github
/
OpenID-Connect-Java-Spring-Server
mirror of https://github.com/mitreid-connect/OpenID-Connect-Java-Spring-Server
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

use JWT bearer assertion token for assertion processing

pull/1108/head
Justin Richer 2016-07-24 14:55:45 -04:00
parent 42ccb8b39e
commit f9e4d75a4a
4 changed files with 18 additions and 39 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

15
openid-connect-server/src/main/java/org/mitre/oauth2/token/JWTAssertionTokenGranter.java
View File

@ -20,24 +20,17 @@
package org.mitre.oauth2.token; package org.mitre.oauth2.token;
import java.text.ParseException; import java.text.ParseException;
import java.util.Date;
import java.util.UUID;
import org.mitre.jwt.assertion.AssertionValidator; import org.mitre.jwt.assertion.AssertionValidator;
import org.mitre.jwt.signer.service.JWTSigningAndValidationService; import org.mitre.jwt.signer.service.JWTSigningAndValidationService;
import org.mitre.oauth2.assertion.AssertionOAuth2RequestFactory; import org.mitre.oauth2.assertion.AssertionOAuth2RequestFactory;
import org.mitre.oauth2.model.ClientDetailsEntity;
import org.mitre.oauth2.model.OAuth2AccessTokenEntity;
import org.mitre.oauth2.service.ClientDetailsEntityService; import org.mitre.oauth2.service.ClientDetailsEntityService;
import org.mitre.oauth2.service.OAuth2TokenEntityService; import org.mitre.oauth2.service.OAuth2TokenEntityService;
import org.mitre.oauth2.service.SystemScopeService; import org.mitre.openid.connect.assertion.JWTBearerAssertionAuthenticationToken;
import org.mitre.openid.connect.config.ConfigurationPropertiesBean; import org.mitre.openid.connect.config.ConfigurationPropertiesBean;
import org.springframework.beans.factory.annotation.Autowired; import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.beans.factory.annotation.Qualifier; import org.springframework.beans.factory.annotation.Qualifier;
import org.springframework.security.authentication.BadCredentialsException;
import org.springframework.security.core.AuthenticationException; import org.springframework.security.core.AuthenticationException;
import org.springframework.security.oauth2.common.OAuth2AccessToken;
import org.springframework.security.oauth2.common.exceptions.InvalidClientException;
import org.springframework.security.oauth2.common.exceptions.InvalidTokenException; import org.springframework.security.oauth2.common.exceptions.InvalidTokenException;
import org.springframework.security.oauth2.provider.ClientDetails; import org.springframework.security.oauth2.provider.ClientDetails;
import org.springframework.security.oauth2.provider.OAuth2Authentication; import org.springframework.security.oauth2.provider.OAuth2Authentication;
@ -46,11 +39,8 @@ import org.springframework.security.oauth2.provider.TokenRequest;
import org.springframework.security.oauth2.provider.token.AbstractTokenGranter; import org.springframework.security.oauth2.provider.token.AbstractTokenGranter;
import org.springframework.stereotype.Component; import org.springframework.stereotype.Component;
import com.nimbusds.jose.JWSHeader;
import com.nimbusds.jwt.JWT; import com.nimbusds.jwt.JWT;
import com.nimbusds.jwt.JWTClaimsSet;
import com.nimbusds.jwt.JWTParser; import com.nimbusds.jwt.JWTParser;
import com.nimbusds.jwt.SignedJWT;
/** /**
* @author jricher * @author jricher
@ -97,7 +87,8 @@ public class JWTAssertionTokenGranter extends AbstractTokenGranter {
// our validator says it's OK, time to make a token from it // our validator says it's OK, time to make a token from it
// the real work happens in the assertion factory and the token services // the real work happens in the assertion factory and the token services
return new OAuth2Authentication(assertionFactory.createOAuth2Request(client, tokenRequest, assertion), null); return new OAuth2Authentication(assertionFactory.createOAuth2Request(client, tokenRequest, assertion),
new JWTBearerAssertionAuthenticationToken(assertion, client.getAuthorities()));
} else { } else {
logger.warn("Incoming assertion did not pass validator, rejecting"); logger.warn("Incoming assertion did not pass validator, rejecting");

34
openid-connect-server/src/main/java/org/mitre/openid/connect/assertion/JWTBearerAssertionAuthenticationToken.java
View File

