Permalink
Show file tree
Hide file tree
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Browse files
Merge pull request #3 from myrle-krantz/develop
Moving TenantRefreshTokenSerializer from identity into anubis.
- Loading branch information
Showing
10 changed files
with
409 additions
and
26 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| @@ -0,0 +1,168 @@ | ||
| /* | ||
| * Copyright 2017 The Mifos Initiative. | ||
| * | ||
| * Licensed under the Apache License, Version 2.0 (the "License"); | ||
| * you may not use this file except in compliance with the License. | ||
| * You may obtain a copy of the License at | ||
| * | ||
| * http://www.apache.org/licenses/LICENSE-2.0 | ||
| * | ||
| * Unless required by applicable law or agreed to in writing, software | ||
| * distributed under the License is distributed on an "AS IS" BASIS, | ||
| * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. | ||
| * See the License for the specific language governing permissions and | ||
| * limitations under the License. | ||
| */ | ||
| package io.mifos.anubis.token; | ||
|
|
||
| import io.jsonwebtoken.*; | ||
| import io.mifos.anubis.api.v1.TokenConstants; | ||
| import io.mifos.anubis.provider.InvalidKeyTimestampException; | ||
| import io.mifos.anubis.provider.TenantRsaKeyProvider; | ||
| import io.mifos.anubis.security.AmitAuthenticationException; | ||
| import org.springframework.beans.factory.annotation.Autowired; | ||
| import org.springframework.stereotype.Component; | ||
|
|
||
| import javax.annotation.Nonnull; | ||
| import java.security.Key; | ||
| import java.security.PrivateKey; | ||
| import java.util.Date; | ||
| import java.util.Optional; | ||
| import java.util.concurrent.TimeUnit; | ||
|
|
||
| /** | ||
| * @author Myrle Krantz | ||
| */ | ||
| @SuppressWarnings("WeakerAccess") | ||
| @Component | ||
| public class TenantRefreshTokenSerializer { | ||
|
|
||
| final private TenantRsaKeyProvider tenantRsaKeyProvider; | ||
|
|
||
| @SuppressWarnings("SpringJavaAutowiringInspection") | ||
| @Autowired | ||
| TenantRefreshTokenSerializer(final TenantRsaKeyProvider tenantRsaKeyProvider) { | ||
| this.tenantRsaKeyProvider = tenantRsaKeyProvider; | ||
| } | ||
|
|
||
| @SuppressWarnings("WeakerAccess") | ||
| public static class Specification { | ||
| private String keyTimestamp; | ||
| private PrivateKey privateKey; | ||
| private String user; | ||
| private long secondsToLive; | ||
| private String sourceApplication; | ||
|
|
||
| public Specification setKeyTimestamp(final String keyTimestamp) { | ||
| this.keyTimestamp = keyTimestamp; | ||
| return this; | ||
| } | ||
|
|
||
| public Specification setPrivateKey(final PrivateKey privateKey) { | ||
| this.privateKey = privateKey; | ||
| return this; | ||
| } | ||
|
|
||
| public Specification setUser(final String user) { | ||
| this.user = user; | ||
| return this; | ||
| } | ||
|
|
||
| public Specification setSecondsToLive(final long secondsToLive) { | ||
| this.secondsToLive = secondsToLive; | ||
| return this; | ||
| } | ||
|
|
||
| public Specification setSourceApplication(final String sourceApplication) { | ||
| this.sourceApplication = sourceApplication; | ||
| return this; | ||
| } | ||
| } | ||
|
|
||
| public TokenSerializationResult build(final Specification specification) | ||
| { | ||
| final long issued = System.currentTimeMillis(); | ||
|
|
||
| if (specification.keyTimestamp == null) { | ||
| throw new IllegalArgumentException("token signature timestamp must not be null."); | ||
| } | ||
| if (specification.privateKey == null) { | ||
| throw new IllegalArgumentException("token signature privateKey must not be null."); | ||
| } | ||
| if (specification.sourceApplication == null) { | ||
| throw new IllegalArgumentException("token source application must not be null."); | ||
| } | ||
|
|
||
| final JwtBuilder jwtBuilder = | ||
| Jwts.builder() | ||
| .setIssuer(specification.sourceApplication) | ||
| .setSubject(specification.user) | ||
| .claim(TokenConstants.JWT_SIGNATURE_TIMESTAMP_CLAIM, specification.keyTimestamp) | ||
| .setIssuedAt(new Date(issued)) | ||
| .signWith(SignatureAlgorithm.RS512, specification.privateKey); | ||
