|
|||||||||
PREV CLASS NEXT CLASS | FRAMES NO FRAMES | ||||||||
SUMMARY: NESTED | FIELD | CONSTR | METHOD | DETAIL: FIELD | CONSTR | METHOD |
java.lang.Objectcom.unboundid.directory.sdk.http.api.OAuthTokenHandler
@Extensible @DirectoryServerExtension @DirectoryProxyServerExtension(appliesToLocalContent=false, appliesToRemoteContent=true) @ThreadSafety(level=INTERFACE_THREADSAFE) public abstract class OAuthTokenHandler
This class defines an API that must be implemented by extensions which will
handle incoming SCIM requests with OAuth 2.0 bearer token authentication.
The OAuthTokenHandler is responsible for decoding the bearer token and
checking it for authenticity and validity.
OAuth provides a method for clients to access a protected resource on
behalf of a resource owner. In the general case, before a client can
access a protected resource, it must first obtain an authorization
grant from the resource owner and then exchange the authorization
grant for an access token. The access token represents the grant's
scope, duration, and other attributes specified by the authorization
grant. The client accesses the protected resource by presenting the
access token to the resource server (i.e. the Directory or Proxy Server with
the SCIM HTTP Servlet enabled).
The access token provides an abstraction, replacing different
authorization constructs (e.g., username and password, assertion) for
a single token understood by the resource server. This abstraction
enables issuing access tokens valid for a short time period, as well
as removing the resource server's need to understand a wide range of
authentication schemes. See "OAuth 2.0 Authorization Framework: Bearer
Token Usage" (RFC 6750) for the full
specification and details.
TLS security is required to use OAuth 2.0 bearer tokens, as specified in
RFC 6750. A bearer token may be used by any party
in possession of that token (the "bearer"), and thus needs to be protected
when transmitted across the network. Implementations of this API should take
special care to verify that the token came from a trusted source (using a
secret key or some other signing mechanism to prove that the token is
authentic). Please read "OAuth 2.0 Threat Model and Security Considerations"
(RFC 6819) for a comprehensive list of
security threats to consider when working with OAuth bearer tokens.
The OAuthTokenHandler is also responsible for extracting an authorization DN
from the bearer token (or otherwise providing one), which will be used to
apply access controls before returning the protected resource. There are also
methods to extract the expiration date of the token as well as verify that
the intended audience is this server (to deal with token redirect).
The order these methods are called by the SCIM HTTP Servlet Extension is as
follows:
dsconfig create-oauth-token-handler \ --handler-name "{handler-name}" \ --type third-party \ --set "extension-class:{class-name}" \ --set "extension-argument:{name=value}"where "{handler-name}" is the name to use for the token handler instance, "{class-name}" is the fully-qualified name of the Java class that extends
com.unboundid.directory.sdk.http.api.OAuthTokenHandler
,
and "{name=value}" represents name-value pairs for any arguments to
provide to the token handler. If multiple arguments should be provided to
the token handler, then the
"--set extension-argument:{name=value}
" option should be
provided multiple times.
ScriptedOAuthTokenHandler
Constructor Summary | |
---|---|
OAuthTokenHandler()
Creates a new instance of this token handler. |
Method Summary | |
---|---|
com.unboundid.ldap.sdk.ResultCode |
applyConfiguration(OAuthTokenHandlerConfig config,
com.unboundid.util.args.ArgumentParser parser,
java.util.List<java.lang.String> adminActionsRequired,
java.util.List<java.lang.String> messages)
Attempts to apply the configuration from the provided argument parser to this extension. |
abstract com.unboundid.scim.sdk.OAuthToken |
decodeOAuthToken(java.lang.String base64TokenValue)
Creates an OAuthToken instance from the incoming token value. |
void |
defineConfigArguments(com.unboundid.util.args.ArgumentParser parser)
Updates the provided argument parser to define any configuration arguments which may be used by this extension. |
void |
finalizeTokenHandler()
Performs any cleanup which may be necessary when this token handler is to be taken out of service. |
abstract com.unboundid.ldap.sdk.DN |
getAuthzDN(com.unboundid.scim.sdk.OAuthToken token)
Extracts the DN of the authorization entry (for which to apply access controls) from the incoming token. |
java.util.Map<java.util.List<java.lang.String>,java.lang.String> |
getExamplesArgumentSets()
Retrieves a map containing examples of configurations that may be used for this extension. |
abstract java.lang.String[] |
getExtensionDescription()
Retrieves a human-readable description for this extension. |
abstract java.lang.String |
getExtensionName()
Retrieves a human-readable name for this extension. |
void |
initializeTokenHandler(HTTPServerContext serverContext,
OAuthTokenHandlerConfig config,
com.unboundid.util.args.ArgumentParser parser)
Initializes this token handler. |
boolean |
isConfigurationAcceptable(OAuthTokenHandlerConfig config,
com.unboundid.util.args.ArgumentParser parser,
java.util.List<java.lang.String> unacceptableReasons)
Indicates whether the configuration represented by the provided argument parser is acceptable for use by this extension. |
abstract boolean |
isTokenAuthentic(com.unboundid.scim.sdk.OAuthToken token)
Determines whether the incoming token is authentic (i.e. |
abstract boolean |
isTokenExpired(com.unboundid.scim.sdk.OAuthToken token)
Determines whether the given token is expired. |
abstract boolean |
isTokenForThisServer(com.unboundid.scim.sdk.OAuthToken token)
Determines whether the incoming token is targeted for this server. |
abstract com.unboundid.scim.sdk.OAuthTokenStatus |
validateToken(com.unboundid.scim.sdk.OAuthToken token,
com.unboundid.scim.sdk.SCIMRequest scimRequest)
Determines whether the incoming token is valid for the given request. |
Methods inherited from class java.lang.Object |
---|
clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait |
Constructor Detail |
---|
public OAuthTokenHandler()
initializeTokenHandler
method.
