Skip to content

Commit 08654fb

Browse files
patternhelloworldpatternhelloworld
committed
authorization code module (in development - 3)
1 parent 1cc7763 commit 08654fb

File tree

6 files changed

+61
-60
lines changed

6 files changed

+61
-60
lines changed

‎README.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -193,7 +193,7 @@ public class CommonDataSourceConfiguration {
193193
* Refer to ``client/src/docs/asciidoc/api-app.adoc``
194194

195195
## OAuth2 - Authorization Code
196-
* Open the web browser by connecting to ``http://localhost:8370/oauth2/authorization?code=32132&response_type=code&client_id=client_customer&redirect_uri=http%3A%2F%2Flocalhost%3A8370%2Fcallback1``
196+
* Open the web browser by connecting to ``http://localhost:8370/oauth2/authorization?code=32132&response_type=code&client_id=client_customer&redirect_uri=http%3A%2F%2Flocalhost%3A8370%2Fcallback1``, using the values from the ``oauth2_registered_client``
197197
* Login with ``[email protected] / 1234 ``
198198

199199
## Running this App with Docker

‎client/src/main/java/com/patternknife/securityhelper/oauth2/client/config/logger/module/ResponseErrorLogConfig.java

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -21,7 +21,7 @@ public class ResponseErrorLogConfig {
2121
private static final Logger logger = LoggerFactory.getLogger(ResponseErrorLogConfig.class);
2222

2323

24-
@AfterReturning(pointcut = ("within(com.patternknife.securityhelper.oauth2.client.config.response.error..*)"),
24+
@AfterReturning(pointcut = ("within(com.patternknife.securityhelper.oauth2.client.config.response.error..*) || within(io.github.patternknife.securityhelper.oauth2.api.config.security.response.error.handler..*)"),
2525
returning = "returnValue")
2626
public void endpointAfterExceptionReturning(JoinPoint p, Object returnValue) {
2727

‎src/main/java/io/github/patternknife/securityhelper/oauth2/api/config/security/converter/auth/endpoint/KnifeAuthorizationCodeRequestConverterController.java

Lines changed: 22 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -50,28 +50,28 @@ public KnifeAuthorizationCodeRequestConverterController(RegisteredClientReposito
5050

5151

5252
@PostMapping("/oauth2/authorization")
53-
public String authorize(@RequestParam(OAuth2ParameterNames.CLIENT_ID) String clientId,
54-
@RequestParam(OAuth2ParameterNames.STATE) String state,
55-
@RequestParam(OAuth2ParameterNames.SCOPE) Set<String> scopes,
56-
@RequestParam(name = OAuth2ParameterNames.CODE, required = false) String authorizationCode,
57-
@RequestParam(name = "consent_action", required = false) String consentAction,
58-
Model model) {
53+
public String authorize(Model model, @RequestParam(OAuth2ParameterNames.CLIENT_ID) String clientId,
54+
@RequestParam(OAuth2ParameterNames.REDIRECT_URI) String redirectUri,
55+
@RequestParam(name = OAuth2ParameterNames.CODE) String authorizationCode) {
5956
// 예시: 클라이언트의 등록된 콜백 URL 가져오기
6057
RegisteredClient registeredClient = this.registeredClientRepository.findByClientId(clientId);
61-
String redirectUri = registeredClient.getRedirectUris().iterator().next();
62-
63-
// 승인된 스코프를 바탕으로 Authorization Code 생성 로직
64-
// Authorization Code를 생성하여 저장하고 해당 코드를 콜백 URL로 리다이렉트합니다.
65-
if ("approve".equals(consentAction)) {
66-
// 실제로는 이곳에서 OAuth2Authorization 객체를 생성하고 저장하는 로직 필요
67-
authorizationCode = "generated-authorization-code"; // 실제 생성된 코드로 교체
68-
69-
// 콜백 URL로 리다이렉트하며 Authorization Code를 전달
70-
return "redirect:" + redirectUri + "?code=" + authorizationCode + "&state=" + state;
71-
} else {
72-
// 거부한 경우 에러 페이지 혹은 다시 로그인 페이지로 리다이렉트
73-
return "redirect:/login?error=access_denied";
58+
if (!registeredClient.getRedirectUris().contains(redirectUri)) {
59+
logger.error("message (Invalid redirect URI when consenting): "
60+
+ "authorizationCode=" + authorizationCode + ", "
61+
+ "clientId=" + clientId + ", "
62+
+ "redirectUri=" + redirectUri + ", "
63+
+ "registeredRedirectUris=" + registeredClient.getRedirectUris().toString());
64+
model.addAttribute("userMessage", iSecurityUserExceptionMessageService.getUserMessage(DefaultSecurityUserExceptionMessage.AUTHENTICATION_INVALID_REDIRECT_URI));
65+
return "error";
7466
}
67+
68+
OAuth2Authorization oAuth2Authorization = oAuth2AuthorizationService.findByToken(authorizationCode, new OAuth2TokenType("authorization_code"));
69+
if(oAuth2Authorization == null){
70+
return "login";
71+
}
72+
String principalName = oAuth2Authorization.getPrincipalName();
73+
74+
return "redirect:" + redirectUri + "?code=" + authorizationCode;
7575
}
7676

