@Test public void refreshAccessToken_requestingSameScope() { OAuth2AccessTokenEntity token = service.refreshAccessToken(refreshTokenValue, tokenRequest); assertThat(token.getScope(), equalTo(storedScope)); }
@Override public OAuth2AccessTokenEntity refreshAccessToken(String refreshTokenValue, TokenRequest authRequest) throws AuthenticationException { OAuth2RefreshTokenEntity refreshToken = tokenRepository.getRefreshTokenByValue(refreshTokenValue); if (refreshToken == null) { throw new InvalidTokenException("Invalid refresh token: " + refreshTokenValue); } ClientDetailsEntity client = refreshToken.getClient(); AuthenticationHolderEntity authHolder = refreshToken.getAuthenticationHolder(); if (!client.isAllowRefresh()) { throw new InvalidClientException("Client does not allow refreshing access token!"); } tokenRepository.clearAccessTokensForRefreshToken(refreshToken); if (refreshToken.isExpired()) { tokenRepository.removeRefreshToken(refreshToken); throw new InvalidTokenException("Expired refresh token: " + refreshTokenValue); } OAuth2AccessTokenEntity token = new OAuth2AccessTokenEntity(); Set<String> refreshScopes = new HashSet<String>(refreshToken.getAuthenticationHolder().getAuthentication().getOAuth2Request().getScope()); refreshScopes = scopeService.removeRestrictedScopes(refreshScopes); Set<String> scope = authRequest.getScope() == null ? new HashSet<String>() : new HashSet<String>(authRequest.getScope()); scope = scopeService.removeRestrictedScopes(scope); if (scope != null && !scope.isEmpty()) { if (refreshScopes != null && refreshScopes.containsAll(scope)) { token.setScope(scope); } else { String errorMsg = "Up-scoping is not allowed."; logger.error(errorMsg); throw new InvalidScopeException(errorMsg); } } else { token.setScope(refreshScopes); } token.setClient(client); if (client.getAccessTokenValiditySeconds() != null) { Date expiration = new Date(System.currentTimeMillis() + (client.getAccessTokenValiditySeconds() * 1000L)); token.setExpiration(expiration); } token.setRefreshToken(refreshToken); token.setAuthenticationHolder(authHolder); tokenEnhancer.enhance(token, authHolder.getAuthentication()); tokenRepository.saveAccessToken(token); return token; }
DefaultOAuth2ProviderTokenService implements OAuth2TokenEntityService { @Override public OAuth2AccessTokenEntity refreshAccessToken(String refreshTokenValue, TokenRequest authRequest) throws AuthenticationException { OAuth2RefreshTokenEntity refreshToken = tokenRepository.getRefreshTokenByValue(refreshTokenValue); if (refreshToken == null) { throw new InvalidTokenException("Invalid refresh token: " + refreshTokenValue); } ClientDetailsEntity client = refreshToken.getClient(); AuthenticationHolderEntity authHolder = refreshToken.getAuthenticationHolder(); if (!client.isAllowRefresh()) { throw new InvalidClientException("Client does not allow refreshing access token!"); } tokenRepository.clearAccessTokensForRefreshToken(refreshToken); if (refreshToken.isExpired()) { tokenRepository.removeRefreshToken(refreshToken); throw new InvalidTokenException("Expired refresh token: " + refreshTokenValue); } OAuth2AccessTokenEntity token = new OAuth2AccessTokenEntity(); Set<String> refreshScopes = new HashSet<String>(refreshToken.getAuthenticationHolder().getAuthentication().getOAuth2Request().getScope()); refreshScopes = scopeService.removeRestrictedScopes(refreshScopes); Set<String> scope = authRequest.getScope() == null ? new HashSet<String>() : new HashSet<String>(authRequest.getScope()); scope = scopeService.removeRestrictedScopes(scope); if (scope != null && !scope.isEmpty()) { if (refreshScopes != null && refreshScopes.containsAll(scope)) { token.setScope(scope); } else { String errorMsg = "Up-scoping is not allowed."; logger.error(errorMsg); throw new InvalidScopeException(errorMsg); } } else { token.setScope(refreshScopes); } token.setClient(client); if (client.getAccessTokenValiditySeconds() != null) { Date expiration = new Date(System.currentTimeMillis() + (client.getAccessTokenValiditySeconds() * 1000L)); token.setExpiration(expiration); } token.setRefreshToken(refreshToken); token.setAuthenticationHolder(authHolder); tokenEnhancer.enhance(token, authHolder.getAuthentication()); tokenRepository.saveAccessToken(token); return token; } }
