Java Code Examples for org.apache.cxf.rs.security.oauth2.common.ServerAccessToken#getScopes()

The following examples show how to use org.apache.cxf.rs.security.oauth2.common.ServerAccessToken#getScopes() . You can vote up the ones you like or vote down the ones you don't like, and go to the original project or source file by following the links above each example. You may check out the related API usage on the sidebar.
Example 1
Source File: OAuthUtils.java    From cxf with Apache License 2.0 6 votes vote down vote up 
public static ClientAccessToken toClientAccessToken(ServerAccessToken serverToken, boolean supportOptionalParams) {
    String tokenKey =
        serverToken.getEncodedToken() != null ? serverToken.getEncodedToken() : serverToken.getTokenKey();
    ClientAccessToken clientToken = new ClientAccessToken(serverToken.getTokenType(),
                                                          tokenKey);
    clientToken.setRefreshToken(serverToken.getRefreshToken());
    if (supportOptionalParams) {
        clientToken.setExpiresIn(serverToken.getExpiresIn());
        List<OAuthPermission> perms = serverToken.getScopes();
        String scopeString = OAuthUtils.convertPermissionsToScope(perms);
        if (!StringUtils.isEmpty(scopeString)) {
            clientToken.setApprovedScope(scopeString);
        }
        clientToken.setParameters(new HashMap<String, String>(serverToken.getParameters()));
    }
    return clientToken;
}
Example 2
Source File: JPAOAuthDataProvider.java    From cxf with Apache License 2.0 6 votes vote down vote up 
@Override
protected ServerAccessToken doCreateAccessToken(AccessTokenRegistration atReg) {
    ServerAccessToken at = super.doCreateAccessToken(atReg);
    // we override this in order to get rid of elementCollections directly injected
    // from another entity
    // this can be the case when using multiple cmt dataProvider operation in a single entityManager
    // lifespan
    if (at.getAudiences() != null) {
        at.setAudiences(new ArrayList<>(at.getAudiences()));
    }
    if (at.getExtraProperties() != null) {
        at.setExtraProperties(new HashMap<String, String>(at.getExtraProperties()));
    }
    if (at.getScopes() != null) {
        at.setScopes(new ArrayList<>(at.getScopes()));
    }
    if (at.getParameters() != null) {
        at.setParameters(new HashMap<String, String>(at.getParameters()));
    }
    return at;
}
Example 3
Source File: AbstractOAuthDataProvider.java    From cxf with Apache License 2.0 5 votes vote down vote up 
protected RefreshToken doCreateNewRefreshToken(ServerAccessToken at) {
    RefreshToken rt = new RefreshToken(at.getClient(), refreshTokenLifetime);
    if (at.getAudiences() != null) {
        rt.setAudiences(new ArrayList<>(at.getAudiences()));
    }
    rt.setGrantType(at.getGrantType());
    if (at.getScopes() != null) {
        rt.setScopes(new ArrayList<>(at.getScopes()));
    }
    rt.setGrantCode(at.getGrantCode());
    rt.setNonce(at.getNonce());
    rt.setSubject(at.getSubject());
    rt.setClientCodeVerifier(at.getClientCodeVerifier());
    return rt;
}
Example 4
Source File: CryptoUtilsTest.java    From cxf with Apache License 2.0 5 votes vote down vote up 
private void compareAccessTokens(ServerAccessToken token, ServerAccessToken token2) {
    assertEquals(token.getTokenKey(), token2.getTokenKey());
    assertEquals(token.getTokenType(), token2.getTokenType());
    assertEquals(token.getIssuedAt(), token2.getIssuedAt());
    assertEquals(token.getExpiresIn(), token2.getExpiresIn());
    Client regClient1 = token.getClient();
    Client regClient2 = token2.getClient();
    assertEquals(regClient1.getClientId(), regClient2.getClientId());
    assertNull(regClient2.getApplicationDescription());
    UserSubject endUser1 = token.getSubject();
    UserSubject endUser2 = token2.getSubject();
    assertEquals(endUser1.getLogin(), endUser2.getLogin());
    assertEquals(endUser1.getId(), endUser2.getId());
    assertEquals(endUser1.getRoles(), endUser2.getRoles());

    assertEquals(token.getRefreshToken(), token2.getRefreshToken());
    assertEquals(token.getAudiences(), token2.getAudiences());
    assertEquals(token.getGrantType(), token2.getGrantType());
    assertEquals(token.getParameters(), token2.getParameters());

    List<OAuthPermission> permissions = token.getScopes();
    List<OAuthPermission> permissions2 = token2.getScopes();
    assertEquals(1, permissions.size());
    assertEquals(1, permissions2.size());
    OAuthPermission perm1 = permissions.get(0);
    OAuthPermission perm2 = permissions2.get(0);
    assertEquals(perm1.getPermission(), perm2.getPermission());
    assertEquals(perm1.getDescription(), perm2.getDescription());

    RefreshToken refreshToken =
        ModelEncryptionSupport.decryptRefreshToken(p, token2.getRefreshToken(), p.key);
    assertEquals(1200L, refreshToken.getExpiresIn());
}
Example 5
Source File: AbstractOAuthDataProviderTest.java    From cxf with Apache License 2.0 5 votes vote down vote up 
@Test
public void testAddGetDeleteRefreshToken() {
    Client c = addClient("101", "bob");

    AccessTokenRegistration atr = new AccessTokenRegistration();
    atr.setClient(c);
    atr.setApprovedScope(Arrays.asList("a", "refreshToken"));
    atr.setSubject(c.getResourceOwnerSubject());

