370 lines
16 KiB
Java
370 lines
16 KiB
Java
package org.gcube.common.keycloak;
|
|
|
|
import static org.gcube.resources.discovery.icclient.ICFactory.clientFor;
|
|
import static org.gcube.resources.discovery.icclient.ICFactory.queryFor;
|
|
import static org.gcube.common.keycloak.model.OIDCConstants.*;
|
|
|
|
import java.io.UnsupportedEncodingException;
|
|
import java.net.MalformedURLException;
|
|
import java.net.URL;
|
|
import java.net.URLEncoder;
|
|
import java.util.Arrays;
|
|
import java.util.Base64;
|
|
import java.util.Collections;
|
|
import java.util.HashMap;
|
|
import java.util.List;
|
|
import java.util.Map;
|
|
import java.util.stream.Collectors;
|
|
|
|
import org.gcube.common.gxrest.request.GXHTTPStringRequest;
|
|
import org.gcube.common.gxrest.response.inbound.GXInboundResponse;
|
|
import org.gcube.common.keycloak.model.ModelUtils;
|
|
import org.gcube.common.keycloak.model.TokenResponse;
|
|
import org.gcube.common.resources.gcore.ServiceEndpoint;
|
|
import org.gcube.common.resources.gcore.ServiceEndpoint.AccessPoint;
|
|
import org.gcube.common.scope.api.ScopeProvider;
|
|
import org.gcube.resources.discovery.client.api.DiscoveryClient;
|
|
import org.gcube.resources.discovery.client.queries.api.SimpleQuery;
|
|
|
|
public class DefaultKeycloakClient implements KeycloakClient {
|
|
|
|
@Override
|
|
public URL findTokenEndpointURL() throws KeycloakClientException {
|
|
logger.debug("Checking ScopeProvider's scope presence and format");
|
|
String originalScope = ScopeProvider.instance.get();
|
|
if (originalScope == null || !originalScope.startsWith("/") || originalScope.length() < 2) {
|
|
throw new KeycloakClientException(originalScope == null ? "Scope not found in ScopeProvider"
|
|
: "Bad scope name found: " + originalScope);
|
|
}
|
|
logger.debug("Assuring use the rootVO to query the endpoint simple query. Actual scope is: {}", originalScope);
|
|
String rootVOScope = "/" + originalScope.split("/")[1];
|
|
logger.debug("Setting rootVO scope into provider as: {}", rootVOScope);
|
|
|
|
List<AccessPoint> accessPoints = null;
|
|
|
|
// trying to be thread safe at least for these calls
|
|
synchronized (ScopeProvider.instance) {
|
|
boolean scopeModified = false;
|
|
if (!ScopeProvider.instance.get().equals(rootVOScope)) {
|
|
logger.debug("Overriding scope in the provider with rootVO scope : {}", rootVOScope);
|
|
ScopeProvider.instance.set(rootVOScope);
|
|
scopeModified = true;
|
|
}
|
|
|
|
logger.debug("Creating simple query");
|
|
SimpleQuery query = queryFor(ServiceEndpoint.class);
|
|
query.addCondition(
|
|
String.format("$resource/Profile/Category/text() eq '%s'", CATEGORY))
|
|
.addCondition(String.format("$resource/Profile/Name/text() eq '%s'", NAME))
|
|
.setResult(String.format("$resource/Profile/AccessPoint[Description/text() eq '%s']", DESCRIPTION));
|
|
|
|
logger.debug("Creating client for AccessPoint");
|
|
DiscoveryClient<AccessPoint> client = clientFor(AccessPoint.class);
|
|
|
|
logger.trace("Submitting query: {}", query);
|
|
accessPoints = client.submit(query);
|
|
|
|
if (scopeModified) {
|
|
logger.debug("Resetting scope into provider to the original value: {}", originalScope);
|
|
ScopeProvider.instance.set(originalScope);
|
|
}
|
|
}
|
|
|
|
if (accessPoints.size() == 0) {
|
|
throw new KeycloakClientException("Service endpoint not found");
|
|
} else if (accessPoints.size() > 1) {
|
|
throw new KeycloakClientException("Found more than one endpoint with query");
|
|
}
|
|
String address = accessPoints.iterator().next().address();
|
|
logger.debug("Found address: {}", address);
|
|
try {
|
|
return new URL(address);
|
|