@ -19,6 +19,7 @@
*/ */
package org.mitre.openid.connect.assertion; package org.mitre.openid.connect.assertion;
import java.text.ParseException;
import java.util.Collection; import java.util.Collection;
import org.springframework.security.authentication.AbstractAuthenticationToken; import org.springframework.security.authentication.AbstractAuthenticationToken;
@ -36,30 +37,27 @@ public class JWTBearerAssertionAuthenticationToken extends AbstractAuthenticatio
* *
*/ */
private static final long serialVersionUID = -3138213539914074617L; private static final long serialVersionUID = -3138213539914074617L;
private String clientId;
private JWT jwt; private JWT jwt;
/** /**
* Create an unauthenticated token with the given client ID and jwt * Create an unauthenticated token with the given subject and jwt
* @param clientId * @param subject
* @param jwt * @param jwt
*/ */
public JWTBearerAssertionAuthenticationToken(String clientId, JWT jwt) { public JWTBearerAssertionAuthenticationToken(JWT jwt) {
super(null); super(null);
this.clientId = clientId;
this.jwt = jwt; this.jwt = jwt;
setAuthenticated(false); setAuthenticated(false);
} }
/** /**
* Create an authenticated token with the given clientID, jwt, and authorities set * Create an authenticated token with the given clientID, jwt, and authorities set
* @param clientId * @param subject
* @param jwt * @param jwt
* @param authorities * @param authorities
*/ */
public JWTBearerAssertionAuthenticationToken(String clientId, JWT jwt, Collection<? extends GrantedAuthority> authorities) { public JWTBearerAssertionAuthenticationToken(JWT jwt, Collection<? extends GrantedAuthority> authorities) {
super(authorities); super(authorities);
this.clientId = clientId;
this.jwt = jwt; this.jwt = jwt;
setAuthenticated(true); setAuthenticated(true);
} }
@ -77,21 +75,11 @@ public class JWTBearerAssertionAuthenticationToken extends AbstractAuthenticatio
*/ */
@Override @Override
public Object getPrincipal() { public Object getPrincipal() {
return clientId; try {
} return jwt.getJWTClaimsSet().getSubject();
} catch (ParseException e) {
/** return null;
* @return the clientId }
*/
public String getClientId() {
return clientId;
}
/**
* @param clientId the clientId to set
*/
public void setClientId(String clientId) {
this.clientId = clientId;
} }
/** /**

6
openid-connect-server/src/main/java/org/mitre/openid/connect/assertion/JWTBearerAuthenticationProvider.java
View File

@ -85,7 +85,7 @@ public class JWTBearerAuthenticationProvider implements AuthenticationProvider {
try { try {
ClientDetailsEntity client = clientService.loadClientByClientId(jwtAuth.getClientId()); ClientDetailsEntity client = clientService.loadClientByClientId(jwtAuth.getName());
JWT jwt = jwtAuth.getJwt(); JWT jwt = jwtAuth.getJwt();
JWTClaimsSet jwtClaims = jwt.getJWTClaimsSet(); JWTClaimsSet jwtClaims = jwt.getJWTClaimsSet();
@ -191,10 +191,10 @@ public class JWTBearerAuthenticationProvider implements AuthenticationProvider {
Set<GrantedAuthority> authorities = new HashSet<>(client.getAuthorities()); Set<GrantedAuthority> authorities = new HashSet<>(client.getAuthorities());
authorities.add(ROLE_CLIENT); authorities.add(ROLE_CLIENT);
return new JWTBearerAssertionAuthenticationToken(client.getClientId(), jwt, authorities); return new JWTBearerAssertionAuthenticationToken(jwt, authorities);
} catch (InvalidClientException e) { } catch (InvalidClientException e) {
throw new UsernameNotFoundException("Could not find client: " + jwtAuth.getClientId()); throw new UsernameNotFoundException("Could not find client: " + jwtAuth.getName());
} catch (ParseException e) { } catch (ParseException e) {
logger.error("Failure during authentication, error was: ", e); logger.error("Failure during authentication, error was: ", e);

2
openid-connect-server/src/main/java/org/mitre/openid/connect/assertion/JWTBearerClientAssertionTokenEndpointFilter.java
View File

@ -95,7 +95,7 @@ public class JWTBearerClientAssertionTokenEndpointFilter extends AbstractAuthent
String clientId = jwt.getJWTClaimsSet().getSubject(); String clientId = jwt.getJWTClaimsSet().getSubject();
Authentication authRequest = new JWTBearerAssertionAuthenticationToken(clientId, jwt); Authentication authRequest = new JWTBearerAssertionAuthenticationToken(jwt);
return this.getAuthenticationManager().authenticate(authRequest); return this.getAuthenticationManager().authenticate(authRequest);
} catch (ParseException e) { } catch (ParseException e) {