You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@cxf.apache.org by se...@apache.org on 2014/11/07 15:17:04 UTC
cxf git commit: Making OAuth2 module depend on JOSE
Repository: cxf
Updated Branches:
refs/heads/master e9d6f160f -> 4915ce370
Making OAuth2 module depend on JOSE
Project: http://git-wip-us.apache.org/repos/asf/cxf/repo
Commit: http://git-wip-us.apache.org/repos/asf/cxf/commit/4915ce37
Tree: http://git-wip-us.apache.org/repos/asf/cxf/tree/4915ce37
Diff: http://git-wip-us.apache.org/repos/asf/cxf/diff/4915ce37
Branch: refs/heads/master
Commit: 4915ce370e5f1905f77ebecc8883cc86fcc3e4f4
Parents: e9d6f16
Author: Sergey Beryozkin <sb...@talend.com>
Authored: Fri Nov 7 14:16:46 2014 +0000
Committer: Sergey Beryozkin <sb...@talend.com>
Committed: Fri Nov 7 14:16:46 2014 +0000
----------------------------------------------------------------------
.../features/src/main/resources/features.xml | 8 +-
rt/pom.xml | 2 +-
.../cxf/rs/security/jose/jws/JwsUtils.java | 4 +
rt/rs/security/oauth-parent/oauth2-jose/pom.xml | 56 ---------
.../jose/jwt/grant/AbstractJwtBearerGrant.java | 69 -----------
.../jose/jwt/grant/AbstractJwtHandler.java | 100 ---------------
.../rs/security/jose/jwt/grant/Constants.java | 33 -----
.../grant/JwtBearerClientCredentialsGrant.java | 41 -------
.../security/jose/jwt/grant/JwtBearerGrant.java | 48 --------
.../jose/jwt/grant/JwtBearerGrantHandler.java | 91 --------------
.../security/jose/jwt/grant/JwtUserSubject.java | 34 -----
.../jose/jwt/token/JwtAccessTokenUtils.java | 123 -------------------
.../jose/jwt/grant/JwtUserSubjectTest.java | 32 -----
rt/rs/security/oauth-parent/oauth2/pom.xml | 12 +-
.../grants/jwt/AbstractJwtBearerGrant.java | 69 +++++++++++
.../oauth2/grants/jwt/AbstractJwtHandler.java | 100 +++++++++++++++
.../security/oauth2/grants/jwt/Constants.java | 33 +++++
.../jwt/JwtBearerClientCredentialsGrant.java | 41 +++++++
.../oauth2/grants/jwt/JwtBearerGrant.java | 48 ++++++++
.../grants/jwt/JwtBearerGrantHandler.java | 91 ++++++++++++++
.../oauth2/grants/jwt/JwtUserSubject.java | 34 +++++
.../utils/crypto/JwtAccessTokenUtils.java | 119 ++++++++++++++++++
.../oauth2/grants/jwt/JwtUserSubjectTest.java | 32 +++++
rt/rs/security/oauth-parent/pom.xml | 1 -
24 files changed, 581 insertions(+), 640 deletions(-)
----------------------------------------------------------------------
http://git-wip-us.apache.org/repos/asf/cxf/blob/4915ce37/osgi/karaf/features/src/main/resources/features.xml
----------------------------------------------------------------------
diff --git a/osgi/karaf/features/src/main/resources/features.xml b/osgi/karaf/features/src/main/resources/features.xml
index 7393641..ade817d 100644
--- a/osgi/karaf/features/src/main/resources/features.xml
+++ b/osgi/karaf/features/src/main/resources/features.xml
@@ -201,14 +201,14 @@
<bundle start-level="30" dependency="true">mvn:org.apache.servicemix.bundles/org.apache.servicemix.bundles.oauth-provider/${cxf.oauth.bundle.version}</bundle>
<bundle start-level="40">mvn:org.apache.cxf/cxf-rt-rs-security-oauth/${project.version}</bundle>
</feature>
- <feature name="cxf-rs-security-oauth2" version="${project.version}" resolver="(obr)">
- <feature version="${project.version}">cxf-jaxrs</feature>
- <bundle start-level="40">mvn:org.apache.cxf/cxf-rt-rs-security-oauth2/${project.version}</bundle>
- </feature>
<feature name="cxf-rs-security-jose" version="${project.version}" resolver="(obr)">
<feature version="${project.version}">cxf-jaxrs</feature>
<bundle start-level="40">mvn:org.apache.cxf/cxf-rt-rs-security-jose/${project.version}</bundle>
</feature>
+ <feature name="cxf-rs-security-oauth2" version="${project.version}" resolver="(obr)">
+ <feature version="${project.version}">cxf-rs-security-jose</feature>
+ <bundle start-level="40">mvn:org.apache.cxf/cxf-rt-rs-security-oauth2/${project.version}</bundle>
+ </feature>
<feature name="cxf-databinding-aegis" version="${project.version}" resolver="(obr)">
<feature version="${project.version}">cxf-wsdl</feature>
<feature version="${project.version}">cxf-bindings-soap</feature>
http://git-wip-us.apache.org/repos/asf/cxf/blob/4915ce37/rt/pom.xml
----------------------------------------------------------------------
diff --git a/rt/pom.xml b/rt/pom.xml
index b5975a6..b76a3c9 100644
--- a/rt/pom.xml
+++ b/rt/pom.xml
@@ -62,9 +62,9 @@
<module>rs/extensions/providers</module>
<module>rs/extensions/search</module>
<module>rs/security/xml</module>
- <module>rs/security/sso/saml</module>
<module>rs/security/jose</module>
<module>rs/security/oauth-parent</module>
+ <module>rs/security/sso/saml</module>
<module>rs/security/cors</module>
<module>management</module>
<module>management-web</module>
http://git-wip-us.apache.org/repos/asf/cxf/blob/4915ce37/rt/rs/security/jose/src/main/java/org/apache/cxf/rs/security/jose/jws/JwsUtils.java
----------------------------------------------------------------------
diff --git a/rt/rs/security/jose/src/main/java/org/apache/cxf/rs/security/jose/jws/JwsUtils.java b/rt/rs/security/jose/src/main/java/org/apache/cxf/rs/security/jose/jws/JwsUtils.java
index 8a5a151..aa59142 100644
--- a/rt/rs/security/jose/src/main/java/org/apache/cxf/rs/security/jose/jws/JwsUtils.java
+++ b/rt/rs/security/jose/src/main/java/org/apache/cxf/rs/security/jose/jws/JwsUtils.java
@@ -48,6 +48,10 @@ public final class JwsUtils {
public static String sign(byte[] key, String algo, String content) {
return sign(getHmacSignatureProvider(key, algo), content);
}
+ public static String verifyAndGetContent(RSAPublicKey key, String algo, String content) {
+ JwsCompactConsumer jws = verify(getRSAKeySignatureVerifier(key, algo), content);
+ return jws.getDecodedJwsPayload();
+ }
public static String verifyAndGetContent(byte[] key, String algo, String content) {
JwsCompactConsumer jws = verify(getHmacSignatureVerifier(key, algo), content);
return jws.getDecodedJwsPayload();
http://git-wip-us.apache.org/repos/asf/cxf/blob/4915ce37/rt/rs/security/oauth-parent/oauth2-jose/pom.xml
----------------------------------------------------------------------
diff --git a/rt/rs/security/oauth-parent/oauth2-jose/pom.xml b/rt/rs/security/oauth-parent/oauth2-jose/pom.xml
deleted file mode 100644
index 3f1e1ab..0000000
--- a/rt/rs/security/oauth-parent/oauth2-jose/pom.xml
+++ /dev/null
@@ -1,56 +0,0 @@
-<?xml version="1.0"?>
-<!--
- Licensed to the Apache Software Foundation (ASF) under one
- or more contributor license agreements. See the NOTICE file
- distributed with this work for additional information
- regarding copyright ownership. The ASF licenses this file
- to you under the Apache License, Version 2.0 (the
- "License"); you may not use this file except in compliance
- with the License. You may obtain a copy of the License at
-
- http://www.apache.org/licenses/LICENSE-2.0
-
- Unless required by applicable law or agreed to in writing,
- software distributed under the License is distributed on an
- "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- KIND, either express or implied. See the License for the
- specific language governing permissions and limitations
- under the License.
