github
/
OpenID-Connect-Java-Spring-Server
mirror of https://github.com/mitreid-connect/OpenID-Connect-Java-Spring-Server
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

defer to system scope matcher in approval handler

pull/516/head
Justin Richer 2013-08-30 16:04:57 -04:00
parent 99ad9b883e
commit 469e722f72
1 changed files with 2 additions and 20 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

22
openid-connect-server/src/main/java/org/mitre/openid/connect/token/TofuUserApprovalHandler.java
View File

@ -138,7 +138,7 @@ public class TofuUserApprovalHandler implements UserApprovalHandler {
if (!ap.isExpired()) {
// if we find one that fits...
if (scopesMatch(authorizationRequest.getScope(), ap.getAllowedScopes())) {
if (systemScopes.scopesMatch(ap.getAllowedScopes(), authorizationRequest.getScope())) {
//We have a match; update the access date on the AP entry and return true.
ap.setAccessDate(new Date());
@ -155,7 +155,7 @@ public class TofuUserApprovalHandler implements UserApprovalHandler {
if (!alreadyApproved) {
WhitelistedSite ws = whitelistedSiteService.getByClientId(clientId);
if (ws != null && scopesMatch(authorizationRequest.getScope(), ws.getAllowedScopes())) {
if (ws != null && systemScopes.scopesMatch(ws.getAllowedScopes(), authorizationRequest.getScope())) {
//Create an approved site
ApprovedSite newSite = approvedSiteService.createApprovedSite(clientId, userId, null, ws.getAllowedScopes(), ws);
@ -265,22 +265,4 @@ public class TofuUserApprovalHandler implements UserApprovalHandler {
}
}
/**
* Check whether the requested scope set is a proper subset of the allowed scopes.
*
* @param requestedScopes
* @param allowedScopes
* @return
*/
private boolean scopesMatch(Set<String> requestedScopes, Set<String> allowedScopes) {
for (String scope : requestedScopes) {
if (!allowedScopes.contains(scope)) {
return false; //throw new InvalidScopeException("Invalid scope: " + scope, allowedScopes);
}
}
return true;
}
}