You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@cxf.apache.org by se...@apache.org on 2017/07/12 14:40:37 UTC
[1/2] cxf-fediz git commit: [FEDIZ-203] Fediz-level work based on
Jan's contribution
Repository: cxf-fediz
Updated Branches:
refs/heads/1.4.x-fixes 6392d4f75 -> 5d96e47da
[FEDIZ-203] Fediz-level work based on Jan's contribution
Project: http://git-wip-us.apache.org/repos/asf/cxf-fediz/repo
Commit: http://git-wip-us.apache.org/repos/asf/cxf-fediz/commit/eb8a8baa
Tree: http://git-wip-us.apache.org/repos/asf/cxf-fediz/tree/eb8a8baa
Diff: http://git-wip-us.apache.org/repos/asf/cxf-fediz/diff/eb8a8baa
Branch: refs/heads/1.4.x-fixes
Commit: eb8a8baa961866f0c9bdf97bffd30d925e58fb8b
Parents: 6392d4f
Author: Sergey Beryozkin <sb...@gmail.com>
Authored: Wed Jul 12 14:45:30 2017 +0100
Committer: Sergey Beryozkin <sb...@gmail.com>
Committed: Wed Jul 12 14:45:30 2017 +0100
----------------------------------------------------------------------
pom.xml | 2 +-
.../fediz/service/oidc/FedizSubjectCreator.java | 49 ++++++++++++++------
2 files changed, 36 insertions(+), 15 deletions(-)
----------------------------------------------------------------------
http://git-wip-us.apache.org/repos/asf/cxf-fediz/blob/eb8a8baa/pom.xml
----------------------------------------------------------------------
diff --git a/pom.xml b/pom.xml
index 998dfe3..58ed206 100644
--- a/pom.xml
+++ b/pom.xml
@@ -44,7 +44,7 @@
<commons.logging.version>1.2</commons.logging.version>
<commons.io.version>2.5</commons.io.version>
<commons.validator.version>1.6</commons.validator.version>
- <cxf.version>3.1.12</cxf.version>
+ <cxf.version>3.1.13-SNAPSHOT</cxf.version>
<cxf.build-utils.version>3.2.0</cxf.build-utils.version>
<dbcp.version>2.1.1</dbcp.version>
<easymock.version>3.4</easymock.version>
http://git-wip-us.apache.org/repos/asf/cxf-fediz/blob/eb8a8baa/services/oidc/src/main/java/org/apache/cxf/fediz/service/oidc/FedizSubjectCreator.java
----------------------------------------------------------------------
diff --git a/services/oidc/src/main/java/org/apache/cxf/fediz/service/oidc/FedizSubjectCreator.java b/services/oidc/src/main/java/org/apache/cxf/fediz/service/oidc/FedizSubjectCreator.java
index ac35b70..c2ebc1a 100644
--- a/services/oidc/src/main/java/org/apache/cxf/fediz/service/oidc/FedizSubjectCreator.java
+++ b/services/oidc/src/main/java/org/apache/cxf/fediz/service/oidc/FedizSubjectCreator.java
@@ -19,6 +19,7 @@
package org.apache.cxf.fediz.service.oidc;
import java.security.Principal;
+import java.util.ArrayList;
import java.util.Arrays;
import java.util.Collections;
import java.util.List;
@@ -38,8 +39,10 @@ import org.apache.cxf.fediz.core.FedizPrincipal;
import org.apache.cxf.jaxrs.ext.MessageContext;
import org.apache.cxf.rs.security.oauth2.provider.OAuthServiceException;
import org.apache.cxf.rs.security.oauth2.provider.SubjectCreator;
+import org.apache.cxf.rs.security.oauth2.utils.OAuthConstants;
import org.apache.cxf.rs.security.oidc.common.IdToken;
import org.apache.cxf.rs.security.oidc.idp.OidcUserSubject;
+import org.apache.cxf.rs.security.oidc.utils.OidcUtils;
import org.apache.cxf.rt.security.crypto.CryptoUtils;
import org.apache.wss4j.common.ext.WSSecurityException;
import org.apache.wss4j.common.saml.SamlAssertionWrapper;
@@ -49,7 +52,7 @@ import org.opensaml.saml.saml2.core.Issuer;
public class FedizSubjectCreator implements SubjectCreator {
-
+ private static final String ROLES_SCOPE = "roles";
private String issuer;
private long defaultTimeToLive = 3600L;
private Map<String, String> supportedClaims = Collections.emptyMap();
@@ -81,7 +84,7 @@ public class FedizSubjectCreator implements SubjectCreator {
oidcSub.getId(),
fedizPrincipal.getClaims(),
fedizPrincipal.getRoleClaims(),
- params.getFirst("claims"));
+ params);
oidcSub.setIdToken(idToken);
// UserInfo can be populated and set on OidcUserSubject too.
