org.springframework.security.oauth2.provider.OAuth2Authentication#isClientOnly

Source File: OpenTokenEnhancer.java From open-cloud with MIT License

6 votes

/**
 * 生成token
 *
 * @param accessToken
 * @param authentication
 * @return
 */
@Override
public OAuth2AccessToken enhance(OAuth2AccessToken accessToken, OAuth2Authentication authentication) {
    DefaultOAuth2AccessToken defaultOAuth2AccessToken = new DefaultOAuth2AccessToken(accessToken);
    final Map<String, Object> additionalInfo = new HashMap<>(8);
    if (!authentication.isClientOnly()) {
        if (authentication.getPrincipal() != null && authentication.getPrincipal() instanceof OpenUserDetails) {
            // 设置额外用户信息
            OpenUserDetails baseUser = ((OpenUserDetails) authentication.getPrincipal());
            additionalInfo.put(OpenSecurityConstants.OPEN_ID, baseUser.getUserId());
            additionalInfo.put(OpenSecurityConstants.DOMAIN, baseUser.getDomain());
        }
    }
    defaultOAuth2AccessToken.setAdditionalInformation(additionalInfo);
    return super.enhance(defaultOAuth2AccessToken, authentication);
}

Source File: OpenHelper.java From open-cloud with MIT License

6 votes

/**
 * 获取认证用户信息
 *
 * @return
 */
public static OpenUserDetails getUser() {
    Authentication authentication = SecurityContextHolder.getContext().getAuthentication();
    if (authentication != null && authentication.isAuthenticated() && authentication instanceof OAuth2Authentication) {
        OAuth2Authentication oAuth2Authentication = (OAuth2Authentication) authentication;
        OAuth2Request clientToken = oAuth2Authentication.getOAuth2Request();
        if (!oAuth2Authentication.isClientOnly()) {
            if (authentication.getPrincipal() instanceof OpenUserDetails) {
                return (OpenUserDetails) authentication.getPrincipal();
            }
            if (authentication.getPrincipal() instanceof Map) {
                return BeanConvertUtils.mapToObject((Map) authentication.getPrincipal(), OpenUserDetails.class);
            }
        } else {
            OpenUserDetails openUser = new OpenUserDetails();
            openUser.setClientId(clientToken.getClientId());
            openUser.setAuthorities(clientToken.getAuthorities());
            return openUser;
        }
    }
    return null;
}

Source File: OpenHelper.java From open-cloud with MIT License

6 votes

/***
 * 更新客户端权限
 * @param tokenStore
 * @param clientId
 * @param authorities
 */
public static void updateOpenClientAuthorities(TokenStore tokenStore, String clientId, Collection<? extends GrantedAuthority> authorities) {
    if (authorities == null) {
        return;
    }
    // 动态更新客户端生成的token
    Collection<OAuth2AccessToken> accessTokens = tokenStore.findTokensByClientId(clientId);
    if (accessTokens != null && !accessTokens.isEmpty()) {
        Iterator<OAuth2AccessToken> iterator = accessTokens.iterator();
        while (iterator.hasNext()) {
            OAuth2AccessToken token = iterator.next();
            OAuth2Authentication oAuth2Authentication = tokenStore.readAuthentication(token);
            if (oAuth2Authentication != null && oAuth2Authentication.isClientOnly()) {
                // 只更新客户端权限
                // 由于没有set方法,使用反射机制强制赋值
                ReflectionUtils.setFieldValue(oAuth2Authentication, "authorities", authorities);
                // 重新保存
                tokenStore.storeAccessToken(token, oAuth2Authentication);
            }
        }
    }
}

Source File: ChoerodonAuthenticationKeyGenerator.java From oauth-server with Apache License 2.0

6 votes

@Override
public String extractKey(OAuth2Authentication authentication) {
    Map<String, String> values = new LinkedHashMap<>();
    OAuth2Request authorizationRequest = authentication.getOAuth2Request();
    if (!authentication.isClientOnly()) {
        values.put(USERNAME, authentication.getName());
    }
    values.put(CLIENT_ID, authorizationRequest.getClientId());
    if (authorizationRequest.getScope() != null) {
        values.put(SCOPE, OAuth2Utils.formatParameterList(new TreeSet<>(authorizationRequest.getScope())));
    }
    Authentication auth = authentication.getUserAuthentication();
    if (auth != null && auth.getDetails() instanceof WebAuthenticationDetails) {
        String sessionId = ((WebAuthenticationDetails) auth.getDetails()).getSessionId();
        logger.info("sessionId : {}", sessionId);
        if (!StringUtils.isEmpty(sessionId)) {
            values.put(SESSION, sessionId);
        }
    }
    return generateKey(values);
}

