Example usage for org.springframework.security.oauth2.client.token AccessTokenRequest getStateKey

Introduction

In this page you can find the example usage for org.springframework.security.oauth2.client.token AccessTokenRequest getStateKey.

Prototype

String getStateKey();

Source Link

Usage

From source file:org.openmhealth.shim.OAuth2ShimBase.java

@Override
public AuthorizationRequestParameters getAuthorizationRequestParameters(String username,
        Map<String, String> addlParameters) throws ShimException {
    OAuth2RestOperations restTemplate = restTemplate();
    try {/*  w  ww.j a v  a 2s  .  c o m*/
        trigger(restTemplate, getTriggerDataRequest());
        return AuthorizationRequestParameters.authorized();
    } catch (UserRedirectRequiredException e) {
        /**
         * If an exception was thrown it means a redirect is required
         * for user's external authorization with toolmaker.
         */
        AccessTokenRequest accessTokenRequest = restTemplate.getOAuth2ClientContext().getAccessTokenRequest();
        String stateKey = accessTokenRequest.getStateKey();

        /**
         * Build an authorization request from the exception
         * parameters. We also serialize spring's accessTokenRequest.
         */
        AuthorizationRequestParameters authRequestParams = new AuthorizationRequestParameters();
        authRequestParams.setRedirectUri(e.getRedirectUri());
        authRequestParams.setStateKey(e.getStateKey());
        authRequestParams.setAuthorizationUrl(getAuthorizationUrl(e));
        authRequestParams.setSerializedRequest(SerializationUtils.serialize(accessTokenRequest));
        authRequestParams.setStateKey(stateKey);

        authorizationRequestParametersRepo.save(authRequestParams);
        return authRequestParams;
    }
}

---

From source file:spring.AbstractAuthorizationCodeProviderTests.java

@Test
@OAuth2ContextConfiguration(resource = MyTrustedClient.class, initialize = false)
public void testWrongRedirectUri() throws Exception {
    approveAccessTokenGrant("http://anywhere", true);
    AccessTokenRequest request = context.getAccessTokenRequest();
    // The redirect is stored in the preserved state...
    context.getOAuth2ClientContext().setPreservedState(request.getStateKey(), "http://nowhere");
    // Finally everything is in place for the grant to happen...
    try {//from  w w w . j  av a 2s . c o m
        assertNotNull(context.getAccessToken());
        fail("Expected RedirectMismatchException");
    } catch (RedirectMismatchException e) {
        // expected
    }
    assertEquals(HttpStatus.BAD_REQUEST, getTokenEndpointResponse().getStatusCode());
}

---

From source file:sparklr.common.AbstractAuthorizationCodeProviderTests.java

@Test
@OAuth2ContextConfiguration(resource = MyTrustedClient.class, initialize = false)
public void testWrongRedirectUri() throws Exception {
    approveAccessTokenGrant("http://anywhere", true);
    AccessTokenRequest request = context.getAccessTokenRequest();
    // The redirect is stored in the preserved state...
    context.getOAuth2ClientContext().setPreservedState(request.getStateKey(), "http://nowhere");
    // Finally everything is in place for the grant to happen...
    try {//w  w  w .  jav  a  2 s.c  o m
        assertNotNull(context.getAccessToken());
        fail("Expected RedirectMismatchException");
    } catch (RedirectMismatchException e) {
        // expected
    }
    assertEquals(HttpStatus.BAD_REQUEST, tokenEndpointResponse.getStatusCode());
}

---

From source file:com.zhm.config.MyAuthorizationCodeAccessTokenProvider.java

private MultiValueMap<String, String> getParametersForTokenRequest(AuthorizationCodeResourceDetails resource,
        AccessTokenRequest request) {

    MultiValueMap<String, String> form = new LinkedMultiValueMap<String, String>();
    form.set("grant_type", "authorization_code");
    form.set("code", request.getAuthorizationCode());