} catch (MalformedURLException e) {
|
|
throw new KeycloakClientException("Cannot create URL from address: " + address, e);
|
|
}
|
|
}
|
|
|
|
@Override
|
|
public TokenResponse queryOIDCToken(String clientId, String clientSecret) throws KeycloakClientException {
|
|
return queryOIDCToken(findTokenEndpointURL(), clientId, clientSecret);
|
|
}
|
|
|
|
@Override
|
|
public TokenResponse queryOIDCToken(URL tokenURL, String clientId, String clientSecret)
|
|
throws KeycloakClientException {
|
|
|
|
return queryOIDCToken(tokenURL, constructBasicAuthenticationHeader(clientId, clientSecret));
|
|
}
|
|
|
|
protected String constructBasicAuthenticationHeader(String clientId, String clientSecret) {
|
|
return "Basic " + Base64.getEncoder().encodeToString((clientId + ":" + clientSecret).getBytes());
|
|
}
|
|
|
|
@Override
|
|
public TokenResponse queryOIDCToken(URL tokenURL, String authorization) throws KeycloakClientException {
|
|
logger.debug("Querying OIDC token from Keycloak server with URL: {}", tokenURL);
|
|
|
|
Map<String, List<String>> params = new HashMap<>();
|
|
params.put(GRANT_TYPE_PARAMETER, Arrays.asList(CLIENT_CREDENTIALS_GRANT_TYPE));
|
|
|
|
return performRequest(tokenURL, authorization, params);
|
|
}
|
|
|
|
@Override
|
|
public TokenResponse queryUMAToken(String clientId, String clientSecret, List<String> permissions)
|
|
throws KeycloakClientException {
|
|
|
|
return queryUMAToken(clientId, clientSecret, ScopeProvider.instance.get(), permissions);
|
|
}
|
|
|
|
@Override
|
|
public TokenResponse queryUMAToken(TokenResponse oidcTokenResponse, String audience, List<String> permissions)
|
|
throws KeycloakClientException {
|
|
|
|
return queryUMAToken(findTokenEndpointURL(), constructBeareAuthenticationHeader(oidcTokenResponse), audience,
|
|
permissions);
|
|
}
|
|
|
|
@Override
|
|
public TokenResponse queryUMAToken(String clientId, String clientSecret, String audience,
|
|
List<String> permissions) throws KeycloakClientException {
|
|
|
|
return queryUMAToken(findTokenEndpointURL(), clientId, clientSecret, audience, permissions);
|
|
}
|
|
|
|
@Override
|
|
public TokenResponse queryUMAToken(URL tokenURL, TokenResponse oidcTokenResponse, String audience,
|
|
List<String> permissions) throws KeycloakClientException {
|
|
|
|
return queryUMAToken(tokenURL, constructBeareAuthenticationHeader(oidcTokenResponse), audience, permissions);
|
|
}
|
|
|
|
protected String constructBeareAuthenticationHeader(TokenResponse oidcTokenResponse) {
|
|
return "Bearer " + oidcTokenResponse.getAccessToken();
|
|
}
|
|
|
|
@Override
|
|
public TokenResponse queryUMAToken(URL tokenURL, String clientId, String clientSecret, String audience,
|
|
List<String> permissions) throws KeycloakClientException {
|
|
|
|
return queryUMAToken(tokenURL,
|
|
constructBasicAuthenticationHeader(clientId, clientSecret),
|
|
audience, permissions);
|
|
}
|
|
|
|
@Override
|
|
public TokenResponse queryUMAToken(URL tokenURL, String authorization, String audience,
|
|
List<String> permissions) throws KeycloakClientException {
|
|
|
|
if (audience == null || "".equals(audience)) {
|
|
throw new KeycloakClientException("Audience must be not null nor empty");
|
|
}
|
|
|
|
logger.debug("Querying UMA token from Keycloak server with URL: {}", tokenURL);
|
|
|
|
Map<String, List<String>> params = new HashMap<>();
|
|
params.put(GRANT_TYPE_PARAMETER, Arrays.asList(UMA_TOKEN_GRANT_TYPE));
|
|
|
|
try {
|
|
params.put(AUDIENCE_PARAMETER, Arrays.asList(URLEncoder.encode(checkAudience(audience), "UTF-8")));
|
|
} catch (UnsupportedEncodingException e) {
|
|
logger.error("Can't URL encode audience: {}", audience, e);
|
|
}
|
|
|
|