    ServerAccessToken at = getProvider().createAccessToken(atr);
    validateAccessToken(at);
    ServerAccessToken at2 = getProvider().getAccessToken(at.getTokenKey());
    validateAccessToken(at2);
    assertEquals(at.getTokenKey(), at2.getTokenKey());
    List<OAuthPermission> scopes = at2.getScopes();
    assertNotNull(scopes);
    assertEquals(2, scopes.size());
    OAuthPermission perm = scopes.get(0);
    assertEquals("a", perm.getPermission());
    OAuthPermission perm2 = scopes.get(1);
    assertEquals("refreshToken", perm2.getPermission());

    RefreshToken rt = getProvider().getRefreshToken(at2.getRefreshToken());
    assertNotNull(rt);
    assertEquals(at2.getTokenKey(), rt.getAccessTokens().get(0));

    List<RefreshToken> tokens = getProvider().getRefreshTokens(c, c.getResourceOwnerSubject());
    assertNotNull(tokens);
    assertEquals(1, tokens.size());
    assertEquals(rt.getTokenKey(), tokens.get(0).getTokenKey());

    getProvider().revokeToken(c, rt.getTokenKey(), OAuthConstants.REFRESH_TOKEN);

    assertNull(getProvider().getRefreshToken(rt.getTokenKey()));
}
Example 6
Source File: ModelEncryptionSupport.java    From cxf with Apache License 2.0 4 votes vote down vote up 
private static String tokenizeServerToken(ServerAccessToken token) {
    StringBuilder state = new StringBuilder();
    // 0: key
    state.append(tokenizeString(token.getTokenKey()));
    // 1: type
    state.append(SEP);
    state.append(tokenizeString(token.getTokenType()));
    // 2: expiresIn
    state.append(SEP);
    state.append(token.getExpiresIn());
    // 3: issuedAt
    state.append(SEP);
    state.append(token.getIssuedAt());
    // 4: client id
    state.append(SEP);
    state.append(tokenizeString(token.getClient().getClientId()));
    // 5: refresh token
    state.append(SEP);
    state.append(tokenizeString(token.getRefreshToken()));
    // 6: grant type
    state.append(SEP);
    state.append(tokenizeString(token.getGrantType()));
    // 7: audience
    state.append(SEP);
    state.append(token.getAudiences().toString());
    // 8: other parameters
    state.append(SEP);
    // {key=value, key=value}
    state.append(token.getParameters().toString());
    // 9: permissions
    state.append(SEP);
    if (token.getScopes().isEmpty()) {
        state.append(' ');
    } else {
        for (OAuthPermission p : token.getScopes()) {
            // 9.1
            state.append(tokenizeString(p.getPermission()));
            state.append('.');
            // 9.2
            state.append(tokenizeString(p.getDescription()));
            state.append('.');
            // 9.3
            state.append(p.isDefaultPermission());
            state.append('.');
            // 9.4
            state.append(p.getHttpVerbs().toString());
            state.append('.');
            // 9.5
            state.append(p.getUris().toString());
        }
    }
    state.append(SEP);
    // 10: code verifier
    state.append(tokenizeString(token.getClientCodeVerifier()));
    state.append(SEP);
    // 11: user subject
    tokenizeUserSubject(state, token.getSubject());
    // 13: extra properties
    state.append(SEP);
    // {key=value, key=value}
    state.append(token.getExtraProperties().toString());
    return state.toString();
}
Example 7
Source File: AbstractOAuthDataProviderTest.java    From cxf with Apache License 2.0 4 votes vote down vote up 
@Test
public void testAddGetDeleteAccessToken() {
    Client c = addClient("101", "bob");

    AccessTokenRegistration atr = new AccessTokenRegistration();
    atr.setClient(c);
    atr.setApprovedScope(Collections.singletonList("a"));
    atr.setSubject(c.getResourceOwnerSubject());

    ServerAccessToken at = getProvider().createAccessToken(atr);
    validateAccessToken(at);
    ServerAccessToken at2 = getProvider().getAccessToken(at.getTokenKey());
    validateAccessToken(at2);
    assertEquals(at.getTokenKey(), at2.getTokenKey());
    List<OAuthPermission> scopes = at2.getScopes();
    assertNotNull(scopes);
    assertEquals(1, scopes.size());
    OAuthPermission perm = scopes.get(0);
    assertEquals("a", perm.getPermission());

    List<ServerAccessToken> tokens = getProvider().getAccessTokens(c, c.getResourceOwnerSubject());
    assertNotNull(tokens);
    assertEquals(1, tokens.size());
    assertEquals(at.getTokenKey(), tokens.get(0).getTokenKey());
    validateAccessToken(tokens.get(0));

    tokens = getProvider().getAccessTokens(c, null);
    assertNotNull(tokens);
    assertEquals(1, tokens.size());
    assertEquals(at.getTokenKey(), tokens.get(0).getTokenKey());
    validateAccessToken(tokens.get(0));

    tokens = getProvider().getAccessTokens(null, c.getResourceOwnerSubject());
    assertNotNull(tokens);
    assertEquals(1, tokens.size());
    assertEquals(at.getTokenKey(), tokens.get(0).getTokenKey());
    validateAccessToken(tokens.get(0));

    tokens = getProvider().getAccessTokens(null, null);
    assertNotNull(tokens);
    assertEquals(1, tokens.size());
    assertEquals(at.getTokenKey(), tokens.get(0).getTokenKey());
    validateAccessToken(tokens.get(0));

    getProvider().revokeToken(c, at.getTokenKey(), OAuthConstants.ACCESS_TOKEN);
    assertNull(getProvider().getAccessToken(at.getTokenKey()));
}