Java AuthorizationResponse類代碼示例

import com.authlete.common.dto.AuthorizationResponse; //導入依賴的package包/類
private void clearCurrentUserInfoInSessionIfNecessary(AuthorizationResponse info, HttpSession session)
{
    // Get the user from the session if they exist.
    User user     = (User)session.getAttribute("user");
    Date authTime = (Date)session.getAttribute("authTime");

    if (user == null || authTime == null)
    {
        // The information about the user does not exist in the session.
        return;
    }

    // Check 'prompts'.
    checkPrompts(info, session);

    // Check 'authentication age'.
    checkAuthenticationAge(info, session, authTime);
}
 

import com.authlete.common.dto.AuthorizationResponse; //導入依賴的package包/類
private void checkAuthenticationAge(AuthorizationResponse info, HttpSession session, Date authTime)
{
    // TODO: max_age == 0 effectively means "log in the user interactively
    // now" but it's used here as a flag, we should fix this to use Integer
    // instead of int probably.
    if (info.getMaxAge() <= 0)
    {
        return;
    }

    Date now = new Date();

    // Calculate number of seconds that have elapsed since login.
    long authAge = (now.getTime() - authTime.getTime()) / 1000L;

    if (authAge > info.getMaxAge())
    {
        // Session age is too old, clear out the current user.
        clearCurrentUserInfoInSession(session);
    };
}
 

import com.authlete.common.dto.AuthorizationResponse; //導入依賴的package包/類
/**
 * Call Authlete's {@code /api/auth/authorization} API.
 */
private AuthorizationResponse callAuthorization(String parameters)
{
    if (parameters == null)
    {
        // Authlete returns different error codes for null and an empty string.
        // 'null' is regarded as a caller's error. An empty string is regarded
        // as a client application's error.
        parameters = "";
    }

    // Create a request for Authlete's /api/auth/authorization API.
    AuthorizationRequest request = new AuthorizationRequest()
        .setParameters(parameters);

    try
    {
        // Call Authlete's /api/auth/authorization API.
        return mApi.authorization(request);
    }
    catch (AuthleteApiException e)
    {
        // The API call failed.
        throw apiFailure("/api/auth/authorization", e);
    }
}
 

import com.authlete.common.dto.AuthorizationResponse; //導入依賴的package包/類
/**
 * Create an {@link AuthorizationPageModel} instance using information
 * contained in an {@link AuthorizationResponse} object, which represents
 * a response from Authlete's {@code /api/auth/authorization} API.
 *
 * <p>
 * {@code user} parameter was added by version 2.1.
 * </p>
 *
 * @param info
 *         An {@link AuthorizationResponse} object, which represents a
 *         response from Authlete's {@code /api/auth/authorization} API.
 *
 * @param user
 */
public AuthorizationPageModel(AuthorizationResponse info, User user)
{
    Client client = info.getClient();

    serviceName     = info.getService().getServiceName();
    clientName      = client.getClientName();
    description     = client.getDescription();
    logoUri         = toString(client.getLogoUri());
    clientUri       = toString(client.getClientUri());
    policyUri       = toString(client.getPolicyUri());
    tosUri          = toString(client.getTosUri());
    scopes          = info.getScopes();
    loginId         = computeLoginId(info);
    loginIdReadOnly = computeLoginIdReadOnly(info);

    // current logged in user, could be null
    this.user       = user;
}
 

import com.authlete.common.dto.AuthorizationResponse; //導入依賴的package包/類
private void noInteractionCheckMaxAge(AuthorizationResponse response, long authTime)
{
    // Get the requested maximum authentication age.
    int maxAge = response.getMaxAge();

    // If no maximum authentication age is requested.
    if (maxAge == 0)
    {
        // No check is needed.
        return;
    }

    // The time at which the authentication expires.
    long expiresAtMillis = (authTime + maxAge) * 1000L;

    // If the authentication has not expired yet.
    if (System.currentTimeMillis() < expiresAtMillis)
    {
        // OK.
        return;
    }

    // The maximum authentication age has elapsed.
    throw getApiCaller().authorizationFail(response.getTicket(), Reason.EXCEEDS_MAX_AGE);
}
 

import com.authlete.common.dto.AuthorizationResponse; //導入依賴的package包/類
private void noInteractionCheckSubject(AuthorizationResponse response, String subject)
{
    // Get the requested subject.
    String requestedSubject = response.getSubject();

    // If no subject is requested.
    if (requestedSubject == null)
    {
        // No check is needed.
        return;
    }

    // If the requested subject matches the current user.
    if (requestedSubject.equals(subject))
    {
        // OK.
        return;
    }

    // The current user is different from the requested subject.
    throw getApiCaller().authorizationFail(response.getTicket(), Reason.DIFFERENT_SUBJECT);
}
 

import com.authlete.common.dto.AuthorizationResponse; //導入依賴的package包/類
private Response noInteractionIssue(
        AuthorizationResponse response, long authTime, String subject,
        String acr, Property[] properties, String[] scopes)
{
    // When prompt=none is contained in an authorization request,
    // response.getClaims() returns null. This means that user
    // claims don't have to be collected. In other words, if an
    // authorization request contains prompt=none and requests
    // user claims at the same time, Authlete regards such a
    // request as illegal, because Authlete does not provide any
    // means to pre-configure consent for claims.
    //
    // See the description about prompt=none in "OpenID Connect
    // Core 1.0, 3.1.2.1. Authentication Request" for details.

    return getApiCaller().authorizationIssue(
        response.getTicket(), subject, authTime, acr,
        (Map<String, Object>)null, properties, scopes);
}
 

import com.authlete.common.dto.AuthorizationResponse; //導入依賴的package包/類
@Override
public Response generateAuthorizationPage(AuthorizationResponse info)
{
    // Create an HTTP session.
    HttpSession session = mRequest.getSession(true);

