Java OAuth2Request.getClientId方法代码示例

import org.springframework.security.oauth2.provider.OAuth2Request; //导入方法依赖的package包/类
@BodyParser.Of(BodyParser.Json.class)
@PreAuthorize("#oauth2.clientHasRole('ROLE_CLIENT') and #oauth2.hasScope('trust')")
public Promise<Result> authenticateUser() {
  JsonNode json = request().body().asJson();
  String username = json.findPath("username").textValue();
  String password = json.findPath("password").textValue();

  Authentication authentication = SecurityContextHolder.getContext().getAuthentication();
  OAuth2Request clientAuthenticationRequest =
      ((OAuth2Authentication) authentication).getOAuth2Request();
  Map<String, String> requestParameters = new HashMap<>();
  requestParameters.put("username", username);
  requestParameters.put("password", password);
  TokenRequest tokenRequest = new TokenRequest(requestParameters,
          clientAuthenticationRequest.getClientId(), clientAuthenticationRequest.getScope(),
          "password");
  OAuth2AccessToken token = tokenGranter.grant("password", tokenRequest);
  ObjectNode result = Json.newObject();
  result.setAll(ImmutableMap.of(
      "accessToken", result.textNode(token.getValue()),
      "username", result.textNode(username),
      "expiration", result.numberNode(token.getExpiration().getTime()),
      "refreshToken", result.textNode(token.getRefreshToken().getValue())));
  return Promise.pure(ok(result));
}
 

import org.springframework.security.oauth2.provider.OAuth2Request; //导入方法依赖的package包/类
@BodyParser.Of(BodyParser.Json.class)
@PreAuthorize("#oauth2.clientHasRole('ROLE_CLIENT') and #oauth2.hasScope('trust')")
public Promise<Result> refreshUserAccessToken() {
  JsonNode body = request().body().asJson();
  String refreshToken = body.findPath("refreshToken").textValue();

  Authentication authentication = SecurityContextHolder.getContext().getAuthentication();
  OAuth2Request clientAuthenticationRequest =
      ((OAuth2Authentication) authentication).getOAuth2Request();
  TokenRequest tokenRequest =
      new TokenRequest(Collections.emptyMap(), clientAuthenticationRequest.getClientId(),
          clientAuthenticationRequest.getScope(), "refresh");
  OAuth2AccessToken token = tokenServices.refreshAccessToken(refreshToken, tokenRequest);
  ObjectNode result = Json.newObject();
  result.setAll(ImmutableMap.of(
      "accessToken", result.textNode(token.getValue()),
      "expiration", result.numberNode(token.getExpiration().getTime()),
      "refreshToken", result.textNode(token.getRefreshToken().getValue())));
  return Promise.pure(ok(result));
}
 

import org.springframework.security.oauth2.provider.OAuth2Request; //导入方法依赖的package包/类
@Override
protected OAuth2Authentication getOAuth2Authentication(ClientDetails client, TokenRequest tokenRequest) {

    Map<String, String> parameters = tokenRequest.getRequestParameters();
    String authorizationCode = parameters.get("code");
    String redirectUri = parameters.get(OAuth2Utils.REDIRECT_URI);
    String codeVerifier = parameters.get("code_verifier");

    if (authorizationCode == null) {
        throw new InvalidRequestException("An authorization code must be supplied.");
    }

    OAuth2Authentication storedAuth = authorizationCodeServices.consumeAuthorizationCode(authorizationCode);
    if (storedAuth == null) {
        throw new InvalidGrantException("Invalid authorization code: " + authorizationCode);
    }

    OAuth2Request pendingOAuth2Request = storedAuth.getOAuth2Request();




