github
/
OpenID-Connect-Java-Spring-Server
mirror of https://github.com/mitreid-connect/OpenID-Connect-Java-Spring-Server
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

more updates to track nimbus-jose-jwt classes and use them properly

pull/306/merge
Justin Richer 2013-02-21 16:22:30 -05:00
parent 9a98d241e8
commit 4d725b88dd
3 changed files with 62 additions and 74 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

87
openid-connect-server/src/main/java/org/mitre/oauth2/token/JwtAssertionTokenGranter.java
View File

@ -72,71 +72,64 @@ public class JwtAssertionTokenGranter extends AbstractTokenGranter {
// it's an ID token, process it accordingly // it's an ID token, process it accordingly
// TODO: make this use the idtoken class try {
JWT idToken;
try {
idToken = JWTParser.parse(incomingTokenValue);
} catch (ParseException e1) {
// TODO Auto-generated catch block
e1.printStackTrace();
return null;
}
OAuth2AccessTokenEntity accessToken = tokenServices.getAccessTokenForIdToken(incomingToken); // TODO: make this use a more specific idtoken class
JWT idToken = JWTParser.parse(incomingTokenValue);
if (accessToken != null) { OAuth2AccessTokenEntity accessToken = tokenServices.getAccessTokenForIdToken(incomingToken);
//OAuth2AccessTokenEntity newIdToken = tokenServices.get if (accessToken != null) {
OAuth2AccessTokenEntity newIdTokenEntity = new OAuth2AccessTokenEntity(); //OAuth2AccessTokenEntity newIdToken = tokenServices.get
// FIXME: we shouldn't have to roundtrip this through JSON to get it to copy all existing claims OAuth2AccessTokenEntity newIdTokenEntity = new OAuth2AccessTokenEntity();
JWTClaimsSet claims;
try {
claims = JWTClaimsSet.parse(idToken.getJWTClaimsSet().toJSONObject());
} catch (ParseException e1) {
// TODO Auto-generated catch block
e1.printStackTrace();
return null;
}
// update expiration and issued-at claims // copy over all existing claims
if (client.getIdTokenValiditySeconds() != null) { JWTClaimsSet claims = new JWTClaimsSet(idToken.getJWTClaimsSet());
Date expiration = new Date(System.currentTimeMillis() + (client.getIdTokenValiditySeconds() * 1000L));
claims.setExpirationTime(expiration); // update expiration and issued-at claims
newIdTokenEntity.setExpiration(expiration); if (client.getIdTokenValiditySeconds() != null) {
} Date expiration = new Date(System.currentTimeMillis() + (client.getIdTokenValiditySeconds() * 1000L));
claims.setIssueTime(new Date()); claims.setExpirationTime(expiration);
newIdTokenEntity.setExpiration(expiration);
}
claims.setIssueTime(new Date());
SignedJWT newIdToken = new SignedJWT((JWSHeader) idToken.getHeader(), claims); SignedJWT newIdToken = new SignedJWT((JWSHeader) idToken.getHeader(), claims);
try { try {
jwtService.signJwt(newIdToken); jwtService.signJwt(newIdToken);
} catch (NoSuchAlgorithmException e) { } catch (NoSuchAlgorithmException e) {
// TODO Auto-generated catch block // TODO Auto-generated catch block
e.printStackTrace(); e.printStackTrace();
} }
newIdTokenEntity.setJwt(newIdToken); newIdTokenEntity.setJwt(newIdToken);
newIdTokenEntity.setAuthenticationHolder(incomingToken.getAuthenticationHolder()); newIdTokenEntity.setAuthenticationHolder(incomingToken.getAuthenticationHolder());
newIdTokenEntity.setScope(incomingToken.getScope()); newIdTokenEntity.setScope(incomingToken.getScope());
newIdTokenEntity.setClient(incomingToken.getClient()); newIdTokenEntity.setClient(incomingToken.getClient());
newIdTokenEntity = tokenServices.saveAccessToken(newIdTokenEntity); newIdTokenEntity = tokenServices.saveAccessToken(newIdTokenEntity);
// attach the ID token to the access token entity // attach the ID token to the access token entity
accessToken.setIdToken(newIdTokenEntity); accessToken.setIdToken(newIdTokenEntity);
accessToken = tokenServices.saveAccessToken(accessToken); accessToken = tokenServices.saveAccessToken(accessToken);
// delete the old ID token // delete the old ID token
tokenServices.revokeAccessToken(incomingToken); tokenServices.revokeAccessToken(incomingToken);
return newIdTokenEntity; return newIdTokenEntity;
}
} catch (ParseException e) {
logger.warn("Couldn't parse id token", e);
} }
} }
// if we got down here, we didn't actually create any tokens, so return null
return null; return null;
/* /*

