@Test(expected = OAuth2NotAuthorizedException.class) public void assertBadlyFormedToken() throws Exception { OAuth2AuthenticationFilter filter = new OAuth2AuthenticationFilter( sessionProvider, configProvider, new String[]{"one"}); doReturn("Bearer not_a_BigInteger").when(requestContext) .getHeaderString(HttpHeaders.AUTHORIZATION); filter.filter(requestContext); }
@Override public void filter(final ContainerRequestContext request) throws IOException { SecurityContext oldContext = request.getSecurityContext(); if (oldContext == null) { throw new OAuth2NotAuthorizedException( request.getUriInfo(), scopesAllowed); } String header = request.getHeaderString(HttpHeaders.AUTHORIZATION); BigInteger tokenId = getTokenIdFromHeader(header); Application a = loadAdminApplication(); Session session = sessionProvider.get(); session.getTransaction().begin(); Criteria c = session.createCriteria(OAuthToken.class) .createAlias("client", "c") .createAlias("c.application", "a") .add(Restrictions.eq("id", tokenId)) .add(Restrictions.eq("a.id", a.getId())) .add(Restrictions.eq("tokenType", OAuthTokenType.Bearer)) .setMaxResults(1) .setResultTransformer(Criteria.DISTINCT_ROOT_ENTITY); OAuthToken token = (OAuthToken) c.uniqueResult(); if (token == null || token.isExpired()) { session.getTransaction().commit(); throw new OAuth2NotAuthorizedException( request.getUriInfo(), scopesAllowed); } SecurityContext context = new OAuth2SecurityContext(token, true); request.setSecurityContext(context); session.getTransaction().commit(); }
OAuth2AuthenticationFilter implements ContainerRequestFilter { @Override public void filter(final ContainerRequestContext request) throws IOException { SecurityContext oldContext = request.getSecurityContext(); if (oldContext == null) { throw new OAuth2NotAuthorizedException( request.getUriInfo(), scopesAllowed); } String header = request.getHeaderString(HttpHeaders.AUTHORIZATION); BigInteger tokenId = getTokenIdFromHeader(header); Application a = loadAdminApplication(); Session session = sessionProvider.get(); session.getTransaction().begin(); Criteria c = session.createCriteria(OAuthToken.class) .createAlias("client", "c") .createAlias("c.application", "a") .add(Restrictions.eq("id", tokenId)) .add(Restrictions.eq("a.id", a.getId())) .add(Restrictions.eq("tokenType", OAuthTokenType.Bearer)) .setMaxResults(1) .setResultTransformer(Criteria.DISTINCT_ROOT_ENTITY); OAuthToken token = (OAuthToken) c.uniqueResult(); if (token == null || token.isExpired()) { session.getTransaction().commit(); throw new OAuth2NotAuthorizedException( request.getUriInfo(), scopesAllowed); } SecurityContext context = new OAuth2SecurityContext(token, true); request.setSecurityContext(context); session.getTransaction().commit(); } }
OAuth2AuthenticationFilter implements ContainerRequestFilter { @Override public void filter(final ContainerRequestContext request) throws IOException { SecurityContext oldContext = request.getSecurityContext(); if (oldContext == null) { throw new OAuth2NotAuthorizedException( request.getUriInfo(), scopesAllowed); } String header = request.getHeaderString(HttpHeaders.AUTHORIZATION); BigInteger tokenId = getTokenIdFromHeader(header); Application a = loadAdminApplication(); Session session = sessionProvider.get(); session.getTransaction().begin(); Criteria c = session.createCriteria(OAuthToken.class) .createAlias("client", "c") .createAlias("c.application", "a") .add(Restrictions.eq("id", tokenId)) .add(Restrictions.eq("a.id", a.getId())) .add(Restrictions.eq("tokenType", OAuthTokenType.Bearer)) .setMaxResults(1) .setResultTransformer(Criteria.DISTINCT_ROOT_ENTITY); OAuthToken token = (OAuthToken) c.uniqueResult(); if (token == null || token.isExpired()) { session.getTransaction().commit(); throw new OAuth2NotAuthorizedException( request.getUriInfo(), scopesAllowed); } SecurityContext context = new OAuth2SecurityContext(token, true); request.setSecurityContext(context); session.getTransaction().commit(); } OAuth2AuthenticationFilter(final Provider<Session> sessionProvider,
                                      final Provider<Configuration>
                                              configProvider,
                                      final String[] scopesAllowed); }
OAuth2AuthenticationFilter implements ContainerRequestFilter { @Override public void filter(final ContainerRequestContext request) throws IOException { SecurityContext oldContext = request.getSecurityContext(); if (oldContext == null) { throw new OAuth2NotAuthorizedException( request.getUriInfo(), scopesAllowed); } String header = request.getHeaderString(HttpHeaders.AUTHORIZATION); BigInteger tokenId = getTokenIdFromHeader(header); Application a = loadAdminApplication(); Session session = sessionProvider.get(); session.getTransaction().begin(); Criteria c = session.createCriteria(OAuthToken.class) .createAlias("client", "c") .createAlias("c.application", "a") .add(Restrictions.eq("id", tokenId)) .add(Restrictions.eq("a.id", a.getId())) .add(Restrictions.eq("tokenType", OAuthTokenType.Bearer)) .setMaxResults(1) .setResultTransformer(Criteria.DISTINCT_ROOT_ENTITY); OAuthToken token = (OAuthToken) c.uniqueResult(); if (token == null || token.isExpired()) { session.getTransaction().commit(); throw new OAuth2NotAuthorizedException( request.getUriInfo(), scopesAllowed); } SecurityContext context = new OAuth2SecurityContext(token, true); request.setSecurityContext(context); session.getTransaction().commit(); } OAuth2AuthenticationFilter(final Provider<Session> sessionProvider,
                                      final Provider<Configuration>
                                              configProvider,
                                      final String[] scopesAllowed); @Override void filter(final ContainerRequestContext request); }
OAuth2AuthenticationFilter implements ContainerRequestFilter { @Override public void filter(final ContainerRequestContext request) throws IOException { SecurityContext oldContext = request.getSecurityContext(); if (oldContext == null) { throw new OAuth2NotAuthorizedException( request.getUriInfo(), scopesAllowed); } String header = request.getHeaderString(HttpHeaders.AUTHORIZATION); BigInteger tokenId = getTokenIdFromHeader(header); Application a = loadAdminApplication(); Session session = sessionProvider.get(); session.getTransaction().begin(); Criteria c = session.createCriteria(OAuthToken.class) .createAlias("client", "c") .createAlias("c.application", "a") .add(Restrictions.eq("id", tokenId)) .add(Restrictions.eq("a.id", a.getId())) .add(Restrictions.eq("tokenType", OAuthTokenType.Bearer)) .setMaxResults(1) .setResultTransformer(Criteria.DISTINCT_ROOT_ENTITY); OAuthToken token = (OAuthToken) c.uniqueResult(); if (token == null || token.isExpired()) { session.getTransaction().commit(); throw new OAuth2NotAuthorizedException( request.getUriInfo(), scopesAllowed); } SecurityContext context = new OAuth2SecurityContext(token, true); request.setSecurityContext(context); session.getTransaction().commit(); } OAuth2AuthenticationFilter(final Provider<Session> sessionProvider,
                                      final Provider<Configuration>
                                              configProvider,
                                      final String[] scopesAllowed); @Override void filter(final ContainerRequestContext request);  }