UaaAuthorizationEndpoint extends AbstractEndpoint implements AuthenticationEntryPoint { public String buildRedirectURI(AuthorizationRequest authorizationRequest, OAuth2AccessToken accessToken, Authentication authUser) { String requestedRedirect = authorizationRequest.getRedirectUri(); if (accessToken == null) { throw new InvalidRequestException("An implicit grant could not be made"); } StringBuilder url = new StringBuilder(); url.append("token_type=").append(encode(accessToken.getTokenType())); if (authorizationRequest.getResponseTypes().contains("token")) { url.append("&access_token=").append(encode(accessToken.getValue())); } if (accessToken instanceof CompositeToken && authorizationRequest.getResponseTypes().contains(CompositeToken.ID_TOKEN)) { url.append("&").append(CompositeToken.ID_TOKEN).append("=").append(encode(((CompositeToken) accessToken).getIdTokenValue())); } if (authorizationRequest.getResponseTypes().contains("code")) { String code = generateCode(authorizationRequest, authUser); url.append("&code=").append(encode(code)); } String state = authorizationRequest.getState(); if (state != null) { url.append("&state=").append(encode(state)); } Date expiration = accessToken.getExpiration(); if (expiration != null) { long expires_in = (expiration.getTime() - System.currentTimeMillis()) / 1000; url.append("&expires_in=").append(expires_in); } String originalScope = authorizationRequest.getRequestParameters().get(OAuth2Utils.SCOPE); if (originalScope == null || !OAuth2Utils.parseParameterList(originalScope).equals(accessToken.getScope())) { url.append("&" + OAuth2Utils.SCOPE + "=").append(encode(OAuth2Utils.formatParameterList(accessToken.getScope()))); } Map<String, Object> additionalInformation = accessToken.getAdditionalInformation(); for (String key : additionalInformation.keySet()) { Object value = additionalInformation.get(key); if (value != null) { url.append("&").append(encode(key)).append("=").append(encode(value.toString())); } } if ("none".equals(authorizationRequest.getRequestParameters().get("prompt"))) { HttpHost httpHost = URIUtils.extractHost(URI.create(requestedRedirect)); String sessionState = openIdSessionStateCalculator.calculate(((UaaPrincipal) authUser.getPrincipal()).getId(), authorizationRequest.getClientId(), httpHost.toURI()); url.append("&session_state=").append(sessionState); } UriComponentsBuilder builder = UriComponentsBuilder.fromUriString(requestedRedirect); String existingFragment = builder.build(true).getFragment(); if (StringUtils.hasText(existingFragment)) { existingFragment = existingFragment + "&" + url.toString(); } else { existingFragment = url.toString(); } builder.fragment(existingFragment); return builder.build(true).toUriString(); } UaaAuthorizationEndpoint(
            final RedirectResolver redirectResolver,
            final @Qualifier("userManagedApprovalHandler") UserApprovalHandler userApprovalHandler,
            final @Qualifier("oauth2RequestValidator") OAuth2RequestValidator oauth2RequestValidator,
            final @Qualifier("authorizationCodeServices") AuthorizationCodeServices authorizationCodeServices,
            final @Qualifier("hybridTokenGranterForAuthCodeGrant") HybridTokenGranterForAuthorizationCode hybridTokenGranterForAuthCode,
            final @Qualifier("openIdSessionStateCalculator") OpenIdSessionStateCalculator openIdSessionStateCalculator,
            final @Qualifier("authorizationRequestManager") OAuth2RequestFactory oAuth2RequestFactory,
            final @Qualifier("jdbcClientDetailsService") MultitenantClientServices clientDetailsService,
            final @Qualifier("oauth2TokenGranter") TokenGranter tokenGranter); @RequestMapping(value = "/oauth/authorize") ModelAndView authorize(Map<String, Object> model,
                                  @RequestParam Map<String, String> parameters,
                                  SessionStatus sessionStatus,
