You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@cxf.apache.org by co...@apache.org on 2022/09/29 15:41:06 UTC
[cxf] 01/03: Make opaque access token generation extensible (#989)
This is an automated email from the ASF dual-hosted git repository.
coheigea pushed a commit to branch 3.6.x-fixes
in repository https://gitbox.apache.org/repos/asf/cxf.git
commit af64d00273b1dcebec08d56cba361388794a5e60
Author: Arthur Chen <ar...@gmail.com>
AuthorDate: Thu Sep 29 22:59:38 2022 +0800
Make opaque access token generation extensible (#989)
* extract opaque token generation to a protected method, so
it can be reused/overwritten by child classes
* extract jwt token conversion to a protected method, so
it can be reused/overwritten by child classes
* Remove response type as old logic didn't have it
(cherry picked from commit dd206fdb527b672ca181f4f513eff06ac1bf4f6c)
---
.../oauth2/provider/AbstractOAuthDataProvider.java | 104 ++++++++++++---------
1 file changed, 62 insertions(+), 42 deletions(-)
diff --git a/rt/rs/security/oauth-parent/oauth2/src/main/java/org/apache/cxf/rs/security/oauth2/provider/AbstractOAuthDataProvider.java b/rt/rs/security/oauth-parent/oauth2/src/main/java/org/apache/cxf/rs/security/oauth2/provider/AbstractOAuthDataProvider.java
index 815a52ce04..d136fc8bc3 100644
--- a/rt/rs/security/oauth-parent/oauth2/src/main/java/org/apache/cxf/rs/security/oauth2/provider/AbstractOAuthDataProvider.java
+++ b/rt/rs/security/oauth-parent/oauth2/src/main/java/org/apache/cxf/rs/security/oauth2/provider/AbstractOAuthDataProvider.java
@@ -76,19 +76,14 @@ public abstract class AbstractOAuthDataProvider implements OAuthDataProvider, Cl
}
protected ServerAccessToken doCreateAccessToken(AccessTokenRegistration atReg) {
- ServerAccessToken at = createNewAccessToken(atReg.getClient(), atReg.getSubject());
- at.setAudiences(atReg.getAudiences());
- at.setGrantType(atReg.getGrantType());
- List<String> theScopes = atReg.getApprovedScope();
- List<OAuthPermission> thePermissions =
- convertScopeToPermissions(atReg.getClient(), theScopes);
- at.setScopes(thePermissions);
- at.setSubject(atReg.getSubject());
- at.setClientCodeVerifier(atReg.getClientCodeVerifier());
- at.setNonce(atReg.getNonce());
- at.setResponseType(atReg.getResponseType());
- at.setGrantCode(atReg.getGrantCode());
- at.getExtraProperties().putAll(atReg.getExtraProperties());
+ ServerAccessToken at = doCreateAccessToken(
+ atReg.getAudiences(), atReg.getClient(),
+ atReg.getClientCodeVerifier(), atReg.getExtraProperties(),
+ atReg.getGrantCode(), atReg.getGrantType(), atReg.getNonce(),
+ atReg.getResponseType(),
+ convertScopeToPermissions(
+ atReg.getClient(), atReg.getApprovedScope()),
+ atReg.getSubject());
if (messageContext != null) {
String certCnf = (String)messageContext.get(JoseConstants.HEADER_X509_THUMBPRINT_SHA256);
@@ -99,18 +94,38 @@ public abstract class AbstractOAuthDataProvider implements OAuthDataProvider, Cl
}
if (isUseJwtFormatForAccessTokens()) {
- JwtClaims claims = createJwtAccessToken(at);
- String jose = processJwtAccessToken(claims);
- if (isPersistJwtEncoding()) {
- at.setTokenKey(jose);
- } else {
- at.setEncodedToken(jose);
- }
+ convertToJWTAccessToken(at);
}
return at;
}
+ protected ServerAccessToken doCreateAccessToken(List<String> audiences,
+ Client client,
+ String clientCodeVerifier,
+ Map<String, String> extraProperties,
+ String grantCode,
