Package org.apache.cxf.rs.security.oauth2.provider

Class AbstractOAuthDataProvider

    • Constructor Detail

      • AbstractOAuthDataProvider

        protected AbstractOAuthDataProvider()

    • Method Detail

      • createJwtAccessToken

        protected org.apache.cxf.rs.security.jose.jwt.JwtClaims createJwtAccessToken​(ServerAccessToken at)

      • convertToJWTAccessToken

        protected void convertToJWTAccessToken​(ServerAccessToken at)

      • revokeToken

        public void revokeToken​(Client client,
                        UserSubject callerSubject,
                        String tokenKey,
                        String tokenTypeHint)
                 throws OAuthServiceException
        Description copied from interface: OAuthDataProvider
        Revokes a refresh or access token, verifying that the authenticated resource owner's identity (callerSubject) matches the subject bound to the token. This prevents one user from revoking another user's token when multiple resource owners share the same OAuth2 client (IDOR guard).

        callerSubject may be null for machine-to-machine (client credentials) flows where no end-user principal is present; in that case only the client-level check is applied.

        Specified by:
        revokeToken in interface OAuthDataProvider
        Parameters:
        client - the authenticated client
        callerSubject - the authenticated resource owner, or null for M2M flows
        tokenKey - token identifier
        tokenTypeHint - can be access_token or refresh_token or null
        Throws:
        OAuthServiceException

      • handleLinkedRefreshToken

        protected void handleLinkedRefreshToken​(Client client,
                                        ServerAccessToken accessToken)

      • revokeAccessTokens

        protected void revokeAccessTokens​(Client client,
                                  RefreshToken currentRefreshToken)

      • unlinkRefreshAccessToken

        protected void unlinkRefreshAccessToken​(RefreshToken rt,
                                        String tokenKey)

      • convertScopeToPermissions

        public List<OAuthPermission> convertScopeToPermissions​(Client client,
                                                       List<String> requestedScopes)
        Description copied from interface: OAuthDataProvider
        Converts the requested scopes to the list of permissions. The scopes are extracted from OAuth2 'scope' property which if set may contain one or more space separated scope values
        Specified by:
        convertScopeToPermissions in interface OAuthDataProvider
        requestedScopes - the scopes
        Returns:
        list of permissions

      • checkRequestedScopes

        protected void checkRequestedScopes​(Client client,
                                    List<String> requestedScopes)

      • isRefreshTokenSupported

        protected boolean isRefreshTokenSupported​(List<String> theScopes)

      • getCurrentRequestedGrantType

        protected String getCurrentRequestedGrantType()

      • getCurrentClientSecret

        protected String getCurrentClientSecret()

      • getCurrentTokenRequestParams

        protected javax.ws.rs.core.MultivaluedMap<String,​String> getCurrentTokenRequestParams()

      • setAccessTokenLifetime

        public void setAccessTokenLifetime​(long accessTokenLifetime)

      • setRefreshTokenLifetime

        public void setRefreshTokenLifetime​(long refreshTokenLifetime)

      • setRecycleRefreshTokens

        public void setRecycleRefreshTokens​(boolean recycleRefreshTokens)

      • isRecycleRefreshTokens

        public boolean isRecycleRefreshTokens()

      • init

        public void init()

      • close

        public void close()

      • setSupportedScopes

        public void setSupportedScopes​(Map<String,​String> scopes)

      • getMessageContext

        public org.apache.cxf.jaxrs.ext.MessageContext getMessageContext()

      • setMessageContext

        public void setMessageContext​(org.apache.cxf.jaxrs.ext.MessageContext messageContext)

      • removeClientTokens

        protected void removeClientTokens​(Client c)

      • authenticateUnregisteredClient

        protected boolean authenticateUnregisteredClient​(String clientId,
                                                 String clientSecret)

      • createClientCredentialsClient

        protected Client createClientCredentialsClient​(String clientId,
                                               String password)

      • saveAccessToken

        protected abstract void saveAccessToken​(ServerAccessToken serverToken)

      • saveRefreshToken

        protected abstract void saveRefreshToken​(RefreshToken refreshToken)

      • doRevokeAccessToken

        protected abstract void doRevokeAccessToken​(ServerAccessToken accessToken)

      • doRevokeRefreshToken

        protected abstract void doRevokeRefreshToken​(RefreshToken refreshToken)

      • getRefreshToken

        protected abstract RefreshToken getRefreshToken​(String refreshTokenKey)

      • doGetClient

        protected abstract Client doGetClient​(String clientId)

      • doRemoveClient

        protected abstract void doRemoveClient​(Client c)

      • getDefaultScopes

        public List<String> getDefaultScopes()

      • setDefaultScopes

        public void setDefaultScopes​(List<String> defaultScopes)

      • getRequiredScopes

        public List<String> getRequiredScopes()

      • setRequiredScopes

        public void setRequiredScopes​(List<String> requiredScopes)

      • getInvisibleToClientScopes

        public List<String> getInvisibleToClientScopes()

      • setInvisibleToClientScopes

        public void setInvisibleToClientScopes​(List<String> invisibleToClientScopes)

      • isSupportPreauthorizedTokens

        public boolean isSupportPreauthorizedTokens()

      • setSupportPreauthorizedTokens

        public void setSupportPreauthorizedTokens​(boolean supportPreauthorizedTokens)

      • isClientMatched

        protected static boolean isClientMatched​(Client c,
                                         UserSubject resourceOwner)

      • setClients

        public void setClients​(List<Client> clients)

      • isUseJwtFormatForAccessTokens

        public boolean isUseJwtFormatForAccessTokens()

      • setUseJwtFormatForAccessTokens

        public void setUseJwtFormatForAccessTokens​(boolean useJwtFormatForAccessTokens)

      • setJwtAccessTokenProducer

        public void setJwtAccessTokenProducer​(OAuthJoseJwtProducer jwtAccessTokenProducer)

      • processJwtAccessToken

        protected String processJwtAccessToken​(org.apache.cxf.rs.security.jose.jwt.JwtClaims jwtCliams)

      • getJwtAccessTokenClaimMap

        public Map<String,​String> getJwtAccessTokenClaimMap()

      • setJwtAccessTokenClaimMap

        public void setJwtAccessTokenClaimMap​(Map<String,​String> jwtAccessTokenClaimMap)

      • isPersistJwtEncoding

        public boolean isPersistJwtEncoding()

      • setPersistJwtEncoding

        public void setPersistJwtEncoding​(boolean persistJwtEncoding)

      • getIssuer

        public String getIssuer()

      • setIssuer

        public void setIssuer​(String issuer)