AccessTokenRequest { public AccessTokenRequest(final String scope) { final String[] scopeList = scope.split(" "); Set<String> scopeRoleNames = new HashSet<>(); for (String scopeItem : scopeList) { if (OBJECT_OPENID.equalsIgnoreCase(scopeItem)) { openidScope = true; continue; } int idx = scopeItem.indexOf(OBJECT_SERVICE); if (idx != -1) { final String scopeDomainName = scopeItem.substring(0, idx); if (domainName != null && !scopeDomainName.equals(domainName)) { throw error("Multiple domains in scope", scope); } final String scopeServiceName = scopeItem.substring(idx + OBJECT_SERVICE.length()); if (serviceName != null && !scopeServiceName.equals(serviceName)) { throw error("Multiple services in scope", scope); } domainName = scopeDomainName; serviceName = scopeServiceName; continue; } if (scopeItem.endsWith(OBJECT_DOMAIN)) { final String scopeDomainName = scopeItem.substring(0, scopeItem.length() - OBJECT_DOMAIN.length()); if (domainName != null && !scopeDomainName.equals(domainName)) { throw error("Multiple domains in scope", scope); } domainName = scopeDomainName; sendScopeResponse = true; continue; } idx = scopeItem.indexOf(OBJECT_ROLE); if (idx != -1) { final String scopeDomainName = scopeItem.substring(0, idx); if (domainName != null && !scopeDomainName.equals(domainName)) { throw error("Multiple domains in scope", scope); } domainName = scopeDomainName; scopeRoleNames.add(scopeItem.substring(idx + OBJECT_ROLE.length())); continue; } if (LOGGER.isDebugEnabled()) { LOGGER.debug("Skipping unknown scope {}", scopeItem); } } if (domainName == null || domainName.isEmpty()) { throw error("No domains in scope", scope); } if (!sendScopeResponse && !scopeRoleNames.isEmpty()) { roleNames = scopeRoleNames; } if (openidScope && (serviceName == null || serviceName.isEmpty())) { throw error("No audience service name for openid scope", scope); } } AccessTokenRequest(final String scope); String getDomainName(); String getServiceName(); String[] getRoleNames(); boolean sendScopeResponse(); boolean isOpenidScope(); static void setSupportOpenidScope(boolean value); static String OBJECT_DOMAIN; static String OBJECT_ROLE; static String OBJECT_SERVICE; static String OBJECT_OPENID; }
@Test public void testAccessTokenRequest() { AccessTokenRequest req1 = new AccessTokenRequest("sports:domain"); assertNotNull(req1); assertEquals("sports", req1.getDomainName()); assertNull(req1.getRoleNames()); assertTrue(req1.sendScopeResponse()); assertFalse(req1.isOpenidScope()); AccessTokenRequest req2 = new AccessTokenRequest("openid sports:service.api sports:domain"); assertNotNull(req2); assertEquals("sports", req2.getDomainName()); assertNull(req2.getRoleNames()); assertTrue(req2.sendScopeResponse()); assertTrue(req2.isOpenidScope()); AccessTokenRequest req3 = new AccessTokenRequest("openid sports:service.api sports:domain sports:role.role1"); assertNotNull(req3); assertEquals("sports", req3.getDomainName()); assertNull(req3.getRoleNames()); assertTrue(req3.sendScopeResponse()); assertTrue(req3.isOpenidScope()); AccessTokenRequest req4 = new AccessTokenRequest("sports:role.role1"); assertNotNull(req4); assertEquals("sports", req4.getDomainName()); assertNotNull(req4.getRoleNames()); assertEquals(1, req4.getRoleNames().length); assertEquals("role1", req4.getRoleNames()[0]); assertFalse(req4.sendScopeResponse()); assertFalse(req4.isOpenidScope()); AccessTokenRequest req5 = new AccessTokenRequest("sports:role.role1 unknown-scope"); assertNotNull(req5); assertEquals("sports", req5.getDomainName()); assertNotNull(req5.getRoleNames()); assertEquals(1, req5.getRoleNames().length); assertEquals("role1", req5.getRoleNames()[0]); assertFalse(req5.sendScopeResponse()); assertFalse(req5.isOpenidScope()); AccessTokenRequest req6 = new AccessTokenRequest("sports:role.role1 sports:role.role2"); assertNotNull(req6); assertEquals("sports", req6.getDomainName()); assertNotNull(req6.getRoleNames()); assertEquals(2, req6.getRoleNames().length); assertEquals("role1", req6.getRoleNames()[0]); assertEquals("role2", req6.getRoleNames()[1]); assertFalse(req6.sendScopeResponse()); assertFalse(req6.isOpenidScope()); }