Package org.ametys.plugins.extrausermgt.authentication.oidc

Class AbstractOIDCCredentialProvider

java.lang.Object

org.ametys.runtime.plugin.component.AbstractLogEnabled

org.ametys.core.authentication.AbstractCredentialProvider

org.ametys.plugins.extrausermgt.authentication.oidc.AbstractOIDCCredentialProvider

All Implemented Interfaces:

BlockingCredentialProvider, CredentialProvider, LogEnabled, Component, Contextualizable, Serviceable

Direct Known Subclasses:

AutoDiscoveringOIDCCredentialProvider, FacebookCredentialProvider, GenericOIDCCredentialProvider, GoogleCredentialProvider

public abstract class AbstractOIDCCredentialProvider
extends AbstractCredentialProvider
implements BlockingCredentialProvider, Contextualizable, Serviceable

Sign in (through Google, facebook...) using the OpenId Connect (OIDC) protocol.

Field Summary

Fields

Modifier and Type	Field	Description
protected URI	_authUri	URI for the authentication request
protected com.nimbusds.oauth2.sdk.id.ClientID	_clientID	Client ID
protected com.nimbusds.oauth2.sdk.auth.Secret	_clientSecret	Client secret
protected Context	_context	Ametys context
protected com.nimbusds.oauth2.sdk.id.Issuer	_iss	Issuer for the validation of the token
protected URL	_jwkSetURL	jwk URL for the validation of the token
protected com.nimbusds.oauth2.sdk.Scope	_scope	Scope for the authentication request
protected URI	_tokenEndpointUri	URI for the token request
protected URI	_userInfoEndpoint	URI for the user info request
static final String	EXPDATE_SESSION_ATTRIBUTE	Session date attribute for OIDC
static final String	REDIRECT_URI_SESSION_ATTRIBUTE	Session attribute for OIDC
static final String	REFRESH_TOKEN_SESSION_ATTRIBUTE	Session attribute for OIDC
static final String	STATE_SESSION_ATTRIBUTE	Session attribute for OIDC
static final String	TOKEN_SESSION_ATTRIBUTE	Session attribute for OIDC

Constructor Summary

Constructors

Constructor	Description
AbstractOIDCCredentialProvider()

Method Summary

Modifier and Type	Method	Description
UserIdentity	blockingGetUserIdentity(Redirector redirector)	Method called by AuthenticateAction each time a request need authentication.
boolean	blockingGrantAnonymousRequest()	Method called by AuthenticateAction before asking for credentials.
boolean	blockingIsStillConnected(UserIdentity userIdentity, Redirector redirector)	Validates that the user specify is still connected
void	blockingUserAllowed(UserIdentity userIdentity, Redirector redirector)	Method called by AuthenticateAction after authentication process succeeded
void	blockingUserNotAllowed(Redirector redirector)	Method called by AuthenticateAction each a user could not get authenticated.
protected void	checkState()	Checks the State parameter of the request to prevent CSRF attacks
void	contextualize(Context context)
protected com.nimbusds.oauth2.sdk.auth.ClientAuthentication	getClientAuthentication()	get the client authentication info for the token end point
protected UserIdentity	getUserIdentity(com.nimbusds.openid.connect.sdk.claims.UserInfo userInfo, Request request, Redirector redirector)	Compute a user identity based on the user info
protected com.nimbusds.openid.connect.sdk.claims.UserInfo	getUserInfo(com.nimbusds.oauth2.sdk.token.AccessToken accessToken)	Request the userInfo using the user info end point and an access token
void	init(String id, String cpModelId, Map<String,Object> paramValues, String label)	Initialize the credential provider with given parameters' values.
protected abstract void	initUrisScope()	Initialize the URIs
protected com.nimbusds.openid.connect.sdk.token.OIDCTokens	requestToken(com.nimbusds.oauth2.sdk.auth.ClientAuthentication clientAuth, com.nimbusds.oauth2.sdk.AuthorizationGrant refreshTokenGrant)	Request the tokens using a refresh token
protected com.nimbusds.openid.connect.sdk.token.OIDCTokens	requestToken(com.nimbusds.oauth2.sdk.AuthorizationCode authCode, URI redirectUri)	Request the tokens (ID token and Access token)
boolean	requiresNewWindow()	Does this blocking credential provider requires a new window to process.
void	service(ServiceManager manager)
protected void	signIn(Redirector redirector, URI redirectUri, Session session)	Sign the user in by sending an authentication request to the issuer
protected com.nimbusds.openid.connect.sdk.claims.IDTokenClaimsSet	validateIdToken(com.nimbusds.jwt.JWT idToken)	Validate the id token from the token request

