Authorization endpoint now supports code-based authn

fcrepo4-archive · Jun 12, 2013 · 0c65d53 · 0c65d53
1 parent a573afe
commit 0c65d53
Show file tree

Hide file tree

Showing 11 changed files with 113 additions and 209 deletions.
diff --git a/src/main/java/org/fcrepo/auth/oauth/Constants.java b/src/main/java/org/fcrepo/auth/oauth/Constants.java
@@ -13,4 +13,6 @@ public interface Constants {
 
     //TODO get namespaced properties to work
     public static final String SCOPES_PROPERTY = "oauth-scopes";
+
+    public static final Long EXPIRATION_TIMEOUT = 3600l;
 }
diff --git a/src/main/java/org/fcrepo/auth/oauth/api/AuthzEndpoint.java b/src/main/java/org/fcrepo/auth/oauth/api/AuthzEndpoint.java
@@ -38,6 +38,7 @@
 
 import static org.apache.oltu.oauth2.common.message.OAuthResponse.errorResponse;
 import static org.fcrepo.auth.oauth.Constants.CLIENT_PROPERTY;
+import static org.fcrepo.auth.oauth.Constants.EXPIRATION_TIMEOUT;
 import static org.fcrepo.auth.oauth.Constants.OAUTH_WORKSPACE;
 import static org.fcrepo.auth.oauth.api.Util.createOauthWorkspace;
 import static org.slf4j.LoggerFactory.getLogger;
@@ -49,7 +50,7 @@ public class AuthzEndpoint extends AbstractResource {
     private static final Logger LOGGER = getLogger(AuthzEndpoint.class);
 
     @GET
-    public Response authorize(@Context
+    public Response getAuthorization(@Context
     final HttpServletRequest request) throws URISyntaxException,
             OAuthSystemException, RepositoryException {
 
@@ -78,7 +79,7 @@ public Response authorize(@Context
             }
             if (responseType.equals(TOKEN.toString())) {
                 builder.setAccessToken(oauthIssuerImpl.accessToken());
-                builder.setExpiresIn(3600l);
+                builder.setExpiresIn(EXPIRATION_TIMEOUT);
             }
 
             final String redirectURI =

diff --git a/src/main/java/org/fcrepo/auth/oauth/api/TokenEndpoint.java b/src/main/java/org/fcrepo/auth/oauth/api/TokenEndpoint.java
@@ -1,8 +1,6 @@
 
 package org.fcrepo.auth.oauth.api;
 
-import static com.google.common.collect.Sets.intersection;
-import static com.google.common.collect.Sets.newHashSet;
 import static javax.servlet.http.HttpServletResponse.SC_BAD_REQUEST;
 import static javax.servlet.http.HttpServletResponse.SC_OK;
 import static javax.servlet.http.HttpServletResponse.SC_UNAUTHORIZED;
@@ -19,10 +17,7 @@
 import static org.fcrepo.auth.oauth.Constants.CLIENT_PROPERTY;
 import static org.fcrepo.auth.oauth.Constants.OAUTH_WORKSPACE;
 import static org.fcrepo.auth.oauth.Constants.PRINCIPAL_PROPERTY;
-import static org.fcrepo.auth.oauth.Constants.SCOPES_PROPERTY;
 import static org.fcrepo.auth.oauth.api.Util.createOauthWorkspace;
-import static org.fcrepo.utils.FedoraTypesUtils.map;
-import static org.fcrepo.utils.FedoraTypesUtils.value2string;
 import static org.slf4j.LoggerFactory.getLogger;
 
 import java.util.Set;
@@ -80,7 +75,7 @@ public Response getToken(@Context
             oauthRequest = new OAuthTokenRequest(request);
 
             // TODO check if clientid is valid
-            if (isValid()) {
+            if (isNotValid()) {
                 final OAuthResponse response =
                         OAuthASResponse.errorResponse(SC_BAD_REQUEST).setError(
                                 INVALID_CLIENT).setErrorDescription(
@@ -90,7 +85,7 @@ public Response getToken(@Context
             }
 
