@Test public void createAccessToken_nullAuth() { when(authentication.getOAuth2Request()).thenReturn(null); try { service.createAccessToken(null); fail("Authentication parameter is null. Excpected a AuthenticationCredentialsNotFoundException."); } catch (AuthenticationCredentialsNotFoundException e) { assertThat(e, is(notNullValue())); } try { service.createAccessToken(authentication); fail("AuthorizationRequest is null. Excpected a AuthenticationCredentialsNotFoundException."); } catch (AuthenticationCredentialsNotFoundException e) { assertThat(e, is(notNullValue())); } }
@Override @Transactional(value="defaultTransactionManager") public OAuth2AccessTokenEntity createAccessToken(OAuth2Authentication authentication) throws AuthenticationException, InvalidClientException { if (authentication != null && authentication.getOAuth2Request() != null) { OAuth2Request request = authentication.getOAuth2Request(); ClientDetailsEntity client = clientDetailsService.loadClientByClientId(request.getClientId()); if (client == null) { throw new InvalidClientException("Client not found: " + request.getClientId()); } if (request.getExtensions().containsKey(CODE_CHALLENGE)) { String challenge = (String) request.getExtensions().get(CODE_CHALLENGE); PKCEAlgorithm alg = PKCEAlgorithm.parse((String) request.getExtensions().get(CODE_CHALLENGE_METHOD)); String verifier = request.getRequestParameters().get(CODE_VERIFIER); if (alg.equals(PKCEAlgorithm.plain)) { if (!challenge.equals(verifier)) { throw new InvalidRequestException("Code challenge and verifier do not match"); } } else if (alg.equals(PKCEAlgorithm.S256)) { try { MessageDigest digest = MessageDigest.getInstance("SHA-256"); String hash = Base64URL.encode(digest.digest(verifier.getBytes(StandardCharsets.US_ASCII))).toString(); if (!challenge.equals(hash)) { throw new InvalidRequestException("Code challenge and verifier do not match"); } } catch (NoSuchAlgorithmException e) { logger.error("Unknown algorithm for PKCE digest", e); } } } OAuth2AccessTokenEntity token = new OAuth2AccessTokenEntity(); token.setClient(client); Set<SystemScope> scopes = scopeService.fromStrings(request.getScope()); scopes = scopeService.removeReservedScopes(scopes); token.setScope(scopeService.toStrings(scopes)); if (client.getAccessTokenValiditySeconds() != null && client.getAccessTokenValiditySeconds() > 0) { Date expiration = new Date(System.currentTimeMillis() + (client.getAccessTokenValiditySeconds() * 1000L)); token.setExpiration(expiration); } AuthenticationHolderEntity authHolder = new AuthenticationHolderEntity(); authHolder.setAuthentication(authentication); authHolder = authenticationHolderRepository.save(authHolder); token.setAuthenticationHolder(authHolder); if (client.isAllowRefresh() && token.getScope().contains(SystemScopeService.OFFLINE_ACCESS)) { OAuth2RefreshTokenEntity savedRefreshToken = createRefreshToken(client, authHolder); token.setRefreshToken(savedRefreshToken); } OAuth2Request originalAuthRequest = authHolder.getAuthentication().getOAuth2Request(); if (originalAuthRequest.getExtensions() != null && originalAuthRequest.getExtensions().containsKey("approved_site")) { Long apId = Long.parseLong((String) originalAuthRequest.getExtensions().get("approved_site")); ApprovedSite ap = approvedSiteService.getById(apId); token.setApprovedSite(ap); } OAuth2AccessTokenEntity enhancedToken = (OAuth2AccessTokenEntity) tokenEnhancer.enhance(token, authentication); OAuth2AccessTokenEntity savedToken = saveAccessToken(enhancedToken); if (savedToken.getRefreshToken() != null) { tokenRepository.saveRefreshToken(savedToken.getRefreshToken()); } return savedToken; } throw new AuthenticationCredentialsNotFoundException("No authentication credentials found"); }
