Package org.apache.cxf.rs.security.oauth2.provider

Interface OAuthDataProvider

All Known Subinterfaces:
AuthorizationCodeDataProvider
All Known Implementing Classes:
AbstractAuthorizationCodeDataProvider, AbstractCodeDataProvider, AbstractOAuthDataProvider, DefaultEncryptingCodeDataProvider, DefaultEncryptingOAuthDataProvider, JCacheCodeDataProvider, JCacheOAuthDataProvider, JPACMTCodeDataProvider, JPACodeDataProvider, JPAOAuthDataProvider
public interface OAuthDataProvider
OAuth provider responsible for persisting the information about OAuth consumers, request and access tokens.

  • Method Details

    • getClient

      Client getClient(String clientId) throws OAuthServiceException
      Returns the previously registered third-party Client
      Parameters:
      clientId - the client id
      Returns:
      Client
      Throws:
      OAuthServiceException

    • createAccessToken

      ServerAccessToken createAccessToken(AccessTokenRegistration accessToken) throws OAuthServiceException
      Create access token
      Parameters:
      accessToken - the token registration info
      Returns:
      AccessToken
      Throws:
      OAuthServiceException

    • getAccessToken

      ServerAccessToken getAccessToken(String accessToken) throws OAuthServiceException
      Get access token
      Parameters:
      accessToken - the token key
      Returns:
      AccessToken
      Throws:
      OAuthServiceException

    • getPreauthorizedToken

      ServerAccessToken getPreauthorizedToken(Client client, List<String> requestedScopes, UserSubject subject, String grantType) throws OAuthServiceException
      Get preauthorized access token
      Parameters:
      client - Client
      requestedScopes - the scopes requested by the client
      subject - End User subject
      Returns:
      AccessToken access token
      Throws:
      OAuthServiceException

    • refreshAccessToken

      ServerAccessToken refreshAccessToken(Client client, String refreshToken, List<String> requestedScopes) throws OAuthServiceException
      Refresh access token
      Parameters:
      client - the client
      refreshToken - refresh token key
      requestedScopes - the scopes requested by the client
      Returns:
      AccessToken
      Throws:
      OAuthServiceException

    • getAccessTokens

      List<ServerAccessToken> getAccessTokens(Client client, UserSubject subject) throws OAuthServiceException
      Return all access tokens associated with a given client
      Parameters:
      client - the client
      subject - the user subject, can be null
      Returns:
      list of access tokens
      Throws:
      OAuthServiceException

    • getRefreshTokens

      List<RefreshToken> getRefreshTokens(Client client, UserSubject subject) throws OAuthServiceException
      Return all refresh tokens associated with a given client
      Parameters:
      client - the client
      subject - the user subject, can be null
      Returns:
      list of refresh tokens
      Throws:
      OAuthServiceException

    • revokeToken

      void revokeToken(Client client, String tokenId, String tokenTypeHint) throws OAuthServiceException
      Revokes a refresh or access token
      Parameters:
      client - the client
      tokenId - token identifier
      tokenTypeHint - can be access_token or refresh_token or null
      Throws:
      OAuthServiceException

    • revokeToken

      default void revokeToken(Client client, UserSubject callerSubject, String tokenId, String tokenTypeHint) throws OAuthServiceException
      Revokes a refresh or access token, verifying that the authenticated resource owner's identity (callerSubject) matches the subject bound to the token. This prevents one user from revoking another user's token when multiple resource owners share the same OAuth2 client (IDOR guard).

      callerSubject may be null for machine-to-machine (client credentials) flows where no end-user principal is present; in that case only the client-level check is applied.

      Parameters:
      client - the authenticated client
      callerSubject - the authenticated resource owner, or null for M2M flows
      tokenId - token identifier
      tokenTypeHint - can be access_token or refresh_token or null
      Throws:
      OAuthServiceException

    • convertScopeToPermissions

      List<OAuthPermission> convertScopeToPermissions(Client client, List<String> requestedScopes)
      Converts the requested scopes to the list of permissions. The scopes are extracted from OAuth2 'scope' property which if set may contain one or more space separated scope values
      Parameters:
      requestedScopes - the scopes
      Returns:
      list of permissions