--->
-<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">
- <modelVersion>4.0.0</modelVersion>
- <artifactId>cxf-rt-rs-security-oauth2-jose</artifactId>
- <packaging>bundle</packaging>
- <name>Apache CXF Runtime OAuth 2.0 JOSE</name>
- <description>Apache CXF Runtime OAuth 2.0 JOSE</description>
- <url>http://cxf.apache.org</url>
- <parent>
- <artifactId>cxf-rt-rs-security-oauth-parent</artifactId>
- <groupId>org.apache.cxf</groupId>
- <version>3.1.0-SNAPSHOT</version>
- <relativePath>../pom.xml</relativePath>
- </parent>
- <dependencies>
- <dependency>
- <groupId>org.apache.cxf</groupId>
- <artifactId>cxf-rt-rs-security-oauth2</artifactId>
- <version>${project.version}</version>
- </dependency>
- <dependency>
- <groupId>org.apache.cxf</groupId>
- <artifactId>cxf-rt-rs-security-jose</artifactId>
- <version>${project.version}</version>
- </dependency>
- <!--test dependencies-->
- <dependency>
- <groupId>junit</groupId>
- <artifactId>junit</artifactId>
- <scope>test</scope>
- </dependency>
- <dependency>
- <groupId>org.easymock</groupId>
- <artifactId>easymock</artifactId>
- <scope>test</scope>
- </dependency>
- </dependencies>
-</project>
http://git-wip-us.apache.org/repos/asf/cxf/blob/4915ce37/rt/rs/security/oauth-parent/oauth2-jose/src/main/java/org/apache/cxf/rs/security/jose/jwt/grant/AbstractJwtBearerGrant.java
----------------------------------------------------------------------
diff --git a/rt/rs/security/oauth-parent/oauth2-jose/src/main/java/org/apache/cxf/rs/security/jose/jwt/grant/AbstractJwtBearerGrant.java b/rt/rs/security/oauth-parent/oauth2-jose/src/main/java/org/apache/cxf/rs/security/jose/jwt/grant/AbstractJwtBearerGrant.java
deleted file mode 100644
index f5705ae..0000000
--- a/rt/rs/security/oauth-parent/oauth2-jose/src/main/java/org/apache/cxf/rs/security/jose/jwt/grant/AbstractJwtBearerGrant.java
+++ /dev/null
@@ -1,69 +0,0 @@
-/**
- * Licensed to the Apache Software Foundation (ASF) under one
- * or more contributor license agreements. See the NOTICE file
- * distributed with this work for additional information
- * regarding copyright ownership. The ASF licenses this file
- * to you under the Apache License, Version 2.0 (the
- * "License"); you may not use this file except in compliance
- * with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied. See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-package org.apache.cxf.rs.security.jose.jwt.grant;
-
-import javax.ws.rs.core.MultivaluedMap;
-
-import org.apache.cxf.common.util.Base64UrlUtility;
-import org.apache.cxf.jaxrs.impl.MetadataMap;
-import org.apache.cxf.rs.security.oauth2.common.AccessTokenGrant;
-import org.apache.cxf.rs.security.oauth2.provider.OAuthServiceException;
-import org.apache.cxf.rs.security.oauth2.utils.OAuthConstants;
-
-public abstract class AbstractJwtBearerGrant implements AccessTokenGrant {
- private static final long serialVersionUID = 5754722119855372511L;
- private String assertion;
- private String scope;
- private boolean encoded;
- private String grantType;
- protected AbstractJwtBearerGrant(String grantType, String assertion, boolean encoded, String scope) {
- this.grantType = grantType;
- this.assertion = assertion;
- this.encoded = encoded;
- this.scope = scope;
- }
-
- public String getType() {
- return grantType;
- }
-
- protected MultivaluedMap<String, String> initMap() {
- MultivaluedMap<String, String> map = new MetadataMap<String, String>();
- map.putSingle(OAuthConstants.GRANT_TYPE, grantType);
- return map;
- }
-
- protected void addScope(MultivaluedMap<String, String> map) {
- if (scope != null) {
- map.putSingle(OAuthConstants.SCOPE, scope);
- }
- }
-
- protected String encodeAssertion() {
- if (encoded) {
- return assertion;
- }
-
- try {
- return Base64UrlUtility.encode(assertion);
- } catch (Exception ex) {
- throw new OAuthServiceException(ex.getMessage(), ex);
- }
- }
-}
http://git-wip-us.apache.org/repos/asf/cxf/blob/4915ce37/rt/rs/security/oauth-parent/oauth2-jose/src/main/java/org/apache/cxf/rs/security/jose/jwt/grant/AbstractJwtHandler.java
----------------------------------------------------------------------
diff --git a/rt/rs/security/oauth-parent/oauth2-jose/src/main/java/org/apache/cxf/rs/security/jose/jwt/grant/AbstractJwtHandler.java b/rt/rs/security/oauth-parent/oauth2-jose/src/main/java/org/apache/cxf/rs/security/jose/jwt/grant/AbstractJwtHandler.java
deleted file mode 100644
index ff163b0..0000000
--- a/rt/rs/security/oauth-parent/oauth2-jose/src/main/java/org/apache/cxf/rs/security/jose/jwt/grant/AbstractJwtHandler.java
+++ /dev/null
@@ -1,100 +0,0 @@
-/**
- * Licensed to the Apache Software Foundation (ASF) under one
- * or more contributor license agreements. See the NOTICE file
- * distributed with this work for additional information
- * regarding copyright ownership. The ASF licenses this file
- * to you under the Apache License, Version 2.0 (the
- * "License"); you may not use this file except in compliance
- * with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied. See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-package org.apache.cxf.rs.security.jose.jwt.grant;
-
-import java.util.List;
-import java.util.Set;
-
-import org.apache.cxf.rs.security.jose.JoseHeaders;
-import org.apache.cxf.rs.security.jose.jws.JwsSignatureVerifier;
-import org.apache.cxf.rs.security.jose.jwt.JwtClaims;
-import org.apache.cxf.rs.security.oauth2.common.Client;
-import org.apache.cxf.rs.security.oauth2.grants.AbstractGrantHandler;
-import org.apache.cxf.rs.security.oauth2.provider.OAuthServiceException;
-import org.apache.cxf.rs.security.oauth2.utils.OAuthConstants;
-
-
-/**
- * The "JWT Bearer" grant handler
- */
-public abstract class AbstractJwtHandler extends AbstractGrantHandler {
- private Set<String> supportedIssuers;
- private JwsSignatureVerifier jwsVefifier;
-
- protected AbstractJwtHandler(List<String> grants) {
- super(grants);
- }
-
- protected void validateSignature(JoseHeaders headers, String unsignedText, byte[] signature) {
- if (jwsVefifier.verify(headers, unsignedText, signature)) {
- throw new OAuthServiceException(OAuthConstants.INVALID_GRANT);
- }
- }
-
- protected void validateClaims(Client client, JwtClaims claims) {
- validateIssuer(claims.getIssuer());
- validateSubject(client, claims.getSubject());
- validateAudience(client, claims.getAudience());
- validateExpiryTime(claims.getExpiryTime());
- validateNotBeforeTime(claims.getNotBefore());
- validateIssuedAtTime(claims.getIssuedAt());
- validateTokenId(claims.getTokenId());
- }
-
- protected void validateIssuer(String issuer) {