    // Validates code verifier
    Map<String, String> pendingOauth2RequestParams = pendingOAuth2Request.getRequestParameters();
    String codeChallenge = pendingOauth2RequestParams.get("code_challenge");
    String codeChallengeMethod = pendingOauth2RequestParams.get("code_challenge_method");

    if (codeVerifier == null && codeChallenge != null) {
        // client is using PKCE but did not send the codeVerifier
        throw new InvalidRequestException(
                "Invalid authorization code for current token request.");
    }

    if (codeVerifier != null && codeChallenge != null) {
        String hashed = codeVerifier;
        if ("S256".equals(codeChallengeMethod)) {
            hashed = DigestUtils.sha256Hex(codeVerifier);
        }

        if (!hashed.equalsIgnoreCase(codeChallenge)) {
            throw new InvalidRequestException(
                    "Invalid authorization code for current token request.");
        }
    }



    // https://jira.springsource.org/browse/SECOAUTH-333
    // This might be null, if the authorization was done without the redirect_uri parameter
    String redirectUriApprovalParameter = pendingOAuth2Request.getRequestParameters().get(
            OAuth2Utils.REDIRECT_URI);

    if ((redirectUri != null || redirectUriApprovalParameter != null)
            && !pendingOAuth2Request.getRedirectUri().equals(redirectUri)) {
        throw new RedirectMismatchException("Redirect URI mismatch.");
    }

    String pendingClientId = pendingOAuth2Request.getClientId();
    String clientId = tokenRequest.getClientId();
    if (clientId != null && !clientId.equals(pendingClientId)) {
        // just a sanity check.
        throw new InvalidClientException("Client ID mismatch");
    }

    // Secret is not required in the authorization request, so it won't be available
    // in the pendingAuthorizationRequest. We do want to check that a secret is provided
    // in the token request, but that happens elsewhere.

    Map<String, String> combinedParameters = new HashMap<String, String>(pendingOAuth2Request
            .getRequestParameters());
    // Combine the parameters adding the new ones last so they override if there are any clashes
    combinedParameters.putAll(parameters);

    // Make a new stored request with the combined parameters
    OAuth2Request finalStoredOAuth2Request = pendingOAuth2Request.createOAuth2Request(combinedParameters);

    Authentication userAuth = storedAuth.getUserAuthentication();

    return new OAuth2Authentication(finalStoredOAuth2Request, userAuth);

}
 

import org.springframework.security.oauth2.provider.OAuth2Request; //导入方法依赖的package包/类
@Override
public OAuth2Authentication extractAuthentication(Map<String, ?> map) {
	List<String> authorities = (List<String>) map.get(CLIENT_AUTHORITIES);
	Collection<GrantedAuthority> grantedAuthorities = authorities.stream().map(a -> new SimpleGrantedAuthority(a)).collect(Collectors.toList());

	OAuth2Authentication authentication = super.extractAuthentication(map);
	OAuth2Request request = authentication.getOAuth2Request();
	OAuth2Request enhancedRequest = new OAuth2Request(request.getRequestParameters(), request.getClientId(), grantedAuthorities, request.isApproved(), request.getScope(), request.getResourceIds(), request.getRedirectUri(), request.getResponseTypes(), request.getExtensions());

	return new OAuth2Authentication(enhancedRequest, authentication.getUserAuthentication());
}
 

import org.springframework.security.oauth2.provider.OAuth2Request; //导入方法依赖的package包/类
@Override
public String getClientIdOrFail() {
    String clientId = null;

    OAuth2Request oAuth2Request = getAuthentication().getOAuth2Request();
    if (oAuth2Request != null) {
        clientId = oAuth2Request.getClientId();
    }
    if (clientId == null) {
        throw new InvalidACSRequestException("Authetication clientId cannot be null");
    }

    return clientId;
}
 

import org.springframework.security.oauth2.provider.OAuth2Request; //导入方法依赖的package包/类
@Override
public boolean preHandle(HttpServletRequest request, HttpServletResponse response, Object handler) throws Exception {

    Authentication authentication = SecurityContextHolder.getContext().getAuthentication();

    if (!(authentication instanceof OAuth2Authentication)) {
        response.setStatus(HttpServletResponse.SC_UNAUTHORIZED);
        setErrorInResponse("Authorization without OAuth2 protocol.", response);
        return false;
    }