// UserInfoService will create it otherwise.
@@ -95,7 +98,7 @@ public class FedizSubjectCreator implements SubjectCreator {
String subjectId,
ClaimCollection claims,
List<String> roles,
- String requestedClaims) {
+ MultivaluedMap<String, String> params) {
// The current SAML Assertion represents an authentication record.
// It has to be translated into IdToken (JWT) so that it can be returned
// to client applications participating in various OIDC flows.
@@ -154,10 +157,24 @@ public class FedizSubjectCreator implements SubjectCreator {
idToken.setExpiryTime(currentTimeInSecs + defaultTimeToLive);
}
+ List<String> requestedClaimsList = new ArrayList<String>();
+ //Derive claims from scope
+ String requestedScope = params.getFirst(OAuthConstants.SCOPE);
+ if (requestedScope != null && !requestedScope.isEmpty()) {
+ String[] scopes = requestedScope.split(" ");
+ //TODO: Note that if the consent screen enabled then it is feasible
+ // that the claims added in this code after mapping the scopes to claims
+ // may need to be removed if the user disapproves the related scope
+
+ // standard scope to claims mapping:
+ requestedClaimsList.addAll(OidcUtils.getScopeClaims(scopes));
+ // custom scopes to claims mapping
+ requestedClaimsList.addAll(getCustomScopeClaims(scopes));
+ }
// Additional claims requested
- List<String> requestedClaimsList = Collections.emptyList();
- if (requestedClaims != null && !supportedClaims.isEmpty()) {
- requestedClaimsList = Arrays.asList(requestedClaims.trim().split(" "));
+ String requestedClaims = params.getFirst("claims");
+ if (requestedClaims != null && !requestedClaims.isEmpty()) {
+ requestedClaimsList.addAll(Arrays.asList(requestedClaims.trim().split(" ")));
}
// Map claims
@@ -176,14 +193,6 @@ public class FedizSubjectCreator implements SubjectCreator {
lastName = (String)c.getValue();
} else if (ClaimTypes.EMAILADDRESS.equals(c.getClaimType())) {
idToken.setEmail((String)c.getValue());
- } else if (ClaimTypes.DATEOFBIRTH.equals(c.getClaimType())) {
- idToken.setBirthDate((String)c.getValue());
- } else if (ClaimTypes.HOMEPHONE.equals(c.getClaimType())) {
- idToken.setPhoneNumber((String)c.getValue());
- } else if (ClaimTypes.GENDER.equals(c.getClaimType())) {
- idToken.setGender((String)c.getValue());
- } else if (ClaimTypes.WEB_PAGE.equals(c.getClaimType())) {
- idToken.setWebsite((String)c.getValue());
} else if (supportedClaims.containsKey(c.getClaimType().toString())
&& requestedClaimsList.contains(supportedClaims.get(c.getClaimType().toString()))) {
idToken.setClaim(supportedClaims.get(c.getClaimType().toString()), (String)c.getValue());
@@ -208,6 +217,18 @@ public class FedizSubjectCreator implements SubjectCreator {
}
+ private List<String> getCustomScopeClaims(String[] scopes) {
+ // For now the only custom scope (to claims) mapping Fediz supports is
+ // roles where the scope name is expected to be 'roles' and the role name must be configured
+ String roleClaimName = supportedClaims.get(FedizConstants.DEFAULT_ROLE_URI.toString());
+ if (roleClaimName != null && Arrays.asList(scopes).contains(ROLES_SCOPE)) {
+ return Collections.singletonList(roleClaimName);
+ } else {
+ return Collections.emptyList();
+ }
+
+ }
+
private Assertion getSaml2Assertion(Element samlToken) {
// Should a null assertion lead to the exception ?
try {
[2/2] cxf-fediz git commit: [FEDIZ-203] Adding Jan's test too
Posted by se...@apache.org.