Method Detail |
---|
public abstract java.lang.String getExtensionName()
getExtensionName
in interface UnboundIDExtension
public abstract java.lang.String[] getExtensionDescription()
getExtensionDescription
in interface UnboundIDExtension
null
or an empty array if no description should be available.public void defineConfigArguments(com.unboundid.util.args.ArgumentParser parser) throws com.unboundid.util.args.ArgumentException
defineConfigArguments
in interface Configurable
parser
- The argument parser to be updated with the configuration
arguments which may be used by this extension.
com.unboundid.util.args.ArgumentException
- If a problem is encountered while updating the
provided argument parser.public void initializeTokenHandler(HTTPServerContext serverContext, OAuthTokenHandlerConfig config, com.unboundid.util.args.ArgumentParser parser) throws com.unboundid.ldap.sdk.LDAPException
serverContext
- A handle to the server context for the server in
which this extension is running.config
- The general configuration for this token handler.parser
- The argument parser which has been initialized from
the configuration for this token handler.
com.unboundid.ldap.sdk.LDAPException
- If a problem occurs while initializing this token
handler.public boolean isConfigurationAcceptable(OAuthTokenHandlerConfig config, com.unboundid.util.args.ArgumentParser parser, java.util.List<java.lang.String> unacceptableReasons)
isConfigurationAcceptable
in interface Reconfigurable<OAuthTokenHandlerConfig>
config
- The general configuration for this extension.parser
- The argument parser that has been used to
parse the proposed configuration for this
extension.unacceptableReasons
- A list to which messages may be added to
provide additional information about why the
provided configuration is not acceptable.
true
if the configuration in the provided argument parser
appears to be acceptable, or false
if not.public com.unboundid.ldap.sdk.ResultCode applyConfiguration(OAuthTokenHandlerConfig config, com.unboundid.util.args.ArgumentParser parser, java.util.List<java.lang.String> adminActionsRequired, java.util.List<java.lang.String> messages)
applyConfiguration
in interface Reconfigurable<OAuthTokenHandlerConfig>
config
- The general configuration for this extension.parser
- The argument parser that has been used to
parse the new configuration for this
extension.adminActionsRequired
- A list to which messages may be added to
provide additional information about any
additional administrative actions that may
be required to apply some of the
configuration changes.messages
- A list to which messages may be added to
provide additional information about the
processing performed by this method.
SUCCESS
should be
used to indicate that all processing completed successfully. Any
other result will indicate that a problem occurred during
processing.public void finalizeTokenHandler()
public java.util.Map<java.util.List<java.lang.String>,java.lang.String> getExamplesArgumentSets()
getExamplesArgumentSets
in interface ExampleUsageProvider
null
or empty if there should
not be any example argument sets.public abstract com.unboundid.scim.sdk.OAuthToken decodeOAuthToken(java.lang.String base64TokenValue) throws java.security.GeneralSecurityException
OAuthToken
instance from the incoming token value.
Implementers may choose to return a subclass of OAuthToken
in order
to provide convenience methods for interacting with the token. This can be
helpful because the returned OAuthToken
is passed to all of the
other methods in this class.
base64TokenValue
- the base64-encoded bearer token value
OAuthToken
instance. This must not be null
.
java.security.GeneralSecurityException
- if there is an error decoding the tokenpublic abstract boolean isTokenExpired(com.unboundid.scim.sdk.OAuthToken token) throws java.security.GeneralSecurityException
token
- the OAuth 2.0 bearer token.
true
if the token is already expired, false
if not.
java.security.GeneralSecurityException
- if there is an error determining the
token's expiration datepublic abstract boolean isTokenAuthentic(com.unboundid.scim.sdk.OAuthToken token) throws java.security.GeneralSecurityException
token
- the OAuth 2.0 bearer token.
true
if the bearer token can be verified as authentic and
originating from a trusted source, false
if not.
java.security.GeneralSecurityException
- if there is an error determining whether
the token is authenticpublic abstract boolean isTokenForThisServer(com.unboundid.scim.sdk.OAuthToken token) throws java.security.GeneralSecurityException
token
- the OAuth 2.0 bearer token.
true
if the bearer token identifies this server as the
intended recipient, false
if not.
java.security.GeneralSecurityException
- if there is an error determining whether
the token is for this serverpublic abstract com.unboundid.scim.sdk.OAuthTokenStatus validateToken(com.unboundid.scim.sdk.OAuthToken token, com.unboundid.scim.sdk.SCIMRequest scimRequest) throws java.security.GeneralSecurityException
SCIMRequest
. This typically
involves checking the token scope and any other attributes granted by the
authorization grant. Implementations may need to call back to the
authorization server to verify that the token is still valid and has not
been revoked.
token
- the OAuth 2.0 bearer token.scimRequest
- the SCIMRequest
that we are validating.
OAuthTokenStatus
object which indicates whether the
bearer token is valid and grants access to the target resource.
This must not be null
.
java.security.GeneralSecurityException
- if there is an error determining whether
the token is validpublic abstract com.unboundid.ldap.sdk.DN getAuthzDN(com.unboundid.scim.sdk.OAuthToken token) throws java.security.GeneralSecurityException
This may require performing an LDAP search in order to find the DN that matches a certain attribute value contained in the token.
token
- the OAuth 2.0 bearer token.
java.security.GeneralSecurityException
- if there is an error determining the
authorization user DN
|
|||||||||
PREV CLASS NEXT CLASS | FRAMES NO FRAMES | ||||||||
SUMMARY: NESTED | FIELD | CONSTR | METHOD | DETAIL: FIELD | CONSTR | METHOD |