+ String grantType,
+ String nonce,
+ String responseType,
+ List<OAuthPermission> scopes,
+ UserSubject userSubject) {
+
+ ServerAccessToken at =
+ createNewAccessToken(client, userSubject);
+ at.setAudiences(audiences);
+ at.setGrantType(grantType);
+ at.setScopes(scopes);
+ at.setSubject(userSubject);
+ at.setClientCodeVerifier(clientCodeVerifier);
+ at.setNonce(nonce);
+ at.setResponseType(responseType);
+ at.setGrantCode(grantCode);
+ at.getExtraProperties().putAll(extraProperties);
+
+ return at;
+ }
+
protected JwtClaims createJwtAccessToken(ServerAccessToken at) {
JwtClaims claims = new JwtClaims();
claims.setTokenId(at.getTokenKey());
@@ -186,6 +201,16 @@ public abstract class AbstractOAuthDataProvider implements OAuthDataProvider, Cl
return claims;
}
+ protected void convertToJWTAccessToken(ServerAccessToken at) {
+ JwtClaims claims = createJwtAccessToken(at);
+ String jose = processJwtAccessToken(claims);
+ if (isPersistJwtEncoding()) {
+ at.setTokenKey(jose);
+ } else {
+ at.setEncodedToken(jose);
+ }
+ }
+
protected ServerAccessToken createNewAccessToken(Client client, UserSubject userSub) {
BearerAccessToken token = new BearerAccessToken(client, accessTokenLifetime);
if (getIssuer() != null) {
@@ -395,35 +420,30 @@ public abstract class AbstractOAuthDataProvider implements OAuthDataProvider, Cl
protected ServerAccessToken doRefreshAccessToken(Client client,
RefreshToken oldRefreshToken,
List<String> restrictedScopes) {
- ServerAccessToken at = createNewAccessToken(client, oldRefreshToken.getSubject());
- at.setAudiences(oldRefreshToken.getAudiences() != null
- ? new ArrayList<String>(oldRefreshToken.getAudiences()) : null);
- at.setGrantType(oldRefreshToken.getGrantType());
- at.setGrantCode(oldRefreshToken.getGrantCode());
- at.setSubject(oldRefreshToken.getSubject());
- at.setNonce(oldRefreshToken.getNonce());
- at.setClientCodeVerifier(oldRefreshToken.getClientCodeVerifier());
- at.getExtraProperties().putAll(oldRefreshToken.getExtraProperties());
+
+ List<OAuthPermission> theNewScopes = null;
+
if (restrictedScopes.isEmpty()) {
- at.setScopes(oldRefreshToken.getScopes() != null
- ? new ArrayList<OAuthPermission>(oldRefreshToken.getScopes()) : null);
+ theNewScopes = oldRefreshToken.getScopes() != null ?
+ new ArrayList<OAuthPermission>(oldRefreshToken.getScopes()) : null;
} else {
- List<OAuthPermission> theNewScopes = convertScopeToPermissions(client, restrictedScopes);
- if (oldRefreshToken.getScopes().containsAll(theNewScopes)) {
- at.setScopes(theNewScopes);
- } else {
+ theNewScopes = convertScopeToPermissions(client, restrictedScopes);
+ if (!oldRefreshToken.getScopes().containsAll(theNewScopes)) {
throw new OAuthServiceException("Invalid scopes");
}
}
+ ServerAccessToken at =
+ doCreateAccessToken(
+ oldRefreshToken.getAudiences() != null ?
+ new ArrayList<String>(oldRefreshToken.getAudiences()) : null,
+ client, oldRefreshToken.getClientCodeVerifier(),
+ oldRefreshToken.getExtraProperties(), oldRefreshToken.getGrantCode(),
+ oldRefreshToken.getGrantType(), oldRefreshToken.getNonce(),
+ null, theNewScopes, oldRefreshToken.getSubject());
+
if (isUseJwtFormatForAccessTokens()) {
- JwtClaims claims = createJwtAccessToken(at);
- String jose = processJwtAccessToken(claims);
- if (isPersistJwtEncoding()) {
- at.setTokenKey(jose);
- } else {
- at.setEncodedToken(jose);
- }
+ convertToJWTAccessToken(at);
}
return at;