Package org.oa4mp.server.loader.oauth2.claims

Class AbstractAccessTokenHandler

java.lang.Object

org.oa4mp.server.loader.oauth2.claims.AbstractPayloadHandler

org.oa4mp.server.loader.oauth2.claims.AbstractAccessTokenHandler

All Implemented Interfaces:

Serializable, AccessTokenHandlerInterface, IDTokenHandlerInterface, PayloadHandler, OA2Scopes

Direct Known Subclasses:

DefaultAccessTokenHandler, RFC9068ATHandler, ScitokenHandler, WLCGTokenHandler

public class AbstractAccessTokenHandler
extends AbstractPayloadHandler
implements AccessTokenHandlerInterface, IDTokenHandlerInterface

Only create an access token handler if you need some special handling, otherwise the default simple token will be used.

Created by Jeff Gaynor
on 7/21/20 at 2:50 PM

See Also:

Serialized Form

Nested Class Summary

Nested classes/interfaces inherited from interface org.oa4mp.delegation.server.OA2Scopes

OA2Scopes.ScopeUtil

Field Summary

Fields

Modifier and Type	Field	Description
static String	AT_BASIC_HANDLER_TYPE
static String	AT_DEFAULT_HANDLER_TYPE

Fields inherited from class org.oa4mp.server.loader.oauth2.claims.AbstractPayloadHandler

client, oa2se, payload, request, transaction

Fields inherited from interface org.oa4mp.delegation.server.OA2Scopes

basicScopes, EDU_PERSON_ORC_ID, nonPublicScopes, SCOPE_ADDRESS, SCOPE_CILOGON_INFO, SCOPE_EMAIL, SCOPE_MYPROXY, SCOPE_OFFLINE_ACCESS, SCOPE_OPENID, SCOPE_PHONE, SCOPE_PROFILE, SCOPE_TOKEN_MANAGER, SCOPE_USER_INFO

Constructor Summary

Constructors

Constructor	Description
AbstractAccessTokenHandler(PayloadHandlerConfigImpl payloadHandlerConfig)

Method Summary

Modifier and Type	Method	Description
void	addRequestState(edu.uiuc.ncsa.security.util.scripting.ScriptRunRequest req)	Marshall any resources this script needs to make a request.
void	checkClaims()	Called after the runner has gotten the claims so that this class can check integrity.
void	finish(boolean doTemplates, boolean isQuery)
void	finish(String execPhase)	Called at the very end of all processing, this lets the handler, clean up or whatever it needs to do.
AccessToken	getAccessToken()	The actual simple access token (usually used as the identifier for the claims-based AT.
protected AccessTokenConfig	getATConfig()	Convenience to peel off the AccessTokenConfig from the handler config and return it.
net.sf.json.JSONObject	getPayload()	The underlying JSONObject that contains the claims that go in to this access token.
AccessTokenImpl	getSignedPayload(edu.uiuc.ncsa.security.util.jwk.JSONWebKey key)
AccessTokenImpl	getSignedPayload(edu.uiuc.ncsa.security.util.jwk.JSONWebKey key, String headerType)	Take the payload of this and sign it with the given key, using the header as needed.
List<ClaimSource>	getSources()	These are the sources that the runner will use to populate the claims
net.sf.json.JSONObject	getUserMetaData()	generally for this class you will need to inject the user meta data.
void	handleResponse(edu.uiuc.ncsa.security.util.scripting.ScriptRunResponse resp)	This takes the response from a script and unmarshalls the resources
void	init()	Creates and initializes the claims object this class manages.
void	refreshAccountingInformation()	This is used on refresh only.
String	resolveTemplates(boolean isQuery)	Templates are of the format
void	saveState(String execPhase)	Called at the end of each block, this lets the handler save its state.
void	setAccessToken(AccessToken accessToken)
void	setAccountingInformation()	This sets the accounting information (such as the expiration and such) for a token.
void	setUserMetaData(net.sf.json.JSONObject userMetaData)

Methods inherited from class org.oa4mp.server.loader.oauth2.claims.AbstractPayloadHandler

doServerVariables, doSubstitution, execute, getExtendedAttributes, getPhCfg, getResponseCode, getTXRecord, hasScript, hasTXRecord, isEmpty, listToString, refresh, setExtendedAttributes, setPayload, setPhCfg, setResponseCode

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Methods inherited from interface org.oa4mp.delegation.server.jwt.PayloadHandler

execute, getExtendedAttributes, getPhCfg, getResponseCode, hasScript, refresh, setPayload, setPhCfg, setResponseCode

Field Detail

AT_DEFAULT_HANDLER_TYPE

public static final String AT_DEFAULT_HANDLER_TYPE

See Also:

Constant Field Values

AT_BASIC_HANDLER_TYPE

public static final String AT_BASIC_HANDLER_TYPE

See Also:

Constant Field Values

Constructor Detail

AbstractAccessTokenHandler

public AbstractAccessTokenHandler(PayloadHandlerConfigImpl payloadHandlerConfig)

Method Detail

getPayload

public net.sf.json.JSONObject getPayload()

The underlying JSONObject that contains the claims that go in to this access token. Note that the getUserMetaData() call will retrieve the user metadata and is not the same as the access token contents!