             // TODO check if client_secret is valid
-            if (isValid()) {
+            if (isNotValid()) {
                 final OAuthResponse response =
                         OAuthASResponse
                                 .errorResponse(SC_UNAUTHORIZED)
@@ -104,8 +99,7 @@ public Response getToken(@Context
             // do checking for different grant types
             if (oauthRequest.getParam(OAUTH_GRANT_TYPE).equals(
                     AUTHORIZATION_CODE.toString())) {
-                // TODO check if authzcode is valid
-                if (isValidAuthCode(oauthRequest)) {
+                if (!isValidAuthCode(oauthRequest)) {
                     final OAuthResponse response =
                             errorResponse(SC_BAD_REQUEST).setError(
                                     INVALID_GRANT).setErrorDescription(
@@ -117,7 +111,7 @@ public Response getToken(@Context
             } else if (oauthRequest.getParam(OAUTH_GRANT_TYPE).equals(
                     GrantType.PASSWORD.toString())) {
                 // TODO check if username/password is valid
-                if (isValid()) {
+                if (isNotValid()) {
                     final OAuthResponse response =
                             errorResponse(SC_BAD_REQUEST).setError(
                                     INVALID_GRANT).setErrorDescription(
@@ -159,23 +153,26 @@ public Response getToken(@Context
     private boolean isValidAuthCode(final OAuthTokenRequest oauthRequest)
             throws RepositoryException {
         final String client = oauthRequest.getClientId();
+        LOGGER.debug("Request has authorization client: {}", client);
         final String code = oauthRequest.getCode();
         final Set<String> scopes = oauthRequest.getScopes();
         final Session session = sessions.getSession(OAUTH_WORKSPACE);
         try {
             final Node authCodeNode =
                     session.getNode("/authorization-codes/" + code);
+            LOGGER.debug("Found authorization code node stored: {}",
+                    authCodeNode.getPath());
             // if the client is right
             if (authCodeNode.getProperty(CLIENT_PROPERTY).getString().equals(
                     client)) {
-                final Set<String> storedScopes =
-                        newHashSet(map(authCodeNode
-                                .getProperty(SCOPES_PROPERTY).getValues(),
-                                value2string));
+                //                final Set<String> storedScopes =
+                //                        newHashSet(map(authCodeNode
+                //                                .getProperty(SCOPES_PROPERTY).getValues(),
+                //                                value2string));
                 // and if there is at least one scope in common
-                if (intersection(storedScopes, scopes).size() > 0) {
-                    return true;
-                }
+                //if (intersection(storedScopes, scopes).size() > 0) {
+                return true;
+                // }
             }
         } catch (final PathNotFoundException e) {
             // this wasn't a code we stored
@@ -203,7 +200,7 @@ private void saveToken(final String token, final String client,
 
     }
 
-    private boolean isValid() {
+    private boolean isNotValid() {
         // TODO actually do some checking of client ID and secret and so forth
         return false;
     }

diff --git a/src/main/java/org/fcrepo/auth/oauth/filter/InjectableOAuthFilter.java b/src/main/java/org/fcrepo/auth/oauth/filter/InjectableOAuthFilter.java
diff --git a/src/main/java/org/fcrepo/auth/oauth/filter/OAuthFilter.java b/src/main/java/org/fcrepo/auth/oauth/filter/OAuthFilter.java
@@ -14,6 +14,7 @@
 import java.security.Principal;
 import java.util.Set;
 
+import javax.annotation.PostConstruct;
 import javax.servlet.Filter;
 import javax.servlet.FilterChain;
 import javax.servlet.FilterConfig;
@@ -42,9 +43,10 @@ public class OAuthFilter implements Filter {
     private OAuthRSProvider provider;
 
     private Set<ParameterStyle> parameterStyles;
-
+
+    @PostConstruct
     public void init() {
-        LOGGER.debug("Initing {}", getClass().getName());
+        LOGGER.debug("Initializing {}", getClass().getName());
 
     }
 
@@ -60,7 +62,8 @@ public void doFilter(ServletRequest request,
         final HttpServletRequest req = (HttpServletRequest) request;
         final HttpServletResponse res = (HttpServletResponse) response;
 
-        LOGGER.debug("Filtering {}", ((HttpServletRequest)request).getRequestURI());
+        LOGGER.debug("Filtering {}", ((HttpServletRequest) request)
+                .getRequestURI());
         try {
 
             // Make an OAuth Request out of this servlet request

diff --git a/src/main/java/org/fcrepo/auth/oauth/filter/RestrictToAuthNFilter.java b/src/main/java/org/fcrepo/auth/oauth/filter/RestrictToAuthNFilter.java
@@ -6,6 +6,7 @@
 
 import java.io.IOException;
 
+import javax.annotation.PostConstruct;
 import javax.servlet.Filter;
 import javax.servlet.FilterChain;
 import javax.servlet.FilterConfig;
@@ -25,10 +26,10 @@ public class RestrictToAuthNFilter implements Filter {
 
     @Override
     public void init(final FilterConfig filterConfig) throws ServletException {
-    	init();
+        init();
     }
-    
-    // used by Spring
+
+    @PostConstruct
     public void init() {
         LOGGER.debug("Initialized {}", this.getClass().getName());
     }

diff --git a/...h/integration/api/AbstractResourceIT.java → ...egration/api/AbstractOAuthResourceIT.java b/...h/integration/api/AbstractResourceIT.java → ...egration/api/AbstractOAuthResourceIT.java
@@ -27,7 +27,13 @@
 
 @RunWith(SpringJUnit4ClassRunner.class)
 @ContextConfiguration("/spring-test/test-container.xml")
-public abstract class AbstractResourceIT {
+public abstract class AbstractOAuthResourceIT {
+
+    protected final String authzEndpoint = "http://" + HOSTNAME + ":" +
+            SERVER_PORT + "/authorization";
+
+    protected final String tokenEndpoint = "http://" + HOSTNAME + ":" +
+            SERVER_PORT + "/token";
 
     protected Logger logger;
 
@@ -51,7 +57,7 @@ public void setLogger() {
 
     protected static HttpClient client;
 
-    public AbstractResourceIT() {
+    public AbstractOAuthResourceIT() {
         connectionManager.setMaxTotal(MAX_VALUE);
         connectionManager.setDefaultMaxPerRoute(5);
         connectionManager.closeIdleConnections(3, SECONDS);