- if (issuer == null || !supportedIssuers.contains(issuer)) {
- throw new OAuthServiceException(OAuthConstants.INVALID_GRANT);
- }
- }
-
- protected void validateSubject(Client client, String subject) {
- //TODO
- }
- protected void validateAudience(Client client, String audience) {
- //TODO
- }
- protected void validateExpiryTime(Long timestamp) {
- if (timestamp != null) {
- //TODO
- }
- }
- protected void validateNotBeforeTime(Long timestamp) {
- if (timestamp != null) {
- //TODO
- }
- }
- protected void validateIssuedAtTime(Long timestamp) {
- if (timestamp != null) {
- //TODO
- }
- }
- protected void validateTokenId(String tokenId) {
- if (tokenId != null) {
- //TODO
- }
- }
- public void setSupportedIssuers(Set<String> supportedIssuers) {
- this.supportedIssuers = supportedIssuers;
- }
-
- public void setJwsVefifier(JwsSignatureVerifier jwsVefifier) {
- this.jwsVefifier = jwsVefifier;
- }
-
-}
http://git-wip-us.apache.org/repos/asf/cxf/blob/4915ce37/rt/rs/security/oauth-parent/oauth2-jose/src/main/java/org/apache/cxf/rs/security/jose/jwt/grant/Constants.java
----------------------------------------------------------------------
diff --git a/rt/rs/security/oauth-parent/oauth2-jose/src/main/java/org/apache/cxf/rs/security/jose/jwt/grant/Constants.java b/rt/rs/security/oauth-parent/oauth2-jose/src/main/java/org/apache/cxf/rs/security/jose/jwt/grant/Constants.java
deleted file mode 100644
index 8714aac..0000000
--- a/rt/rs/security/oauth-parent/oauth2-jose/src/main/java/org/apache/cxf/rs/security/jose/jwt/grant/Constants.java
+++ /dev/null
@@ -1,33 +0,0 @@
-/**
- * Licensed to the Apache Software Foundation (ASF) under one
- * or more contributor license agreements. See the NOTICE file
- * distributed with this work for additional information
- * regarding copyright ownership. The ASF licenses this file
- * to you under the Apache License, Version 2.0 (the
- * "License"); you may not use this file except in compliance
- * with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied. See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-package org.apache.cxf.rs.security.jose.jwt.grant;
-
-public final class Constants {
- public static final String JWT_BEARER_GRANT = "urn:ietf:params:oauth:grant-type:jwt-bearer";
- public static final String CLIENT_GRANT_ASSERTION_PARAM = "assertion";
-
- public static final String CLIENT_AUTH_ASSERTION_PARAM = "client_assertion";
- public static final String CLIENT_AUTH_ASSERTION_TYPE = "client_assertion_type";
- public static final String CLIENT_AUTH_JWT_BEARER = "urn:ietf:params:oauth:client-assertion-type:jwt-bearer";
-
-
- private Constants() {
-
- }
-}
http://git-wip-us.apache.org/repos/asf/cxf/blob/4915ce37/rt/rs/security/oauth-parent/oauth2-jose/src/main/java/org/apache/cxf/rs/security/jose/jwt/grant/JwtBearerClientCredentialsGrant.java
----------------------------------------------------------------------
diff --git a/rt/rs/security/oauth-parent/oauth2-jose/src/main/java/org/apache/cxf/rs/security/jose/jwt/grant/JwtBearerClientCredentialsGrant.java b/rt/rs/security/oauth-parent/oauth2-jose/src/main/java/org/apache/cxf/rs/security/jose/jwt/grant/JwtBearerClientCredentialsGrant.java
deleted file mode 100644
index f5f86a8..0000000
--- a/rt/rs/security/oauth-parent/oauth2-jose/src/main/java/org/apache/cxf/rs/security/jose/jwt/grant/JwtBearerClientCredentialsGrant.java
+++ /dev/null
@@ -1,41 +0,0 @@
-/**
- * Licensed to the Apache Software Foundation (ASF) under one
- * or more contributor license agreements. See the NOTICE file
- * distributed with this work for additional information
- * regarding copyright ownership. The ASF licenses this file
- * to you under the Apache License, Version 2.0 (the
- * "License"); you may not use this file except in compliance
- * with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied. See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-package org.apache.cxf.rs.security.jose.jwt.grant;
-
-import javax.ws.rs.core.MultivaluedMap;
-
-import org.apache.cxf.rs.security.oauth2.utils.OAuthConstants;
-
-public class JwtBearerClientCredentialsGrant extends AbstractJwtBearerGrant {
-
- private static final long serialVersionUID = 4801583498206813025L;
-
- public JwtBearerClientCredentialsGrant(String assertion, boolean encoded, String scope) {
- super(OAuthConstants.CLIENT_CREDENTIALS_GRANT, assertion, encoded, scope);
- }
-
- public MultivaluedMap<String, String> toMap() {
- MultivaluedMap<String, String> map = initMap();
- map.putSingle(Constants.CLIENT_AUTH_ASSERTION_TYPE, Constants.CLIENT_AUTH_JWT_BEARER);
- map.putSingle(Constants.CLIENT_AUTH_ASSERTION_PARAM, encodeAssertion());
- addScope(map);
- return map;
- }
-
-}
http://git-wip-us.apache.org/repos/asf/cxf/blob/4915ce37/rt/rs/security/oauth-parent/oauth2-jose/src/main/java/org/apache/cxf/rs/security/jose/jwt/grant/JwtBearerGrant.java
----------------------------------------------------------------------
diff --git a/rt/rs/security/oauth-parent/oauth2-jose/src/main/java/org/apache/cxf/rs/security/jose/jwt/grant/JwtBearerGrant.java b/rt/rs/security/oauth-parent/oauth2-jose/src/main/java/org/apache/cxf/rs/security/jose/jwt/grant/JwtBearerGrant.java
deleted file mode 100644
index 49041b9..0000000
--- a/rt/rs/security/oauth-parent/oauth2-jose/src/main/java/org/apache/cxf/rs/security/jose/jwt/grant/JwtBearerGrant.java
+++ /dev/null
@@ -1,48 +0,0 @@
-/**
- * Licensed to the Apache Software Foundation (ASF) under one
- * or more contributor license agreements. See the NOTICE file
- * distributed with this work for additional information
- * regarding copyright ownership. The ASF licenses this file
- * to you under the Apache License, Version 2.0 (the
- * "License"); you may not use this file except in compliance
- * with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied. See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-package org.apache.cxf.rs.security.jose.jwt.grant;
-
-import javax.ws.rs.core.MultivaluedMap;
-
-public class JwtBearerGrant extends AbstractJwtBearerGrant {
- private static final long serialVersionUID = -7296527609343431294L;
-
- public JwtBearerGrant(String assertion) {
- this(assertion, false);
- }
-
- public JwtBearerGrant(String assertion, boolean encoded) {
- this(assertion, false, null);
- }
-
- public JwtBearerGrant(String assertion, String scope) {
- this(assertion, false, scope);
- }
-
- public JwtBearerGrant(String assertion, boolean encoded, String scope) {
- super(Constants.JWT_BEARER_GRANT, assertion, encoded, scope);
- }
-
- public MultivaluedMap<String, String> toMap() {
- MultivaluedMap<String, String> map = initMap();
