Package org.apache.cxf.rs.security.oauth2.provider

Interface OAuthDataProvider

All Known Subinterfaces:

AuthorizationCodeDataProvider

All Known Implementing Classes:

AbstractAuthorizationCodeDataProvider, AbstractCodeDataProvider, AbstractOAuthDataProvider, DefaultEncryptingCodeDataProvider, DefaultEncryptingOAuthDataProvider, JCacheCodeDataProvider, JCacheOAuthDataProvider, JPACMTCodeDataProvider, JPACodeDataProvider, JPAOAuthDataProvider

public interface OAuthDataProvider

OAuth provider responsible for persisting the information about OAuth consumers, request and access tokens.

Method Summary

Modifier and Type	Method	Description
List<OAuthPermission>	convertScopeToPermissions(Client client, List<String> requestedScopes)	Converts the requested scopes to the list of permissions.
ServerAccessToken	createAccessToken(AccessTokenRegistration accessToken)	Create access token
ServerAccessToken	getAccessToken(String accessToken)	Get access token
List<ServerAccessToken>	getAccessTokens(Client client, UserSubject subject)	Return all access tokens associated with a given client
Client	getClient(String clientId)	Returns the previously registered third-party Client
ServerAccessToken	getPreauthorizedToken(Client client, List<String> requestedScopes, UserSubject subject, String grantType)	Get preauthorized access token
List<RefreshToken>	getRefreshTokens(Client client, UserSubject subject)	Return all refresh tokens associated with a given client
ServerAccessToken	refreshAccessToken(Client client, String refreshToken, List<String> requestedScopes)	Refresh access token
void	revokeToken(Client client, String tokenId, String tokenTypeHint)	Revokes a refresh or access token
default void	revokeToken(Client client, UserSubject callerSubject, String tokenId, String tokenTypeHint)	Revokes a refresh or access token, verifying that the authenticated resource owner's identity (callerSubject) matches the subject bound to the token.

Method Detail

getClient

Client getClient(String clientId)
          throws OAuthServiceException

Returns the previously registered third-party Client

Parameters:

clientId - the client id

Returns:

Client

Throws:

OAuthServiceException

createAccessToken

ServerAccessToken createAccessToken(AccessTokenRegistration accessToken)
                             throws OAuthServiceException

Create access token

Parameters:

accessToken - the token registration info

Returns:

AccessToken

Throws:

OAuthServiceException

getAccessToken

ServerAccessToken getAccessToken(String accessToken)
                          throws OAuthServiceException

Get access token

Parameters:

accessToken - the token key

Returns:

AccessToken

Throws:

OAuthServiceException

getPreauthorizedToken

ServerAccessToken getPreauthorizedToken(Client client,
                                        List<String> requestedScopes,
                                        UserSubject subject,
                                        String grantType)
                                 throws OAuthServiceException

Get preauthorized access token

Parameters:

client - Client

requestedScopes - the scopes requested by the client

subject - End User subject

Returns:

AccessToken access token

Throws:

OAuthServiceException

refreshAccessToken

ServerAccessToken refreshAccessToken(Client client,
                                     String refreshToken,
                                     List<String> requestedScopes)
                              throws OAuthServiceException

Refresh access token

Parameters:

client - the client

refreshToken - refresh token key

requestedScopes - the scopes requested by the client

Returns:

AccessToken

Throws:

OAuthServiceException

getAccessTokens

List<ServerAccessToken> getAccessTokens(Client client,
                                        UserSubject subject)
                                 throws OAuthServiceException

Return all access tokens associated with a given client

Parameters:

client - the client

subject - the user subject, can be null

Returns:

list of access tokens

Throws:

OAuthServiceException

getRefreshTokens

List<RefreshToken> getRefreshTokens(Client client,
                                    UserSubject subject)
                             throws OAuthServiceException

Return all refresh tokens associated with a given client

Parameters:

client - the client

subject - the user subject, can be null

Returns:

list of refresh tokens

Throws:

OAuthServiceException

revokeToken

void revokeToken(Client client,
                 String tokenId,
                 String tokenTypeHint)
          throws OAuthServiceException

Revokes a refresh or access token

Parameters:

client - the client

tokenId - token identifier

tokenTypeHint - can be access_token or refresh_token or null

Throws:

OAuthServiceException

revokeToken

default void revokeToken(Client client,
                         UserSubject callerSubject,
                         String tokenId,
                         String tokenTypeHint)
                  throws OAuthServiceException

Revokes a refresh or access token, verifying that the authenticated resource owner's identity (callerSubject) matches the subject bound to the token. This prevents one user from revoking another user's token when multiple resource owners share the same OAuth2 client (IDOR guard).

callerSubject may be null for machine-to-machine (client credentials) flows where no end-user principal is present; in that case only the client-level check is applied.

Parameters:

client - the authenticated client

callerSubject - the authenticated resource owner, or null for M2M flows

tokenId - token identifier

tokenTypeHint - can be access_token or refresh_token or null

Throws:

OAuthServiceException

convertScopeToPermissions

List<OAuthPermission> convertScopeToPermissions(Client client,
                                                List<String> requestedScopes)

Converts the requested scopes to the list of permissions. The scopes are extracted from OAuth2 'scope' property which if set may contain one or more space separated scope values

Parameters:

requestedScopes - the scopes

Returns:

list of permissions