Source File: MongoTokenStore.java From spring-security-mongo with MIT License

6 votes

@Override
public void storeAccessToken(final OAuth2AccessToken token,
                             final OAuth2Authentication authentication) {
    String refreshToken = null;
    if (nonNull(token.getRefreshToken())) {
        refreshToken = token.getRefreshToken().getValue();
    }

    if (nonNull(readAccessToken(token.getValue()))) {
        removeAccessToken(token.getValue());
    }

    final String tokenKey = extractTokenKey(token.getValue());

    final MongoOAuth2AccessToken oAuth2AccessToken = new MongoOAuth2AccessToken(tokenKey,
            serializeAccessToken(token),
            authenticationKeyGenerator.extractKey(authentication),
            authentication.isClientOnly() ? null : authentication.getName(),
            authentication.getOAuth2Request().getClientId(),
            serializeAuthentication(authentication),
            extractTokenKey(refreshToken));

    mongoOAuth2AccessTokenRepository.save(oAuth2AccessToken);
}

Source File: CustomTokenStore.java From oauth-server with Apache License 2.0

5 votes

@Override
public OAuth2AccessToken getAccessToken(OAuth2Authentication authentication) {
    if (oauthProperties.isEnabledSingleLogin() && !authentication.isClientOnly()) {
        String key = authenticationKeyGenerator.extractKey(authentication);
        String username = authentication.getName();
        String clientId = authentication.getOAuth2Request().getClientId();
        accessTokenMapper.selectTokens(username, clientId, key);
        accessTokenMapper.deleteTokens(username, clientId, key);

    }
    return super.getAccessToken(authentication);
}

Source File: PigRedisTokenStore.java From pig with MIT License

5 votes

@Override
public void storeAccessToken(OAuth2AccessToken token, OAuth2Authentication authentication) {

    this.redisTemplate.opsForValue().set(ACCESS + token.getValue(), token);
    this.redisTemplate.opsForValue().set(AUTH + token.getValue(), authentication);
    this.redisTemplate.opsForValue().set(AUTH_TO_ACCESS + authenticationKeyGenerator.extractKey(authentication), token);
    if (!authentication.isClientOnly()) {
        redisTemplate.opsForList().rightPush(UNAME_TO_ACCESS + getApprovalKey(authentication), token);
    }

    redisTemplate.opsForList().rightPush(CLIENT_ID_TO_ACCESS + authentication.getOAuth2Request().getClientId(), token);

    if (token.getExpiration() != null) {

        int seconds = token.getExpiresIn();
        redisTemplate.expire(ACCESS + token.getValue(), seconds, TimeUnit.SECONDS);
        redisTemplate.expire(AUTH + token.getValue(), seconds, TimeUnit.SECONDS);

        redisTemplate.expire(AUTH_TO_ACCESS + authenticationKeyGenerator.extractKey(authentication), seconds, TimeUnit.SECONDS);
        redisTemplate.expire(CLIENT_ID_TO_ACCESS + authentication.getOAuth2Request().getClientId(), seconds, TimeUnit.SECONDS);
        redisTemplate.expire(UNAME_TO_ACCESS + getApprovalKey(authentication), seconds, TimeUnit.SECONDS);
    }
    if (token.getRefreshToken() != null && token.getRefreshToken().getValue() != null) {
        this.redisTemplate.opsForValue().set(REFRESH_TO_ACCESS + token.getRefreshToken().getValue(), token.getValue());
        this.redisTemplate.opsForValue().set(ACCESS_TO_REFRESH + token.getValue(), token.getRefreshToken().getValue());
    }
}

Source File: FwRedisTokenStore.java From fw-cloud-framework with MIT License

5 votes

@Override
public void storeAccessToken(OAuth2AccessToken token, OAuth2Authentication authentication) {

	this.redisTemplate.opsForValue().set(ACCESS + token.getValue(), token);
	this.redisTemplate.opsForValue().set(AUTH + token.getValue(), authentication);
	this.redisTemplate.opsForValue().set(AUTH_TO_ACCESS + authenticationKeyGenerator.extractKey(authentication), token);
	if (!authentication.isClientOnly()) {
		this.redisTemplate.opsForList().rightPush(UNAME_TO_ACCESS + getApprovalKey(authentication), token);
	}

	redisTemplate.opsForList().rightPush(CLIENT_ID_TO_ACCESS + authentication.getOAuth2Request().getClientId(), token);

	if (token.getExpiration() != null) {

		int seconds = token.getExpiresIn();
		redisTemplate.expire(ACCESS + token.getValue(), seconds, TimeUnit.SECONDS);
		redisTemplate.expire(AUTH + token.getValue(), seconds, TimeUnit.SECONDS);

		redisTemplate.expire(AUTH_TO_ACCESS + authenticationKeyGenerator.extractKey(authentication), seconds, TimeUnit.SECONDS);
		redisTemplate.expire(CLIENT_ID_TO_ACCESS + authentication.getOAuth2Request().getClientId(), seconds, TimeUnit.SECONDS);
		redisTemplate.expire(UNAME_TO_ACCESS + getApprovalKey(authentication), seconds, TimeUnit.SECONDS);
	}
	if (token.getRefreshToken() != null && token.getRefreshToken()
			.getValue() != null) {
		this.redisTemplate.opsForValue().set(REFRESH_TO_ACCESS + token.getRefreshToken().getValue(), token.getValue());
		this.redisTemplate.opsForValue().set(ACCESS_TO_REFRESH + token.getValue(), token.getRefreshToken().getValue());
	}
}