- map.putSingle(Constants.CLIENT_GRANT_ASSERTION_PARAM, encodeAssertion());
- addScope(map);
- return map;
- }
-}
http://git-wip-us.apache.org/repos/asf/cxf/blob/4915ce37/rt/rs/security/oauth-parent/oauth2-jose/src/main/java/org/apache/cxf/rs/security/jose/jwt/grant/JwtBearerGrantHandler.java
----------------------------------------------------------------------
diff --git a/rt/rs/security/oauth-parent/oauth2-jose/src/main/java/org/apache/cxf/rs/security/jose/jwt/grant/JwtBearerGrantHandler.java b/rt/rs/security/oauth-parent/oauth2-jose/src/main/java/org/apache/cxf/rs/security/jose/jwt/grant/JwtBearerGrantHandler.java
deleted file mode 100644
index f7b25f8..0000000
--- a/rt/rs/security/oauth-parent/oauth2-jose/src/main/java/org/apache/cxf/rs/security/jose/jwt/grant/JwtBearerGrantHandler.java
+++ /dev/null
@@ -1,91 +0,0 @@
-/**
- * Licensed to the Apache Software Foundation (ASF) under one
- * or more contributor license agreements. See the NOTICE file
- * distributed with this work for additional information
- * regarding copyright ownership. The ASF licenses this file
- * to you under the Apache License, Version 2.0 (the
- * "License"); you may not use this file except in compliance
- * with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied. See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-package org.apache.cxf.rs.security.jose.jwt.grant;
-
-import java.util.Arrays;
-
-import javax.ws.rs.core.MultivaluedMap;
-
-import org.apache.cxf.jaxrs.utils.HttpUtils;
-import org.apache.cxf.rs.security.jose.jws.JwsJwtCompactConsumer;
-import org.apache.cxf.rs.security.jose.jwt.JwtToken;
-import org.apache.cxf.rs.security.jose.jwt.JwtTokenReader;
-import org.apache.cxf.rs.security.oauth2.common.Client;
-import org.apache.cxf.rs.security.oauth2.common.ServerAccessToken;
-import org.apache.cxf.rs.security.oauth2.common.UserSubject;
-import org.apache.cxf.rs.security.oauth2.provider.OAuthServiceException;
-import org.apache.cxf.rs.security.oauth2.utils.OAuthConstants;
-import org.apache.cxf.rs.security.oauth2.utils.OAuthUtils;
-
-/**
- * The "JWT Bearer" grant handler
- */
-public class JwtBearerGrantHandler extends AbstractJwtHandler {
- private static final String ENCODED_JWT_BEARER_GRANT;
- static {
- // AccessTokenService may be configured with the form provider
- // which will not decode by default - so listing both the actual
- // and encoded grant type value will help
- ENCODED_JWT_BEARER_GRANT = HttpUtils.urlEncode(Constants.JWT_BEARER_GRANT, "UTF-8");
- }
- private JwtTokenReader jwtReader;
- public JwtBearerGrantHandler() {
- super(Arrays.asList(Constants.JWT_BEARER_GRANT, ENCODED_JWT_BEARER_GRANT));
- }
-
- @Override
- public ServerAccessToken createAccessToken(Client client, MultivaluedMap<String, String> params)
- throws OAuthServiceException {
- String assertion = params.getFirst(Constants.CLIENT_GRANT_ASSERTION_PARAM);
- if (assertion == null) {
- throw new OAuthServiceException(OAuthConstants.INVALID_GRANT);
- }
- try {
- JwsJwtCompactConsumer jwsReader = getJwsReader(assertion);
- JwtToken jwtToken = jwsReader.getJwtToken();
- super.validateSignature(jwtToken.getHeaders(),
- jwsReader.getUnsignedEncodedSequence(),
- jwsReader.getDecodedSignature());
-
-
- super.validateClaims(client, jwtToken.getClaims());
- UserSubject grantSubject = new UserSubject(jwtToken.getClaims().getSubject());
-
- return doCreateAccessToken(client,
- grantSubject,
- Constants.JWT_BEARER_GRANT,
- OAuthUtils.parseScope(params.getFirst(OAuthConstants.SCOPE)));
- } catch (OAuthServiceException ex) {
- throw ex;
- } catch (Exception ex) {
- throw new OAuthServiceException(OAuthConstants.INVALID_GRANT, ex);
- }
-
- }
-
- protected JwsJwtCompactConsumer getJwsReader(String assertion) {
- return new JwsJwtCompactConsumer(assertion, jwtReader);
- }
-
- public void setJwtReader(JwtTokenReader tokenReader) {
- this.jwtReader = tokenReader;
- }
-
-
-}
http://git-wip-us.apache.org/repos/asf/cxf/blob/4915ce37/rt/rs/security/oauth-parent/oauth2-jose/src/main/java/org/apache/cxf/rs/security/jose/jwt/grant/JwtUserSubject.java
----------------------------------------------------------------------
diff --git a/rt/rs/security/oauth-parent/oauth2-jose/src/main/java/org/apache/cxf/rs/security/jose/jwt/grant/JwtUserSubject.java b/rt/rs/security/oauth-parent/oauth2-jose/src/main/java/org/apache/cxf/rs/security/jose/jwt/grant/JwtUserSubject.java
deleted file mode 100644
index 18eaae1..0000000
--- a/rt/rs/security/oauth-parent/oauth2-jose/src/main/java/org/apache/cxf/rs/security/jose/jwt/grant/JwtUserSubject.java
+++ /dev/null
@@ -1,34 +0,0 @@
-/**
- * Licensed to the Apache Software Foundation (ASF) under one
- * or more contributor license agreements. See the NOTICE file
- * distributed with this work for additional information
- * regarding copyright ownership. The ASF licenses this file
- * to you under the Apache License, Version 2.0 (the
- * "License"); you may not use this file except in compliance
- * with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied. See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-package org.apache.cxf.rs.security.jose.jwt.grant;
-
-import org.apache.cxf.rs.security.jose.jwt.JwtToken;
-import org.apache.cxf.rs.security.oauth2.common.UserSubject;
-
-public class JwtUserSubject extends UserSubject {
- private static final long serialVersionUID = -1135272749329239037L;
- private JwtToken token;
- public JwtUserSubject(String user, JwtToken token) {
- super(user);
- this.token = token;
- }
- public JwtToken getToken() {
- return token;
- }
-}
http://git-wip-us.apache.org/repos/asf/cxf/blob/4915ce37/rt/rs/security/oauth-parent/oauth2-jose/src/main/java/org/apache/cxf/rs/security/jose/jwt/token/JwtAccessTokenUtils.java
----------------------------------------------------------------------
diff --git a/rt/rs/security/oauth-parent/oauth2-jose/src/main/java/org/apache/cxf/rs/security/jose/jwt/token/JwtAccessTokenUtils.java b/rt/rs/security/oauth-parent/oauth2-jose/src/main/java/org/apache/cxf/rs/security/jose/jwt/token/JwtAccessTokenUtils.java
deleted file mode 100644
index 594d777..0000000
--- a/rt/rs/security/oauth-parent/oauth2-jose/src/main/java/org/apache/cxf/rs/security/jose/jwt/token/JwtAccessTokenUtils.java
+++ /dev/null
@@ -1,123 +0,0 @@
-/**
- * Licensed to the Apache Software Foundation (ASF) under one
- * or more contributor license agreements. See the NOTICE file
- * distributed with this work for additional information
- * regarding copyright ownership. The ASF licenses this file
- * to you under the Apache License, Version 2.0 (the
- * "License"); you may not use this file except in compliance
