Package org.oa4mp.server.proxy

Class RFC8628AuthenticationServer

java.lang.Object

javax.servlet.GenericServlet

javax.servlet.http.HttpServlet

edu.uiuc.ncsa.security.servlet.AbstractServlet

org.oa4mp.server.api.storage.servlet.EnvServlet

org.oa4mp.server.proxy.RFC8628AuthenticationServer

All Implemented Interfaces:

edu.uiuc.ncsa.security.core.Logable, Serializable, javax.servlet.Servlet, javax.servlet.ServletConfig

public class RFC8628AuthenticationServer
extends EnvServlet

This does the authentication for the device flow.

Created by Jeff Gaynor
on 2/12/21 at 6:19 AM

See Also:

Serialized Form

Nested Class Summary

Nested Classes

Modifier and Type	Class	Description
static class	RFC8628AuthenticationServer.PendingState	A class that is used by the authorization server to track user retries.
static class	RFC8628AuthenticationServer.TooManyRetriesException
static class	RFC8628AuthenticationServer.UnknownUserCodeException

Field Summary

Fields

Modifier and Type	Field	Description
static String	CONSENT_PAGE
protected boolean	DEBUG_LOGIN
static String	USER_CODE_KEY

Fields inherited from class org.oa4mp.server.api.storage.servlet.EnvServlet

ERROR_NOTIFICATION_BODY_KEY, ERROR_NOTIFICATION_SUBJECT_KEY, notificationListeners, storeUpdatesDone

Fields inherited from class edu.uiuc.ncsa.security.servlet.AbstractServlet

environment, initialization, IP_HEADERS, PING_PARAMETER

Constructor Summary

Constructors

Constructor	Description
RFC8628AuthenticationServer()

Method Summary

Modifier and Type	Method	Description
void	checkUser(String username, String password)
protected void	cleanupPending()
void	debugCheckUser(String username, String password)
protected void	doIt(javax.servlet.http.HttpServletRequest request, javax.servlet.http.HttpServletResponse response)
protected String	getConsentPage()
protected String	getFailPage()
protected String	getInitialPage()
protected String	getOkPage()
protected String	getRemoteUserInitialPage()
protected OA2SE	getServiceEnvironment()
void	postprocess(RFC8628AuthenticationServer.PendingState pendingState)
void	prepare(edu.uiuc.ncsa.security.servlet.PresentableState state)
void	present(edu.uiuc.ncsa.security.servlet.PresentableState state)
protected void	processRequest(javax.servlet.http.HttpServletRequest request, RFC8628AuthenticationServer.PendingState pendingState, boolean checkCount)	This is where the user's log in is actually processed and the values they sent are checked.
protected void	setClientConsentAttributes(javax.servlet.http.HttpServletRequest request, OA2ServiceTransaction t)
protected String	setClientConsentAttributes(OA2ServiceTransaction t, RFC8628AuthenticationServer.PendingState pendingState, String contextPath)	Set the attributes for the consent page.
protected void	setClientRequestAttributes(RFC8628AuthenticationServer.PendingState pendingState)
void	storeUpdates()	This will be invoked at init before anything else and should include code to seamlessly upgrade stores from earlier versions.

Methods inherited from class org.oa4mp.server.api.storage.servlet.EnvServlet

addNotificationListener, checkCancel, checkCancel, isCancelled, loadEnvironment, loadProperties2, processStoreCheck, removeNotificationListener

Methods inherited from class edu.uiuc.ncsa.security.servlet.AbstractServlet

checkContentType, CONST, debug, doGet, doPing, doPost, error, error, getConfigurationLoader, getEnvironment, getExceptionHandler, getInitialization, getMyLogger, getRequestIPAddress, handleException, info, init, isDebugOn, logOK, logOK, printAllParameters, printAllParameters, resetState, setConfigurationLoader, setDebugOn, setEnvironment, setExceptionHandler, setInitialization, warn

Methods inherited from class javax.servlet.http.HttpServlet

doDelete, doHead, doOptions, doPut, doTrace, getLastModified, service, service

Methods inherited from class javax.servlet.GenericServlet

destroy, getInitParameter, getInitParameterNames, getServletConfig, getServletContext, getServletInfo, getServletName, init, log, log

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Field Detail

USER_CODE_KEY

public static final String USER_CODE_KEY

See Also:

Constant Field Values

DEBUG_LOGIN

protected boolean DEBUG_LOGIN

CONSENT_PAGE

public static String CONSENT_PAGE

Constructor Detail

RFC8628AuthenticationServer

public RFC8628AuthenticationServer()

Method Detail

getInitialPage

protected String getInitialPage()

getRemoteUserInitialPage

protected String getRemoteUserInitialPage()

getOkPage

protected String getOkPage()

getFailPage

protected String getFailPage()

storeUpdates

public void storeUpdates()
                  throws IOException,
                         SQLException

Description copied from class: EnvServlet

This will be invoked at init before anything else and should include code to seamlessly upgrade stores from earlier versions. For instance, if a new column needs to be added to a table. This pre-supposes that the current user has the correct permissions to alter the table, btw. This also updates the internal flag EnvServlet.storeUpdatesDone which should be checks in overrides. If you override this method and call super, let super manage this flag. If it is true, do not execute your method.

Specified by:

storeUpdates in class EnvServlet

Throws:

IOException

SQLException

getServiceEnvironment

protected OA2SE getServiceEnvironment()

prepare

public void prepare(edu.uiuc.ncsa.security.servlet.PresentableState state)
             throws Throwable

Throws:

Throwable

setClientRequestAttributes

protected void setClientRequestAttributes(RFC8628AuthenticationServer.PendingState pendingState)

postprocess

public void postprocess(RFC8628AuthenticationServer.PendingState pendingState)
                 throws Throwable

Throws:

Throwable

doIt

protected void doIt(javax.servlet.http.HttpServletRequest request,
                    javax.servlet.http.HttpServletResponse response)
             throws Throwable

Specified by:

doIt in class edu.uiuc.ncsa.security.servlet.AbstractServlet

Throws:

Throwable

setClientConsentAttributes

protected String setClientConsentAttributes(OA2ServiceTransaction t,
                                            RFC8628AuthenticationServer.PendingState pendingState,
                                            String contextPath)

Set the attributes for the consent page. In this case, the pending state ID is set as the base 64 proxy_hash.

Parameters:

t -

pendingState -

contextPath -

Returns:

processRequest

protected void processRequest(javax.servlet.http.HttpServletRequest request,
                              RFC8628AuthenticationServer.PendingState pendingState,
                              boolean checkCount)
                       throws Throwable

This is where the user's log in is actually processed and the values they sent are checked. It then forwards the user browser to the consent page, so if you do anything with the servlet request, you will get an error since it has been committed.

Parameters:

request -

pendingState -

checkCount -

Throws:

Throwable

debugCheckUser

public void debugCheckUser(String username,
                           String password)
                    throws GeneralSecurityException

Throws:

GeneralSecurityException

checkUser

public void checkUser(String username,
                      String password)
               throws GeneralSecurityException

Throws:

GeneralSecurityException

present

public void present(edu.uiuc.ncsa.security.servlet.PresentableState state)
             throws Throwable

Throws:

Throwable

cleanupPending

protected void cleanupPending()

setClientConsentAttributes

protected void setClientConsentAttributes(javax.servlet.http.HttpServletRequest request,
                                          OA2ServiceTransaction t)

getConsentPage

protected String getConsentPage()