Package org.gcube.common.iam

Class AbstractIAMResponse

java.lang.Object
org.gcube.common.iam.AbstractIAMResponse
All Implemented Interfaces:
IAMResponse
Direct Known Subclasses:
D4ScienceIAMClientAuthn, D4ScienceIAMClientAuthz
public class AbstractIAMResponse extends Object implements IAMResponse
Abstract base class for D4Science IAM responses that implements common functionality for handling authentication and authorization responses.
Author:
Mauro Mugnaini (Nubisware S.r.l.)

  • Constructor Summary

    Constructors
    Constructor
    Description
    AbstractIAMResponse(D4ScienceIAMClient iamClient, org.gcube.common.keycloak.model.TokenResponse tokenResponse)
    Creates a new AbstractIAMResponse with the specified IAM client and token response.

  • Method Summary

    Modifier and Type
    Method
    Description
    boolean
    canBeRefreshed()
    Check if the current response can be refreshed
    void
    exchange(String clientId, String clientSecret, String audience, String scope)
    Exchanges and updates the current response with new one obtained with parameters provided.
    void
    exchangeForRefreshToken(String clientId, String clientSecret, String audience, String scope)
    Same as exchange(String, String, String, String) but asks the IAM also for a refresh token (requested_token_type=refresh_token): afterwards getRefreshTokenString() gives it, and getRefreshExpiresIn() its lifetime.
    org.gcube.common.keycloak.model.AccessToken
    getAccessToken()
    Returns the access token in the response.
    String
    getAccessTokenString()
    Returns the access token in the response as string.
    String[]
    getAudience()
    Returns the aud claim of the access token, as in the token (the contexts are URL-encoded)
    String
    getAuthorizedParty()
    Returns the azp claim of the access token: the client the token was issued to
    String
    getContactOrganization()
    Returns the client's contact organization from the token
    String
    getContactPerson()
    Returns the client's contact person from the token
    String
    getContext()
    Returns the token context is issued for This is done by checking in the order: If the token contains the d4s_context claim, as specified also in KeycloakClient.D4S_DYNAMIC_SCOPE_NAME_TOKEN_CLAIM The value of the aud claim if contains a single value (for retro-compatibility) It returns null if none of the options are satisfied and the context cannot be determined.
    Set<String>
    getContextRoles()
    Returns the resource roles for the resource specified in the token context
    String
    getEmail()
    Returns the email claim of the access token
    long
    getExpiresIn()
    Returns the lifetime of the access token as stated by the IAM when it issued it.
    String
    getFamilyName()
    Returns the family_name claim of the access token
    String
    getGivenName()
    Returns the given_name claim of the access token
    Set<String>
    getGlobalRoles()
    Returns the realm roles in the token
    D4ScienceIAMClient
    getIamClient()
    Returns the IAM client instance.
    String
    getIdTokenString()
     
    String
    getName()
    Returns the client's name from the token
    String
    getPreferredUsername()
    Returns the preferred_username claim of the access token
    long
    getRefreshExpiresIn()
    Returns the lifetime of the refresh token as stated by the IAM when it issued it.
    String
    getRefreshTokenString()
    Returns the refresh token as a string.
    Map<String,Set<String>>
    getResourceAccessRoles()
    Returns the roles of the token per resource (client), as in the resource_access claim.
    Set<String>
    getResourceRoles(String resource)
    Returns the resource roles for the resource specified in the resource parameter
    Set<String>
    getRoles()
    Returns all the roles, realm and from all the resources in the token in the same set
    String
    getSubject()
    Returns the sub claim of the access token
    protected org.gcube.common.keycloak.model.TokenResponse
    getTokenResponse()
    Returns the token response.
    boolean
    isAccessTokenValid()
    Quick way to check if the access token is valid by checking the digital signature and the token expiration
    boolean
    isAccessTokenValid(boolean checkExpiration)
    Quick way to check if the access token is valid by checking the digital signature and the token expiration if the checkExpiration parameter is true
    boolean
    isExpired()
    Check if the current response is expired
    boolean
    isRefreshTokenValid()
    Quick way to check if the refresh token present in the current response and it is valid by checking the digital signature and the token expiration
    boolean
    isRefreshTokenValid(boolean checkExpiration)
    Quick way to check if the refresh token present in the current response and it is valid by checking the digital signature and the token expiration if the checkExpiration parameter is true
    void
    logout(String clientId, String clientSecret)
    Ends the user session on the IAM (end session endpoint) using the refresh token.
    void
    refresh()
    Refreshes the current response, new data can be obtained again with accessors.
    void
    refresh(String clientId, String clientSecret)
    Refreshes the token using the specified client credentials.
    void
    setIamClient(D4ScienceIAMClient iamClient)
    Sets the IAM client instance.
    void
    setTokenResponse(org.gcube.common.keycloak.model.TokenResponse tokenResponse)
    Sets the token response.
    void
    verifyAccessToken()
    Verifies the access token integrity and validity; token digital signature and expiration are reported via specific exceptions.
    void
    verifyAccessToken(boolean checkExpiration)
    Verifies the access token integrity and optionally for expiration; token digital signature and expiration are reported via specific exceptions.
    void
    verifyRefreshToken()
    Verifies the refresh token integrity and validity; token digital signature and expiration are reported via specific exceptions.
    void
    verifyRefreshToken(boolean checkExpiration)
    Verifies the refresh token integrity and validity; token digital signature and expiration are reported via specific exceptions.

