org.springframework.security.oauth2.provider.OAuth2Authentication#getOAuth2Request

Source File: TokenService.java From osiam with MIT License

7 votes

public AccessToken validateToken(final String token) {
    OAuth2Authentication auth = tokenStore.readAuthentication(token);
    OAuth2AccessToken accessToken = tokenStore.getAccessToken(auth);
    OAuth2Request authReq = auth.getOAuth2Request();

    AccessToken.Builder tokenBuilder = new AccessToken.Builder(token).setClientId(authReq.getClientId());

    if (auth.getUserAuthentication() != null && auth.getPrincipal() instanceof User) {
        User user = (User) auth.getPrincipal();
        tokenBuilder.setUserName(user.getUserName());
        tokenBuilder.setUserId(user.getId());
    }

    tokenBuilder.setExpiresAt(accessToken.getExpiration());
    for (String scopeString : authReq.getScope()) {
        tokenBuilder.addScope(new Scope(scopeString));
    }

    return tokenBuilder.build();
}

Source File: CustomRedisTokenStore.java From microservices-platform with Apache License 2.0

6 votes

@Override
public OAuth2Authentication readAuthentication(OAuth2AccessToken token) {
    OAuth2Authentication auth2Authentication = readAuthentication(token.getValue());
    //是否开启token续签
    boolean isRenew = securityProperties.getAuth().getRenew().getEnable();
    if (isRenew && auth2Authentication != null) {
        OAuth2Request clientAuth = auth2Authentication.getOAuth2Request();
        //判断当前应用是否需要自动续签
        if (checkRenewClientId(clientAuth.getClientId())) {
            //获取过期时长
            int validitySeconds = getAccessTokenValiditySeconds(clientAuth.getClientId());
            if (validitySeconds > 0) {
                double expiresRatio = token.getExpiresIn() / (double)validitySeconds;
                //判断是否需要续签，当前剩余时间小于过期时长的50%则续签
                if (expiresRatio <= securityProperties.getAuth().getRenew().getTimeRatio()) {
                    //更新AccessToken过期时间
                    DefaultOAuth2AccessToken oAuth2AccessToken = (DefaultOAuth2AccessToken) token;
                    oAuth2AccessToken.setExpiration(new Date(System.currentTimeMillis() + (validitySeconds * 1000L)));
                    storeAccessToken(oAuth2AccessToken, auth2Authentication, true);
                }
            }
        }
    }
    return auth2Authentication;
}

Source File: OpenHelper.java From open-cloud with MIT License

6 votes

/**
 * 获取认证用户信息
 *
 * @return
 */
public static OpenUserDetails getUser() {
    Authentication authentication = SecurityContextHolder.getContext().getAuthentication();
    if (authentication != null && authentication.isAuthenticated() && authentication instanceof OAuth2Authentication) {
        OAuth2Authentication oAuth2Authentication = (OAuth2Authentication) authentication;
        OAuth2Request clientToken = oAuth2Authentication.getOAuth2Request();
        if (!oAuth2Authentication.isClientOnly()) {
            if (authentication.getPrincipal() instanceof OpenUserDetails) {
                return (OpenUserDetails) authentication.getPrincipal();
            }
            if (authentication.getPrincipal() instanceof Map) {
                return BeanConvertUtils.mapToObject((Map) authentication.getPrincipal(), OpenUserDetails.class);
            }
        } else {
            OpenUserDetails openUser = new OpenUserDetails();
            openUser.setClientId(clientToken.getClientId());
            openUser.setAuthorities(clientToken.getAuthorities());
            return openUser;
        }
    }
    return null;
}

Source File: ChoerodonAuthenticationKeyGenerator.java From oauth-server with Apache License 2.0

6 votes

@Override
public String extractKey(OAuth2Authentication authentication) {
    Map<String, String> values = new LinkedHashMap<>();
    OAuth2Request authorizationRequest = authentication.getOAuth2Request();
    if (!authentication.isClientOnly()) {
        values.put(USERNAME, authentication.getName());
    }
    values.put(CLIENT_ID, authorizationRequest.getClientId());
    if (authorizationRequest.getScope() != null) {
        values.put(SCOPE, OAuth2Utils.formatParameterList(new TreeSet<>(authorizationRequest.getScope())));
    }
    Authentication auth = authentication.getUserAuthentication();
    if (auth != null && auth.getDetails() instanceof WebAuthenticationDetails) {
        String sessionId = ((WebAuthenticationDetails) auth.getDetails()).getSessionId();
        logger.info("sessionId : {}", sessionId);
        if (!StringUtils.isEmpty(sessionId)) {
            values.put(SESSION, sessionId);
        }
    }
    return generateKey(values);
}