- * with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied. See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-package org.apache.cxf.rs.security.jose.jwt.token;
-
-import javax.crypto.SecretKey;
-
-import org.apache.cxf.rs.security.jose.JoseHeaders;
-import org.apache.cxf.rs.security.jose.jwa.Algorithm;
-import org.apache.cxf.rs.security.jose.jwe.AesGcmContentDecryptionAlgorithm;
-import org.apache.cxf.rs.security.jose.jwe.AesGcmContentEncryptionAlgorithm;
-import org.apache.cxf.rs.security.jose.jwe.ContentEncryptionAlgorithm;
-import org.apache.cxf.rs.security.jose.jwe.DirectKeyJweDecryption;
-import org.apache.cxf.rs.security.jose.jwe.DirectKeyJweEncryption;
-import org.apache.cxf.rs.security.jose.jwe.JweDecryptionProvider;
-import org.apache.cxf.rs.security.jose.jwe.JweEncryptionProvider;
-import org.apache.cxf.rs.security.jose.jws.JwsJwtCompactConsumer;
-import org.apache.cxf.rs.security.jose.jws.JwsJwtCompactProducer;
-import org.apache.cxf.rs.security.jose.jws.JwsSignature;
-import org.apache.cxf.rs.security.jose.jws.JwsSignatureProvider;
-import org.apache.cxf.rs.security.jose.jwt.JwtToken;
-import org.apache.cxf.rs.security.oauth2.common.Client;
-import org.apache.cxf.rs.security.oauth2.common.ServerAccessToken;
-import org.apache.cxf.rs.security.oauth2.tokens.bearer.BearerAccessToken;
-
-public final class JwtAccessTokenUtils {
- private JwtAccessTokenUtils() {
-
- }
-
- public static ServerAccessToken toAccessToken(JwtToken jwt,
- Client client,
- SecretKey key) {
- ContentEncryptionAlgorithm contentEncryption =
- new AesGcmContentEncryptionAlgorithm(key, null, Algorithm.A128GCM.getJwtName());
- JweEncryptionProvider jweEncryption = new DirectKeyJweEncryption(contentEncryption);
- return toAccessToken(jwt, client, jweEncryption);
-
- }
-
- public static ServerAccessToken toAccessToken(JwtToken jwt,
- Client client,
- JweEncryptionProvider jweEncryption) {
- String jwtString = new JwsJwtCompactProducer(jwt)
- .signWith(new NoneSignatureProvider());
- String tokenId = jweEncryption.encrypt(getBytes(jwtString), null);
- Long issuedAt = jwt.getClaims().getIssuedAt();
- Long notBefore = jwt.getClaims().getNotBefore();
- if (issuedAt == null) {
- issuedAt = System.currentTimeMillis();
- notBefore = null;
- }
- Long expiresIn = null;
- if (notBefore == null) {
- expiresIn = 3600L;
- } else {
- expiresIn = notBefore - issuedAt;
- }
-
- return new BearerAccessToken(client, tokenId, issuedAt, expiresIn);
-
- }
- public static JwtToken fromAccessTokenId(String tokenId, SecretKey key) {
- DirectKeyJweDecryption jweDecryption =
- new DirectKeyJweDecryption(key,
- new AesGcmContentDecryptionAlgorithm(Algorithm.A128GCM.getJwtName()));
- return fromAccessTokenId(tokenId, jweDecryption);
- }
- public static JwtToken fromAccessTokenId(String tokenId, JweDecryptionProvider jweDecryption) {
- String decrypted = jweDecryption.decrypt(tokenId).getContentText();
- JwsJwtCompactConsumer consumer = new JwsJwtCompactConsumer(decrypted);
- return consumer.getJwtToken();
- }
- private static class NoneSignatureProvider implements JwsSignatureProvider {
-
- @Override
- public String getAlgorithm() {
- return "none";
- }
-
- @Override
- public JwsSignature createJwsSignature(JoseHeaders headers) {
- return new NoneJwsSignature();
- }
-
- }
- private static class NoneJwsSignature implements JwsSignature {
-
- @Override
- public void update(byte[] src, int off, int len) {
- // complete
- }
-
- @Override
- public byte[] sign() {
- return new byte[]{};
- }
-
- }
- private static byte[] getBytes(String str) {
- try {
- return str.getBytes("UTF-8");
- } catch (Exception ex) {
- // ignore
- }
- return null;
- }
-}
http://git-wip-us.apache.org/repos/asf/cxf/blob/4915ce37/rt/rs/security/oauth-parent/oauth2-jose/src/test/java/org/apache/cxf/rs/security/jose/jwt/grant/JwtUserSubjectTest.java
----------------------------------------------------------------------
diff --git a/rt/rs/security/oauth-parent/oauth2-jose/src/test/java/org/apache/cxf/rs/security/jose/jwt/grant/JwtUserSubjectTest.java b/rt/rs/security/oauth-parent/oauth2-jose/src/test/java/org/apache/cxf/rs/security/jose/jwt/grant/JwtUserSubjectTest.java
deleted file mode 100644
index 1be0216..0000000
--- a/rt/rs/security/oauth-parent/oauth2-jose/src/test/java/org/apache/cxf/rs/security/jose/jwt/grant/JwtUserSubjectTest.java
+++ /dev/null
@@ -1,32 +0,0 @@
-/**
- * Licensed to the Apache Software Foundation (ASF) under one
- * or more contributor license agreements. See the NOTICE file
- * distributed with this work for additional information
- * regarding copyright ownership. The ASF licenses this file
- * to you under the Apache License, Version 2.0 (the
- * "License"); you may not use this file except in compliance
- * with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied. See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-package org.apache.cxf.rs.security.jose.jwt.grant;
-
-import org.junit.Assert;
-import org.junit.Test;
-
-public class JwtUserSubjectTest extends Assert {
-
- @Test
- public void testJwtUserSubject() {
- // to be expanded
- assertNotNull(new JwtUserSubject("user", null));
- }
-
-}
http://git-wip-us.apache.org/repos/asf/cxf/blob/4915ce37/rt/rs/security/oauth-parent/oauth2/pom.xml
----------------------------------------------------------------------
diff --git a/rt/rs/security/oauth-parent/oauth2/pom.xml b/rt/rs/security/oauth-parent/oauth2/pom.xml
index 5e2661b..9411505 100644
--- a/rt/rs/security/oauth-parent/oauth2/pom.xml
+++ b/rt/rs/security/oauth-parent/oauth2/pom.xml
@@ -43,6 +43,11 @@
</dependency>
<dependency>
<groupId>org.apache.cxf</groupId>
+ <artifactId>cxf-rt-rs-security-jose</artifactId>
+ <version>${project.version}</version>
+ </dependency>
+ <dependency>
+ <groupId>org.apache.cxf</groupId>
<artifactId>cxf-rt-rs-client</artifactId>
<version>${project.version}</version>
</dependency>
@@ -59,13 +64,6 @@
<scope>provided</scope>
<optional>true</optional>
</dependency>
- <!--test dependencies-->
- <dependency>
- <groupId>org.apache.cxf</groupId>
- <artifactId>cxf-rt-rs-extension-providers</artifactId>
- <version>${project.version}</version>
- <scope>test</scope>
- </dependency>
<dependency>
<groupId>org.codehaus.jettison</groupId>
<artifactId>jettison</artifactId>
http://git-wip-us.apache.org/repos/asf/cxf/blob/4915ce37/rt/rs/security/oauth-parent/oauth2/src/main/java/org/apache/cxf/rs/security/oauth2/grants/jwt/AbstractJwtBearerGrant.java
----------------------------------------------------------------------