Specified by:

getPayload in interface AccessTokenHandlerInterface

Specified by:

getPayload in interface PayloadHandler

Returns:

getUserMetaData

public net.sf.json.JSONObject getUserMetaData()

generally for this class you will need to inject the user meta data.

Specified by:

getUserMetaData in interface AccessTokenHandlerInterface

Specified by:

getUserMetaData in interface IDTokenHandlerInterface

Returns:

setUserMetaData

public void setUserMetaData(net.sf.json.JSONObject userMetaData)

Specified by:

setUserMetaData in interface IDTokenHandlerInterface

init

public void init()
          throws Throwable

Description copied from interface: PayloadHandler

Creates and initializes the claims object this class manages.

Specified by:

init in interface PayloadHandler

Throws:

Throwable

addRequestState

public void addRequestState(edu.uiuc.ncsa.security.util.scripting.ScriptRunRequest req)
                     throws Throwable

Description copied from interface: PayloadHandler

Marshall any resources this script needs to make a request. I.e., add specific state (if needed) from this handler to the ScriptRunRequest.

Specified by:

addRequestState in interface PayloadHandler

Throws:

Throwable

handleResponse

public void handleResponse(edu.uiuc.ncsa.security.util.scripting.ScriptRunResponse resp)
                    throws Throwable

Description copied from interface: PayloadHandler

This takes the response from a script and unmarshalls the resources

Specified by:

handleResponse in interface PayloadHandler

Overrides:

handleResponse in class AbstractPayloadHandler

Throws:

Throwable

checkClaims

public void checkClaims()
                 throws Throwable

Description copied from interface: PayloadHandler

Called after the runner has gotten the claims so that this class can check integrity. For instance, an OIDC server would need to see that the subject is set properly. SciTokens needs to check that its scopes (aka resource permissions) were set

Specified by:

checkClaims in interface PayloadHandler

Throws:

Throwable

resolveTemplates

public String resolveTemplates(boolean isQuery)

Templates are of the format

     [{"aud":audience,
     [{"op":X0, "path":P0},
      {"op":X1, "path":P1},...}]
     ]
 

getATConfig

protected AccessTokenConfig getATConfig()

Convenience to peel off the AccessTokenConfig from the handler config and return it.

Returns:

getSources

public List<ClaimSource> getSources()
                             throws Throwable

Description copied from interface: PayloadHandler

These are the sources that the runner will use to populate the claims

Specified by:

getSources in interface PayloadHandler

Returns:

Throws:

Throwable

finish

public void finish(boolean doTemplates,
                   boolean isQuery)
            throws Throwable

Throws:

Throwable

finish

public void finish(String execPhase)
            throws Throwable

Description copied from interface: PayloadHandler

Called at the very end of all processing, this lets the handler, clean up or whatever it needs to do. It is called before PayloadHandler.saveState(String) ()}.

Specified by:

finish in interface PayloadHandler

Parameters:

execPhase - - the current execution phase.

Throws:

Throwable

getSignedPayload

public AccessTokenImpl getSignedPayload(edu.uiuc.ncsa.security.util.jwk.JSONWebKey key)

Specified by:

getSignedPayload in interface PayloadHandler

getSignedPayload

public AccessTokenImpl getSignedPayload(edu.uiuc.ncsa.security.util.jwk.JSONWebKey key,
                                        String headerType)

Description copied from interface: PayloadHandler

Take the payload of this and sign it with the given key, using the header as needed.

Specified by:

getSignedPayload in interface PayloadHandler

Returns:

saveState

public void saveState(String execPhase)
               throws Throwable

Description copied from interface: PayloadHandler

Called at the end of each block, this lets the handler save its state. Note that for OA4MP, the state is saved in the transaction which is saved once after the handlers run. Only put actual save code in here if needed, since it is apt to get called a lot.

Specified by:

saveState in interface PayloadHandler

Overrides:

saveState in class AbstractPayloadHandler

Throws:

Throwable

setAccountingInformation

public void setAccountingInformation()

Description copied from interface: PayloadHandler

This sets the accounting information (such as the expiration and such) for a token. This is called when a token is created or refreshed.

Specified by:

setAccountingInformation in interface PayloadHandler

refreshAccountingInformation

public void refreshAccountingInformation()

Description copied from interface: PayloadHandler

This is used on refresh only. It will reset all the standard accounting information (such as timestamps) for an existing claims object.

Usage

Create an instance of the handler with the constructor for any state, then invoke this method.

Specified by:

refreshAccountingInformation in interface PayloadHandler

getAccessToken

public AccessToken getAccessToken()

Description copied from interface: AccessTokenHandlerInterface

The actual simple access token (usually used as the identifier for the claims-based AT. To get the signed claims, invoke PayloadHandler.getSignedPayload(JSONWebKey, String) (JSONWebKey)}.

Specified by:

getAccessToken in interface AccessTokenHandlerInterface

Returns:

setAccessToken

public void setAccessToken(AccessToken accessToken)

Specified by:

setAccessToken in interface AccessTokenHandlerInterface