/org/apache/sling/extensions/oidc_rp/support/OAuthEnabledSlingServlet.java
@@ -25,13 +25,13 @@ import javax.servlet.http.HttpServletResponse;
import org.apache.sling.api.SlingHttpServletRequest;
import org.apache.sling.api.SlingHttpServletResponse;
import org.apache.sling.api.servlets.SlingSafeMethodsServlet;
-import org.apache.sling.extensions.oidc_rp.OAuthUris;
+import org.apache.sling.extensions.oidc_rp.OAuthToken;
import org.apache.sling.extensions.oidc_rp.OAuthTokenRefresher;
+import org.apache.sling.extensions.oidc_rp.OAuthTokenStore;
+import org.apache.sling.extensions.oidc_rp.OAuthTokens;
+import org.apache.sling.extensions.oidc_rp.OAuthUris;
import org.apache.sling.extensions.oidc_rp.OidcConnection;
-import org.apache.sling.extensions.oidc_rp.OidcToken;
-import org.apache.sling.extensions.oidc_rp.OidcTokenState;
-import org.apache.sling.extensions.oidc_rp.OidcTokenStore;
-import org.apache.sling.extensions.oidc_rp.OidcTokens;
+import org.apache.sling.extensions.oidc_rp.TokenState;
import org.jetbrains.annotations.NotNull;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
@@ -44,11 +44,11 @@ public abstract class OAuthEnabledSlingServlet extends SlingSafeMethodsServlet {
private final OidcConnection connection;
- private final OidcTokenStore tokenStore;
+ private final OAuthTokenStore tokenStore;
private final OAuthTokenRefresher oidcClient;
- protected OAuthEnabledSlingServlet(OidcConnection connection, OidcTokenStore tokenStore, OAuthTokenRefresher oidcClient) {
+ protected OAuthEnabledSlingServlet(OidcConnection connection, OAuthTokenStore tokenStore, OAuthTokenRefresher oidcClient) {
this.connection = Objects.requireNonNull(connection, "connection may not null");
this.tokenStore = Objects.requireNonNull(tokenStore, "tokenStore may not null");
this.oidcClient = Objects.requireNonNull(oidcClient, "oidcClient may not null");
@@ -68,7 +68,7 @@ public abstract class OAuthEnabledSlingServlet extends SlingSafeMethodsServlet {
if ( logger.isDebugEnabled() )
logger.debug("Configured with connection (name={}) and redirectPath={}", connection.name(), redirectPath);
- OidcToken tokenResponse = tokenStore.getAccessToken(connection, request.getResourceResolver());
+ OAuthToken tokenResponse = tokenStore.getAccessToken(connection, request.getResourceResolver());
switch ( tokenResponse.getState() ) {
case VALID:
@@ -78,13 +78,13 @@ public abstract class OAuthEnabledSlingServlet extends SlingSafeMethodsServlet {
response.sendRedirect(OAuthUris.getOidcEntryPointUri(connection, request, redirectPath).toString());
break;
case EXPIRED:
- OidcToken refreshToken = tokenStore.getRefreshToken(connection, request.getResourceResolver());
- if ( refreshToken.getState() != OidcTokenState.VALID ) {
+ OAuthToken refreshToken = tokenStore.getRefreshToken(connection, request.getResourceResolver());
+ if ( refreshToken.getState() != TokenState.VALID ) {
response.sendRedirect(OAuthUris.getOidcEntryPointUri(connection, request, redirectPath).toString());
return;
}
- OidcTokens oidcTokens = oidcClient.refreshTokens(connection, refreshToken.getValue());
+ OAuthTokens oidcTokens = oidcClient.refreshTokens(connection, refreshToken.getValue());
tokenStore.persistTokens(connection, request.getResourceResolver(), oidcTokens);
doGetWithToken(request, response, tokenResponse);
break;
@@ -96,6 +96,6 @@ public abstract class OAuthEnabledSlingServlet extends SlingSafeMethodsServlet {
return request.getRequestURI();
}
- protected abstract void doGetWithToken(@NotNull SlingHttpServletRequest request, @NotNull SlingHttpServletResponse response, OidcToken token)