diff --git a/rt/rs/security/oauth-parent/oauth2/src/main/java/org/apache/cxf/rs/security/oauth2/grants/jwt/AbstractJwtBearerGrant.java b/rt/rs/security/oauth-parent/oauth2/src/main/java/org/apache/cxf/rs/security/oauth2/grants/jwt/AbstractJwtBearerGrant.java
new file mode 100644
index 0000000..2e21e8d
--- /dev/null
+++ b/rt/rs/security/oauth-parent/oauth2/src/main/java/org/apache/cxf/rs/security/oauth2/grants/jwt/AbstractJwtBearerGrant.java
@@ -0,0 +1,69 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.cxf.rs.security.oauth2.grants.jwt;
+
+import javax.ws.rs.core.MultivaluedMap;
+
+import org.apache.cxf.common.util.Base64UrlUtility;
+import org.apache.cxf.jaxrs.impl.MetadataMap;
+import org.apache.cxf.rs.security.oauth2.common.AccessTokenGrant;
+import org.apache.cxf.rs.security.oauth2.provider.OAuthServiceException;
+import org.apache.cxf.rs.security.oauth2.utils.OAuthConstants;
+
+public abstract class AbstractJwtBearerGrant implements AccessTokenGrant {
+ private static final long serialVersionUID = 5754722119855372511L;
+ private String assertion;
+ private String scope;
+ private boolean encoded;
+ private String grantType;
+ protected AbstractJwtBearerGrant(String grantType, String assertion, boolean encoded, String scope) {
+ this.grantType = grantType;
+ this.assertion = assertion;
+ this.encoded = encoded;
+ this.scope = scope;
+ }
+
+ public String getType() {
+ return grantType;
+ }
+
+ protected MultivaluedMap<String, String> initMap() {
+ MultivaluedMap<String, String> map = new MetadataMap<String, String>();
+ map.putSingle(OAuthConstants.GRANT_TYPE, grantType);
+ return map;
+ }
+
+ protected void addScope(MultivaluedMap<String, String> map) {
+ if (scope != null) {
+ map.putSingle(OAuthConstants.SCOPE, scope);
+ }
+ }
+
+ protected String encodeAssertion() {
+ if (encoded) {
+ return assertion;
+ }
+
+ try {
+ return Base64UrlUtility.encode(assertion);
+ } catch (Exception ex) {
+ throw new OAuthServiceException(ex.getMessage(), ex);
+ }
+ }
+}
http://git-wip-us.apache.org/repos/asf/cxf/blob/4915ce37/rt/rs/security/oauth-parent/oauth2/src/main/java/org/apache/cxf/rs/security/oauth2/grants/jwt/AbstractJwtHandler.java
----------------------------------------------------------------------
diff --git a/rt/rs/security/oauth-parent/oauth2/src/main/java/org/apache/cxf/rs/security/oauth2/grants/jwt/AbstractJwtHandler.java b/rt/rs/security/oauth-parent/oauth2/src/main/java/org/apache/cxf/rs/security/oauth2/grants/jwt/AbstractJwtHandler.java
new file mode 100644
index 0000000..33c1ecf
--- /dev/null
+++ b/rt/rs/security/oauth-parent/oauth2/src/main/java/org/apache/cxf/rs/security/oauth2/grants/jwt/AbstractJwtHandler.java
@@ -0,0 +1,100 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.cxf.rs.security.oauth2.grants.jwt;
+
+import java.util.List;
+import java.util.Set;
+
+import org.apache.cxf.rs.security.jose.JoseHeaders;
+import org.apache.cxf.rs.security.jose.jws.JwsSignatureVerifier;
+import org.apache.cxf.rs.security.jose.jwt.JwtClaims;
+import org.apache.cxf.rs.security.oauth2.common.Client;
+import org.apache.cxf.rs.security.oauth2.grants.AbstractGrantHandler;
+import org.apache.cxf.rs.security.oauth2.provider.OAuthServiceException;
+import org.apache.cxf.rs.security.oauth2.utils.OAuthConstants;
+
+
+/**
+ * The "JWT Bearer" grant handler
+ */
+public abstract class AbstractJwtHandler extends AbstractGrantHandler {
+ private Set<String> supportedIssuers;
+ private JwsSignatureVerifier jwsVefifier;
+
+ protected AbstractJwtHandler(List<String> grants) {
+ super(grants);
+ }
+
+ protected void validateSignature(JoseHeaders headers, String unsignedText, byte[] signature) {
+ if (jwsVefifier.verify(headers, unsignedText, signature)) {
+ throw new OAuthServiceException(OAuthConstants.INVALID_GRANT);
+ }
+ }
+
+ protected void validateClaims(Client client, JwtClaims claims) {
+ validateIssuer(claims.getIssuer());
+ validateSubject(client, claims.getSubject());
+ validateAudience(client, claims.getAudience());
+ validateExpiryTime(claims.getExpiryTime());
+ validateNotBeforeTime(claims.getNotBefore());
+ validateIssuedAtTime(claims.getIssuedAt());
+ validateTokenId(claims.getTokenId());
+ }
+
+ protected void validateIssuer(String issuer) {
+ if (issuer == null || !supportedIssuers.contains(issuer)) {
+ throw new OAuthServiceException(OAuthConstants.INVALID_GRANT);
+ }
+ }
+
+ protected void validateSubject(Client client, String subject) {
+ //TODO
+ }
+ protected void validateAudience(Client client, String audience) {
+ //TODO
+ }
+ protected void validateExpiryTime(Long timestamp) {
+ if (timestamp != null) {
+ //TODO
+ }
+ }
+ protected void validateNotBeforeTime(Long timestamp) {
+ if (timestamp != null) {
+ //TODO
+ }
+ }
+ protected void validateIssuedAtTime(Long timestamp) {
+ if (timestamp != null) {
+ //TODO
+ }
+ }
+ protected void validateTokenId(String tokenId) {
+ if (tokenId != null) {
+ //TODO
+ }
+ }
+ public void setSupportedIssuers(Set<String> supportedIssuers) {
+ this.supportedIssuers = supportedIssuers;
+ }
+
+ public void setJwsVefifier(JwsSignatureVerifier jwsVefifier) {
+ this.jwsVefifier = jwsVefifier;
+ }
+
+}
http://git-wip-us.apache.org/repos/asf/cxf/blob/4915ce37/rt/rs/security/oauth-parent/oauth2/src/main/java/org/apache/cxf/rs/security/oauth2/grants/jwt/Constants.java
----------------------------------------------------------------------
diff --git a/rt/rs/security/oauth-parent/oauth2/src/main/java/org/apache/cxf/rs/security/oauth2/grants/jwt/Constants.java b/rt/rs/security/oauth-parent/oauth2/src/main/java/org/apache/cxf/rs/security/oauth2/grants/jwt/Constants.java
new file mode 100644
index 0000000..11a65ff
--- /dev/null
+++ b/rt/rs/security/oauth-parent/oauth2/src/main/java/org/apache/cxf/rs/security/oauth2/grants/jwt/Constants.java
@@ -0,0 +1,33 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.cxf.rs.security.oauth2.grants.jwt;
+
+public final class Constants {
+ public static final String JWT_BEARER_GRANT = "urn:ietf:params:oauth:grant-type:jwt-bearer";
+ public static final String CLIENT_GRANT_ASSERTION_PARAM = "assertion";
+
+ public static final String CLIENT_AUTH_ASSERTION_PARAM = "client_assertion";
+ public static final String CLIENT_AUTH_ASSERTION_TYPE = "client_assertion_type";
+ public static final String CLIENT_AUTH_JWT_BEARER = "urn:ietf:params:oauth:client-assertion-type:jwt-bearer";
+
+
+ private Constants() {
+
+ }
+}
http://git-wip-us.apache.org/repos/asf/cxf/blob/4915ce37/rt/rs/security/oauth-parent/oauth2/src/main/java/org/apache/cxf/rs/security/oauth2/grants/jwt/JwtBearerClientCredentialsGrant.java
----------------------------------------------------------------------