    Object preservedState = request.getPreservedState();
    if (request.getStateKey() != null || stateMandatory) {
        // The token endpoint has no use for the state so we don't send it back, but we are using it
        // for CSRF detection client side...
        if (preservedState == null) {
            throw new InvalidRequestException(
                    "Possible CSRF detected - state parameter was required but no state could be found");
        }//from  ww  w  . j av a  2  s  . c  o m
    }

    // Extracting the redirect URI from a saved request should ignore the current URI, so it's not simply a call to
    // resource.getRedirectUri()
    String redirectUri = null;
    // Get the redirect uri from the stored state
    if (preservedState instanceof String) {
        // Use the preserved state in preference if it is there
        // TODO: treat redirect URI as a special kind of state (this is a historical mini hack)
        redirectUri = String.valueOf(preservedState);
    } else {
        redirectUri = resource.getRedirectUri(request);
    }

    if (redirectUri != null && !"NONE".equals(redirectUri)) {
        form.set("redirect_uri", redirectUri);
    }

    return form;

}

---

From source file:com.emergya.spring.security.oauth.google.GoogleAuthorizationCodeAccessTokenProvider.java

private MultiValueMap<String, String> getParametersForTokenRequest(
        final AuthorizationCodeResourceDetails resource, final AccessTokenRequest request) {

    MultiValueMap<String, String> form = new LinkedMultiValueMap<>();
    form.set("grant_type", "authorization_code");
    form.set("code", request.getAuthorizationCode());

    Object preservedState = request.getPreservedState();
    if (request.getStateKey() != null) {
        // The token endpoint has no use for the state so we don't send it back, but we are using it
        // for CSRF detection client side...
        if (preservedState == null) {
            throw new InvalidRequestException(
                    "Possible CSRF detected - state parameter was present but no state could be found");
        }/*  w ww .j  a  va2  s . com*/
    }

    // Extracting the redirect URI from a saved request should ignore the current URI, so it's not simply a call to
    // resource.getRedirectUri()
    String redirectUri;
    // Get the redirect uri from the stored state
    if (preservedState instanceof String) {
        // Use the preserved state in preference if it is there
        // TODO: treat redirect URI as a special kind of state (this is a historical mini hack)
        redirectUri = String.valueOf(preservedState);
    } else {
        redirectUri = resource.getRedirectUri(request);
    }

    if (redirectUri != null && !"NONE".equals(redirectUri)) {
        form.set("redirect_uri", redirectUri);
    }

    return form;

}

---

From source file:com.zhm.config.MyAuthorizationCodeAccessTokenProvider.java

public OAuth2AccessToken obtainAccessToken(OAuth2ProtectedResourceDetails details, AccessTokenRequest request)
        throws UserRedirectRequiredException, UserApprovalRequiredException, AccessDeniedException,
        OAuth2AccessDeniedException {
    // request.setPreservedState("http://localhost:9099/home");
    AuthorizationCodeResourceDetails resource = (AuthorizationCodeResourceDetails) details;
    if (request.getAuthorizationCode() == null) {
        if (request.getStateKey() == null) {
            throw getRedirectForAuthorization(resource, request);
        }//  w  w  w .  j  av  a  2  s .c om
        obtainAuthorizationCode(resource, request);
    }
    return retrieveToken(request, resource, getParametersForTokenRequest(resource, request),
            getHeadersForTokenRequest(request));

}

---

From source file:com.emergya.spring.security.oauth.google.GoogleAuthorizationCodeAccessTokenProvider.java

@Override
public final OAuth2AccessToken obtainAccessToken(final OAuth2ProtectedResourceDetails details,
        final AccessTokenRequest request) throws UserRedirectRequiredException, UserApprovalRequiredException,
        AccessDeniedException, OAuth2AccessDeniedException {