Source File: JwtAccessTokenCustomizer.java From spring-oauth2-keycloak-connector with Apache License 2.0

6 votes

/**
 * Spring oauth2 expects roles under authorities element in tokenMap, but keycloak provides it under resource_access. Hence extractAuthentication
 * method is overriden to extract roles from resource_access.
 *
 * @return OAuth2Authentication with authorities for given application
 */
@Override
public OAuth2Authentication extractAuthentication(Map<String, ?> tokenMap) {
  LOG.debug("Begin extractAuthentication: tokenMap = {}", tokenMap);
  JsonNode token = mapper.convertValue(tokenMap, JsonNode.class);
  Set<String> audienceList = extractClients(token); // extracting client names
  List<GrantedAuthority> authorities = extractRoles(token); // extracting client roles

  OAuth2Authentication authentication = super.extractAuthentication(tokenMap);
  OAuth2Request oAuth2Request = authentication.getOAuth2Request();

  OAuth2Request request =
      new OAuth2Request(oAuth2Request.getRequestParameters(), oAuth2Request.getClientId(), authorities, true, oAuth2Request.getScope(),
          audienceList, null, null, null);

  Authentication usernamePasswordAuthentication = new UsernamePasswordAuthenticationToken(authentication.getPrincipal(), "N/A", authorities);
  LOG.debug("End extractAuthentication");
  return new OAuth2Authentication(request, usernamePasswordAuthentication);
}

Source File: RedisTokensServiceImpl.java From microservices-platform with Apache License 2.0

5 votes

@Override
public PageResult<TokenVo> listTokens(Map<String, Object> params, String clientId) {
    Integer page = MapUtils.getInteger(params, "page");
    Integer limit = MapUtils.getInteger(params, "limit");
    int[] startEnds = PageUtil.transToStartEnd(page, limit);
    //根据请求参数生成redis的key
    String redisKey = getRedisKey(params, clientId);
    long size = redisRepository.length(redisKey);
    List<TokenVo> result = new ArrayList<>(limit);
    //查询token集合
    List<Object> tokenObjs = redisRepository.getList(redisKey, startEnds[0], startEnds[1]-1);
    if (tokenObjs != null) {
        for (Object obj : tokenObjs) {
            DefaultOAuth2AccessToken accessToken = (DefaultOAuth2AccessToken)obj;
            //构造token对象
            TokenVo tokenVo = new TokenVo();
            tokenVo.setTokenValue(accessToken.getValue());
            tokenVo.setExpiration(accessToken.getExpiration());

            //获取用户信息
            Object authObj = redisRepository.get(SecurityConstants.REDIS_TOKEN_AUTH + accessToken.getValue());
            OAuth2Authentication authentication = (OAuth2Authentication)authObj;
            if (authentication != null) {
                OAuth2Request request = authentication.getOAuth2Request();
                tokenVo.setUsername(authentication.getName());
                tokenVo.setClientId(request.getClientId());
                tokenVo.setGrantType(request.getGrantType());
            }

            result.add(tokenVo);
        }
    }
    return PageResult.<TokenVo>builder().data(result).code(0).count(size).build();
}

Source File: YamiTokenServices.java From mall4j with GNU Affero General Public License v3.0

5 votes

public String getClientId(String tokenValue) {
    OAuth2Authentication authentication = tokenStore.readAuthentication(tokenValue);
    if (authentication == null) {
        throw new InvalidTokenException("Invalid access token: " + tokenValue);
    }
    OAuth2Request clientAuth = authentication.getOAuth2Request();
    if (clientAuth == null) {
        throw new InvalidTokenException("Invalid access token (no client id): " + tokenValue);
    }
    return clientAuth.getClientId();
}

Source File: CustomAccessTokenConverter.java From microservices-oauth with Apache License 2.0

