github
/
OpenID-Connect-Java-Spring-Server
mirror of https://github.com/mitreid-connect/OpenID-Connect-Java-Spring-Server
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

Trying to fix nonce service

pull/263/merge
Amanda Anganes 2013-01-23 12:43:06 -05:00
parent 86bf51f0a7
commit 06f970e61b
2 changed files with 36 additions and 21 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

59
openid-connect-server/src/main/java/org/mitre/openid/connect/ConnectAuthorizationRequestManager.java
View File

@ -15,6 +15,7 @@ import org.slf4j.Logger;
import org.slf4j.LoggerFactory; import org.slf4j.LoggerFactory;
import org.springframework.beans.factory.InitializingBean; import org.springframework.beans.factory.InitializingBean;
import org.springframework.beans.factory.annotation.Autowired; import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.security.core.context.SecurityContextHolder;
import org.springframework.security.oauth2.common.exceptions.InvalidClientException; import org.springframework.security.oauth2.common.exceptions.InvalidClientException;
import org.springframework.security.oauth2.common.exceptions.InvalidScopeException; import org.springframework.security.oauth2.common.exceptions.InvalidScopeException;
import org.springframework.security.oauth2.common.util.OAuth2Utils; import org.springframework.security.oauth2.common.util.OAuth2Utils;
@ -76,29 +77,43 @@ public class ConnectAuthorizationRequestManager implements AuthorizationRequestM
String requestNonce = parameters.get("nonce"); String requestNonce = parameters.get("nonce");
Object principal = SecurityContextHolder.getContext().getAuthentication().getPrincipal();
boolean anonymous = false;
if (principal instanceof String) {
if (principal.toString().equals("anonymousUser")) {
anonymous = true;
}
}
//If a nonce was included in the request, process it //If a nonce was included in the request, process it
if (requestNonce != null) { // if (requestNonce != null) {
//
//Check request nonce for reuse // //Check request nonce for reuse
Collection<Nonce> clientNonces = nonceService.getByClientId(client.getClientId()); // Collection<Nonce> clientNonces = nonceService.getByClientId(client.getClientId());
for (Nonce nonce : clientNonces) { // for (Nonce nonce : clientNonces) {
if (nonce.getValue().equals(requestNonce)) { // if (nonce.getValue().equals(requestNonce)) {
throw new NonceReuseException(client.getClientId(), nonce); // throw new NonceReuseException(client.getClientId(), nonce);
} // }
} // }
//
//Store nonce //
Nonce nonce = new Nonce(); //
nonce.setClientId(client.getClientId()); // if (principal != null && !anonymous) {
nonce.setValue(requestNonce); //
DateTime now = new DateTime(new Date()); // //Store nonce
nonce.setUseDate(now.toDate()); // Nonce nonce = new Nonce();
DateTime expDate = now.plus(nonceStorageDuration); // nonce.setClientId(client.getClientId());
Date expirationJdkDate = expDate.toDate(); // nonce.setValue(requestNonce);
nonce.setExpireDate(expirationJdkDate); // DateTime now = new DateTime(new Date());
// nonce.setUseDate(now.toDate());
nonceService.save(nonce); // DateTime expDate = now.plus(nonceStorageDuration);
} // Date expirationJdkDate = expDate.toDate();
// nonce.setExpireDate(expirationJdkDate);
//
// nonceService.save(nonce);
// }
// }
Set<String> scopes = OAuth2Utils.parseParameterList(parameters.get("scope")); Set<String> scopes = OAuth2Utils.parseParameterList(parameters.get("scope"));
if ((scopes == null || scopes.isEmpty())) { if ((scopes == null || scopes.isEmpty())) {

2
openid-connect-server/src/main/java/org/mitre/openid/connect/view/JSONUserInfoView.java
View File

@ -106,7 +106,7 @@ public class JSONUserInfoView extends AbstractView {
JsonObject obj = new JsonObject(); JsonObject obj = new JsonObject();
//The "sub" claim must always be returned from this endpoint //The "sub" claim must always be returned from this endpoint
obj.addProperty("sub", ui.getUserId()); obj.addProperty("sub", ui.getSub());
//TODO: I think the following should be removed. "sub" replaces "user_id", and according //TODO: I think the following should be removed. "sub" replaces "user_id", and according
//to the spec it must ALWAYS be returned from this endpoint. //to the spec it must ALWAYS be returned from this endpoint.