RefreshTokenCreator { public CompositeExpiringOAuth2RefreshToken createRefreshToken(UaaUser user, RefreshTokenRequestData tokenRequestData, String revocableHashSignature) { String grantType = tokenRequestData.grantType; Set<String> scope = tokenRequestData.scopes; if (!isRefreshTokenSupported(grantType, scope)) { return null; } Map<String, String> additionalAuthorizationAttributes = new AuthorizationAttributesParser().getAdditionalAuthorizationAttributes(tokenRequestData.authorities); Date expirationDate = refreshTokenValidityResolver.resolve(tokenRequestData.clientId); String tokenId = UUID.randomUUID().toString().replace("-", "") + REFRESH_TOKEN_SUFFIX; String jwtToken = buildJwtToken(user, tokenRequestData, revocableHashSignature, grantType, additionalAuthorizationAttributes, expirationDate, tokenId); return new CompositeExpiringOAuth2RefreshToken(jwtToken, expirationDate, tokenId); } RefreshTokenCreator(boolean isRestrictRefreshGrant,
                               TokenValidityResolver refreshTokenValidityResolver,
                               TokenEndpointBuilder tokenEndpointBuilder,
                               TimeService timeService,
                               KeyInfoService keyInfoService); CompositeExpiringOAuth2RefreshToken createRefreshToken(UaaUser user,
                                                         RefreshTokenRequestData tokenRequestData,
                                                         String revocableHashSignature); void ensureRefreshTokenCreationNotRestricted(ArrayList<String> tokenScopes); void setRestrictRefreshGrant(boolean isRestrictRefreshGrant); void setTimeService(TimeService timeService);  }
@Test public void refreshToken_includesClaimsNeededToBuildIdTokens() { UaaUser user = new UaaUser(new UaaUserPrototype() .withId("id") .withEmail("spongebob@krustykrab.com") .withUsername("spongebob") .withOrigin("uaa") ); Date authTime = new Date(1000L); HashSet<String> authenticationMethods = Sets.newHashSet("pwd"); RefreshTokenRequestData refreshTokenRequestData = new RefreshTokenRequestData( "refresh_token", Sets.newHashSet(), authenticationMethods, null, Sets.newHashSet(), "someclient", false, authTime, Sets.newHashSet("urn:oasis:names:tc:SAML:2.0:ac:classes:Password"), Maps.newHashMap()); ExpiringOAuth2RefreshToken refreshToken = refreshTokenCreator.createRefreshToken(user, refreshTokenRequestData, "abcdef"); Map<String, Object> refreshClaims = UaaTokenUtils.getClaims(refreshToken.getValue()); assertThat(refreshClaims.get(AUTH_TIME), is(1)); assertThat((List<String>) refreshClaims.get(AMR), hasItem("pwd")); assertThat((Map<String, List<String>>) refreshClaims.get(ACR), hasKey("values")); assertThat(((Map<String, List<String>>) refreshClaims.get(ACR)).get("values"), hasItem("urn:oasis:names:tc:SAML:2.0:ac:classes:Password")); }
@Test public void refreshToken_ifIdTokenClaimsAreUnknown_omitsThem() { UaaUser user = new UaaUser(new UaaUserPrototype() .withId("id") .withEmail("spongebob@krustykrab.com") .withUsername("spongebob") .withOrigin("uaa") ); Date authTime = null; HashSet<String> authenticationMethods = Sets.newHashSet(); RefreshTokenRequestData refreshTokenRequestData = new RefreshTokenRequestData( "refresh_token", Sets.newHashSet(), authenticationMethods, null, Sets.newHashSet(), "someclient", false, authTime, Sets.newHashSet(), Maps.newHashMap()); ExpiringOAuth2RefreshToken refreshToken = refreshTokenCreator.createRefreshToken(user, refreshTokenRequestData, "abcdef"); Map<String, Object> refreshClaims = UaaTokenUtils.getClaims(refreshToken.getValue()); assertFalse(refreshClaims.containsKey(AUTH_TIME)); assertFalse(refreshClaims.containsKey(AMR)); assertFalse(refreshClaims.containsKey(ACR)); }