5 votes

public Map<String, ?> convertAccessToken(OAuth2AccessToken token, OAuth2Authentication authentication) {
	Map<String, Object> response = new HashMap<String, Object>();
	OAuth2Request clientToken = authentication.getOAuth2Request();

	if (!authentication.isClientOnly())
		response.putAll(userTokenConverter.convertUserAuthentication(authentication.getUserAuthentication()));
	else if (clientToken.getAuthorities() != null && !clientToken.getAuthorities().isEmpty())
		response.put(UserAuthenticationConverter.AUTHORITIES,
				AuthorityUtils.authorityListToSet(clientToken.getAuthorities()));

	if (token.getScope() != null)
		response.put(SCOPE, token.getScope());

	if (token.getAdditionalInformation().containsKey(JTI))
		response.put(JTI, token.getAdditionalInformation().get(JTI));

	if (token.getExpiration() != null)
		response.put(EXP, token.getExpiration().getTime() / 1000);

	if (includeGrantType && authentication.getOAuth2Request().getGrantType() != null)
		response.put(GRANT_TYPE, authentication.getOAuth2Request().getGrantType());

	response.putAll(token.getAdditionalInformation());

	response.put(CLIENT_ID, clientToken.getClientId());
	if (clientToken.getResourceIds() != null && !clientToken.getResourceIds().isEmpty())
		response.put(AUD, clientToken.getResourceIds());

	return response;
}

Source File: CustomAccessTokenConverter.java From spring-boot-2-oauth2-resource-jwt with MIT License

5 votes

public Map<String, ?> convertAccessToken(OAuth2AccessToken token, OAuth2Authentication authentication) {
	Map<String, Object> response = new HashMap<String, Object>();
	OAuth2Request clientToken = authentication.getOAuth2Request();

	if (!authentication.isClientOnly())
		response.putAll(userTokenConverter.convertUserAuthentication(authentication.getUserAuthentication()));
	else if (clientToken.getAuthorities() != null && !clientToken.getAuthorities().isEmpty())
		response.put(UserAuthenticationConverter.AUTHORITIES,
				AuthorityUtils.authorityListToSet(clientToken.getAuthorities()));

	if (token.getScope() != null)
		response.put(SCOPE, token.getScope());

	if (token.getAdditionalInformation().containsKey(JTI))
		response.put(JTI, token.getAdditionalInformation().get(JTI));

	if (token.getExpiration() != null)
		response.put(EXP, token.getExpiration().getTime() / 1000);

	if (includeGrantType && authentication.getOAuth2Request().getGrantType() != null)
		response.put(GRANT_TYPE, authentication.getOAuth2Request().getGrantType());

	response.putAll(token.getAdditionalInformation());

	response.put(CLIENT_ID, clientToken.getClientId());
	if (clientToken.getResourceIds() != null && !clientToken.getResourceIds().isEmpty())
		response.put(AUD, clientToken.getResourceIds());

	return response;
}

Source File: SysUserServiceImpl.java From open-capacity-platform with Apache License 2.0

4 votes

@Transactional
@Override
public SysUser updateSysUser(SysUser sysUser) {
	sysUser.setUpdateTime(new Date());

	Authentication authentication = SecurityContextHolder.getContext().getAuthentication();

	if (authentication instanceof OAuth2Authentication) {
		OAuth2Authentication oAuth2Auth = (OAuth2Authentication) authentication;
		authentication = oAuth2Auth.getUserAuthentication();

		OAuth2AuthenticationDetails details = (OAuth2AuthenticationDetails) oAuth2Auth.getDetails();

		LoginAppUser user = SysUserUtil.getLoginAppUser();

		if (user != null) {

			if ( !ObjectUtils.notEqual(user.getId(),sysUser.getId()) ) {

				OAuth2AccessToken token = redisTokenStore.readAccessToken(details.getTokenValue());

				if (token != null) {

					if (!StringUtils.isBlank(sysUser.getHeadImgUrl())) {
						user.setHeadImgUrl(sysUser.getHeadImgUrl());
					}

					if (!StringUtils.isBlank(sysUser.getNewPassword())) {
						user.setPassword(sysUser.getNewPassword());
					}

					if (!StringUtils.isBlank(sysUser.getNewPassword())) {
						user.setPassword(sysUser.getNewPassword());
					}

					if (!StringUtils.isBlank(sysUser.getNickname())) {
						user.setNickname(sysUser.getNickname());
					}

					if (!StringUtils.isBlank(sysUser.getPhone())){
						user.setPhone(sysUser.getPhone());
					}

					if (sysUser.getSex() != null) {
						user.setSex(sysUser.getSex());
					}

					UsernamePasswordAuthenticationToken userAuthentication = new UsernamePasswordAuthenticationToken(user,
	                        null, user.getAuthorities());