    // Store some variables into the session so that they can be
    // referred to later in AuthorizationDecisionEndpoint.
    session.setAttribute("ticket",       info.getTicket());
    session.setAttribute("claimNames",   info.getClaims());
    session.setAttribute("claimLocales", info.getClaimsLocales());

    // Clear the current user information in the session if necessary.
    clearCurrentUserInfoInSessionIfNecessary(info, session);

    // Get the user from the session if they exist.
    User user = (User)session.getAttribute("user");

    // Prepare a model object which contains information needed to
    // render the authorization page. Feel free to create a subclass
    // of AuthorizationPageModel or define another different class
    // according to what you need in the authorization page.
    AuthorizationPageModel model = new AuthorizationPageModel(info, user);

    // Create a Viewable instance that represents the authorization
    // page. Viewable is a class provided by Jersey for MVC.
    Viewable viewable = new Viewable(TEMPLATE, model);

    // Create a response that has the viewable as its content.
    return Response.ok(viewable, MEDIA_TYPE_HTML).build();
}
 

import com.authlete.common.dto.AuthorizationResponse; //導入依賴的package包/類
private void checkPrompts(AuthorizationResponse info, HttpSession session)
{
    if (info.getPrompts() == null)
    {
        return;
    }

    List<Prompt> prompts = Arrays.asList(info.getPrompts());

    if (prompts.contains(Prompt.LOGIN))
    {
        // Force a login by clearing out the current user.
        clearCurrentUserInfoInSession(session);
    };
}
 

import com.authlete.common.dto.AuthorizationResponse; //導入依賴的package包/類
/**
 * Call {@code /api/auth/authorization} API.
 */
@Override
public AuthorizationResponse authorization(AuthorizationRequest request) throws AuthleteApiException
{
    return executeApiCall(
            new ServicePostApiCaller<AuthorizationResponse>(
                    AuthorizationResponse.class, request, AUTH_AUTHORIZATION_API_PATH));
}
 

import com.authlete.common.dto.AuthorizationResponse; //導入依賴的package包/類
/**
 * Compute the initial value for the login ID field in the
 * authorization page.
 */
private static String computeLoginId(AuthorizationResponse info)
{
    if (info.getSubject() != null)
    {
        return info.getSubject();
    }

    return info.getLoginHint();
}
 

import com.authlete.common.dto.AuthorizationResponse; //導入依賴的package包/類
/**
 * Return {@code "readonly"} if the authorization request requires
 * that a specific subject be used.
 */
private static String computeLoginIdReadOnly(AuthorizationResponse info)
{
    if (info.getSubject() != null)
    {
        return "readonly";
    }
    else
    {
        return null;
    }
}
 

import com.authlete.common.dto.AuthorizationResponse; //導入依賴的package包/類
/**
 * Handle the case where {@code action} parameter in a response from
 * Authlete's {@code /api/auth/authorization} API is {@code NO_INTERACTION}.
 */
private Response handleNoInteraction(AuthorizationResponse response)
{
    // Check 1. End-User Authentication
    noInteractionCheckAuthentication(response);

    // Get the time when the user was authenticated.
    long authTime = mSpi.getUserAuthenticatedAt();

    // Check 2. Max Age
    noInteractionCheckMaxAge(response, authTime);

    // The current subject, i.e. the unique ID assigned by
    // the service to the current user.
    String subject = mSpi.getUserSubject();

    // Check 3. Subject
    noInteractionCheckSubject(response, subject);

    // Get the ACR that was satisfied when the current user
    // was authenticated.
    String acr = mSpi.getAcr();

    // Check 4. ACR
    noInteractionCheckAcr(response, acr);

    // Extra properties to associate with an access token and/or
    // an authorization code.
    Property[] properties = mSpi.getProperties();

    // Scopes to associate with an access token and/or an authorization code.
    // If a non-null value is returned from mSpi.getScopes(), the scope set
    // replaces the scopes that have been specified in the original
    // authorization request.
    String[] scopes = mSpi.getScopes();

    // Issue
    return noInteractionIssue(response, authTime, subject, acr, properties, scopes);
}
 

import com.authlete.common.dto.AuthorizationResponse; //導入依賴的package包/類
/**
 * Check whether an end-user has already logged in or not.
 */
private void noInteractionCheckAuthentication(AuthorizationResponse response)
{
    // If the current user has already been authenticated.
    if (mSpi.isUserAuthenticated())
    {
        // OK.
        return;
    }

    // A user must have logged in.
    throw getApiCaller().authorizationFail(response.getTicket(), Reason.NOT_LOGGED_IN);
}
 

import com.authlete.common.dto.AuthorizationResponse; //導入依賴的package包/類
private void noInteractionCheckAcr(AuthorizationResponse response, String acr)
{
    // Get the list of requested ACRs.
    String[] requestedAcrs = response.getAcrs();

    // If no ACR is requested.
    if (requestedAcrs == null || requestedAcrs.length == 0)
    {
        // No check is needed.
        return;
    }

    for (String requestedAcr : requestedAcrs)
    {
        if (requestedAcr.equals(acr))
        {
            // OK. The ACR satisfied when the current user was
            // authenticated matches one of the requested ACRs.
            return;
        }
    }

    // If one of the requested ACRs must be satisfied.
    if (response.isAcrEssential())
    {
        // None of the requested ACRs is satisfied.
        throw getApiCaller().authorizationFail(response.getTicket(), Reason.ACR_NOT_SATISFIED);
    }

    // The ACR satisfied when the current user was authenticated
    // does not match any one of the requested ACRs, but the
    // authorization request from the client application did
    // not request ACR as essential. Therefore, it is not
    // necessary to raise an error here.
}