protected String getTokenFromFormData(Message message) { String method = (String)message.get(Message.HTTP_REQUEST_METHOD); String type = (String)message.get(Message.CONTENT_TYPE); if (type != null && MediaType.APPLICATION_FORM_URLENCODED.startsWith(type) && method != null && (method.equals(HttpMethod.POST) || method.equals(HttpMethod.PUT))) { try { FormEncodingProvider<Form> provider = new FormEncodingProvider<>(true); Form form = FormUtils.readForm(provider, message); MultivaluedMap<String, String> formData = form.asMap(); String token = formData.getFirst(OAuthConstants.ACCESS_TOKEN); if (token != null) { FormUtils.restoreForm(provider, form, message); return token; } } catch (Exception ex) { // the exception will be thrown below } } AuthorizationUtils.throwAuthorizationFailure(supportedSchemes, realm); return null; }
protected String getTokenFromFormData(Message message) { String method = (String)message.get(Message.HTTP_REQUEST_METHOD); String type = (String)message.get(Message.CONTENT_TYPE); if (type != null && MediaType.APPLICATION_FORM_URLENCODED.startsWith(type) && method != null && (method.equals(HttpMethod.POST) || method.equals(HttpMethod.PUT))) { try { FormEncodingProvider<Form> provider = new FormEncodingProvider<>(true); Form form = FormUtils.readForm(provider, message); MultivaluedMap<String, String> formData = form.asMap(); String token = formData.getFirst(OAuthConstants.ACCESS_TOKEN); if (token != null) { FormUtils.restoreForm(provider, form, message); return token; } } catch (Exception ex) { // the exception will be thrown below } } AuthorizationUtils.throwAuthorizationFailure(supportedSchemes, realm); return null; }
@Override public void filter(ContainerRequestContext context) { Message message = JAXRSUtils.getCurrentMessage(); Form form = readFormData(message); MultivaluedMap<String, String> formData = form.asMap(); String assertion = formData.getFirst(SAML_ELEMENT); handleToken(message, assertion); // redirect if needed String samlRequestURI = formData.getFirst(SAML_RELAY_STATE); if (samlRequestURI != null) { // RelayState may actually represent a reference to a transient local state // containing the actual REQUEST URI client was using before being redirected // back to IDP - at the moment assume it's URI UriInfoImpl ui = new UriInfoImpl(message); if (!samlRequestURI.startsWith(ui.getBaseUri().toString())) { context.abortWith(Response.status(302).location(URI.create(samlRequestURI)).build()); return; } } formData.remove(SAML_ELEMENT); formData.remove(SAML_RELAY_STATE); // restore input stream try { FormUtils.restoreForm(provider, form, message); } catch (Exception ex) { throwFault(ex.getMessage(), ex); } }
@Override public void filter(ContainerRequestContext context) { Message message = JAXRSUtils.getCurrentMessage(); Form form = readFormData(message); MultivaluedMap<String, String> formData = form.asMap(); String assertion = formData.getFirst(SAML_ELEMENT); handleToken(message, assertion); // redirect if needed String samlRequestURI = formData.getFirst(SAML_RELAY_STATE); if (samlRequestURI != null) { // RelayState may actually represent a reference to a transient local state // containing the actual REQUEST URI client was using before being redirected // back to IDP - at the moment assume it's URI UriInfoImpl ui = new UriInfoImpl(message); if (!samlRequestURI.startsWith(ui.getBaseUri().toString())) { context.abortWith(Response.status(302).location(URI.create(samlRequestURI)).build()); return; } } formData.remove(SAML_ELEMENT); formData.remove(SAML_RELAY_STATE); // restore input stream try { FormUtils.restoreForm(provider, form, message); } catch (Exception ex) { throwFault(ex.getMessage(), ex); } }
@Override public void filter(ContainerRequestContext context) { Message message = JAXRSUtils.getCurrentMessage(); Form form = readFormData(message); MultivaluedMap<String, String> formData = form.asMap(); String assertionType = formData.getFirst(Constants.CLIENT_AUTH_ASSERTION_TYPE); String decodedAssertionType = assertionType != null ? HttpUtils.urlDecode(assertionType) : null; if (decodedAssertionType == null || !Constants.CLIENT_AUTH_SAML2_BEARER.equals(decodedAssertionType)) { throw ExceptionUtils.toNotAuthorizedException(null, null); } String assertion = formData.getFirst(Constants.CLIENT_AUTH_ASSERTION_PARAM); Element token = readToken(message, assertion); String clientId = formData.getFirst(OAuthConstants.CLIENT_ID); validateToken(message, token, clientId); formData.remove(OAuthConstants.CLIENT_ID); formData.remove(Constants.CLIENT_AUTH_ASSERTION_PARAM); formData.remove(Constants.CLIENT_AUTH_ASSERTION_TYPE); // restore input stream try { FormUtils.restoreForm(provider, form, message); } catch (Exception ex) { throw ExceptionUtils.toNotAuthorizedException(null, null); } }
@Override public void filter(ContainerRequestContext context) { Message message = JAXRSUtils.getCurrentMessage(); Form form = readFormData(message); MultivaluedMap<String, String> formData = form.asMap(); String assertionType = formData.getFirst(Constants.CLIENT_AUTH_ASSERTION_TYPE); String decodedAssertionType = assertionType != null ? HttpUtils.urlDecode(assertionType) : null; if (decodedAssertionType == null || !Constants.CLIENT_AUTH_SAML2_BEARER.equals(decodedAssertionType)) { throw ExceptionUtils.toNotAuthorizedException(null, null); } String assertion = formData.getFirst(Constants.CLIENT_AUTH_ASSERTION_PARAM); Element token = readToken(message, assertion); String clientId = formData.getFirst(OAuthConstants.CLIENT_ID); validateToken(message, token, clientId); formData.remove(OAuthConstants.CLIENT_ID); formData.remove(Constants.CLIENT_AUTH_ASSERTION_PARAM); formData.remove(Constants.CLIENT_AUTH_ASSERTION_TYPE); // restore input stream try { FormUtils.restoreForm(provider, form, message); } catch (Exception ex) { throw ExceptionUtils.toNotAuthorizedException(null, null); } }
FormUtils.restoreForm(provider, form, message); } catch (Exception ex) { throw ExceptionUtils.toNotAuthorizedException(null, null);
FormUtils.restoreForm(provider, form, message); } catch (Exception ex) { throw ExceptionUtils.toNotAuthorizedException(null, null);