| if (specification.secondsToLive <= 0) { | ||
| throw new IllegalArgumentException("token secondsToLive must be positive."); | ||
| } | ||
|
|
||
| final Date expiration = new Date(issued + TimeUnit.SECONDS.toMillis(specification.secondsToLive)); | ||
| jwtBuilder.setExpiration(expiration); | ||
|
|
||
| return new TokenSerializationResult(TokenConstants.PREFIX + jwtBuilder.compact(), expiration); | ||
| } | ||
|
|
||
| public TokenDeserializationResult deserialize(final String refreshToken) | ||
| { | ||
| final Optional<String> tokenString = getJwtTokenString(refreshToken); | ||
|
|
||
| final String token = tokenString.orElseThrow(AmitAuthenticationException::invalidToken); | ||
|
|
||
|
|
||
| try { | ||
| final JwtParser parser = Jwts.parser().setSigningKeyResolver(new SigningKeyResolver() { | ||
| @Override public Key resolveSigningKey(final JwsHeader header, final Claims claims) { | ||
| final String keyTimestamp = getKeyTimestampFromClaims(claims); | ||
|
|
||
| try { | ||
| return tenantRsaKeyProvider.getPublicKey(keyTimestamp); | ||
| } | ||
| catch (final IllegalArgumentException e) | ||
| { | ||
| throw AmitAuthenticationException.missingTenant(); | ||
| } | ||
| catch (final InvalidKeyTimestampException e) | ||
| { | ||
| throw AmitAuthenticationException.invalidTokenKeyTimestamp(TokenType.TENANT.getIssuer(), keyTimestamp); | ||
| } | ||
| } | ||
|
|
||
| @Override public Key resolveSigningKey(final JwsHeader header, final String plaintext) { | ||
| return null; | ||
| } | ||
| }); | ||
|
|
||
| @SuppressWarnings("unchecked") Jwt<Header, Claims> jwt = parser.parse(token); | ||
|
|
||
| return new TokenDeserializationResult(jwt.getBody().getSubject(), jwt.getBody().getExpiration(), jwt.getBody().getIssuer()); | ||
| } | ||
| catch (final JwtException e) { | ||
| throw AmitAuthenticationException.invalidToken(); | ||
| } | ||
| } | ||
|
|
||
| private static Optional<String> getJwtTokenString(final String refreshToken) { | ||
| if ((refreshToken == null) || refreshToken.equals( | ||
| TokenConstants.NO_AUTHENTICATION)){ | ||
| return Optional.empty(); | ||
| } | ||
|
|
||
| if (!refreshToken.startsWith(TokenConstants.PREFIX)) { | ||
| throw AmitAuthenticationException.invalidToken(); | ||
| } | ||
| return Optional.of(refreshToken.substring(TokenConstants.PREFIX.length()).trim()); | ||
| } | ||
|
|
||
| private @Nonnull | ||
| String getKeyTimestampFromClaims(final Claims claims) { | ||
| return claims.get(TokenConstants.JWT_SIGNATURE_TIMESTAMP_CLAIM, String.class); | ||
| } | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| @@ -0,0 +1,46 @@ | ||
| /* | ||
| * Copyright 2017 The Mifos Initiative. | ||
| * | ||
| * Licensed under the Apache License, Version 2.0 (the "License"); | ||
| * you may not use this file except in compliance with the License. | ||
| * You may obtain a copy of the License at | ||
| * | ||
| * http://www.apache.org/licenses/LICENSE-2.0 | ||
| * | ||
| * Unless required by applicable law or agreed to in writing, software | ||
| * distributed under the License is distributed on an "AS IS" BASIS, | ||
| * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. | ||
| * See the License for the specific language governing permissions and | ||
| * limitations under the License. | ||
| */ | ||
| package io.mifos.anubis.token; | ||
|
|
||
| import java.util.Date; | ||
|
|
||
| /** | ||
| * @author Myrle Krantz | ||
| */ | ||
| @SuppressWarnings("WeakerAccess") | ||
| public class TokenDeserializationResult { | ||
| final private String userIdentifier; | ||
| final private Date expiration; | ||
| final private String sourceApplication; | ||
|
|
||
| TokenDeserializationResult(final String userIdentifier, final Date expiration, final String sourceApplication) { | ||
| this.userIdentifier = userIdentifier; | ||
| this.expiration = expiration; | ||
| this.sourceApplication = sourceApplication; | ||
| } | ||
|
|
||
| public String getUserIdentifier() { | ||
| return userIdentifier; | ||
| } | ||
|
|
||
| public Date getExpiration() { | ||
| return expiration; | ||
| } | ||
|
|
||
| public String getSourceApplication() { | ||
| return sourceApplication; | ||
| } | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.