+ protected abstract void doGetWithToken(@NotNull SlingHttpServletRequest request, @NotNull SlingHttpServletResponse response, OAuthToken token)
throws ServletException, IOException;
}
diff --git a/org.apache.sling.servlets.oidc-rp/src/test/java/org/apache/sling/servlets/oidc_rp/impl/OidcConnectionFinderImplTest.java b/org.apache.sling.servlets.oidc-rp/src/test/java/org/apache/sling/servlets/oidc_rp/impl/OidcConnectionFinderImplTest.java
index 54de7f7c..bd717cd9 100644
--- a/org.apache.sling.servlets.oidc-rp/src/test/java/org/apache/sling/servlets/oidc_rp/impl/OidcConnectionFinderImplTest.java
+++ b/org.apache.sling.servlets.oidc-rp/src/test/java/org/apache/sling/servlets/oidc_rp/impl/OidcConnectionFinderImplTest.java
@@ -25,11 +25,11 @@ import javax.jcr.RepositoryException;
import org.apache.jackrabbit.api.security.user.User;
import org.apache.sling.api.resource.Resource;
import org.apache.sling.api.resource.ValueMap;
+import org.apache.sling.extensions.oidc_rp.OAuthToken;
import org.apache.sling.extensions.oidc_rp.OidcConnection;
-import org.apache.sling.extensions.oidc_rp.OidcToken;
-import org.apache.sling.extensions.oidc_rp.OidcTokenState;
+import org.apache.sling.extensions.oidc_rp.TokenState;
import org.apache.sling.extensions.oidc_rp.impl.Converter;
-import org.apache.sling.extensions.oidc_rp.impl.JcrUserHomeOidcTokenStore;
+import org.apache.sling.extensions.oidc_rp.impl.JcrUserHomeOAuthTokenStore;
import org.apache.sling.jackrabbit.usermanager.impl.AuthorizableAdapterFactory;
import org.apache.sling.testing.mock.sling.ResourceResolverType;
import org.apache.sling.testing.mock.sling.junit5.SlingContext;
@@ -60,8 +60,8 @@ class OidcConnectionFinderImplTest {
OIDCTokens tokens = new OIDCTokens(new BearerAccessToken(12), null);
- JcrUserHomeOidcTokenStore connectionFinder = new JcrUserHomeOidcTokenStore();
- connectionFinder.persistTokens(connection, context.resourceResolver(), Converter.toApiOidcTokens(tokens));
+ JcrUserHomeOAuthTokenStore connectionFinder = new JcrUserHomeOAuthTokenStore();
+ connectionFinder.persistTokens(connection, context.resourceResolver(), Converter.toSlingOAuthTokens(tokens));
Resource connectionResource = getConnectionResource(connection);
@@ -77,8 +77,8 @@ class OidcConnectionFinderImplTest {
OIDCTokens tokens = new OIDCTokens(new PlainJWT(new JWTClaimsSet.Builder().issuer("example.com").build()), new BearerAccessToken(12), null);
- JcrUserHomeOidcTokenStore connectionFinder = new JcrUserHomeOidcTokenStore();
- connectionFinder.persistTokens(connection, context.resourceResolver(), Converter.toApiOidcTokens(tokens));
+ JcrUserHomeOAuthTokenStore connectionFinder = new JcrUserHomeOAuthTokenStore();
+ connectionFinder.persistTokens(connection, context.resourceResolver(), Converter.toSlingOAuthTokens(tokens));
Resource connectionResource = getConnectionResource(connection);
@@ -94,14 +94,14 @@ class OidcConnectionFinderImplTest {
@Test
void getAccessToken_missing() {
- JcrUserHomeOidcTokenStore connectionFinder = new JcrUserHomeOidcTokenStore();
+ JcrUserHomeOAuthTokenStore connectionFinder = new JcrUserHomeOAuthTokenStore();
- OidcToken accessToken = connectionFinder.getAccessToken(connection, context.resourceResolver());
+ OAuthToken accessToken = connectionFinder.getAccessToken(connection, context.resourceResolver());
assertThat(accessToken).as("access token")
.isNotNull()
- .extracting( OidcToken::getState )
- .isEqualTo( OidcTokenState.MISSING );
+ .extracting( OAuthToken::getState )
+ .isEqualTo( TokenState.MISSING );
}
@Test
@@ -109,14 +109,14 @@ class OidcConnectionFinderImplTest {
OIDCTokens tokens = new OIDCTokens(new BearerAccessToken(12), null);
- JcrUserHomeOidcTokenStore connectionFinder = new JcrUserHomeOidcTokenStore();