    OAuth2Authentication oauth2Authentication = (OAuth2Authentication) authentication;
    OAuth2Request clientAuthentication = oauth2Authentication.getOAuth2Request();
    String clientId = clientAuthentication.getClientId();
    Long userId = ((User) oauth2Authentication.getUserAuthentication().getPrincipal()).getId();

    HandlerMethod handlerMethod = (HandlerMethod) handler;
    Integer hash = StaticUtls.getHashFrom(handlerMethod);

    Boolean permitted = permissionService.isPermitted(clientId, userId, hash);
    if (Objects.isNull(permitted)) {
        response.setStatus(HttpServletResponse.SC_FORBIDDEN);
        setErrorInResponse(
                "Client and/or user haven't permission to access "
                + handlerMethod.getBeanType().getSimpleName().replace("RestControllerImpl", "")
                + "["
                + handlerMethod.getMethod().getName()
                + "]"
                + " method.", response);
        return false;
    }

    return permitted;
}
 

import org.springframework.security.oauth2.provider.OAuth2Request; //导入方法依赖的package包/类
public String getClientId(String tokenValue) {
	OAuth2Authentication authentication = tokenStore
			.readAuthentication(tokenValue);
	if (authentication == null) {
		throw new InvalidTokenException("Invalid access token: "
				+ tokenValue);
	}
	OAuth2Request clientAuth = authentication.getOAuth2Request();
	if (clientAuth == null) {
		throw new InvalidTokenException(
				"Invalid access token (no client id): " + tokenValue);
	}
	return clientAuth.getClientId();
}
 

import org.springframework.security.oauth2.provider.OAuth2Request; //导入方法依赖的package包/类
public UserContext createUserContext(OAuth2Authentication authentication, String token) {
  OAuth2Request oauth2Request = authentication.getOAuth2Request();
  String clientId = oauth2Request.getClientId();
  String grantType = oauth2Request.getGrantType();
  String userId = null;
  String userName = null;
  String issuer = null;
  long validFrom = 0;
  long validUntil = 0;
  String scope = null;

  if (token == null) {
    OAuth2AuthenticationDetails authDetails = (OAuth2AuthenticationDetails) authentication
        .getDetails();
    token = authDetails.getTokenValue();
  }

  OAuth2AccessToken accessToken;
  accessToken = resourceServerTokenServices.readAccessToken(token);


  if (accessToken != null) {
    Set<String> scopes = accessToken.getScope();
    scope = scopes == null ? null : String.join(",", scopes);

    Map<String, Object> additionalInformation = accessToken.getAdditionalInformation();
    userName = (String) additionalInformation.get("user_name");
    userId = (String) additionalInformation.get("user_id");
    issuer = (String) additionalInformation.get("iss");
    validFrom = claimValueAsLong(additionalInformation);
    validUntil = accessToken.getExpiration().toInstant().getEpochSecond();
  }

  return new UserContext(
      userId,
      userName,
      issuer,
      validFrom,
      validUntil,
      clientId,
      scope,
      grantType,
      UserContext.AUTH_METHOD_UAA
  );
}
 

import org.springframework.security.oauth2.provider.OAuth2Request; //导入方法依赖的package包/类
@Override
protected OAuth2Authentication getOAuth2Authentication(ClientDetails client, TokenRequest tokenRequest) {

    Map<String, String> parameters = tokenRequest.getRequestParameters();
    String authorizationCode = parameters.get("code");
    String redirectUri = parameters.get(OAuth2Utils.REDIRECT_URI);

    if (authorizationCode == null) {
        throw new InvalidRequestException("An authorization code must be supplied.");
    }

    OAuth2Authentication storedAuth = authorizationCodeServices.consumeAuthorizationCode(authorizationCode);
    if (storedAuth == null) {
        throw new InvalidGrantException("Invalid authorization code: " + authorizationCode);
    }