    Methods inherited from class java.lang.Object

    clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

  • Constructor Details

    • AbstractIAMResponse

      public AbstractIAMResponse(D4ScienceIAMClient iamClient, org.gcube.common.keycloak.model.TokenResponse tokenResponse)
      Creates a new AbstractIAMResponse with the specified IAM client and token response.
      Parameters:
      iamClient - the D4Science IAM client instance
      tokenResponse - the token response from the authentication/authorization process

  • Method Details

    • setIamClient

      public void setIamClient(D4ScienceIAMClient iamClient)
      Sets the IAM client instance.
      Parameters:
      iamClient - the D4Science IAM client to set

    • getIamClient

      public D4ScienceIAMClient getIamClient()
      Returns the IAM client instance.
      Returns:
      the D4Science IAM client

    • setTokenResponse

      public void setTokenResponse(org.gcube.common.keycloak.model.TokenResponse tokenResponse)
      Sets the token response.
      Parameters:
      tokenResponse - the token response to set

    • getTokenResponse

      protected org.gcube.common.keycloak.model.TokenResponse getTokenResponse()
      Returns the token response.
      Returns:
      the token response

    • getAccessToken

      public org.gcube.common.keycloak.model.AccessToken getAccessToken() throws D4ScienceIAMClientException
      Description copied from interface: IAMResponse
      Returns the access token in the response.
      Specified by:
      getAccessToken in interface IAMResponse
      Returns:
      The access token
      Throws:
      D4ScienceIAMClientException - if something goes wrong during the token decoding or JSON parsing

    • getAccessTokenString

      public String getAccessTokenString()
      Description copied from interface: IAMResponse
      Returns the access token in the response as string.
      Specified by:
      getAccessTokenString in interface IAMResponse
      Returns:
      The access token as string

    • isExpired

      public boolean isExpired() throws D4ScienceIAMClientException
      Description copied from interface: IAMResponse
      Check if the current response is expired
      Specified by:
      isExpired in interface IAMResponse
      Returns:
      true if the response is expired, false otherwise
      Throws:
      D4ScienceIAMClientException - if something goes wrong during the token decoding or JSON parsing

    • getRefreshTokenString

      public String getRefreshTokenString()
      Returns the refresh token as a string.
      Returns:
      the refresh token string

    • canBeRefreshed

      public boolean canBeRefreshed() throws D4ScienceIAMClientException
      Description copied from interface: IAMResponse
      Check if the current response can be refreshed
      Specified by:
      canBeRefreshed in interface IAMResponse
      Returns:
      true if the response can be refreshed, false otherwise
      Throws:
      D4ScienceIAMClientException - if something goes wrong during the token decoding or JSON parsing

    • refresh

      public void refresh() throws D4ScienceIAMClientException
      Description copied from interface: IAMResponse
      Refreshes the current response, new data can be obtained again with accessors.
      Specified by:
      refresh in interface IAMResponse
      Throws:
      D4ScienceIAMClientException - if something goes wrong during the token refresh

    • refresh

      public void refresh(String clientId, String clientSecret) throws D4ScienceIAMClientException
      Refreshes the token using the specified client credentials.
      Parameters:
      clientId - the client ID
      clientSecret - the client secret
      Throws:
      D4ScienceIAMClientException - if an error occurs during token refresh

    • logout

      public void logout(String clientId, String clientSecret) throws D4ScienceIAMClientException
      Ends the user session on the IAM (end session endpoint) using the refresh token.
      Parameters:
      clientId - the client the tokens were issued to, null to read it from the access token (azp)
      clientSecret - the client secret, null or empty for a public client
      Throws:
      D4ScienceIAMClientException - if there is no refresh token or the IAM refuses the logout

