Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add support for resource parameter #888

Open
wants to merge 9 commits into
base: develop
Choose a base branch
from
Open

Add support for resource parameter #888

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
9 commits
Select commit Hold shift + click to select a range
79fc51f
Add support for resource parameter
federicaagostini Nov 28, 2024
bf94d06
Add tests
federicaagostini Nov 29, 2024
227743a
Set proper resource during token builder
federicaagostini Dec 9, 2024
9eba7f5
Add tests
federicaagostini Dec 9, 2024
fb34a12
Unify methods
federicaagostini Dec 10, 2024
e3b46c5
Fail if query/fragment components are present
federicaagostini Dec 10, 2024
6ad6d5b
Cosmetic fix
federicaagostini Dec 10, 2024
e063781
Add method to handle audience requests
federicaagostini Dec 11, 2024
a7745b0
Add authorization code test
federicaagostini Dec 11, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
36 changes: 36 additions & 0 deletions ...ervice/src/main/java/it/infn/mw/iam/core/oauth/profile/common/BaseAccessTokenBuilder.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,8 +19,12 @@
import static it.infn.mw.iam.core.oauth.granters.TokenExchangeTokenGranter.TOKEN_EXCHANGE_GRANT_TYPE;
import static java.util.Objects.isNull;

import java.net.MalformedURLException;
import java.net.URISyntaxException;
import java.net.URL;
import java.text.ParseException;
import java.time.Instant;
import java.util.Arrays;
import java.util.Date;
import java.util.Map;
import java.util.UUID;
Expand All @@ -32,6 +36,7 @@
import org.springframework.security.oauth2.common.exceptions.InvalidRequestException;
import org.springframework.security.oauth2.provider.OAuth2Authentication;
import org.springframework.security.oauth2.provider.OAuth2Request;
import org.springframework.security.oauth2.provider.TokenRequest;

import com.google.common.base.Splitter;
import com.google.common.collect.Maps;
Expand All @@ -41,6 +46,7 @@
import com.nimbusds.jwt.JWTParser;

import it.infn.mw.iam.config.IamProperties;
import it.infn.mw.iam.core.error.InvalidResourceError;
import it.infn.mw.iam.core.oauth.profile.JWTAccessTokenBuilder;

@SuppressWarnings("deprecation")
Expand All @@ -49,6 +55,7 @@ public abstract class BaseAccessTokenBuilder implements JWTAccessTokenBuilder {
public static final Logger LOG = LoggerFactory.getLogger(BaseAccessTokenBuilder.class);

public static final String AUDIENCE = "audience";
public static final String RESOURCE = "resource";
public static final String AUD_KEY = "aud";
public static final String SCOPE_CLAIM_NAME = "scope";

Expand Down Expand Up @@ -123,6 +130,28 @@ protected boolean hasRefreshTokenAudienceRequest(OAuth2Authentication authentica
return false;
}

protected boolean hasValidRefreshTokenResourceRequest(OAuth2Authentication authentication) {
TokenRequest refreshTokenRequest = authentication.getOAuth2Request().getRefreshTokenRequest();
if (!(isNull(refreshTokenRequest)
|| isNull(refreshTokenRequest.getRequestParameters().get(RESOURCE)))) {
final String audience = authentication.getOAuth2Request()
.getRefreshTokenRequest()
.getRequestParameters()
.get(RESOURCE);
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This was already computed in the if. Can we reuse that value?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

In case refreshTokenRequest is null, refreshTokenRequest.getRequestParameters() would return a NullPointerException.

Arrays.asList(audience.split(" ")).forEach(this::validateUrl);
return true;
}
return false;
}

private void validateUrl(String url) {
try {
new URL(url).toURI();
} catch (MalformedURLException | URISyntaxException e) {
throw new InvalidResourceError("Not a valid URI: " + url);
}
}

protected boolean hasAudienceRequest(OAuth2Authentication authentication) {
final String audience = (String) authentication.getOAuth2Request().getExtensions().get(AUD_KEY);
return !isNullOrEmpty(audience);
Expand Down Expand Up @@ -161,6 +190,13 @@ protected JWTClaimsSet.Builder baseJWTSetup(OAuth2AccessTokenEntity token,
.get(AUDIENCE);
}

if (hasValidRefreshTokenResourceRequest(authentication)) {
audience = authentication.getOAuth2Request()
.getRefreshTokenRequest()
.getRequestParameters()
.get(RESOURCE);
}

if (!isNullOrEmpty(audience)) {
builder.audience(splitter.splitToList(audience));
}
Expand Down
3 changes: 2 additions & 1 deletion ...e/src/main/java/it/infn/mw/iam/core/oauth/profile/wlcg/WLCGProfileAccessTokenBuilder.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -114,7 +114,8 @@ private void addAuthnInfoClaims(Builder builder, Set<String> scopes, UserInfo us
}

private void addAudience(Builder builder, OAuth2Authentication authentication) {
if (!hasAudienceRequest(authentication) && !hasRefreshTokenAudienceRequest(authentication)) {
if (!(hasAudienceRequest(authentication) || hasRefreshTokenAudienceRequest(authentication)
|| hasValidRefreshTokenResourceRequest(authentication))) {
builder.audience(ALL_AUDIENCES_VALUE);
}
}
Expand Down