DefaultOAuth2ProviderTokenService implements OAuth2TokenEntityService { @Override @Transactional(value="defaultTransactionManager") public OAuth2AccessTokenEntity createAccessToken(OAuth2Authentication authentication) throws AuthenticationException, InvalidClientException { if (authentication != null && authentication.getOAuth2Request() != null) { OAuth2Request request = authentication.getOAuth2Request(); ClientDetailsEntity client = clientDetailsService.loadClientByClientId(request.getClientId()); if (client == null) { throw new InvalidClientException("Client not found: " + request.getClientId()); } if (request.getExtensions().containsKey(CODE_CHALLENGE)) { String challenge = (String) request.getExtensions().get(CODE_CHALLENGE); PKCEAlgorithm alg = PKCEAlgorithm.parse((String) request.getExtensions().get(CODE_CHALLENGE_METHOD)); String verifier = request.getRequestParameters().get(CODE_VERIFIER); if (alg.equals(PKCEAlgorithm.plain)) { if (!challenge.equals(verifier)) { throw new InvalidRequestException("Code challenge and verifier do not match"); } } else if (alg.equals(PKCEAlgorithm.S256)) { try { MessageDigest digest = MessageDigest.getInstance("SHA-256"); String hash = Base64URL.encode(digest.digest(verifier.getBytes(StandardCharsets.US_ASCII))).toString(); if (!challenge.equals(hash)) { throw new InvalidRequestException("Code challenge and verifier do not match"); } } catch (NoSuchAlgorithmException e) { logger.error("Unknown algorithm for PKCE digest", e); } } } OAuth2AccessTokenEntity token = new OAuth2AccessTokenEntity(); token.setClient(client); Set<SystemScope> scopes = scopeService.fromStrings(request.getScope()); scopes = scopeService.removeReservedScopes(scopes); token.setScope(scopeService.toStrings(scopes)); if (client.getAccessTokenValiditySeconds() != null && client.getAccessTokenValiditySeconds() > 0) { Date expiration = new Date(System.currentTimeMillis() + (client.getAccessTokenValiditySeconds() * 1000L)); token.setExpiration(expiration); } AuthenticationHolderEntity authHolder = new AuthenticationHolderEntity(); authHolder.setAuthentication(authentication); authHolder = authenticationHolderRepository.save(authHolder); token.setAuthenticationHolder(authHolder); if (client.isAllowRefresh() && token.getScope().contains(SystemScopeService.OFFLINE_ACCESS)) { OAuth2RefreshTokenEntity savedRefreshToken = createRefreshToken(client, authHolder); token.setRefreshToken(savedRefreshToken); } OAuth2Request originalAuthRequest = authHolder.getAuthentication().getOAuth2Request(); if (originalAuthRequest.getExtensions() != null && originalAuthRequest.getExtensions().containsKey("approved_site")) { Long apId = Long.parseLong((String) originalAuthRequest.getExtensions().get("approved_site")); ApprovedSite ap = approvedSiteService.getById(apId); token.setApprovedSite(ap); } OAuth2AccessTokenEntity enhancedToken = (OAuth2AccessTokenEntity) tokenEnhancer.enhance(token, authentication); OAuth2AccessTokenEntity savedToken = saveAccessToken(enhancedToken); if (savedToken.getRefreshToken() != null) { tokenRepository.saveRefreshToken(savedToken.getRefreshToken()); } return savedToken; } throw new AuthenticationCredentialsNotFoundException("No authentication credentials found"); } }
DefaultOAuth2ProviderTokenService implements OAuth2TokenEntityService { @Override @Transactional(value="defaultTransactionManager") public OAuth2AccessTokenEntity createAccessToken(OAuth2Authentication authentication) throws AuthenticationException, InvalidClientException { if (authentication != null && authentication.getOAuth2Request() != null) { OAuth2Request request = authentication.getOAuth2Request(); ClientDetailsEntity client = clientDetailsService.loadClientByClientId(request.getClientId()); if (client == null) { throw new InvalidClientException("Client not found: " + request.getClientId()); } if (request.getExtensions().containsKey(CODE_CHALLENGE)) { String challenge = (String) request.getExtensions().get(CODE_CHALLENGE); PKCEAlgorithm alg = PKCEAlgorithm.parse((String) request.getExtensions().get(CODE_CHALLENGE_METHOD)); String verifier = request.getRequestParameters().get(CODE_VERIFIER); if (alg.equals(PKCEAlgorithm.plain)) { if (!challenge.equals(verifier)) { throw new InvalidRequestException("Code challenge and verifier do not match"); } } else if (alg.equals(PKCEAlgorithm.S256)) { try { MessageDigest digest = MessageDigest.getInstance("SHA-256"); String