    • getContext

      public String getContext() throws D4ScienceIAMClientException
      Description copied from interface: IAMResponse
      Returns the token context is issued for This is done by checking in the order:
      • If the token contains the d4s_context claim, as specified also in KeycloakClient.D4S_DYNAMIC_SCOPE_NAME_TOKEN_CLAIM
      • The value of the aud claim if contains a single value (for retro-compatibility)
      It returns null if none of the options are satisfied and the context cannot be determined.
      Specified by:
      getContext in interface IAMResponse
      Returns:
      the token context or null
      Throws:
      D4ScienceIAMClientException - if something goes wrong during the token decoding or JSON parsing

    • getGlobalRoles

      public Set<String> getGlobalRoles() throws D4ScienceIAMClientException
      Description copied from interface: IAMResponse
      Returns the realm roles in the token
      Specified by:
      getGlobalRoles in interface IAMResponse
      Returns:
      the realm roles
      Throws:
      D4ScienceIAMClientException - if something goes wrong during the token decoding or JSON parsing

    • getRoles

      public Set<String> getRoles() throws D4ScienceIAMClientException
      Description copied from interface: IAMResponse
      Returns all the roles, realm and from all the resources in the token in the same set
      Specified by:
      getRoles in interface IAMResponse
      Returns:
      the union of all the roles in the token
      Throws:
      D4ScienceIAMClientException - if something goes wrong during the token decoding or JSON parsing

    • getResourceRoles

      public Set<String> getResourceRoles(String resource) throws D4ScienceIAMClientException
      Description copied from interface: IAMResponse
      Returns the resource roles for the resource specified in the resource parameter
      Specified by:
      getResourceRoles in interface IAMResponse
      Parameters:
      resource - the resource of which obtain the roles
      Returns:
      the roles for the resource
      Throws:
      D4ScienceIAMClientException - if something goes wrong during the token decoding or JSON parsing

    • getContextRoles

      public Set<String> getContextRoles() throws D4ScienceIAMClientException
      Description copied from interface: IAMResponse
      Returns the resource roles for the resource specified in the token context
      Specified by:
      getContextRoles in interface IAMResponse
      Returns:
      the token context's roles
      Throws:
      D4ScienceIAMClientException - if something goes wrong during the token decoding or JSON parsing

    • getResourceAccessRoles

      public Map<String,Set<String>> getResourceAccessRoles() throws D4ScienceIAMClientException
      Description copied from interface: IAMResponse
      Returns the roles of the token per resource (client), as in the resource_access claim. The resources are the contexts for a D4Science token, but also the Keycloak built-in clients (e.g. account): callers interested in the contexts only skip them.
      Specified by:
      getResourceAccessRoles in interface IAMResponse
      Returns:
      a new map resource to roles, empty if the token has no resource_access claim
      Throws:
      D4ScienceIAMClientException - if something goes wrong during the token decoding or JSON parsing

    • getAudience

      public String[] getAudience() throws D4ScienceIAMClientException
      Description copied from interface: IAMResponse
      Returns the aud claim of the access token, as in the token (the contexts are URL-encoded)
      Specified by:
      getAudience in interface IAMResponse
      Returns:
      the audiences, an empty array if the token has none
      Throws:
      D4ScienceIAMClientException - if something goes wrong during the token decoding or JSON parsing

    • getSubject

      public String getSubject() throws D4ScienceIAMClientException
      Description copied from interface: IAMResponse
      Returns the sub claim of the access token
      Specified by:
      getSubject in interface IAMResponse
      Returns:
      the subject or null
      Throws:
      D4ScienceIAMClientException - if something goes wrong during the token decoding or JSON parsing

    • getIdTokenString

      public String getIdTokenString()
      Returns:
      the ID token string, or null if none was issued

    • getAuthorizedParty

      public String getAuthorizedParty() throws D4ScienceIAMClientException
      Description copied from interface: IAMResponse
      Returns the azp claim of the access token: the client the token was issued to
      Specified by:
      getAuthorizedParty in interface IAMResponse
      Returns:
      the authorized party or null
      Throws:
      D4ScienceIAMClientException - if something goes wrong during the token decoding or JSON parsing

    • getEmail

      public String getEmail() throws D4ScienceIAMClientException
      Description copied from interface: IAMResponse
      Returns the email claim of the access token
      Specified by:
      getEmail in interface IAMResponse
      Returns:
      the e-mail address or null
      Throws:
      D4ScienceIAMClientException - if something goes wrong during the token decoding or JSON parsing

