/**
* Generate a preapproved request token for the specified user data.
*
* @param userData
* @return the request token and secret
*/
public TokenPair getPreapprovedToken(String userData) {
String requestToken = Crypto.getRandomString(16);
String requestTokenSecret = Crypto.getRandomString(16);
TokenState state = new TokenState(requestTokenSecret, oauthConsumer, null);
state.approveToken();
state.setUserData(userData);
tokenState.put(requestToken, state);
return new TokenPair(requestToken, requestTokenSecret);
}
/**
* Used to fake a browser visit to approve a token.
*
* @return a redirect URL, which may or may not include an oauth verifier
*/
public String browserVisit(String url) throws Exception {
ParsedUrl parsed = new ParsedUrl(url);
String requestToken = parsed.getQueryParam("oauth_token");
TokenState state = tokenState.get(requestToken);
state.approveToken();
// Not part of the OAuth spec, just a handy thing for testing.
state.setUserData(parsed.getQueryParam("user_data"));
if (state.callbackUrl != null) {
UriBuilder callback = UriBuilder.parse(state.callbackUrl);
callback.addQueryParameter(OAuthConstants.OAUTH_VERIFIER, state.verifier);
return callback.toString();
}
return null;
}
private HttpResponse handleResourceUrl(HttpRequest request) throws Exception {
MessageInfo info = parseMessage(request);
String consumerId = info.message.getParameter("oauth_consumer_key");
OAuthConsumer consumer;
if (CONSUMER_KEY.equals(consumerId)) {
consumer = oauthConsumer;
} else if ("signedfetch".equals(consumerId)) {
consumer = signedFetchConsumer;
} else if ("container.com".equals(consumerId)) {
consumer = signedFetchConsumer;
} else {
return makeOAuthProblemReport(
OAuthConstants.PROBLEM_PARAMETER_MISSING,
"oauth_consumer_key not found",
HttpResponse.SC_BAD_REQUEST);
}
OAuthAccessor accessor = new OAuthAccessor(consumer);
String responseBody = null;
if (throttled) {
return makeOAuthProblemReport(
OAuthConstants.PROBLEM_CONSUMER_KEY_REFUSED, "exceeded quota", HttpResponse.SC_FORBIDDEN);
}
if (unauthorized) {
return makeOAuthProblemReport(
OAuthConstants.PROBLEM_PERMISSION_DENIED,
"user refused access",
HttpResponse.SC_UNAUTHORIZED);
}
if (consumer == oauthConsumer) {
// for OAuth, check the access token. We skip this for signed fetch
String accessToken = info.message.getParameter("oauth_token");
TokenState state = tokenState.get(accessToken);
if (state == null) {
return makeOAuthProblemReport(
OAuthConstants.PROBLEM_TOKEN_REJECTED,
"Access token unknown",
HttpResponse.SC_UNAUTHORIZED);
}
// Check the signature
accessor.accessToken = accessToken;
accessor.tokenSecret = state.getSecret();
validateMessage(accessor, info, false);
if (state.getState() != State.APPROVED) {
return makeOAuthProblemReport(
OAuthConstants.PROBLEM_TOKEN_REVOKED,
"User revoked permissions",
HttpResponse.SC_UNAUTHORIZED);
}
if (sessionExtension) {
long expiration = state.issued + TOKEN_EXPIRATION_SECONDS * 1000;
if (expiration < clock.currentTimeMillis()) {
return makeOAuthProblemReport(
OAuthConstants.PROBLEM_ACCESS_TOKEN_EXPIRED,
"token needs to be refreshed",
HttpResponse.SC_UNAUTHORIZED);
}
}
responseBody = "User data is " + state.getUserData();
} else {
// Check the signature
validateMessage(accessor, info, false);
// For signed fetch, just echo back the query parameters in the body
responseBody = request.getUri().getQuery();
}
// Send back a response
HttpResponseBuilder resp =
new HttpResponseBuilder()
.setHttpStatusCode(HttpResponse.SC_OK)
.setResponseString(responseBody);
if (info.aznHeader != null) {
resp.setHeader(AUTHZ_ECHO_HEADER, info.aznHeader);
}
if (info.body != null) {