hash = Base64URL.encode(digest.digest(verifier.getBytes(StandardCharsets.US_ASCII))).toString(); if (!challenge.equals(hash)) { throw new InvalidRequestException("Code challenge and verifier do not match"); } } catch (NoSuchAlgorithmException e) { logger.error("Unknown algorithm for PKCE digest", e); } } } OAuth2AccessTokenEntity token = new OAuth2AccessTokenEntity(); token.setClient(client); Set<SystemScope> scopes = scopeService.fromStrings(request.getScope()); scopes = scopeService.removeReservedScopes(scopes); token.setScope(scopeService.toStrings(scopes)); if (client.getAccessTokenValiditySeconds() != null && client.getAccessTokenValiditySeconds() > 0) { Date expiration = new Date(System.currentTimeMillis() + (client.getAccessTokenValiditySeconds() * 1000L)); token.setExpiration(expiration); } AuthenticationHolderEntity authHolder = new AuthenticationHolderEntity(); authHolder.setAuthentication(authentication); authHolder = authenticationHolderRepository.save(authHolder); token.setAuthenticationHolder(authHolder); if (client.isAllowRefresh() && token.getScope().contains(SystemScopeService.OFFLINE_ACCESS)) { OAuth2RefreshTokenEntity savedRefreshToken = createRefreshToken(client, authHolder); token.setRefreshToken(savedRefreshToken); } OAuth2Request originalAuthRequest = authHolder.getAuthentication().getOAuth2Request(); if (originalAuthRequest.getExtensions() != null && originalAuthRequest.getExtensions().containsKey("approved_site")) { Long apId = Long.parseLong((String) originalAuthRequest.getExtensions().get("approved_site")); ApprovedSite ap = approvedSiteService.getById(apId); token.setApprovedSite(ap); } OAuth2AccessTokenEntity enhancedToken = (OAuth2AccessTokenEntity) tokenEnhancer.enhance(token, authentication); OAuth2AccessTokenEntity savedToken = saveAccessToken(enhancedToken); if (savedToken.getRefreshToken() != null) { tokenRepository.saveRefreshToken(savedToken.getRefreshToken()); } return savedToken; } throw new AuthenticationCredentialsNotFoundException("No authentication credentials found"); }  }
DefaultOAuth2ProviderTokenService implements OAuth2TokenEntityService { @Override @Transactional(value="defaultTransactionManager") public OAuth2AccessTokenEntity createAccessToken(OAuth2Authentication authentication) throws AuthenticationException, InvalidClientException { if (authentication != null && authentication.getOAuth2Request() != null) { OAuth2Request request = authentication.getOAuth2Request(); ClientDetailsEntity client = clientDetailsService.loadClientByClientId(request.getClientId()); if (client == null) { throw new InvalidClientException("Client not found: " + request.getClientId()); } if (request.getExtensions().containsKey(CODE_CHALLENGE)) { String challenge = (String) request.getExtensions().get(CODE_CHALLENGE); PKCEAlgorithm alg = PKCEAlgorithm.parse((String) request.getExtensions().get(CODE_CHALLENGE_METHOD)); String verifier = request.getRequestParameters().get(CODE_VERIFIER); if (alg.equals(PKCEAlgorithm.plain)) { if (!challenge.equals(verifier)) { throw new InvalidRequestException("Code challenge and verifier do not match"); } } else if (alg.equals(PKCEAlgorithm.S256)) { try { MessageDigest digest = MessageDigest.getInstance("SHA-256"); String hash = Base64URL.encode(digest.digest(verifier.getBytes(StandardCharsets.US_ASCII))).toString(); if (!challenge.equals(hash)) { throw new InvalidRequestException("Code challenge and verifier do not match"); } } catch (NoSuchAlgorithmException e) { logger.error("Unknown algorithm for PKCE digest", e); } } } OAuth2AccessTokenEntity token = new OAuth2AccessTokenEntity(); token.setClient(client); Set<SystemScope> scopes = scopeService.fromStrings(request.getScope()); scopes = scopeService.removeReservedScopes(scopes); token.setScope(scopeService.toStrings(scopes)); if (client.getAccessTokenValiditySeconds() != null && client.getAccessTokenValiditySeconds() > 0) { Date expiration = new Date(System.currentTimeMillis() + (client.getAccessTokenValiditySeconds() * 1000L)); token.setExpiration(expiration); } AuthenticationHolderEntity