    • getGivenName

      public String getGivenName() throws D4ScienceIAMClientException
      Description copied from interface: IAMResponse
      Returns the given_name claim of the access token
      Specified by:
      getGivenName in interface IAMResponse
      Returns:
      the given name or null
      Throws:
      D4ScienceIAMClientException - if something goes wrong during the token decoding or JSON parsing

    • getFamilyName

      public String getFamilyName() throws D4ScienceIAMClientException
      Description copied from interface: IAMResponse
      Returns the family_name claim of the access token
      Specified by:
      getFamilyName in interface IAMResponse
      Returns:
      the family name or null
      Throws:
      D4ScienceIAMClientException - if something goes wrong during the token decoding or JSON parsing

    • getPreferredUsername

      public String getPreferredUsername() throws D4ScienceIAMClientException
      Description copied from interface: IAMResponse
      Returns the preferred_username claim of the access token
      Specified by:
      getPreferredUsername in interface IAMResponse
      Returns:
      the preferred username or null
      Throws:
      D4ScienceIAMClientException - if something goes wrong during the token decoding or JSON parsing

    • getName

      public String getName() throws D4ScienceIAMClientException
      Description copied from interface: IAMResponse
      Returns the client's name from the token
      Specified by:
      getName in interface IAMResponse
      Returns:
      the name string
      Throws:
      D4ScienceIAMClientException - if something goes wrong during the token decoding or JSON parsing

    • getContactPerson

      public String getContactPerson() throws D4ScienceIAMClientException
      Description copied from interface: IAMResponse
      Returns the client's contact person from the token
      Specified by:
      getContactPerson in interface IAMResponse
      Returns:
      the contact person string
      Throws:
      D4ScienceIAMClientException - if something goes wrong during the token decoding or JSON parsing

    • getContactOrganization

      public String getContactOrganization() throws D4ScienceIAMClientException
      Description copied from interface: IAMResponse
      Returns the client's contact organization from the token
      Specified by:
      getContactOrganization in interface IAMResponse
      Returns:
      the contact organization string
      Throws:
      D4ScienceIAMClientException - if something goes wrong during the token decoding or JSON parsing

    • isAccessTokenValid

      public boolean isAccessTokenValid() throws D4ScienceIAMClientException
      Description copied from interface: IAMResponse
      Quick way to check if the access token is valid by checking the digital signature and the token expiration
      Specified by:
      isAccessTokenValid in interface IAMResponse
      Returns:
      true if the access token is valid, false otherwise
      Throws:
      D4ScienceIAMClientException - if something goes wrong during the token validity checks

    • isAccessTokenValid

      public boolean isAccessTokenValid(boolean checkExpiration) throws D4ScienceIAMClientException
      Description copied from interface: IAMResponse
      Quick way to check if the access token is valid by checking the digital signature and the token expiration if the checkExpiration parameter is true
      Specified by:
      isAccessTokenValid in interface IAMResponse
      Parameters:
      checkExpiration - checks also if the token is expired
      Returns:
      true if the access token is valid, false otherwise
      Throws:
      D4ScienceIAMClientException - if something goes wrong during the token validity checks

    • verifyAccessToken

      public void verifyAccessToken() throws org.gcube.io.jsonwebtoken.security.SignatureException, org.gcube.io.jsonwebtoken.ExpiredJwtException, D4ScienceIAMClientException
      Description copied from interface: IAMResponse
      Verifies the access token integrity and validity; token digital signature and expiration are reported via specific exceptions.
      Specified by:
      verifyAccessToken in interface IAMResponse
      Throws:
      org.gcube.io.jsonwebtoken.security.SignatureException - if the token has been tampered and/or signature is invalid
      org.gcube.io.jsonwebtoken.ExpiredJwtException - if the token validity is expired
      D4ScienceIAMClientException - if something else goes wrong during the token verification

    • verifyAccessToken

      public void verifyAccessToken(boolean checkExpiration) throws org.gcube.io.jsonwebtoken.security.SignatureException, org.gcube.io.jsonwebtoken.ExpiredJwtException, D4ScienceIAMClientException
      Description copied from interface: IAMResponse
      Verifies the access token integrity and optionally for expiration; token digital signature and expiration are reported via specific exceptions.
      Specified by:
      verifyAccessToken in interface IAMResponse
      Parameters:
      checkExpiration - if false token expiration check is disabled
      Throws:
      org.gcube.io.jsonwebtoken.security.SignatureException - if the token has been tampered and/or signature is invalid
      org.gcube.io.jsonwebtoken.ExpiredJwtException - if the token validity is expired if the checkExpiration argument is true
      D4ScienceIAMClientException - if something else goes wrong during the token verification