18
openid-connect-server/src/main/java/org/mitre/openid/connect/ConnectAuthorizationRequestManager.java
View File

@ -33,6 +33,7 @@ import org.springframework.stereotype.Component;
import com.google.common.base.Strings; import com.google.common.base.Strings;
import com.nimbusds.jose.JWSObject; import com.nimbusds.jose.JWSObject;
import com.nimbusds.jose.util.JSONObjectUtils;
@Component("authorizationRequestManager") @Component("authorizationRequestManager")
public class ConnectAuthorizationRequestManager implements AuthorizationRequestManager, InitializingBean { public class ConnectAuthorizationRequestManager implements AuthorizationRequestManager, InitializingBean {
@ -172,52 +173,51 @@ public class ConnectAuthorizationRequestManager implements AuthorizationRequestM
* we don't care * we don't care
*/ */
// FIXME: all of these are doing raw JSON parsing and don't guarantee good behavior vis a vis strings String responseTypes = JSONObjectUtils.getString(claims, "response_type");
String responseTypes = (String) claims.get("response_type");
if (responseTypes != null) { if (responseTypes != null) {
parameters.put("response_type", responseTypes); parameters.put("response_type", responseTypes);
} }
String clientId = (String) claims.get("client_id"); String clientId = JSONObjectUtils.getString(claims, "client_id");
if (clientId != null) { if (clientId != null) {
parameters.put("client_id", clientId); parameters.put("client_id", clientId);
} }
if (claims.get("redirect_uri") != null) { if (claims.get("redirect_uri") != null) {
if (inputParams.containsKey("redirect_uri") == false) { if (inputParams.containsKey("redirect_uri") == false) {
parameters.put("redirect_uri", (String) claims.get("redirect_uri")); parameters.put("redirect_uri", JSONObjectUtils.getString(claims, "redirect_uri"));
} }
} }
String state = (String) claims.get("state"); String state = JSONObjectUtils.getString(claims, "state");
if(state != null) { if(state != null) {
if (inputParams.containsKey("state") == false) { if (inputParams.containsKey("state") == false) {
parameters.put("state", state); parameters.put("state", state);
} }
} }
String nonce = (String) claims.get("nonce"); String nonce = JSONObjectUtils.getString(claims, "nonce");
if(nonce != null) { if(nonce != null) {
if (inputParams.containsKey("nonce") == false) { if (inputParams.containsKey("nonce") == false) {
parameters.put("nonce", nonce); parameters.put("nonce", nonce);
} }
} }
String display = (String) claims.get("display"); String display = JSONObjectUtils.getString(claims, "display");
if (display != null) { if (display != null) {
if (inputParams.containsKey("display") == false) { if (inputParams.containsKey("display") == false) {
parameters.put("display", display); parameters.put("display", display);
} }
} }
String prompt = (String) claims.get("prompt"); String prompt = JSONObjectUtils.getString(claims, "prompt");
if (prompt != null) { if (prompt != null) {
if (inputParams.containsKey("prompt") == false) { if (inputParams.containsKey("prompt") == false) {
parameters.put("prompt", prompt); parameters.put("prompt", prompt);
} }
} }
String scope = (String) claims.get("scope"); String scope = JSONObjectUtils.getString(claims, "scope");
if (scope != null) { if (scope != null) {
if (inputParams.containsKey("scope") == false) { if (inputParams.containsKey("scope") == false) {
parameters.put("scope", scope); parameters.put("scope", scope);

5
openid-connect-server/src/main/java/org/mitre/openid/connect/view/JSONUserInfoView.java
View File

@ -126,11 +126,6 @@ public class JSONUserInfoView extends AbstractView {
JsonObject obj = new JsonObject(); JsonObject obj = new JsonObject();
//The "sub" claim must always be returned from this endpoint
obj.addProperty("sub", ui.getSub());
//TODO: I think the following should be removed. "sub" replaces "user_id", and according
//to the spec it must ALWAYS be returned from this endpoint.
if (scope.contains("openid")) { if (scope.contains("openid")) {
obj.addProperty("sub", ui.getSub()); obj.addProperty("sub", ui.getSub());
} }