authHolder = new AuthenticationHolderEntity(); authHolder.setAuthentication(authentication); authHolder = authenticationHolderRepository.save(authHolder); token.setAuthenticationHolder(authHolder); if (client.isAllowRefresh() && token.getScope().contains(SystemScopeService.OFFLINE_ACCESS)) { OAuth2RefreshTokenEntity savedRefreshToken = createRefreshToken(client, authHolder); token.setRefreshToken(savedRefreshToken); } OAuth2Request originalAuthRequest = authHolder.getAuthentication().getOAuth2Request(); if (originalAuthRequest.getExtensions() != null && originalAuthRequest.getExtensions().containsKey("approved_site")) { Long apId = Long.parseLong((String) originalAuthRequest.getExtensions().get("approved_site")); ApprovedSite ap = approvedSiteService.getById(apId); token.setApprovedSite(ap); } OAuth2AccessTokenEntity enhancedToken = (OAuth2AccessTokenEntity) tokenEnhancer.enhance(token, authentication); OAuth2AccessTokenEntity savedToken = saveAccessToken(enhancedToken); if (savedToken.getRefreshToken() != null) { tokenRepository.saveRefreshToken(savedToken.getRefreshToken()); } return savedToken; } throw new AuthenticationCredentialsNotFoundException("No authentication credentials found"); }  @Override Set<OAuth2AccessTokenEntity> getAllAccessTokensForUser(String userName); @Override Set<OAuth2RefreshTokenEntity> getAllRefreshTokensForUser(String userName); @Override OAuth2AccessTokenEntity getAccessTokenById(Long id); @Override OAuth2RefreshTokenEntity getRefreshTokenById(Long id); @Override @Transactional(value="defaultTransactionManager") OAuth2AccessTokenEntity createAccessToken(OAuth2Authentication authentication); @Override @Transactional(value="defaultTransactionManager") OAuth2AccessTokenEntity refreshAccessToken(String refreshTokenValue, TokenRequest authRequest); @Override OAuth2Authentication loadAuthentication(String accessTokenValue); @Override OAuth2AccessTokenEntity readAccessToken(String accessTokenValue); @Override OAuth2AccessTokenEntity getAccessToken(OAuth2Authentication authentication); @Override OAuth2RefreshTokenEntity getRefreshToken(String refreshTokenValue); @Override @Transactional(value="defaultTransactionManager") void revokeRefreshToken(OAuth2RefreshTokenEntity refreshToken); @Override @Transactional(value="defaultTransactionManager") void revokeAccessToken(OAuth2AccessTokenEntity accessToken); @Override List<OAuth2AccessTokenEntity> getAccessTokensForClient(ClientDetailsEntity client); @Override List<OAuth2RefreshTokenEntity> getRefreshTokensForClient(ClientDetailsEntity client); @Override void clearExpiredTokens(); @Override @Transactional(value="defaultTransactionManager") OAuth2AccessTokenEntity saveAccessToken(OAuth2AccessTokenEntity accessToken); @Override @Transactional(value="defaultTransactionManager") OAuth2RefreshTokenEntity saveRefreshToken(OAuth2RefreshTokenEntity refreshToken); TokenEnhancer getTokenEnhancer(); void setTokenEnhancer(TokenEnhancer tokenEnhancer); @Override OAuth2AccessTokenEntity getRegistrationAccessTokenForClient(ClientDetailsEntity client); }
DefaultOAuth2ProviderTokenService implements OAuth2TokenEntityService { @Override @Transactional(value="defaultTransactionManager") public OAuth2AccessTokenEntity createAccessToken(OAuth2Authentication authentication) throws AuthenticationException, InvalidClientException { if (authentication != null && authentication.getOAuth2Request() != null) { OAuth2Request request = authentication.getOAuth2Request(); ClientDetailsEntity client = clientDetailsService.loadClientByClientId(request.getClientId()); if (client == null) { throw new InvalidClientException("Client not found: " + request.getClientId()); } if (request.getExtensions().containsKey(CODE_CHALLENGE)) { String challenge = (String) request.getExtensions().get(CODE_CHALLENGE); PKCEAlgorithm alg = PKCEAlgorithm.parse((String) request.getExtensions().get(CODE_CHALLENGE_METHOD)); String verifier = request.getRequestParameters().get(CODE_VERIFIER); if (alg.equals(PKCEAlgorithm.plain)) { if (!challenge.equals(verifier)) { throw new