resp.setHeader(BODY_ECHO_HEADER, info.body);
}
if (info.rawBody != null) {
resp.setHeader(RAW_BODY_ECHO_HEADER, new String(Base64.encodeBase64(info.rawBody)));
}
return resp.create();
}
private HttpResponse handleAccessTokenUrl(HttpRequest request) throws Exception {
MessageInfo info = parseMessage(request);
String requestToken = info.message.getParameter("oauth_token");
TokenState state = tokenState.get(requestToken);
if (throttled) {
return makeOAuthProblemReport(
OAuthConstants.PROBLEM_CONSUMER_KEY_REFUSED, "exceeded quota", HttpResponse.SC_FORBIDDEN);
} else if (unauthorized) {
return makeOAuthProblemReport(
OAuthConstants.PROBLEM_PERMISSION_DENIED,
"user refused access",
HttpResponse.SC_UNAUTHORIZED);
} else if (state == null) {
return makeOAuthProblemReport(
OAuthConstants.PROBLEM_TOKEN_REJECTED,
"Unknown request token",
HttpResponse.SC_UNAUTHORIZED);
}
if (rejectExtraParams) {
String extra = hasExtraParams(info.message);
if (extra != null) {
return makeOAuthProblemReport(
OAuthConstants.PROBLEM_PARAMETER_REJECTED, extra, HttpResponse.SC_BAD_REQUEST);
}
}
OAuthAccessor accessor = new OAuthAccessor(oauthConsumer);
accessor.requestToken = requestToken;
accessor.tokenSecret = state.tokenSecret;
validateMessage(accessor, info, true);
if (state.getState() == State.APPROVED_UNCLAIMED) {
String sentVerifier = info.message.getParameter("oauth_verifier");
if (state.verifier != null && !state.verifier.equals(sentVerifier)) {
return makeOAuthProblemReport(
OAuthConstants.PROBLEM_BAD_VERIFIER,
"wrong oauth verifier",
HttpResponse.SC_UNAUTHORIZED);
}
state.claimToken();
} else if (state.getState() == State.APPROVED) {
// Verify can refresh
String sentHandle = info.message.getParameter("oauth_session_handle");
if (sentHandle == null) {
return makeOAuthProblemReport(
OAuthConstants.PROBLEM_PARAMETER_ABSENT,
"no oauth_session_handle",
HttpResponse.SC_BAD_REQUEST);
}
if (!sentHandle.equals(state.sessionHandle)) {
return makeOAuthProblemReport(
OAuthConstants.PROBLEM_TOKEN_INVALID, "token not valid", HttpResponse.SC_UNAUTHORIZED);
}
state.renewToken();
} else if (state.getState() == State.REVOKED) {
return makeOAuthProblemReport(
OAuthConstants.PROBLEM_TOKEN_REVOKED,
"Revoked access token can't be renewed",
HttpResponse.SC_UNAUTHORIZED);
} else {
throw new Exception("Token in weird state " + state.getState());
}
String accessToken = Crypto.getRandomString(16);
String accessTokenSecret = Crypto.getRandomString(16);
state.tokenSecret = accessTokenSecret;
tokenState.put(accessToken, state);
tokenState.remove(requestToken);
List<OAuth.Parameter> params =
OAuth.newList(
"oauth_token", accessToken,
"oauth_token_secret", accessTokenSecret);
if (sessionExtension) {
params.add(new OAuth.Parameter("oauth_session_handle", state.sessionHandle));
if (reportExpirationTimes) {
params.add(new OAuth.Parameter("oauth_expires_in", "" + TOKEN_EXPIRATION_SECONDS));
}
}
if (returnAccessTokenData) {
params.add(new OAuth.Parameter("userid", "userid value"));
params.add(new OAuth.Parameter("xoauth_stuff", "xoauth_stuff value"));
params.add(new OAuth.Parameter("oauth_stuff", "oauth_stuff value"));
}
return new HttpResponse(OAuth.formEncode(params));
}
/** Changes session handles to prevent renewal from working. */
public void changeAllSessionHandles() throws Exception {
for (TokenState state : tokenState.values()) {
state.sessionHandle = null;
}
}
/**
* Used to revoke all access tokens issued by this service provider.
*
* @throws Exception
*/
public void revokeAllAccessTokens() throws Exception {
for (TokenState state : tokenState.values()) {
state.revokeToken();
}
}
