net.krotscheck.kangaroo.authz.oauth2.resource.IntrospectionResponseEntity Maven / Gradle / Ivy
Go to download
Show more of this group Show more artifacts with this name
Show all versions of kangaroo-server-authz Show documentation
Show all versions of kangaroo-server-authz Show documentation
Kangaroo's Administration API.
/*
* Copyright (c) 2017 Michael Krotscheck
*
* Licensed under the Apache License, Version 2.0 (the "License"); you may not
* use this file except in compliance with the License. You may obtain a copy
* of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
* WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
*
* See the License for the specific language governing permissions and
* limitations under the License.
*
*/
package net.krotscheck.kangaroo.authz.oauth2.resource;
import com.fasterxml.jackson.annotation.JsonInclude;
import com.fasterxml.jackson.annotation.JsonInclude.Include;
import com.fasterxml.jackson.annotation.JsonProperty;
import net.krotscheck.kangaroo.authz.common.database.entity.OAuthToken;
import net.krotscheck.kangaroo.authz.common.database.entity.OAuthTokenType;
import java.math.BigInteger;
import java.util.Calendar;
import java.util.stream.Collectors;
/**
* A POJO that represents the response from the introspection endpoint.
*
* @author Michael Krotscheck
*/
@JsonInclude(Include.NON_NULL)
public final class IntrospectionResponseEntity {
/**
* REQUIRED. Boolean indicator of whether or not the presented token
* is currently active. The specifics of a token's "active" state
* will vary depending on the implementation of the authorization
* server and the information it keeps about its tokens, but a "true"
* value return for the "active" property will generally indicate
* that a given token has been issued by this authorization server,
* has not been revoked by the resource owner, and is within its
* given time window of validity (e.g., after its issuance time and
* before its expiration time). See Section 4 for information on
* implementation of such checks.
*/
private boolean active = false;
/**
* OPTIONAL. A JSON string containing a space-separated list of
* scopes associated with this token, in the format described in
* Section 3.3 of OAuth 2.0 [RFC6749].
*/
private String scope;
/**
* OPTIONAL. Client identifier for the OAuth 2.0 client that
* requested this token.
*/
@JsonProperty("client_id")
private BigInteger clientId;
/**
* OPTIONAL. Human-readable identifier for the resource owner who
* authorized this token.
*/
private String username;
/**
* OPTIONAL. Type of the token as defined in Section 5.1 of OAuth
* 2.0 [RFC6749].
*/
@JsonProperty("token_type")
private OAuthTokenType tokenType;
/**
* OPTIONAL. Integer timestamp, measured in the number of seconds
* since January 1 1970 UTC, indicating when this token will expire,
* as defined in JWT [RFC7519].
*/
private Calendar exp;
/**
* OPTIONAL. Integer timestamp, measured in the number of seconds
* since January 1 1970 UTC, indicating when this token was
* originally issued, as defined in JWT [RFC7519].
*/
private Calendar iat;
/**
* OPTIONAL. Integer timestamp, measured in the number of seconds
* since January 1 1970 UTC, indicating when this token is not to be
* used before, as defined in JWT [RFC7519].
*/
private Calendar nbf;
/**
* OPTIONAL. Subject of the token, as defined in JWT [RFC7519].
* Usually a machine-readable identifier of the resource owner who
* authorized this token.
*/
private BigInteger sub;
/**
* OPTIONAL. Service-specific string identifier or list of string
* identifiers representing the intended audience for this token, as
* defined in JWT [RFC7519].
*/
private BigInteger aud;
/**
* OPTIONAL. String representing the issuer of this token, as
* defined in JWT [RFC7519].
*/
private String iss;
/**
* OPTIONAL. String identifier for the token, as defined in JWT
* [RFC7519].
*/
private BigInteger jti;
/**
* Create a new IntrospectionResponseEntity from a token.
*
* @param token The token.
*/
public IntrospectionResponseEntity(final OAuthToken token) {
this.active = token != null && !token.isExpired();
// If the token is not active, return now- no additional data may be
// sent.
if (!this.active) {
return;
}
this.tokenType = token.getTokenType();
this.clientId = token.getClient().getId();
this.aud = token.getClient().getApplication().getId();
this.jti = token.getId();
if (token.getIdentity() != null) {
this.username = token.getIdentity().getRemoteId();
this.sub = token.getIdentity().getUser().getId();
} else {
this.sub = token.getClient().getId();
}
Calendar future = (Calendar) token.getCreatedDate().clone();
future.add(Calendar.SECOND, token.getExpiresIn().intValue());
this.exp = future;
this.iat = (Calendar) token.getCreatedDate().clone();
this.nbf = (Calendar) token.getCreatedDate().clone();
this.scope = token.getScopes().keySet()
.stream()
.collect(Collectors.joining(" "));
this.iss = token.getIssuer();
}
/**
* Create a new IntrospectionResponseEntity with default values
* (mostly null).
*/
public IntrospectionResponseEntity() {
}
/**
* The current active state of this token.
*
* @return True if it's active, otherwise false.
*/
public boolean isActive() {
return active;
}
/**
* The list of scopes authorized for this token.
*
* @return A space-separated list of scopes.
*/
public String getScope() {
return scope;
}
/**
* The client ID.
*
* @return The client ID.
*/
public BigInteger getClientId() {
return clientId;
}
/**
* The username, if applicable.
*
* @return The username.
*/
public String getUsername() {
return username;
}
/**
* Return the token type.
*
* @return The token type.
*/
public OAuthTokenType getTokenType() {
return tokenType;
}
/**
* The expiration timestamp.
*
* @return The time when this token expires.
*/
public Calendar getExp() {
return exp;
}
/**
* Issued At timestamp.
*
* @return The date this token was issued.
*/
public Calendar getIat() {
return iat;
}
/**
* Not-Before timestamp.
*
* @return The time _before which_ this token may not be used.
*/
public Calendar getNbf() {
return nbf;
}
/**
* The token subject, usually the resource owner.
*
* @return The ID of the resource owner.
*/
public BigInteger getSub() {
return sub;
}
/**
* Intended audience, in our case the Client ID.
*
* @return The client ID.
*/
public BigInteger getAud() {
return aud;
}
/**
* The issuer, as in the entity that issued this token.
*
* @return The URL of this kangaroo server.
*/
public String getIss() {
return iss;
}
/**
* The token ID.
*
* @return String identifier for the token (the ID).
*/
public BigInteger getJti() {
return jti;
}
}