                                  Principal principal,
                                  HttpServletRequest request); @Override void commence(HttpServletRequest request, HttpServletResponse response, AuthenticationException authException); @RequestMapping(value = "/oauth/authorize", method = RequestMethod.POST, params = OAuth2Utils.USER_OAUTH_APPROVAL) View approveOrDeny(@RequestParam Map<String, String> approvalParameters, Map<String, ?> model,
                              SessionStatus sessionStatus, Principal principal); String buildRedirectURI(AuthorizationRequest authorizationRequest,
                                   OAuth2AccessToken accessToken,
                                   Authentication authUser); @SuppressWarnings("deprecation") void setImplicitGrantService(org.springframework.security.oauth2.provider.implicit.ImplicitGrantService implicitGrantService); @ExceptionHandler(ClientRegistrationException.class) ModelAndView handleClientRegistrationException(Exception e, ServletWebRequest webRequest); @ExceptionHandler(OAuth2Exception.class) ModelAndView handleOAuth2Exception(OAuth2Exception e, ServletWebRequest webRequest); @ExceptionHandler(HttpSessionRequiredException.class) ModelAndView handleHttpSessionRequiredException(HttpSessionRequiredException e, ServletWebRequest webRequest); static final String AUTHORIZATION_REQUEST; static final String ORIGINAL_AUTHORIZATION_REQUEST; }
@Test public void testBuildRedirectURI_doesNotIncludeSessionStateWhenNotPromptNone() { AuthorizationRequest authorizationRequest = new AuthorizationRequest(); authorizationRequest.setRedirectUri("http: authorizationRequest.setResponseTypes(new HashSet<String>() { { add("code"); add("token"); add("id_token"); } }); authorizationRequest.setState("California"); CompositeToken accessToken = new CompositeToken("TOKEN_VALUE+="); accessToken.setIdTokenValue("idTokenValue"); UaaPrincipal principal = new UaaPrincipal("userid", "username", "email", "origin", "extid", "zoneid"); UaaAuthenticationDetails details = new UaaAuthenticationDetails(true, "clientid", "origin", "SOMESESSIONID"); Authentication authUser = new UaaAuthentication(principal, Collections.emptyList(), details); accessToken.setExpiration(Calendar.getInstance().getTime()); OAuth2Request storedOAuth2Request = mock(OAuth2Request.class); when(oAuth2RequestFactory.createOAuth2Request(any())).thenReturn(storedOAuth2Request); when(authorizationCodeServices.createAuthorizationCode(any())).thenReturn("ABCD"); String result = uaaAuthorizationEndpoint.buildRedirectURI(authorizationRequest, accessToken, authUser); assertThat(result, containsString("http: assertThat(result, containsString("token_type=bearer")); assertThat(result, containsString("access_token=TOKEN_VALUE+%3D")); assertThat(result, containsString("id_token=idTokenValue")); assertThat(result, containsString("code=ABCD")); assertThat(result, containsString("state=California")); assertThat(result, containsString("expires_in=")); assertThat(result, containsString("scope=null")); }
@Test public void buildRedirectURI_includesSessionStateForPromptEqualsNone() { AuthorizationRequest authorizationRequest = new AuthorizationRequest(); authorizationRequest.setRedirectUri("http: authorizationRequest.setRequestParameters(new HashMap<String, String>() { { put("prompt", "none"); } }); CompositeToken accessToken = new CompositeToken("TOKEN_VALUE+="); UaaPrincipal principal = new UaaPrincipal("userid", "username", "email", "origin", "extid", "zoneid"); UaaAuthenticationDetails details = new UaaAuthenticationDetails(true, "clientid", "origin", "SOMESESSIONID"); Authentication authUser = new UaaAuthentication(principal, Collections.emptyList(), details); when(authorizationCodeServices.createAuthorizationCode(any())).thenReturn("ABCD"); String result = uaaAuthorizationEndpoint.buildRedirectURI(authorizationRequest, accessToken, authUser); assertThat(result, containsString("session_state=opbshash")); }