    • isRefreshTokenValid

      public boolean isRefreshTokenValid() throws D4ScienceIAMClientException
      Description copied from interface: IAMResponse
      Quick way to check if the refresh token present in the current response and it is valid by checking the digital signature and the token expiration
      Specified by:
      isRefreshTokenValid in interface IAMResponse
      Returns:
      true if the refresh token is valid, false otherwise
      Throws:
      D4ScienceIAMClientException - if something goes wrong during the token validity checks

    • isRefreshTokenValid

      public boolean isRefreshTokenValid(boolean checkExpiration) throws D4ScienceIAMClientException
      Description copied from interface: IAMResponse
      Quick way to check if the refresh token present in the current response and it is valid by checking the digital signature and the token expiration if the checkExpiration parameter is true
      Specified by:
      isRefreshTokenValid in interface IAMResponse
      Parameters:
      checkExpiration - checks also if the token is expired
      Returns:
      true if the refresh token is valid, false otherwise
      Throws:
      D4ScienceIAMClientException - if something goes wrong during the token validity checks

    • verifyRefreshToken

      public void verifyRefreshToken() throws org.gcube.io.jsonwebtoken.security.SignatureException, org.gcube.io.jsonwebtoken.ExpiredJwtException, D4ScienceIAMClientException
      Description copied from interface: IAMResponse
      Verifies the refresh token integrity and validity; token digital signature and expiration are reported via specific exceptions.
      Specified by:
      verifyRefreshToken in interface IAMResponse
      Throws:
      org.gcube.io.jsonwebtoken.security.SignatureException - if the token has been tampered and/or signature is invalid
      org.gcube.io.jsonwebtoken.ExpiredJwtException - if the token validity is expired
      D4ScienceIAMClientException - if something else goes wrong during the token verification

    • verifyRefreshToken

      public void verifyRefreshToken(boolean checkExpiration) throws org.gcube.io.jsonwebtoken.security.SignatureException, org.gcube.io.jsonwebtoken.ExpiredJwtException, D4ScienceIAMClientException
      Description copied from interface: IAMResponse
      Verifies the refresh token integrity and validity; token digital signature and expiration are reported via specific exceptions.
      Specified by:
      verifyRefreshToken in interface IAMResponse
      Parameters:
      checkExpiration - if false token expiration check is disabled
      Throws:
      org.gcube.io.jsonwebtoken.security.SignatureException - if the token has been tampered and/or signature is invalid
      org.gcube.io.jsonwebtoken.ExpiredJwtException - if the token validity is expired if the checkExpiration argument is true
      D4ScienceIAMClientException - if something else goes wrong during the token verification

    • exchange

      public void exchange(String clientId, String clientSecret, String audience, String scope) throws D4ScienceIAMClientException
      Description copied from interface: IAMResponse
      Exchanges and updates the current response with new one obtained with parameters provided.
      Specified by:
      exchange in interface IAMResponse
      Parameters:
      clientId - the client id to be used for the exchange
      clientSecret - the client secret to be used for the exchange
      audience - the audience to specify in the exchange, can be null
      scope - the scope (as standard space separated list) to specify in the exchange, can be null
      Throws:
      D4ScienceIAMClientException - if something goes wrong during the token exchange

    • exchangeForRefreshToken

      public void exchangeForRefreshToken(String clientId, String clientSecret, String audience, String scope) throws D4ScienceIAMClientException
      Same as exchange(String, String, String, String) but asks the IAM also for a refresh token (requested_token_type=refresh_token): afterwards getRefreshTokenString() gives it, and getRefreshExpiresIn() its lifetime. Add offline_access to the scope for an offline refresh token. Used by the Personal Token of the portal, as Liferay 6.2 did.
      Parameters:
      clientId - the client id to be used for the exchange
      clientSecret - the client secret to be used for the exchange (empty for a public client)
      audience - the audience to specify in the exchange, can be null
      scope - the scope (as standard space separated list), e.g. d4s-context:/gcube/devsec/devVRE
      Throws:
      D4ScienceIAMClientException - if something goes wrong during the token exchange

    • getExpiresIn

      public long getExpiresIn()
      Returns the lifetime of the access token as stated by the IAM when it issued it.
      Returns:
      the seconds of validity of the access token when issued

    • getRefreshExpiresIn

      public long getRefreshExpiresIn()
      Returns the lifetime of the refresh token as stated by the IAM when it issued it.
      Returns:
      the seconds of validity of the refresh token when issued (0 if there is none)