Methods inherited from class org.ametys.core.authentication.AbstractCredentialProvider

equals, getCredentialProviderModelId, getId, getLabel, getParameterValues, hashCode

Methods inherited from class org.ametys.runtime.plugin.component.AbstractLogEnabled

getLogger, setLogger

Methods inherited from class java.lang.Object

clone, finalize, getClass, notify, notifyAll, toString, wait, wait, wait

Methods inherited from interface org.ametys.core.authentication.CredentialProvider

getCredentialProviderModelId, getId, getLabel, getParameterValues, getUserIdentity, grantAnonymousRequest, isStillConnected, userAllowed, userNotAllowed

Field Details

REDIRECT_URI_SESSION_ATTRIBUTE

public static final String REDIRECT_URI_SESSION_ATTRIBUTE

Session attribute for OIDC

See Also:

• Constant Field Values

TOKEN_SESSION_ATTRIBUTE

public static final String TOKEN_SESSION_ATTRIBUTE

Session attribute for OIDC

See Also:

• Constant Field Values

EXPDATE_SESSION_ATTRIBUTE

public static final String EXPDATE_SESSION_ATTRIBUTE

Session date attribute for OIDC

See Also:

• Constant Field Values

REFRESH_TOKEN_SESSION_ATTRIBUTE

public static final String REFRESH_TOKEN_SESSION_ATTRIBUTE

Session attribute for OIDC

See Also:

• Constant Field Values

STATE_SESSION_ATTRIBUTE

public static final String STATE_SESSION_ATTRIBUTE

Session attribute for OIDC

See Also:

• Constant Field Values

_scope

protected com.nimbusds.oauth2.sdk.Scope _scope

Scope for the authentication request

_authUri

protected URI _authUri

URI for the authentication request

_tokenEndpointUri

protected URI _tokenEndpointUri

URI for the token request

_userInfoEndpoint

protected URI _userInfoEndpoint

URI for the user info request

_jwkSetURL

protected URL _jwkSetURL

jwk URL for the validation of the token

_iss

protected com.nimbusds.oauth2.sdk.id.Issuer _iss

Issuer for the validation of the token

_context

protected Context _context

Ametys context

_clientID

protected com.nimbusds.oauth2.sdk.id.ClientID _clientID

Client ID

_clientSecret

protected com.nimbusds.oauth2.sdk.auth.Secret _clientSecret

Client secret

Constructor Details

AbstractOIDCCredentialProvider

public AbstractOIDCCredentialProvider()

Method Details

contextualize

public void contextualize(Context context)
                   throws ContextException

Specified by:

contextualize in interface Contextualizable

Throws:

ContextException

service

public void service(ServiceManager manager)
             throws ServiceException

Specified by:

service in interface Serviceable

Throws:

ServiceException

init

public void init(String id,
 String cpModelId,
 Map<String,Object> paramValues,
 String label)
          throws Exception

Description copied from interface: CredentialProvider

Initialize the credential provider with given parameters' values.

Specified by:

init in interface CredentialProvider

Overrides:

init in class AbstractCredentialProvider

Parameters:

id - The unique identifier

cpModelId - The id of credential provider extension point

paramValues - The parameters' values

label - The specific label of this instance. Can be null

Throws:

Exception - If an error occurred

getClientAuthentication

protected com.nimbusds.oauth2.sdk.auth.ClientAuthentication getClientAuthentication()

get the client authentication info for the token end point

Returns:

the client authentication

blockingGrantAnonymousRequest

public boolean blockingGrantAnonymousRequest()

Description copied from interface: BlockingCredentialProvider

Method called by AuthenticateAction before asking for credentials. This method is used to bypass authentication. If this method returns true, no authentication will be required. Use it with care, as it may lead to obvious security issues.

Specified by:

blockingGrantAnonymousRequest in interface BlockingCredentialProvider

Returns:

true if the Request is not authenticated

blockingIsStillConnected

public boolean blockingIsStillConnected(UserIdentity userIdentity,
 Redirector redirector)
                                 throws Exception

Description copied from interface: BlockingCredentialProvider

Validates that the user specify is still connected

Specified by:

blockingIsStillConnected in interface BlockingCredentialProvider

Parameters:

userIdentity - the user previously correctly identified with this credential provider

redirector - The cocoon redirector

Returns:

true if this CredentialProvider was in a valid state, false to restart authentication process

Throws:

Exception - If an error occurred

blockingGetUserIdentity

public UserIdentity blockingGetUserIdentity(Redirector redirector)
                                     throws Exception

Description copied from interface: BlockingCredentialProvider

Method called by AuthenticateAction each time a request need authentication.