    OAuth2Request pendingOAuth2Request = storedAuth.getOAuth2Request();
    // https://jira.springsource.org/browse/SECOAUTH-333
    // This might be null, if the authorization was done without the redirect_uri parameter
    String redirectUriApprovalParameter = pendingOAuth2Request.getRequestParameters().get(OAuth2Utils.REDIRECT_URI);

    if (redirectUriApprovalParameter != null && redirectUri == null
            || redirectUriApprovalParameter != null
            && !pendingOAuth2Request.getRedirectUri().startsWith(redirectUri)) {
        throw new RedirectMismatchException("Redirect URI mismatch.");
    }

    String pendingClientId = pendingOAuth2Request.getClientId();
    String clientId = tokenRequest.getClientId();
    if (clientId != null && !clientId.equals(pendingClientId)) {
        // just a sanity check.
        throw new InvalidClientException("Client ID mismatch");
    }

    // Secret is not required in the authorization request, so it won't be available
    // in the pendingAuthorizationRequest. We do want to check that a secret is provided
    // in the token request, but that happens elsewhere.

    Map<String, String> combinedParameters = new HashMap<>(pendingOAuth2Request.getRequestParameters());
    // Combine the parameters adding the new ones last so they override if there are any clashes
    combinedParameters.putAll(parameters);

    // Make a new stored request with the combined parameters
    OAuth2Request finalStoredOAuth2Request = pendingOAuth2Request.createOAuth2Request(combinedParameters);

    Authentication userAuth = storedAuth.getUserAuthentication();

    return new OAuth2Authentication(finalStoredOAuth2Request, userAuth);
}
 

import org.springframework.security.oauth2.provider.OAuth2Request; //导入方法依赖的package包/类
@Override
protected OAuth2Authentication getOAuth2Authentication(ClientDetails client, TokenRequest tokenRequest) {

	Map<String, String> parameters = tokenRequest.getRequestParameters();
	String authorizationCode = parameters.get("code");
	String redirectUri = parameters.get(OAuth2Utils.REDIRECT_URI);

	if (authorizationCode == null) {
		throw new InvalidRequestException("An authorization code must be supplied.");
	}

	OAuth2Authentication storedAuth = authorizationCodeServices.consumeAuthorizationCode(authorizationCode);
	if (storedAuth == null) {
		throw new InvalidGrantException("Invalid authorization code: " + authorizationCode);
	}

	OAuth2Request pendingOAuth2Request = storedAuth.getOAuth2Request();
	// https://jira.springsource.org/browse/SECOAUTH-333
	// This might be null, if the authorization was done without the redirect_uri parameter
	String redirectUriApprovalParameter = pendingOAuth2Request.getRequestParameters().get(
			OAuth2Utils.REDIRECT_URI);

	if ((redirectUri != null || redirectUriApprovalParameter != null)
			&& !pendingOAuth2Request.getRedirectUri().equals(redirectUri)) {
		throw new RedirectMismatchException("Redirect URI mismatch.");
	}

	String pendingClientId = pendingOAuth2Request.getClientId();
	String clientId = tokenRequest.getClientId();
	if (clientId != null && !clientId.equals(pendingClientId)) {
		// just a sanity check.
		throw new InvalidClientException("Client ID mismatch");
	}

	// Secret is not required in the authorization request, so it won't be available
	// in the pendingAuthorizationRequest. We do want to check that a secret is provided
	// in the token request, but that happens elsewhere.

	Map<String, String> combinedParameters = new HashMap<String, String>(pendingOAuth2Request
			.getRequestParameters());
	// Combine the parameters adding the new ones last so they override if there are any clashes
	combinedParameters.putAll(parameters);
	
	// Make a new stored request with the combined parameters
	OAuth2Request finalStoredOAuth2Request = pendingOAuth2Request.createOAuth2Request(combinedParameters);
	
	Authentication userAuth = storedAuth.getUserAuthentication();
	
	return new OAuth2Authentication(finalStoredOAuth2Request, userAuth);

}