[FEDIZ-203] Adding Jan's test too
Project: http://git-wip-us.apache.org/repos/asf/cxf-fediz/repo
Commit: http://git-wip-us.apache.org/repos/asf/cxf-fediz/commit/5d96e47d
Tree: http://git-wip-us.apache.org/repos/asf/cxf-fediz/tree/5d96e47d
Diff: http://git-wip-us.apache.org/repos/asf/cxf-fediz/diff/5d96e47d
Branch: refs/heads/1.4.x-fixes
Commit: 5d96e47da90b92f2a2c34c12ebbe30803203dc41
Parents: eb8a8ba
Author: Sergey Beryozkin <sb...@gmail.com>
Authored: Wed Jul 12 15:40:13 2017 +0100
Committer: Sergey Beryozkin <sb...@gmail.com>
Committed: Wed Jul 12 15:40:13 2017 +0100
----------------------------------------------------------------------
.../main/webapp/WEB-INF/applicationContext.xml | 8 +++-
.../src/main/webapp/WEB-INF/data-manager.xml | 1 +
.../cxf/fediz/systests/oidc/OIDCTest.java | 40 +++++++++++++++++++-
.../test/resources/oidc/applicationContext.xml | 8 +++-
.../src/test/resources/oidc/data-manager.xml | 1 +
5 files changed, 53 insertions(+), 5 deletions(-)
----------------------------------------------------------------------
http://git-wip-us.apache.org/repos/asf/cxf-fediz/blob/5d96e47d/services/oidc/src/main/webapp/WEB-INF/applicationContext.xml
----------------------------------------------------------------------
diff --git a/services/oidc/src/main/webapp/WEB-INF/applicationContext.xml b/services/oidc/src/main/webapp/WEB-INF/applicationContext.xml
index 6b308d3..b1eb250 100644
--- a/services/oidc/src/main/webapp/WEB-INF/applicationContext.xml
+++ b/services/oidc/src/main/webapp/WEB-INF/applicationContext.xml
@@ -41,10 +41,14 @@
<import resource="data-manager.xml" />
<!-- Supports OIDC Authorization Code flow -->
+ <util:list id="scopesRequiringNoConsent">
+ <value>openid</value>
+ <value>roles</value>
+ </util:list>
<bean id="oidcAuthorizationService" class="org.apache.cxf.rs.security.oidc.idp.OidcAuthorizationCodeService">
<property name="dataProvider" ref="oauthProvider"/>
<property name="subjectCreator" ref="subjectCreator"/>
- <property name="skipAuthorizationWithOidcScope" value="true"/>
+ <property name="scopesRequiringNoConsent" ref="scopesRequiringNoConsent"/>
<!--
<property name="useAllClientScopes" value="true"/>
-->
@@ -54,7 +58,7 @@
<bean id="oidcHybridService" class="org.apache.cxf.rs.security.oidc.idp.OidcHybridService">
<property name="dataProvider" ref="oauthProvider"/>
<property name="subjectCreator" ref="subjectCreator"/>
- <property name="skipAuthorizationWithOidcScope" value="true"/>
+ <property name="scopesRequiringNoConsent" ref="scopesRequiringNoConsent"/>
<property name="responseFilter" ref="idTokenFilter"/>
<property name="codeService" ref="oidcAuthorizationService"/>
</bean>
http://git-wip-us.apache.org/repos/asf/cxf-fediz/blob/5d96e47d/services/oidc/src/main/webapp/WEB-INF/data-manager.xml
----------------------------------------------------------------------
diff --git a/services/oidc/src/main/webapp/WEB-INF/data-manager.xml b/services/oidc/src/main/webapp/WEB-INF/data-manager.xml
index dc9bd0e..57feaf0 100644
--- a/services/oidc/src/main/webapp/WEB-INF/data-manager.xml
+++ b/services/oidc/src/main/webapp/WEB-INF/data-manager.xml
@@ -34,6 +34,7 @@
<entry key="openid" value="Access the authentication claims" />
<entry key="email" value="Access the email address" />
<entry key="profile" value="Access the profile claims" />
+ <entry key="roles" value="Access the user roles" />
<entry key="refreshToken" value="Refresh access tokens" />
</util:map>
http://git-wip-us.apache.org/repos/asf/cxf-fediz/blob/5d96e47d/systests/oidc/src/test/java/org/apache/cxf/fediz/systests/oidc/OIDCTest.java
----------------------------------------------------------------------
diff --git a/systests/oidc/src/test/java/org/apache/cxf/fediz/systests/oidc/OIDCTest.java b/systests/oidc/src/test/java/org/apache/cxf/fediz/systests/oidc/OIDCTest.java
index 56014d9..b9f9291 100644
--- a/systests/oidc/src/test/java/org/apache/cxf/fediz/systests/oidc/OIDCTest.java
+++ b/systests/oidc/src/test/java/org/apache/cxf/fediz/systests/oidc/OIDCTest.java
@@ -936,7 +936,45 @@ public class OIDCTest {
webClient.close();
}
+ @org.junit.Test
+ public void testOIDCLoginForClient1WithRolesScope() throws Exception {
+