if (permissions != null && !permissions.isEmpty()) {
|
|
params.put(
|
|
PERMISSION_PARAMETER, permissions.stream().map(s -> {
|
|
try {
|
|
return URLEncoder.encode(s, "UTF-8");
|
|
} catch (UnsupportedEncodingException e) {
|
|
return "";
|
|
}
|
|
}).collect(Collectors.toList()));
|
|
}
|
|
|
|
return performRequest(tokenURL, authorization, params);
|
|
}
|
|
|
|
protected TokenResponse performRequest(URL tokenURL, String authorization, Map<String, List<String>> params)
|
|
throws KeycloakClientException {
|
|
|
|
if (tokenURL == null) {
|
|
throw new KeycloakClientException("Token URL must be not null");
|
|
}
|
|
|
|
if (authorization == null || "".equals(authorization)) {
|
|
throw new KeycloakClientException("Authorization must be not null nor empty");
|
|
}
|
|
// Constructing request object
|
|
GXHTTPStringRequest request;
|
|
try {
|
|
|
|
String queryString = params.entrySet().stream()
|
|
.flatMap(p -> p.getValue().stream().map(v -> p.getKey() + "=" + v))
|
|
.reduce((p1, p2) -> p1 + "&" + p2).orElse("");
|
|
|
|
request = GXHTTPStringRequest.newRequest(tokenURL.toString())
|
|
.header("Content-Type", "application/x-www-form-urlencoded").withBody(queryString);
|
|
|
|
request.isExternalCall(true);
|
|
if (authorization != null) {
|
|
logger.debug("Adding authorization header as: {}", authorization);
|
|
request = request.header("Authorization", authorization);
|
|
}
|
|
} catch (Exception e) {
|
|
throw new KeycloakClientException("Cannot construct the request object correctly", e);
|
|
}
|
|
|
|
GXInboundResponse response;
|
|
try {
|
|
response = request.post();
|
|
} catch (Exception e) {
|
|
throw new KeycloakClientException("Cannot send request correctly", e);
|
|
}
|
|
if (response.isSuccessResponse()) {
|
|
try {
|
|
return response.tryConvertStreamedContentFromJson(TokenResponse.class);
|
|
} catch (Exception e) {
|
|
throw new KeycloakClientException("Cannot construct token response object correctly", e);
|
|
}
|
|
} else {
|
|
throw KeycloakClientException.create("Unable to get token", response.getHTTPCode(),
|
|
response.getHeaderFields()
|
|
.getOrDefault("content-type", Collections.singletonList("unknown/unknown")).get(0),
|
|
response.getMessage());
|
|
}
|
|
}
|
|
|
|
private static String checkAudience(String audience) {
|
|
if (audience.startsWith("/")) {
|
|
try {
|
|
logger.trace("Audience was provided in non URL encoded form, encoding it");
|
|
return URLEncoder.encode(audience, "UTF-8");
|
|
} catch (UnsupportedEncodingException e) {
|
|
logger.error("Cannot URL encode 'audience'", e);
|
|
}
|
|
}
|
|
return audience;
|
|
}
|
|
|
|
@Override
|
|
public TokenResponse refreshToken(TokenResponse tokenResponse) throws KeycloakClientException {
|
|
return refreshToken((String) null, tokenResponse);
|
|
}
|
|
|
|
@Override
|
|
public TokenResponse refreshToken(URL tokenURL, TokenResponse tokenResponse) throws KeycloakClientException {
|
|
return refreshToken(tokenURL, null, null, tokenResponse);
|
|
}
|
|
|
|
@Override
|
|
public TokenResponse refreshToken(String clientId, TokenResponse tokenResponse) throws KeycloakClientException {
|
|
return refreshToken(clientId, null, tokenResponse);
|
|
}
|
|
|
|
@Override
|
|
public TokenResponse refreshToken(String clientId, String clientSecret, TokenResponse tokenResponse)
|
|
throws KeycloakClientException {
|
|
|
|
return refreshToken(findTokenEndpointURL(), clientId, clientSecret, tokenResponse);
|
|
}
|
|
|
|
@Override
|
|
public TokenResponse refreshToken(URL tokenURL, String clientId, String clientSecret, TokenResponse tokenResponse)
|
|
throws KeycloakClientException {
|
|
|
|
if (clientId == null) {
|
|