Specified by:

blockingGetUserIdentity in interface BlockingCredentialProvider

Parameters:

redirector - the cocoon redirector.

Returns:

the UserIdentity corresponding to the user (with or without population specified), or null if user could not get authenticated.

Throws:

Exception - if something wrong occurs

blockingUserNotAllowed

public void blockingUserNotAllowed(Redirector redirector)
                            throws Exception

Description copied from interface: BlockingCredentialProvider

Method called by AuthenticateAction each a user could not get authenticated. This method implementation is responsible of redirecting response to appropriate url.

Specified by:

blockingUserNotAllowed in interface BlockingCredentialProvider

Parameters:

redirector - the cocoon Redirector that can be used for redirecting response.

Throws:

Exception - if something wrong occurs

blockingUserAllowed

public void blockingUserAllowed(UserIdentity userIdentity,
 Redirector redirector)
                         throws Exception

Description copied from interface: BlockingCredentialProvider

Method called by AuthenticateAction after authentication process succeeded

Specified by:

blockingUserAllowed in interface BlockingCredentialProvider

Parameters:

userIdentity - The user correctly connected

redirector - the cocoon Redirector that can be used for redirecting response.

Throws:

Exception - if something wrong occurs

requiresNewWindow

public boolean requiresNewWindow()

Description copied from interface: BlockingCredentialProvider

Does this blocking credential provider requires a new window to process.

Specified by:

requiresNewWindow in interface BlockingCredentialProvider

Returns:

true to ask the client to process this credential provider throught a new window

initUrisScope

protected abstract void initUrisScope()
                               throws AccessDeniedException

Initialize the URIs

Throws:

AccessDeniedException - If an error occurs

signIn

protected void signIn(Redirector redirector,
 URI redirectUri,
 Session session)
               throws ProcessingException,
IOException

Sign the user in by sending an authentication request to the issuer

Parameters:

redirector - The redirector

redirectUri - The redirect URI

session - The current session

Throws:

ProcessingException - If an error occurs

IOException - If an error occurs

checkState

protected void checkState()
                   throws AccessDeniedException

Checks the State parameter of the request to prevent CSRF attacks

Throws:

AccessDeniedException - If an error occurs

requestToken

protected com.nimbusds.openid.connect.sdk.token.OIDCTokens requestToken(com.nimbusds.oauth2.sdk.AuthorizationCode authCode,
 URI redirectUri)
                                                                 throws AccessDeniedException

Request the tokens (ID token and Access token)

Parameters:

authCode - The authorization code from the authentication request

redirectUri - The redirect URI

Returns:

The OIDCTokens that contains the access token and the id token

Throws:

AccessDeniedException - If an error occurs

requestToken

protected com.nimbusds.openid.connect.sdk.token.OIDCTokens requestToken(com.nimbusds.oauth2.sdk.auth.ClientAuthentication clientAuth,
 com.nimbusds.oauth2.sdk.AuthorizationGrant refreshTokenGrant)
                                                                 throws AccessDeniedException,
URISyntaxException

Request the tokens using a refresh token

Parameters:

clientAuth - The client authentication

refreshTokenGrant - The refreshtokenGrant

Returns:

The OIDCTokens that contains the access token and the id token

Throws:

AccessDeniedException - If an error occurs

URISyntaxException - If an error occurs

validateIdToken

protected com.nimbusds.openid.connect.sdk.claims.IDTokenClaimsSet validateIdToken(com.nimbusds.jwt.JWT idToken)
                                                                           throws AccessDeniedException

Validate the id token from the token request

Parameters:

idToken - The id token from the token request

Returns:

The IDTokenClaimsSet that contains information on the connection such as the expiration time

Throws:

AccessDeniedException - If an error occurs

getUserInfo

protected com.nimbusds.openid.connect.sdk.claims.UserInfo getUserInfo(com.nimbusds.oauth2.sdk.token.AccessToken accessToken)
                                                               throws IOException,
com.nimbusds.oauth2.sdk.ParseException

Request the userInfo using the user info end point and an access token

Parameters:

accessToken - the access token to retrieve the user info

Returns:

a representation of the user info from the scope requested with the token

Throws:

IOException - if an error occurred while contacting the end point

com.nimbusds.oauth2.sdk.ParseException - if an error occurred while parsing the end point answer

getUserIdentity

protected UserIdentity getUserIdentity(com.nimbusds.openid.connect.sdk.claims.UserInfo userInfo,
 Request request,
 Redirector redirector)
                                throws NotUniqueUserException

Compute a user identity based on the user info

Parameters:

userInfo - the user info

request - the original request

redirector - the redirector to use if need be

Returns:

the identified user info or null if no matching user were found

Throws:

NotUniqueUserException - if multiple user matched