					OAuth2Authentication oAuth2Authentication = new OAuth2Authentication(oAuth2Auth.getOAuth2Request(), userAuthentication);
					oAuth2Authentication.setAuthenticated(true);
					redisTokenStore.storeAccessToken(token, oAuth2Authentication);

				}

			}

		}
	}

	sysUserDao.updateByOps(sysUser);
	log.info("修改用户：{}", sysUser);
	return sysUser;
}

Source File: CustomAuthCodeTokenGranter.java From OAuth-2.0-Cookbook with MIT License

4 votes

@Override
protected OAuth2Authentication getOAuth2Authentication(ClientDetails client, TokenRequest tokenRequest) {

    Map<String, String> parameters = tokenRequest.getRequestParameters();
    String authorizationCode = parameters.get("code");
    String redirectUri = parameters.get(OAuth2Utils.REDIRECT_URI);
    String codeVerifier = parameters.get("code_verifier");

    if (authorizationCode == null) {
        throw new InvalidRequestException("An authorization code must be supplied.");
    }

    OAuth2Authentication storedAuth = authorizationCodeServices.consumeAuthorizationCode(authorizationCode);
    if (storedAuth == null) {
        throw new InvalidGrantException("Invalid authorization code: " + authorizationCode);
    }

    OAuth2Request pendingOAuth2Request = storedAuth.getOAuth2Request();




    // Validates code verifier
    Map<String, String> pendingOauth2RequestParams = pendingOAuth2Request.getRequestParameters();
    String codeChallenge = pendingOauth2RequestParams.get("code_challenge");
    String codeChallengeMethod = pendingOauth2RequestParams.get("code_challenge_method");

    if (codeVerifier == null && codeChallenge != null) {
        // client is using PKCE but did not send the codeVerifier
        throw new InvalidRequestException(
                "Invalid authorization code for current token request.");
    }

    if (codeVerifier != null && codeChallenge != null) {
        String hashed = codeVerifier;
        if ("S256".equals(codeChallengeMethod)) {
            hashed = DigestUtils.sha256Hex(codeVerifier);
        }

        if (!hashed.equalsIgnoreCase(codeChallenge)) {
            throw new InvalidRequestException(
                    "Invalid authorization code for current token request.");
        }
    }



    // https://jira.springsource.org/browse/SECOAUTH-333
    // This might be null, if the authorization was done without the redirect_uri parameter
    String redirectUriApprovalParameter = pendingOAuth2Request.getRequestParameters().get(
            OAuth2Utils.REDIRECT_URI);

    if ((redirectUri != null || redirectUriApprovalParameter != null)
            && !pendingOAuth2Request.getRedirectUri().equals(redirectUri)) {
        throw new RedirectMismatchException("Redirect URI mismatch.");
    }

    String pendingClientId = pendingOAuth2Request.getClientId();
    String clientId = tokenRequest.getClientId();
    if (clientId != null && !clientId.equals(pendingClientId)) {
        // just a sanity check.
        throw new InvalidClientException("Client ID mismatch");
    }

    // Secret is not required in the authorization request, so it won't be available
    // in the pendingAuthorizationRequest. We do want to check that a secret is provided
    // in the token request, but that happens elsewhere.

    Map<String, String> combinedParameters = new HashMap<String, String>(pendingOAuth2Request
            .getRequestParameters());
    // Combine the parameters adding the new ones last so they override if there are any clashes
    combinedParameters.putAll(parameters);

    // Make a new stored request with the combined parameters
    OAuth2Request finalStoredOAuth2Request = pendingOAuth2Request.createOAuth2Request(combinedParameters);

    Authentication userAuth = storedAuth.getUserAuthentication();

    return new OAuth2Authentication(finalStoredOAuth2Request, userAuth);

}

Source File: LessStrictRedirectUriAuthorizationCodeTokenGranter.java From osiam with MIT License

4 votes

@Override
protected OAuth2Authentication getOAuth2Authentication(ClientDetails client, TokenRequest tokenRequest) {