DefaultOAuth2ProviderTokenService implements OAuth2TokenEntityService { @Override public OAuth2AccessTokenEntity refreshAccessToken(String refreshTokenValue, TokenRequest authRequest) throws AuthenticationException { OAuth2RefreshTokenEntity refreshToken = tokenRepository.getRefreshTokenByValue(refreshTokenValue); if (refreshToken == null) { throw new InvalidTokenException("Invalid refresh token: " + refreshTokenValue); } ClientDetailsEntity client = refreshToken.getClient(); AuthenticationHolderEntity authHolder = refreshToken.getAuthenticationHolder(); if (!client.isAllowRefresh()) { throw new InvalidClientException("Client does not allow refreshing access token!"); } tokenRepository.clearAccessTokensForRefreshToken(refreshToken); if (refreshToken.isExpired()) { tokenRepository.removeRefreshToken(refreshToken); throw new InvalidTokenException("Expired refresh token: " + refreshTokenValue); } OAuth2AccessTokenEntity token = new OAuth2AccessTokenEntity(); Set<String> refreshScopes = new HashSet<String>(refreshToken.getAuthenticationHolder().getAuthentication().getOAuth2Request().getScope()); refreshScopes = scopeService.removeRestrictedScopes(refreshScopes); Set<String> scope = authRequest.getScope() == null ? new HashSet<String>() : new HashSet<String>(authRequest.getScope()); scope = scopeService.removeRestrictedScopes(scope); if (scope != null && !scope.isEmpty()) { if (refreshScopes != null && refreshScopes.containsAll(scope)) { token.setScope(scope); } else { String errorMsg = "Up-scoping is not allowed."; logger.error(errorMsg); throw new InvalidScopeException(errorMsg); } } else { token.setScope(refreshScopes); } token.setClient(client); if (client.getAccessTokenValiditySeconds() != null) { Date expiration = new Date(System.currentTimeMillis() + (client.getAccessTokenValiditySeconds() * 1000L)); token.setExpiration(expiration); } token.setRefreshToken(refreshToken); token.setAuthenticationHolder(authHolder); tokenEnhancer.enhance(token, authHolder.getAuthentication()); tokenRepository.saveAccessToken(token); return token; }  }
DefaultOAuth2ProviderTokenService implements OAuth2TokenEntityService { @Override public OAuth2AccessTokenEntity refreshAccessToken(String refreshTokenValue, TokenRequest authRequest) throws AuthenticationException { OAuth2RefreshTokenEntity refreshToken = tokenRepository.getRefreshTokenByValue(refreshTokenValue); if (refreshToken == null) { throw new InvalidTokenException("Invalid refresh token: " + refreshTokenValue); } ClientDetailsEntity client = refreshToken.getClient(); AuthenticationHolderEntity authHolder = refreshToken.getAuthenticationHolder(); if (!client.isAllowRefresh()) { throw new InvalidClientException("Client does not allow refreshing access token!"); } tokenRepository.clearAccessTokensForRefreshToken(refreshToken); if (refreshToken.isExpired()) { tokenRepository.removeRefreshToken(refreshToken); throw new InvalidTokenException("Expired refresh token: " + refreshTokenValue); } OAuth2AccessTokenEntity token = new OAuth2AccessTokenEntity(); Set<String> refreshScopes = new HashSet<String>(refreshToken.getAuthenticationHolder().getAuthentication().getOAuth2Request().getScope()); refreshScopes = scopeService.removeRestrictedScopes(refreshScopes); Set<String> scope = authRequest.getScope() == null ? new HashSet<String>() : new HashSet<String>(authRequest.getScope()); scope = scopeService.removeRestrictedScopes(scope); if (scope != null && !scope.isEmpty()) { if (refreshScopes != null && refreshScopes.containsAll(scope)) { token.setScope(scope); } else { String errorMsg = "Up-scoping is not allowed."; logger.error(errorMsg); throw new InvalidScopeException(errorMsg); } } else { token.setScope(refreshScopes); } token.setClient(client); if (client.getAccessTokenValiditySeconds() != null) { Date expiration = new Date(System.currentTimeMillis() + (client.getAccessTokenValiditySeconds() * 1000L)); token.setExpiration(expiration); } token.setRefreshToken(refreshToken); token.setAuthenticationHolder(authHolder); tokenEnhancer.enhance(token, authHolder.getAuthentication()); tokenRepository.saveAccessToken(token); return token; }  @Override Set<OAuth2AccessTokenEntity> getAllAccessTokensForUser(String id); @Override Set<OAuth2RefreshTokenEntity> getAllRefreshTokensForUser(String id); @Override OAuth2AccessTokenEntity getAccessTokenById(Long id); @Override OAuth2RefreshTokenEntity getRefreshTokenById(Long id); @Override OAuth2AccessTokenEntity createAccessToken(OAuth2Authentication authentication); @Override OAuth2AccessTokenEntity refreshAccessToken(String refreshTokenValue, TokenRequest authRequest); @Override OAuth2Authentication loadAuthentication(String accessTokenValue); @Override OAuth2AccessTokenEntity readAccessToken(String accessTokenValue); @Override OAuth2AccessTokenEntity getAccessToken(OAuth2Authentication authentication); @Override OAuth2RefreshTokenEntity