diff --git a/rt/rs/security/oauth-parent/oauth2/src/main/java/org/apache/cxf/rs/security/oauth2/grants/jwt/JwtBearerClientCredentialsGrant.java b/rt/rs/security/oauth-parent/oauth2/src/main/java/org/apache/cxf/rs/security/oauth2/grants/jwt/JwtBearerClientCredentialsGrant.java
new file mode 100644
index 0000000..ddd4dd9
--- /dev/null
+++ b/rt/rs/security/oauth-parent/oauth2/src/main/java/org/apache/cxf/rs/security/oauth2/grants/jwt/JwtBearerClientCredentialsGrant.java
@@ -0,0 +1,41 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.cxf.rs.security.oauth2.grants.jwt;
+
+import javax.ws.rs.core.MultivaluedMap;
+
+import org.apache.cxf.rs.security.oauth2.utils.OAuthConstants;
+
+public class JwtBearerClientCredentialsGrant extends AbstractJwtBearerGrant {
+
+ private static final long serialVersionUID = 4801583498206813025L;
+
+ public JwtBearerClientCredentialsGrant(String assertion, boolean encoded, String scope) {
+ super(OAuthConstants.CLIENT_CREDENTIALS_GRANT, assertion, encoded, scope);
+ }
+
+ public MultivaluedMap<String, String> toMap() {
+ MultivaluedMap<String, String> map = initMap();
+ map.putSingle(Constants.CLIENT_AUTH_ASSERTION_TYPE, Constants.CLIENT_AUTH_JWT_BEARER);
+ map.putSingle(Constants.CLIENT_AUTH_ASSERTION_PARAM, encodeAssertion());
+ addScope(map);
+ return map;
+ }
+
+}
http://git-wip-us.apache.org/repos/asf/cxf/blob/4915ce37/rt/rs/security/oauth-parent/oauth2/src/main/java/org/apache/cxf/rs/security/oauth2/grants/jwt/JwtBearerGrant.java
----------------------------------------------------------------------
diff --git a/rt/rs/security/oauth-parent/oauth2/src/main/java/org/apache/cxf/rs/security/oauth2/grants/jwt/JwtBearerGrant.java b/rt/rs/security/oauth-parent/oauth2/src/main/java/org/apache/cxf/rs/security/oauth2/grants/jwt/JwtBearerGrant.java
new file mode 100644
index 0000000..a528705
--- /dev/null
+++ b/rt/rs/security/oauth-parent/oauth2/src/main/java/org/apache/cxf/rs/security/oauth2/grants/jwt/JwtBearerGrant.java
@@ -0,0 +1,48 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.cxf.rs.security.oauth2.grants.jwt;
+
+import javax.ws.rs.core.MultivaluedMap;
+
+public class JwtBearerGrant extends AbstractJwtBearerGrant {
+ private static final long serialVersionUID = -7296527609343431294L;
+
+ public JwtBearerGrant(String assertion) {
+ this(assertion, false);
+ }
+
+ public JwtBearerGrant(String assertion, boolean encoded) {
+ this(assertion, false, null);
+ }
+
+ public JwtBearerGrant(String assertion, String scope) {
+ this(assertion, false, scope);
+ }
+
+ public JwtBearerGrant(String assertion, boolean encoded, String scope) {
+ super(Constants.JWT_BEARER_GRANT, assertion, encoded, scope);
+ }
+
+ public MultivaluedMap<String, String> toMap() {
+ MultivaluedMap<String, String> map = initMap();
+ map.putSingle(Constants.CLIENT_GRANT_ASSERTION_PARAM, encodeAssertion());
+ addScope(map);
+ return map;
+ }
+}
http://git-wip-us.apache.org/repos/asf/cxf/blob/4915ce37/rt/rs/security/oauth-parent/oauth2/src/main/java/org/apache/cxf/rs/security/oauth2/grants/jwt/JwtBearerGrantHandler.java
----------------------------------------------------------------------
diff --git a/rt/rs/security/oauth-parent/oauth2/src/main/java/org/apache/cxf/rs/security/oauth2/grants/jwt/JwtBearerGrantHandler.java b/rt/rs/security/oauth-parent/oauth2/src/main/java/org/apache/cxf/rs/security/oauth2/grants/jwt/JwtBearerGrantHandler.java
new file mode 100644
index 0000000..d0fc0fa
--- /dev/null
+++ b/rt/rs/security/oauth-parent/oauth2/src/main/java/org/apache/cxf/rs/security/oauth2/grants/jwt/JwtBearerGrantHandler.java
@@ -0,0 +1,91 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.cxf.rs.security.oauth2.grants.jwt;
+
+import java.util.Arrays;
+
+import javax.ws.rs.core.MultivaluedMap;
+
+import org.apache.cxf.jaxrs.utils.HttpUtils;
+import org.apache.cxf.rs.security.jose.jws.JwsJwtCompactConsumer;
+import org.apache.cxf.rs.security.jose.jwt.JwtToken;
+import org.apache.cxf.rs.security.jose.jwt.JwtTokenReader;
+import org.apache.cxf.rs.security.oauth2.common.Client;
+import org.apache.cxf.rs.security.oauth2.common.ServerAccessToken;
+import org.apache.cxf.rs.security.oauth2.common.UserSubject;
+import org.apache.cxf.rs.security.oauth2.provider.OAuthServiceException;
+import org.apache.cxf.rs.security.oauth2.utils.OAuthConstants;
+import org.apache.cxf.rs.security.oauth2.utils.OAuthUtils;
+
+/**
+ * The "JWT Bearer" grant handler
+ */
+public class JwtBearerGrantHandler extends AbstractJwtHandler {
+ private static final String ENCODED_JWT_BEARER_GRANT;
+ static {
+ // AccessTokenService may be configured with the form provider
+ // which will not decode by default - so listing both the actual
+ // and encoded grant type value will help
+ ENCODED_JWT_BEARER_GRANT = HttpUtils.urlEncode(Constants.JWT_BEARER_GRANT, "UTF-8");
+ }
+ private JwtTokenReader jwtReader;
+ public JwtBearerGrantHandler() {
+ super(Arrays.asList(Constants.JWT_BEARER_GRANT, ENCODED_JWT_BEARER_GRANT));
+ }
+
+ @Override
+ public ServerAccessToken createAccessToken(Client client, MultivaluedMap<String, String> params)
+ throws OAuthServiceException {
+ String assertion = params.getFirst(Constants.CLIENT_GRANT_ASSERTION_PARAM);
+ if (assertion == null) {
+ throw new OAuthServiceException(OAuthConstants.INVALID_GRANT);
+ }
+ try {
+ JwsJwtCompactConsumer jwsReader = getJwsReader(assertion);
+ JwtToken jwtToken = jwsReader.getJwtToken();
+ super.validateSignature(jwtToken.getHeaders(),
+ jwsReader.getUnsignedEncodedSequence(),
+ jwsReader.getDecodedSignature());
+
+
+ super.validateClaims(client, jwtToken.getClaims());
+ UserSubject grantSubject = new UserSubject(jwtToken.getClaims().getSubject());
+
+ return doCreateAccessToken(client,
+ grantSubject,
+ Constants.JWT_BEARER_GRANT,
+ OAuthUtils.parseScope(params.getFirst(OAuthConstants.SCOPE)));
+ } catch (OAuthServiceException ex) {
+ throw ex;
+ } catch (Exception ex) {
+ throw new OAuthServiceException(OAuthConstants.INVALID_GRANT, ex);
+ }
+
+ }
+
+ protected JwsJwtCompactConsumer getJwsReader(String assertion) {
+ return new JwsJwtCompactConsumer(assertion, jwtReader);
+ }
+
+ public void setJwtReader(JwtTokenReader tokenReader) {
+ this.jwtReader = tokenReader;
+ }
+
+
+}
http://git-wip-us.apache.org/repos/asf/cxf/blob/4915ce37/rt/rs/security/oauth-parent/oauth2/src/main/java/org/apache/cxf/rs/security/oauth2/grants/jwt/JwtUserSubject.java
----------------------------------------------------------------------
diff --git a/rt/rs/security/oauth-parent/oauth2/src/main/java/org/apache/cxf/rs/security/oauth2/grants/jwt/JwtUserSubject.java b/rt/rs/security/oauth-parent/oauth2/src/main/java/org/apache/cxf/rs/security/oauth2/grants/jwt/JwtUserSubject.java
