OAuth Response

最新推荐文章于 2022-09-10 11:26:19 发布

原创最新推荐文章于 2022-09-10 11:26:19 发布 · 723 阅读

0 ·

CC 4.0 BY-SA版权

本文介绍了一个用于OAuth2令牌验证的方法，该方法通过构建OAuth2IntrospectionResponseDTO对象来完成令牌的有效性和详细信息验证，包括对令牌的有效期、发行时间、作用域、用户名等属性的检查。

摘要生成于 C知道，由 DeepSeek-R1 满血版支持，前往体验 >

public OAuth2IntrospectionResponseDTO buildIntrospectionResponse(OAuth2TokenValidationRequestDTO validationRequest)
           throws IdentityOAuth2Exception {

       OAuth2TokenValidationResponseDTO responseDTO = new OAuth2TokenValidationResponseDTO();
       OAuth2IntrospectionResponseDTO introResp = new OAuth2IntrospectionResponseDTO();
       
       OAuth2TokenValidationMessageContext messageContext =
               new OAuth2TokenValidationMessageContext(validationRequest, responseDTO);

       OAuth2TokenValidationRequestDTO.OAuth2AccessToken accessToken = validationRequest.getAccessToken();
OAuth2TokenValidator tokenValidator = null;
AccessTokenDO accessTokenDO = null;

try {
    tokenValidator = findAccessTokenValidator(accessToken);
} catch (IllegalArgumentException e) {
    // access token not provided.
    return buildIntrospectionErrorResponse(e.getMessage());
}
           
if (!tokenValidator.validateAccessToken(messageContext)) {
    return buildIntrospectionErrorResponse("Access token validation failed");
}

if (messageContext.getProperty(OAuth2Util.REMOTE_ACCESS_TOKEN) != null
   && "true".equalsIgnoreCase((String) messageContext.getProperty(OAuth2Util.REMOTE_ACCESS_TOKEN))) {
    // this can be a self-issued JWT or any access token issued by a trusted OAuth authorization server.

    // should be in seconds
    if (messageContext.getProperty(OAuth2Util.EXP) != null) {
   introResp.setExp(Long.parseLong((String) messageContext.getProperty(OAuth2Util.EXP)));
    }
    // should be in seconds
    if (messageContext.getProperty(OAuth2Util.IAT) != null) {
   introResp.setIat(Long.parseLong((String) messageContext.getProperty(OAuth2Util.IAT)));
    }

    // token scopes - space delimited
    if (messageContext.getProperty(OAuth2Util.SCOPE) != null) {
   introResp.setScope((String) messageContext.getProperty(OAuth2Util.SCOPE));
    }
    // set user-name
    if (messageContext.getProperty(OAuth2Util.USERNAME) != null) {
   introResp.setUsername((String) messageContext.getProperty(OAuth2Util.USERNAME));
    }
    // set client-id
    if (messageContext.getProperty(OAuth2Util.CLIENT_ID) != null) {
   introResp.setClientId((String) messageContext.getProperty(OAuth2Util.CLIENT_ID));
    }
    
} else {
    
    try {
   accessTokenDO = findAccessToken(validationRequest.getAccessToken().getIdentifier());
    } catch (IllegalArgumentException e) {
   // access token not found in the system.
   return buildIntrospectionErrorResponse(e.getMessage());
    }

    if (hasAcessTokenExpired(accessTokenDO)) {
   // token is not active. we do not need to worry about other details.
   introResp.setActive(false);
   return introResp;
    }

    // should be in seconds
    introResp
       .setExp((accessTokenDO.getValidityPeriodInMillis() + accessTokenDO.getIssuedTime().getTime()) / 1000);
    // should be in seconds
    introResp.setIat(accessTokenDO.getIssuedTime().getTime() / 1000);
    // token scopes
    introResp.setScope(OAuth2Util.buildScopeString((accessTokenDO.getScope())));
    // set user-name
    introResp.setUsername(getAuthzUser(accessTokenDO));
    // add client id
    introResp.setClientId(accessTokenDO.getConsumerKey());
    // adding the AccessTokenDO as a context property for further use
    messageContext.addProperty("AccessTokenDO", accessTokenDO);
}

if (!tokenValidator.validateAccessDelegation(messageContext)) {
    return buildIntrospectionErrorResponse("Invalid access delegation");
}
       
if (!tokenValidator.validateScope(messageContext)) {
    return buildIntrospectionErrorResponse("Scope validation failed");
}

if (messageContext.getProperty(OAuth2Util.JWT_ACCESS_TOKEN) != null
   && "true".equalsIgnoreCase((String) messageContext.getProperty(OAuth2Util.JWT_ACCESS_TOKEN))) {
    // attributes only related JWT access tokens.
    
    if (messageContext.getProperty(OAuth2Util.SUB) != null) {
   introResp.setSub((String) messageContext.getProperty(OAuth2Util.SUB));
    }
    if (messageContext.getProperty(OAuth2Util.ISS) != null) {
   introResp.setIss((String) messageContext.getProperty(OAuth2Util.ISS));
    }
    if (messageContext.getProperty(OAuth2Util.AUD) != null) {
   introResp.setAud((String) messageContext.getProperty(OAuth2Util.AUD));
    }
    if (messageContext.getProperty(OAuth2Util.JTI) != null) {
   introResp.setJti((String) messageContext.getProperty(OAuth2Util.JTI));
    }
    // set the token not to be used before time in seconds
    if (messageContext.getProperty(OAuth2Util.NBF) != null) {
   introResp.setNbf(Long.parseLong((String) messageContext.getProperty(OAuth2Util.NBF)));
    }
}
     
// all set. mark the token active.
       introResp.setActive(true);

if (tokenGenerator != null) {
    // add user attributes to the introspection response.
    tokenGenerator.generateToken(messageContext);
    if (log.isDebugEnabled()) {
   log.debug(tokenGenerator.getClass().getName() + "generated token set to response.");
    }
    if (responseDTO.getAuthorizationContextToken() != null) {
   introResp.setUserContext(responseDTO.getAuthorizationContextToken().getTokenString());
    }
}

       return introResp;