Source File: CustomAccessTokenConverter.java From microservices-oauth with Apache License 2.0

5 votes

public Map<String, ?> convertAccessToken(OAuth2AccessToken token, OAuth2Authentication authentication) {
	Map<String, Object> response = new HashMap<String, Object>();
	OAuth2Request clientToken = authentication.getOAuth2Request();

	if (!authentication.isClientOnly())
		response.putAll(userTokenConverter.convertUserAuthentication(authentication.getUserAuthentication()));
	else if (clientToken.getAuthorities() != null && !clientToken.getAuthorities().isEmpty())
		response.put(UserAuthenticationConverter.AUTHORITIES,
				AuthorityUtils.authorityListToSet(clientToken.getAuthorities()));

	if (token.getScope() != null)
		response.put(SCOPE, token.getScope());

	if (token.getAdditionalInformation().containsKey(JTI))
		response.put(JTI, token.getAdditionalInformation().get(JTI));

	if (token.getExpiration() != null)
		response.put(EXP, token.getExpiration().getTime() / 1000);

	if (includeGrantType && authentication.getOAuth2Request().getGrantType() != null)
		response.put(GRANT_TYPE, authentication.getOAuth2Request().getGrantType());

	response.putAll(token.getAdditionalInformation());

	response.put(CLIENT_ID, clientToken.getClientId());
	if (clientToken.getResourceIds() != null && !clientToken.getResourceIds().isEmpty())
		response.put(AUD, clientToken.getResourceIds());

	return response;
}

Source File: CustomAccessTokenConverter.java From spring-boot-2-oauth2-resource-jwt with MIT License

5 votes

public Map<String, ?> convertAccessToken(OAuth2AccessToken token, OAuth2Authentication authentication) {
	Map<String, Object> response = new HashMap<String, Object>();
	OAuth2Request clientToken = authentication.getOAuth2Request();

	if (!authentication.isClientOnly())
		response.putAll(userTokenConverter.convertUserAuthentication(authentication.getUserAuthentication()));
	else if (clientToken.getAuthorities() != null && !clientToken.getAuthorities().isEmpty())
		response.put(UserAuthenticationConverter.AUTHORITIES,
				AuthorityUtils.authorityListToSet(clientToken.getAuthorities()));

	if (token.getScope() != null)
		response.put(SCOPE, token.getScope());

	if (token.getAdditionalInformation().containsKey(JTI))
		response.put(JTI, token.getAdditionalInformation().get(JTI));

	if (token.getExpiration() != null)
		response.put(EXP, token.getExpiration().getTime() / 1000);

	if (includeGrantType && authentication.getOAuth2Request().getGrantType() != null)
		response.put(GRANT_TYPE, authentication.getOAuth2Request().getGrantType());

	response.putAll(token.getAdditionalInformation());

	response.put(CLIENT_ID, clientToken.getClientId());
	if (clientToken.getResourceIds() != null && !clientToken.getResourceIds().isEmpty())
		response.put(AUD, clientToken.getResourceIds());

	return response;
}

Source File: MeController.java From osiam with MIT License

5 votes

@RequestMapping(method = RequestMethod.GET)
public MappingJacksonValue getCurrentUser(@RequestHeader("Authorization") String tokenHeader,
                                          @RequestParam(required = false) String attributes,
                                          HttpServletResponse response,
                                          UriComponentsBuilder builder) {

    if (Strings.isNullOrEmpty(tokenHeader)) {
        throw new IllegalArgumentException("No access token provided!"); // This should never happen!
    }

    String accessToken = tokenHeader.substring("Bearer ".length());

    OAuth2Authentication oAuth = resourceServerTokenServices.loadAuthentication(accessToken);
    if (oAuth.isClientOnly()) {
        throw new InvalidTokenException("Can't return an user. This access token belongs to a client.");
    }

    Authentication userAuthentication = oAuth.getUserAuthentication();

    Object principal = userAuthentication.getPrincipal();
    User user;
    if (principal instanceof User) {
        user = userProvisioning.getById(((User) principal).getId());
    } else {
        throw new IllegalArgumentException("User not authenticated.");
    }

    response.setHeader("Location", buildLocation(user, builder).toString());
    return buildResponse(user, attributes);
}

Source File: OauthAdminController.java From OpenESPI-DataCustodian-java with Apache License 2.0

5 votes

private void checkResourceOwner(String user, Principal principal) {
	if (principal instanceof OAuth2Authentication) {
		OAuth2Authentication authentication = (OAuth2Authentication) principal;
		if (!authentication.isClientOnly() && !user.equals(principal.getName())) {
			throw new AccessDeniedException(String.format("User '%s' cannot obtain tokens for user '%s'",
					principal.getName(), user));
		}
	}
}

Java Code Examples for org.springframework.security.oauth2.provider.OAuth2Authentication#isClientOnly()