logger.debug("Client id not set, trying to get it from access token info");
|
|
try {
|
|
clientId = ModelUtils.getClientIdFromToken(ModelUtils.getAccessTokenFrom(tokenResponse));
|
|
} catch (Exception e) {
|
|
throw new KeycloakClientException("Cannot construct access token object from token response", e);
|
|
}
|
|
}
|
|
return refreshToken(tokenURL, clientId, clientSecret, tokenResponse.getRefreshToken());
|
|
}
|
|
|
|
@Override
|
|
public TokenResponse refreshToken(String refreshTokenJWTString) throws KeycloakClientException {
|
|
try {
|
|
String clientId = ModelUtils.getClientIdFromToken(ModelUtils.getRefreshTokenFrom(refreshTokenJWTString));
|
|
return refreshToken(clientId, refreshTokenJWTString);
|
|
} catch (Exception e) {
|
|
throw new KeycloakClientException("Cannot construct access token object from token response", e);
|
|
}
|
|
}
|
|
|
|
@Override
|
|
public TokenResponse refreshToken(String clientId, String refreshTokenJWTString) throws KeycloakClientException {
|
|
return refreshToken(clientId, null, refreshTokenJWTString);
|
|
}
|
|
|
|
@Override
|
|
public TokenResponse refreshToken(String clientId, String clientSecret, String refreshTokenJWTString)
|
|
throws KeycloakClientException {
|
|
|
|
return refreshToken(findTokenEndpointURL(), clientId, clientSecret, refreshTokenJWTString);
|
|
}
|
|
|
|
@Override
|
|
public TokenResponse refreshToken(URL tokenURL, String clientId, String clientSecret, String refreshTokenJWTString)
|
|
throws KeycloakClientException {
|
|
|
|
if (tokenURL == null) {
|
|
throw new KeycloakClientException("Token URL must be not null");
|
|
}
|
|
|
|
if (clientId == null || "".equals(clientId)) {
|
|
throw new KeycloakClientException("Client id must be not null nor empty");
|
|
}
|
|
|
|
if (refreshTokenJWTString == null || "".equals(clientId)) {
|
|
throw new KeycloakClientException("Refresh token JWT encoded string must be not null nor empty");
|
|
}
|
|
|
|
logger.debug("Refreshing token from Keycloak server with URL: {}", tokenURL);
|
|
|
|
// Constructing request object
|
|
GXHTTPStringRequest request;
|
|
try {
|
|
Map<String, String> params = new HashMap<>();
|
|
params.put(GRANT_TYPE_PARAMETER, REFRESH_TOKEN_GRANT_TYPE);
|
|
params.put(REFRESH_TOKEN_PARAMETER, refreshTokenJWTString);
|
|
params.put(CLIENT_ID_PARAMETER, URLEncoder.encode(clientId, "UTF-8"));
|
|
if (clientSecret != null && !"".equals(clientSecret)) {
|
|
params.put(CLIENT_SECRET_PARAMETER, URLEncoder.encode(clientSecret, "UTF-8"));
|
|
}
|
|
String queryString = params.entrySet().stream()
|
|
.map(p -> p.getKey() + "=" + p.getValue())
|
|
.reduce((p1, p2) -> p1 + "&" + p2).orElse("");
|
|
|
|
request = GXHTTPStringRequest.newRequest(tokenURL.toString()).header("Content-Type",
|
|
"application/x-www-form-urlencoded").withBody(queryString);
|
|
|
|
request.isExternalCall(true);
|
|
} catch (Exception e) {
|
|
throw new KeycloakClientException("Cannot construct the request object correctly", e);
|
|
}
|
|
|
|
GXInboundResponse response;
|
|
try {
|
|
response = request.post();
|
|
} catch (Exception e) {
|
|
throw new KeycloakClientException("Cannot send request correctly", e);
|
|
}
|
|
if (response.isSuccessResponse()) {
|
|
try {
|
|
return response.tryConvertStreamedContentFromJson(TokenResponse.class);
|
|
} catch (Exception e) {
|
|
throw new KeycloakClientException("Cannot construct token response object correctly", e);
|
|
}
|
|
} else {
|
|
throw KeycloakClientException.create("Unable to get token", response.getHTTPCode(),
|
|
response.getHeaderFields()
|
|
.getOrDefault("content-type", Collections.singletonList("unknown/unknown")).get(0),
|
|
response.getMessage());
|
|
}
|
|
}
|
|
|
|
}
|