+ String url = "https://localhost:" + getRpHttpsPort() + "/fediz-oidc/idp/authorize?";
+ url += "client_id=" + storedClientId;
+ url += "&response_type=code";
+ url += "&scope=openid%20roles";
+ String user = "alice";
+ String password = "ecila";
+
+ // Login to the OIDC token endpoint + get the authorization code
+ WebClient webClient = setupWebClient(user, password, getIdpHttpsPort());
+ String authorizationCode = loginAndGetAuthorizationCode(url, webClient);
+ Assert.assertNotNull(authorizationCode);
+
+ // Now use the code to get an IdToken
+
+ url = "https://localhost:" + getRpHttpsPort() + "/fediz-oidc/oauth2/token";
+ WebRequest request = new WebRequest(new URL(url), HttpMethod.POST);
+
+ request.setRequestParameters(new ArrayList<NameValuePair>());
+ request.getRequestParameters().add(new NameValuePair("client_id", storedClientId));
+ request.getRequestParameters().add(new NameValuePair("grant_type", "authorization_code"));
+ request.getRequestParameters().add(new NameValuePair("code", authorizationCode));
+
+ webClient.getOptions().setJavaScriptEnabled(false);
+ final UnexpectedPage responsePage = webClient.getPage(request);
+ String response = responsePage.getWebResponse().getContentAsString();
+
+ // Check the IdToken
+ String idToken = getIdToken(response);
+ Assert.assertNotNull(idToken);
+ validateIdToken(idToken, storedClientId, "User");
+
+ webClient.close();
+ }
+
+
private static WebClient setupWebClient(String user, String password, String idpPort) {
final WebClient webClient = new WebClient();
webClient.getOptions().setUseInsecureSSL(true);
@@ -1041,7 +1079,7 @@ public class OIDCTest {
// Check role
if (role != null) {
- List<?> roles = (List<?>)jwt.getClaim("roles");
+ List<String> roles = jwt.getClaims().getListStringProperty("roles");
Assert.assertNotNull(roles);
Assert.assertFalse(roles.isEmpty());
Assert.assertEquals(role, roles.get(0));
http://git-wip-us.apache.org/repos/asf/cxf-fediz/blob/5d96e47d/systests/oidc/src/test/resources/oidc/applicationContext.xml
----------------------------------------------------------------------
diff --git a/systests/oidc/src/test/resources/oidc/applicationContext.xml b/systests/oidc/src/test/resources/oidc/applicationContext.xml
index b764704..234b493 100644
--- a/systests/oidc/src/test/resources/oidc/applicationContext.xml
+++ b/systests/oidc/src/test/resources/oidc/applicationContext.xml
@@ -47,10 +47,14 @@
<import resource="data-manager.xml" />
<!-- Supports OIDC Authorization Code flow -->
+ <util:list id="scopesRequiringNoConsent">
+ <value>openid</value>
+ <value>roles</value>
+ </util:list>
<bean id="oidcAuthorizationService" class="org.apache.cxf.rs.security.oidc.idp.OidcAuthorizationCodeService">
<property name="dataProvider" ref="oauthProvider"/>
<property name="subjectCreator" ref="subjectCreator"/>
- <property name="skipAuthorizationWithOidcScope" value="true"/>
+ <property name="scopesRequiringNoConsent" ref="scopesRequiringNoConsent"/>
<!--
<property name="useAllClientScopes" value="true"/>
-->
@@ -60,7 +64,7 @@
<bean id="oidcHybridService" class="org.apache.cxf.rs.security.oidc.idp.OidcHybridService">
<property name="dataProvider" ref="oauthProvider"/>
<property name="subjectCreator" ref="subjectCreator"/>
- <property name="skipAuthorizationWithOidcScope" value="true"/>
+ <property name="scopesRequiringNoConsent" ref="scopesRequiringNoConsent"/>
<property name="responseFilter" ref="idTokenFilter"/>
<property name="codeService" ref="oidcAuthorizationService"/>
</bean>
http://git-wip-us.apache.org/repos/asf/cxf-fediz/blob/5d96e47d/systests/oidc/src/test/resources/oidc/data-manager.xml
----------------------------------------------------------------------
diff --git a/systests/oidc/src/test/resources/oidc/data-manager.xml b/systests/oidc/src/test/resources/oidc/data-manager.xml
index 7c2b7dc..e704818 100644
--- a/systests/oidc/src/test/resources/oidc/data-manager.xml
+++ b/systests/oidc/src/test/resources/oidc/data-manager.xml
@@ -32,6 +32,7 @@
<!-- List of accepted scopes -->
<util:map id="supportedScopes">
<entry key="openid" value="Access the authentication claims" />
+ <entry key="roles" value="Access the user roles" />
<entry key="refreshToken" value="Refresh access tokens" />
</util:map>