new file mode 100644
index 0000000..2f09e63
--- /dev/null
+++ b/rt/rs/security/oauth-parent/oauth2/src/main/java/org/apache/cxf/rs/security/oauth2/grants/jwt/JwtUserSubject.java
@@ -0,0 +1,34 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.cxf.rs.security.oauth2.grants.jwt;
+
+import org.apache.cxf.rs.security.jose.jwt.JwtToken;
+import org.apache.cxf.rs.security.oauth2.common.UserSubject;
+
+public class JwtUserSubject extends UserSubject {
+ private static final long serialVersionUID = -1135272749329239037L;
+ private JwtToken token;
+ public JwtUserSubject(String user, JwtToken token) {
+ super(user);
+ this.token = token;
+ }
+ public JwtToken getToken() {
+ return token;
+ }
+}
http://git-wip-us.apache.org/repos/asf/cxf/blob/4915ce37/rt/rs/security/oauth-parent/oauth2/src/main/java/org/apache/cxf/rs/security/oauth2/utils/crypto/JwtAccessTokenUtils.java
----------------------------------------------------------------------
diff --git a/rt/rs/security/oauth-parent/oauth2/src/main/java/org/apache/cxf/rs/security/oauth2/utils/crypto/JwtAccessTokenUtils.java b/rt/rs/security/oauth-parent/oauth2/src/main/java/org/apache/cxf/rs/security/oauth2/utils/crypto/JwtAccessTokenUtils.java
new file mode 100644
index 0000000..fd97257
--- /dev/null
+++ b/rt/rs/security/oauth-parent/oauth2/src/main/java/org/apache/cxf/rs/security/oauth2/utils/crypto/JwtAccessTokenUtils.java
@@ -0,0 +1,119 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.cxf.rs.security.oauth2.utils.crypto;
+
+import javax.crypto.SecretKey;
+
+import org.apache.cxf.common.util.StringUtils;
+import org.apache.cxf.rs.security.jose.JoseHeaders;
+import org.apache.cxf.rs.security.jose.jwa.Algorithm;
+import org.apache.cxf.rs.security.jose.jwe.AesGcmContentDecryptionAlgorithm;
+import org.apache.cxf.rs.security.jose.jwe.AesGcmContentEncryptionAlgorithm;
+import org.apache.cxf.rs.security.jose.jwe.ContentEncryptionAlgorithm;
+import org.apache.cxf.rs.security.jose.jwe.DirectKeyJweDecryption;
+import org.apache.cxf.rs.security.jose.jwe.DirectKeyJweEncryption;
+import org.apache.cxf.rs.security.jose.jwe.JweDecryptionProvider;
+import org.apache.cxf.rs.security.jose.jwe.JweEncryptionProvider;
+import org.apache.cxf.rs.security.jose.jws.JwsJwtCompactConsumer;
+import org.apache.cxf.rs.security.jose.jws.JwsJwtCompactProducer;
+import org.apache.cxf.rs.security.jose.jws.JwsSignature;
+import org.apache.cxf.rs.security.jose.jws.JwsSignatureProvider;
+import org.apache.cxf.rs.security.jose.jwt.JwtToken;
+import org.apache.cxf.rs.security.oauth2.common.Client;
+import org.apache.cxf.rs.security.oauth2.common.ServerAccessToken;
+import org.apache.cxf.rs.security.oauth2.tokens.bearer.BearerAccessToken;
+
+public final class JwtAccessTokenUtils {
+ private JwtAccessTokenUtils() {
+
+ }
+
+ public static ServerAccessToken toAccessToken(JwtToken jwt,
+ Client client,
+ SecretKey key) {
+ ContentEncryptionAlgorithm contentEncryption =
+ new AesGcmContentEncryptionAlgorithm(key, null, Algorithm.A128GCM.getJwtName());
+ JweEncryptionProvider jweEncryption = new DirectKeyJweEncryption(contentEncryption);
+ return toAccessToken(jwt, client, jweEncryption);
+
+ }
+
+ public static ServerAccessToken toAccessToken(JwtToken jwt,
+ Client client,
+ JweEncryptionProvider jweEncryption) {
+ String jwtString = new JwsJwtCompactProducer(jwt)
+ .signWith(new NoneSignatureProvider());
+ String tokenId = jweEncryption.encrypt(getBytes(jwtString), null);
+ Long issuedAt = jwt.getClaims().getIssuedAt();
+ Long notBefore = jwt.getClaims().getNotBefore();
+ if (issuedAt == null) {
+ issuedAt = System.currentTimeMillis();
+ notBefore = null;
+ }
+ Long expiresIn = null;
+ if (notBefore == null) {
+ expiresIn = 3600L;
+ } else {
+ expiresIn = notBefore - issuedAt;
+ }
+
+ return new BearerAccessToken(client, tokenId, issuedAt, expiresIn);
+
+ }
+ public static JwtToken fromAccessTokenId(String tokenId, SecretKey key) {
+ DirectKeyJweDecryption jweDecryption =
+ new DirectKeyJweDecryption(key,
+ new AesGcmContentDecryptionAlgorithm(Algorithm.A128GCM.getJwtName()));
+ return fromAccessTokenId(tokenId, jweDecryption);
+ }
+ public static JwtToken fromAccessTokenId(String tokenId, JweDecryptionProvider jweDecryption) {
+ String decrypted = jweDecryption.decrypt(tokenId).getContentText();
+ JwsJwtCompactConsumer consumer = new JwsJwtCompactConsumer(decrypted);
+ return consumer.getJwtToken();
+ }
+ private static class NoneSignatureProvider implements JwsSignatureProvider {
+
+ @Override
+ public String getAlgorithm() {
+ return "none";
+ }
+
+ @Override
+ public JwsSignature createJwsSignature(JoseHeaders headers) {
+ return new NoneJwsSignature();
+ }
+
+ }
+ private static class NoneJwsSignature implements JwsSignature {
+
+ @Override
+ public void update(byte[] src, int off, int len) {
+ // complete
+ }
+
+ @Override
+ public byte[] sign() {
+ return new byte[]{};
+ }
+
+ }
+ private static byte[] getBytes(String str) {
+ return StringUtils.toBytesUTF8(str);
+ }
+}
http://git-wip-us.apache.org/repos/asf/cxf/blob/4915ce37/rt/rs/security/oauth-parent/oauth2/src/test/java/org/apache/cxf/rs/security/oauth2/grants/jwt/JwtUserSubjectTest.java
----------------------------------------------------------------------
diff --git a/rt/rs/security/oauth-parent/oauth2/src/test/java/org/apache/cxf/rs/security/oauth2/grants/jwt/JwtUserSubjectTest.java b/rt/rs/security/oauth-parent/oauth2/src/test/java/org/apache/cxf/rs/security/oauth2/grants/jwt/JwtUserSubjectTest.java
new file mode 100644
index 0000000..29bfd25
--- /dev/null
+++ b/rt/rs/security/oauth-parent/oauth2/src/test/java/org/apache/cxf/rs/security/oauth2/grants/jwt/JwtUserSubjectTest.java
@@ -0,0 +1,32 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.cxf.rs.security.oauth2.grants.jwt;
+
+import org.junit.Assert;
+import org.junit.Test;
+
+public class JwtUserSubjectTest extends Assert {
+
+ @Test
+ public void testJwtUserSubject() {
+ // to be expanded
+ assertNotNull(new JwtUserSubject("user", null));
+ }
+
+}
http://git-wip-us.apache.org/repos/asf/cxf/blob/4915ce37/rt/rs/security/oauth-parent/pom.xml
----------------------------------------------------------------------
diff --git a/rt/rs/security/oauth-parent/pom.xml b/rt/rs/security/oauth-parent/pom.xml
index 251689e..ccd1079 100644
--- a/rt/rs/security/oauth-parent/pom.xml
+++ b/rt/rs/security/oauth-parent/pom.xml
@@ -39,6 +39,5 @@
<module>oauth</module>
<module>oauth2</module>
<module>oauth2-saml</module>
- <module>oauth2-jose</module>
</modules>
</project>