    GoogleAuthCodeResourceDetails resource;

    try {//  w w  w  .  j  a  va  2s . c  o  m
        resource = (GoogleAuthCodeResourceDetails) details;
    } catch (ClassCastException ex) {
        throw new IllegalArgumentException("details is not an instance of class GoogleAuthCodeResourceDetails");
    }

    if (request.getAuthorizationCode() == null) {
        if (request.getStateKey() == null) {
            throw getRedirectForAuthorization(resource, request);
        }
        obtainAuthorizationCode(resource, request);
    }
    return retrieveToken(request, resource, getParametersForTokenRequest(resource, request),
            getHeadersForTokenRequest());

}

---

From source file:com.zhm.config.MyAuthorizationCodeAccessTokenProvider.java

private MultiValueMap<String, String> getParametersForAuthorizeRequest(
        AuthorizationCodeResourceDetails resource, AccessTokenRequest request) {

    MultiValueMap<String, String> form = new LinkedMultiValueMap<String, String>();
    form.set("response_type", "code");
    form.set("client_id", resource.getClientId());

    if (request.get("scope") != null) {
        form.set("scope", request.getFirst("scope"));
    } else {/*from  w w w  .jav a 2  s .  c om*/
        form.set("scope", OAuth2Utils.formatParameterList(resource.getScope()));
    }

    // Extracting the redirect URI from a saved request should ignore the current URI, so it's not simply a call to
    // resource.getRedirectUri()
    String redirectUri = resource.getPreEstablishedRedirectUri();

    Object preservedState = request.getPreservedState();
    if (redirectUri == null && preservedState != null) {
        // no pre-established redirect uri: use the preserved state
        // TODO: treat redirect URI as a special kind of state (this is a historical mini hack)
        redirectUri = String.valueOf(preservedState);
    } else {
        redirectUri = request.getCurrentUri();
    }

    String stateKey = request.getStateKey();
    if (stateKey != null) {
        form.set("state", stateKey);
        if (preservedState == null) {
            throw new InvalidRequestException(
                    "Possible CSRF detected - state parameter was present but no state could be found");
        }
    }

    if (redirectUri != null) {
        form.set("redirect_uri", redirectUri);
    }

    return form;

}

---

From source file:com.emergya.spring.security.oauth.google.GoogleAuthorizationCodeAccessTokenProvider.java

private MultiValueMap<String, String> getParametersForAuthorizeRequest(GoogleAuthCodeResourceDetails resource,
        AccessTokenRequest request) {

    MultiValueMap<String, String> form = new LinkedMultiValueMap<>();
    form.set("response_type", "code");
    form.set("client_id", resource.getClientId());

    if (request.get("scope") != null) {
        form.set("scope", request.getFirst("scope"));
    } else {/* w  w w  .  java2s  .  c o  m*/
        form.set("scope", OAuth2Utils.formatParameterList(resource.getScope()));
    }

    // Extracting the redirect URI from a saved request should ignore the current URI, so it's not simply a call to
    // resource.getRedirectUri()
    String redirectUri = resource.getPreEstablishedRedirectUri();

    Object preservedState = request.getPreservedState();
    if (redirectUri == null && preservedState != null) {
        // no pre-established redirect uri: use the preserved state
        // TODO: treat redirect URI as a special kind of state (this is a historical mini hack)
        redirectUri = String.valueOf(preservedState);
    } else {
        redirectUri = request.getCurrentUri();
    }

    String stateKey = request.getStateKey();
    if (stateKey != null) {
        form.set("state", stateKey);
        if (preservedState == null) {
            throw new InvalidRequestException(
                    "Possible CSRF detected - state parameter was present but no state could be found");
        }
    }

    form.set("approval_prompt", resource.getApprovalPrompt());

    if (StringUtils.isEmpty(resource.getLoginHint())) {
        form.set("login_hint", resource.getLoginHint());
    }

    if (redirectUri != null) {
        form.set("redirect_uri", redirectUri);
    }

    return form;

}

---