InvalidRequestException("Code challenge and verifier do not match"); } } else if (alg.equals(PKCEAlgorithm.S256)) { try { MessageDigest digest = MessageDigest.getInstance("SHA-256"); String hash = Base64URL.encode(digest.digest(verifier.getBytes(StandardCharsets.US_ASCII))).toString(); if (!challenge.equals(hash)) { throw new InvalidRequestException("Code challenge and verifier do not match"); } } catch (NoSuchAlgorithmException e) { logger.error("Unknown algorithm for PKCE digest", e); } } } OAuth2AccessTokenEntity token = new OAuth2AccessTokenEntity(); token.setClient(client); Set<SystemScope> scopes = scopeService.fromStrings(request.getScope()); scopes = scopeService.removeReservedScopes(scopes); token.setScope(scopeService.toStrings(scopes)); if (client.getAccessTokenValiditySeconds() != null && client.getAccessTokenValiditySeconds() > 0) { Date expiration = new Date(System.currentTimeMillis() + (client.getAccessTokenValiditySeconds() * 1000L)); token.setExpiration(expiration); } AuthenticationHolderEntity authHolder = new AuthenticationHolderEntity(); authHolder.setAuthentication(authentication); authHolder = authenticationHolderRepository.save(authHolder); token.setAuthenticationHolder(authHolder); if (client.isAllowRefresh() && token.getScope().contains(SystemScopeService.OFFLINE_ACCESS)) { OAuth2RefreshTokenEntity savedRefreshToken = createRefreshToken(client, authHolder); token.setRefreshToken(savedRefreshToken); } OAuth2Request originalAuthRequest = authHolder.getAuthentication().getOAuth2Request(); if (originalAuthRequest.getExtensions() != null && originalAuthRequest.getExtensions().containsKey("approved_site")) { Long apId = Long.parseLong((String) originalAuthRequest.getExtensions().get("approved_site")); ApprovedSite ap = approvedSiteService.getById(apId); token.setApprovedSite(ap); } OAuth2AccessTokenEntity enhancedToken = (OAuth2AccessTokenEntity) tokenEnhancer.enhance(token, authentication); OAuth2AccessTokenEntity savedToken = saveAccessToken(enhancedToken); if (savedToken.getRefreshToken() != null) { tokenRepository.saveRefreshToken(savedToken.getRefreshToken()); } return savedToken; } throw new AuthenticationCredentialsNotFoundException("No authentication credentials found"); }  @Override Set<OAuth2AccessTokenEntity> getAllAccessTokensForUser(String userName); @Override Set<OAuth2RefreshTokenEntity> getAllRefreshTokensForUser(String userName); @Override OAuth2AccessTokenEntity getAccessTokenById(Long id); @Override OAuth2RefreshTokenEntity getRefreshTokenById(Long id); @Override @Transactional(value="defaultTransactionManager") OAuth2AccessTokenEntity createAccessToken(OAuth2Authentication authentication); @Override @Transactional(value="defaultTransactionManager") OAuth2AccessTokenEntity refreshAccessToken(String refreshTokenValue, TokenRequest authRequest); @Override OAuth2Authentication loadAuthentication(String accessTokenValue); @Override OAuth2AccessTokenEntity readAccessToken(String accessTokenValue); @Override OAuth2AccessTokenEntity getAccessToken(OAuth2Authentication authentication); @Override OAuth2RefreshTokenEntity getRefreshToken(String refreshTokenValue); @Override @Transactional(value="defaultTransactionManager") void revokeRefreshToken(OAuth2RefreshTokenEntity refreshToken); @Override @Transactional(value="defaultTransactionManager") void revokeAccessToken(OAuth2AccessTokenEntity accessToken); @Override List<OAuth2AccessTokenEntity> getAccessTokensForClient(ClientDetailsEntity client); @Override List<OAuth2RefreshTokenEntity> getRefreshTokensForClient(ClientDetailsEntity client); @Override void clearExpiredTokens(); @Override @Transactional(value="defaultTransactionManager") OAuth2AccessTokenEntity saveAccessToken(OAuth2AccessTokenEntity accessToken); @Override @Transactional(value="defaultTransactionManager") OAuth2RefreshTokenEntity saveRefreshToken(OAuth2RefreshTokenEntity refreshToken); TokenEnhancer getTokenEnhancer(); void setTokenEnhancer(TokenEnhancer tokenEnhancer); @Override OAuth2AccessTokenEntity getRegistrationAccessTokenForClient(ClientDetailsEntity client);  }