getRefreshToken(String refreshTokenValue); @Override void revokeRefreshToken(OAuth2RefreshTokenEntity refreshToken); @Override void revokeAccessToken(OAuth2AccessTokenEntity accessToken); @Override List<OAuth2AccessTokenEntity> getAccessTokensForClient(ClientDetailsEntity client); @Override List<OAuth2RefreshTokenEntity> getRefreshTokensForClient(ClientDetailsEntity client); @Override void clearExpiredTokens(); @Override OAuth2AccessTokenEntity saveAccessToken(OAuth2AccessTokenEntity accessToken); @Override OAuth2RefreshTokenEntity saveRefreshToken(OAuth2RefreshTokenEntity refreshToken); TokenEnhancer getTokenEnhancer(); void setTokenEnhancer(TokenEnhancer tokenEnhancer); @Override OAuth2AccessTokenEntity getAccessTokenForIdToken(OAuth2AccessTokenEntity idToken); @Override OAuth2AccessTokenEntity getRegistrationAccessTokenForClient(ClientDetailsEntity client); }
DefaultOAuth2ProviderTokenService implements OAuth2TokenEntityService { @Override public OAuth2AccessTokenEntity refreshAccessToken(String refreshTokenValue, TokenRequest authRequest) throws AuthenticationException { OAuth2RefreshTokenEntity refreshToken = tokenRepository.getRefreshTokenByValue(refreshTokenValue); if (refreshToken == null) { throw new InvalidTokenException("Invalid refresh token: " + refreshTokenValue); } ClientDetailsEntity client = refreshToken.getClient(); AuthenticationHolderEntity authHolder = refreshToken.getAuthenticationHolder(); if (!client.isAllowRefresh()) { throw new InvalidClientException("Client does not allow refreshing access token!"); } tokenRepository.clearAccessTokensForRefreshToken(refreshToken); if (refreshToken.isExpired()) { tokenRepository.removeRefreshToken(refreshToken); throw new InvalidTokenException("Expired refresh token: " + refreshTokenValue); } OAuth2AccessTokenEntity token = new OAuth2AccessTokenEntity(); Set<String> refreshScopes = new HashSet<String>(refreshToken.getAuthenticationHolder().getAuthentication().getOAuth2Request().getScope()); refreshScopes = scopeService.removeRestrictedScopes(refreshScopes); Set<String> scope = authRequest.getScope() == null ? new HashSet<String>() : new HashSet<String>(authRequest.getScope()); scope = scopeService.removeRestrictedScopes(scope); if (scope != null && !scope.isEmpty()) { if (refreshScopes != null && refreshScopes.containsAll(scope)) { token.setScope(scope); } else { String errorMsg = "Up-scoping is not allowed."; logger.error(errorMsg); throw new InvalidScopeException(errorMsg); } } else { token.setScope(refreshScopes); } token.setClient(client); if (client.getAccessTokenValiditySeconds() != null) { Date expiration = new Date(System.currentTimeMillis() + (client.getAccessTokenValiditySeconds() * 1000L)); token.setExpiration(expiration); } token.setRefreshToken(refreshToken); token.setAuthenticationHolder(authHolder); tokenEnhancer.enhance(token, authHolder.getAuthentication()); tokenRepository.saveAccessToken(token); return token; }  @Override Set<OAuth2AccessTokenEntity> getAllAccessTokensForUser(String id); @Override Set<OAuth2RefreshTokenEntity> getAllRefreshTokensForUser(String id); @Override OAuth2AccessTokenEntity getAccessTokenById(Long id); @Override OAuth2RefreshTokenEntity getRefreshTokenById(Long id); @Override OAuth2AccessTokenEntity createAccessToken(OAuth2Authentication authentication); @Override OAuth2AccessTokenEntity refreshAccessToken(String refreshTokenValue, TokenRequest authRequest); @Override OAuth2Authentication loadAuthentication(String accessTokenValue); @Override OAuth2AccessTokenEntity readAccessToken(String accessTokenValue); @Override OAuth2AccessTokenEntity getAccessToken(OAuth2Authentication authentication); @Override OAuth2RefreshTokenEntity getRefreshToken(String refreshTokenValue); @Override void revokeRefreshToken(OAuth2RefreshTokenEntity refreshToken); @Override void revokeAccessToken(OAuth2AccessTokenEntity accessToken); @Override List<OAuth2AccessTokenEntity> getAccessTokensForClient(ClientDetailsEntity client); @Override List<OAuth2RefreshTokenEntity> getRefreshTokensForClient(ClientDetailsEntity client); @Override void clearExpiredTokens(); @Override OAuth2AccessTokenEntity saveAccessToken(OAuth2AccessTokenEntity accessToken); @Override OAuth2RefreshTokenEntity saveRefreshToken(OAuth2RefreshTokenEntity refreshToken); TokenEnhancer getTokenEnhancer(); void setTokenEnhancer(TokenEnhancer tokenEnhancer); @Override OAuth2AccessTokenEntity getAccessTokenForIdToken(OAuth2AccessTokenEntity idToken); @Override OAuth2AccessTokenEntity getRegistrationAccessTokenForClient(ClientDetailsEntity client);  }