    Map<String, String> parameters = tokenRequest.getRequestParameters();
    String authorizationCode = parameters.get("code");
    String redirectUri = parameters.get(OAuth2Utils.REDIRECT_URI);

    if (authorizationCode == null) {
        throw new InvalidRequestException("An authorization code must be supplied.");
    }

    OAuth2Authentication storedAuth = authorizationCodeServices.consumeAuthorizationCode(authorizationCode);
    if (storedAuth == null) {
        throw new InvalidGrantException("Invalid authorization code: " + authorizationCode);
    }

    OAuth2Request pendingOAuth2Request = storedAuth.getOAuth2Request();
    // https://jira.springsource.org/browse/SECOAUTH-333
    // This might be null, if the authorization was done without the redirect_uri parameter
    String redirectUriApprovalParameter = pendingOAuth2Request.getRequestParameters().get(OAuth2Utils.REDIRECT_URI);

    if (redirectUriApprovalParameter != null && redirectUri == null
            || redirectUriApprovalParameter != null
            && !pendingOAuth2Request.getRedirectUri().startsWith(redirectUri)) {
        throw new RedirectMismatchException("Redirect URI mismatch.");
    }

    String pendingClientId = pendingOAuth2Request.getClientId();
    String clientId = tokenRequest.getClientId();
    if (clientId != null && !clientId.equals(pendingClientId)) {
        // just a sanity check.
        throw new InvalidClientException("Client ID mismatch");
    }

    // Secret is not required in the authorization request, so it won't be available
    // in the pendingAuthorizationRequest. We do want to check that a secret is provided
    // in the token request, but that happens elsewhere.

    Map<String, String> combinedParameters = new HashMap<>(pendingOAuth2Request.getRequestParameters());
    // Combine the parameters adding the new ones last so they override if there are any clashes
    combinedParameters.putAll(parameters);

    // Make a new stored request with the combined parameters
    OAuth2Request finalStoredOAuth2Request = pendingOAuth2Request.createOAuth2Request(combinedParameters);

    Authentication userAuth = storedAuth.getUserAuthentication();

    return new OAuth2Authentication(finalStoredOAuth2Request, userAuth);
}

Source File: OAuth2TokenDAO.java From entando-core with GNU Lesser General Public License v3.0

4 votes

@Override
public void storeAccessToken(OAuth2AccessToken accessToken, OAuth2Authentication authentication) {
    Connection conn = null;
    PreparedStatement stat = null;
    try {
        conn = this.getConnection();
        String tokenValue = accessToken.getValue();
        if (null != this.getAccessToken(tokenValue, conn)) {
            logger.debug("storeAccessToken: Stored Token already exists");
            return;
        }
        conn.setAutoCommit(false);
        stat = conn.prepareStatement(INSERT_TOKEN);
        stat.setString(1, accessToken.getValue());
        if (accessToken instanceof OAuth2AccessTokenImpl) {
            stat.setString(2, ((OAuth2AccessTokenImpl) accessToken).getClientId());
        } else if (null != authentication.getOAuth2Request()) {
            stat.setString(2, authentication.getOAuth2Request().getClientId());
        } else {
            stat.setNull(2, Types.VARCHAR);
        }
        stat.setTimestamp(3, new Timestamp(accessToken.getExpiration().getTime()));
        stat.setString(4, accessToken.getRefreshToken().getValue());
        if (accessToken instanceof OAuth2AccessTokenImpl) {
            stat.setString(5, ((OAuth2AccessTokenImpl) accessToken).getGrantType());
            stat.setString(6, ((OAuth2AccessTokenImpl) accessToken).getLocalUser());
        } else {
            if (null != authentication.getOAuth2Request()) {
                stat.setString(5, authentication.getOAuth2Request().getGrantType());
            } else {
                stat.setNull(5, Types.VARCHAR);
            }
            if (authentication.getPrincipal() instanceof UserDetails) {
                stat.setString(6, ((UserDetails) authentication.getPrincipal()).getUsername());
            } else {
                stat.setString(6, authentication.getPrincipal().toString());
            }
        }
        stat.executeUpdate();
        conn.commit();
    } catch (Exception t) {
        this.executeRollback(conn);
        logger.error("Error while adding an access token", t);
        throw new RuntimeException("Error while adding an access token", t);
    } finally {
        closeDaoResources(null, stat, conn);
    }
}

Java Code Examples for org.springframework.security.oauth2.provider.OAuth2Authentication#getOAuth2Request()