From 08413302eb57893c6aeaaf56deb90e92ab7a462b Mon Sep 17 00:00:00 2001 From: Justin Richer Date: Tue, 31 Mar 2015 15:35:20 -0400 Subject: [PATCH] configured OIDC client on claims collection endpoint --- .../src/main/webapp/WEB-INF/user-context.xml | 99 ++++++++++++++++++- .../webapp/WEB-INF/views/external_login.jsp | 54 ++++++++++ .../util/ExternalLoginAuthoritiesMapper.java | 44 +++++++++ .../uma/web/ClaimsCollectionEndpoint.java | 54 ++++++++++ 4 files changed, 249 insertions(+), 2 deletions(-) create mode 100644 openid-connect-server-webapp/src/main/webapp/WEB-INF/views/external_login.jsp create mode 100644 openid-connect-server/src/main/java/org/mitre/uma/util/ExternalLoginAuthoritiesMapper.java create mode 100644 openid-connect-server/src/main/java/org/mitre/uma/web/ClaimsCollectionEndpoint.java diff --git a/openid-connect-server-webapp/src/main/webapp/WEB-INF/user-context.xml b/openid-connect-server-webapp/src/main/webapp/WEB-INF/user-context.xml index 54b8b5a9b..d8f295620 100644 --- a/openid-connect-server-webapp/src/main/webapp/WEB-INF/user-context.xml +++ b/openid-connect-server-webapp/src/main/webapp/WEB-INF/user-context.xml @@ -29,6 +29,99 @@ http://www.springframework.org/schema/tx http://www.springframework.org/schema/tx/spring-tx-4.1.xsd http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context-4.1.xsd"> + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + openid + profile + email + phone + address + + + + + + #{configBean.issuer + "openid_connect_login"} + + + + + + + + + + + + + + + @@ -36,14 +129,16 @@ - + + - + + diff --git a/openid-connect-server-webapp/src/main/webapp/WEB-INF/views/external_login.jsp b/openid-connect-server-webapp/src/main/webapp/WEB-INF/views/external_login.jsp new file mode 100644 index 000000000..a2171fe31 --- /dev/null +++ b/openid-connect-server-webapp/src/main/webapp/WEB-INF/views/external_login.jsp @@ -0,0 +1,54 @@ +<%@ page language="java" contentType="text/html; charset=UTF-8" pageEncoding="UTF-8"%> +<%@ taglib uri="http://java.sun.com/jsp/jstl/core" prefix="c" %> +<%@ taglib prefix="security" uri="http://www.springframework.org/security/tags" %> +<%@ taglib prefix="o" tagdir="/WEB-INF/tags"%> + + +
+
+
+ +

Log In

+ +

Use this page to log in by entering an issuer URI or a webfinger identifier. + Use the buttons to pre-fill the form with a known identifier.

+ +
+
+ +
+ +
+ +
+ +
+
+ +
+ +
+
+ + +
+
+ +
+ +
+
+
+ + + \ No newline at end of file diff --git a/openid-connect-server/src/main/java/org/mitre/uma/util/ExternalLoginAuthoritiesMapper.java b/openid-connect-server/src/main/java/org/mitre/uma/util/ExternalLoginAuthoritiesMapper.java new file mode 100644 index 000000000..1b23f53c7 --- /dev/null +++ b/openid-connect-server/src/main/java/org/mitre/uma/util/ExternalLoginAuthoritiesMapper.java @@ -0,0 +1,44 @@ +/******************************************************************************* + * Copyright 2015 The MITRE Corporation + * and the MIT Kerberos and Internet Trust Consortium + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + *******************************************************************************/ + +package org.mitre.uma.util; + +import java.util.Collection; +import java.util.Set; + +import org.springframework.security.core.GrantedAuthority; +import org.springframework.security.core.authority.SimpleGrantedAuthority; +import org.springframework.security.core.authority.mapping.GrantedAuthoritiesMapper; + +import com.google.common.collect.Sets; + +/** + * @author jricher + * + */ +public class ExternalLoginAuthoritiesMapper implements GrantedAuthoritiesMapper { + + private static final GrantedAuthority ROLE_EXTERNAL_USER = new SimpleGrantedAuthority("ROLE_EXTERNAL_USER"); + + @Override + public Collection mapAuthorities(Collection authorities) { + Set out = Sets.newHashSet(authorities); + out.add(ROLE_EXTERNAL_USER); + return out; + } + +} diff --git a/openid-connect-server/src/main/java/org/mitre/uma/web/ClaimsCollectionEndpoint.java b/openid-connect-server/src/main/java/org/mitre/uma/web/ClaimsCollectionEndpoint.java new file mode 100644 index 000000000..6162b2bce --- /dev/null +++ b/openid-connect-server/src/main/java/org/mitre/uma/web/ClaimsCollectionEndpoint.java @@ -0,0 +1,54 @@ +/******************************************************************************* + * Copyright 2015 The MITRE Corporation + * and the MIT Kerberos and Internet Trust Consortium + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + *******************************************************************************/ + +package org.mitre.uma.web; + +import org.mitre.openid.connect.view.JsonErrorView; +import org.springframework.security.access.prepost.PreAuthorize; +import org.springframework.security.core.Authentication; +import org.springframework.stereotype.Controller; +import org.springframework.ui.Model; +import org.springframework.web.bind.annotation.RequestMapping; +import org.springframework.web.bind.annotation.RequestMethod; +import org.springframework.web.bind.annotation.RequestParam; + +/** + * + * Collect claims interactively from the end user. + * + * @author jricher + * + */ +@Controller +@PreAuthorize("hasRole('ROLE_EXTERNAL_USER')") +@RequestMapping("/" + ClaimsCollectionEndpoint.URL) +public class ClaimsCollectionEndpoint { + + public static final String URL = "rqp_claims"; + + + @RequestMapping(method = RequestMethod.GET) + public String collectClaims(@RequestParam("client_id") String clientId, @RequestParam("redirect_uri") String redirectUri, + @RequestParam("ticket") String ticket, @RequestParam("state") String state, + Model m, Authentication auth) { + + + + return JsonErrorView.VIEWNAME; + } + +}