- connectionFinder.persistTokens(connection, context.resourceResolver(), Converter.toApiOidcTokens(tokens));
+ JcrUserHomeOAuthTokenStore connectionFinder = new JcrUserHomeOAuthTokenStore();
+ connectionFinder.persistTokens(connection, context.resourceResolver(), Converter.toSlingOAuthTokens(tokens));
- OidcToken accessToken = connectionFinder.getAccessToken(connection, context.resourceResolver());
+ OAuthToken accessToken = connectionFinder.getAccessToken(connection, context.resourceResolver());
assertThat(accessToken).as("access token")
.isNotNull()
- .extracting( OidcToken::getState , OidcToken::getValue )
- .containsExactly( OidcTokenState.VALID, tokens.getAccessToken().getValue() );
+ .extracting( OAuthToken::getState , OAuthToken::getValue )
+ .containsExactly( TokenState.VALID, tokens.getAccessToken().getValue() );
}
@Test
@@ -125,43 +125,43 @@ class OidcConnectionFinderImplTest {
int lifetimeSeconds = 1;
OIDCTokens tokens = new OIDCTokens(new BearerAccessToken(12, lifetimeSeconds, null), null);
- JcrUserHomeOidcTokenStore connectionFinder = new JcrUserHomeOidcTokenStore();
- connectionFinder.persistTokens(connection, context.resourceResolver(), Converter.toApiOidcTokens(tokens));
+ JcrUserHomeOAuthTokenStore connectionFinder = new JcrUserHomeOAuthTokenStore();
+ connectionFinder.persistTokens(connection, context.resourceResolver(), Converter.toSlingOAuthTokens(tokens));
// wait for the token to expire
Thread.sleep( TimeUnit.SECONDS.toMillis( 2 * lifetimeSeconds ) );
- OidcToken accessToken = connectionFinder.getAccessToken(connection, context.resourceResolver());
+ OAuthToken accessToken = connectionFinder.getAccessToken(connection, context.resourceResolver());
assertThat(accessToken).as("access token")
.isNotNull()
- .extracting( OidcToken::getState )
- .isEqualTo( OidcTokenState.EXPIRED );
+ .extracting( OAuthToken::getState )
+ .isEqualTo( TokenState.EXPIRED );
}
@Test
void getRefreshToken_valid() {
OIDCTokens tokens = new OIDCTokens(new BearerAccessToken(12), new RefreshToken(12));
- JcrUserHomeOidcTokenStore connectionFinder = new JcrUserHomeOidcTokenStore();
- connectionFinder.persistTokens(connection, context.resourceResolver(), Converter.toApiOidcTokens(tokens));
+ JcrUserHomeOAuthTokenStore connectionFinder = new JcrUserHomeOAuthTokenStore();
+ connectionFinder.persistTokens(connection, context.resourceResolver(), Converter.toSlingOAuthTokens(tokens));
- OidcToken refreshToken = connectionFinder.getRefreshToken(connection, context.resourceResolver());
+ OAuthToken refreshToken = connectionFinder.getRefreshToken(connection, context.resourceResolver());
assertThat(refreshToken).as("refresh token")
.isNotNull()
- .extracting( OidcToken::getState , OidcToken::getValue )
- .containsExactly( OidcTokenState.VALID, tokens.getRefreshToken().getValue() );
+ .extracting( OAuthToken::getState , OAuthToken::getValue )
+ .containsExactly( TokenState.VALID, tokens.getRefreshToken().getValue() );
}
@Test
void getRefreshToken_missing() {
- JcrUserHomeOidcTokenStore connectionFinder = new JcrUserHomeOidcTokenStore();
+ JcrUserHomeOAuthTokenStore connectionFinder = new JcrUserHomeOAuthTokenStore();
- OidcToken refreshToken = connectionFinder.getRefreshToken(connection, context.resourceResolver());
+ OAuthToken refreshToken = connectionFinder.getRefreshToken(connection, context.resourceResolver());
assertThat(refreshToken).as("refresh token")
.isNotNull()
- .extracting( OidcToken::getState )
- .isEqualTo( OidcTokenState.MISSING);
+ .extracting( OAuthToken::getState )
+ .isEqualTo( TokenState.MISSING);
}
private Resource getConnectionResource(OidcConnection connection) throws RepositoryException {