7777

@@ -143,7 +143,7 @@ public String consent(Model model,
143143
return "redirect:" + redirectUri + "?code=" + authorizationCode;
144144
}else{
145145

146-
Set<String> authorizedScopes = currentAuthorizationConsent.getScopes();
146+
Set<String> authorizedScopes = registeredClient.getScopes();
147147

148148
Set<String> requestedScopes = StringUtils.commaDelimitedListToSet(scope);
149149

@@ -174,7 +174,8 @@ public String consent(Model model,
174174
model.addAttribute("clientId", clientId);
175175
model.addAttribute("scopes", withDescription(approvedScopes));
176176
model.addAttribute("principalName", principalName);
177-
model.addAttribute("requestURI", "/oauth2/authorization");
177+
model.addAttribute("redirectUri", redirectUri);
178+
model.addAttribute("consentRequestURI", "/oauth2/authorization");
178179

179180
return "consent";
180181
}

‎src/main/java/io/github/patternknife/securityhelper/oauth2/api/config/security/serivce/persistence/authorization/OAuth2AuthorizationServiceImpl.java

Lines changed: 32 additions & 32 deletions
Original file line numberDiff line numberDiff line change
@@ -88,47 +88,47 @@ public void save(OAuth2Authorization shouldBeNewAuthorization) {
8888
}else{
8989
// ROPC
9090
knifeAuthorization.setRegisteredClientId(shouldBeNewAuthorization.getAttribute("client_id"));
91-
}
9291

93-
if(shouldBeNewAuthorization.getAccessToken() != null) {
94-
knifeAuthorization.hashSetAccessTokenValue(shouldBeNewAuthorization.getAccessToken().getToken().getTokenValue());
95-
}
96-
if(shouldBeNewAuthorization.getRefreshToken() != null) {
97-
knifeAuthorization.hashSetRefreshTokenValue(shouldBeNewAuthorization.getRefreshToken().getToken().getTokenValue());
98-
}
92+
if(shouldBeNewAuthorization.getAccessToken() != null) {
93+
knifeAuthorization.hashSetAccessTokenValue(shouldBeNewAuthorization.getAccessToken().getToken().getTokenValue());
94+
}
95+
if(shouldBeNewAuthorization.getRefreshToken() != null) {
96+
knifeAuthorization.hashSetRefreshTokenValue(shouldBeNewAuthorization.getRefreshToken().getToken().getTokenValue());
97+
}
9998

100-
String appTokenValue = shouldBeNewAuthorization.getAttribute(KnifeHttpHeaders.APP_TOKEN);
101-
if (appTokenValue != null) {
102-
knifeAuthorization.setAccessTokenAppToken(appTokenValue);
103-
}
99+
String appTokenValue = shouldBeNewAuthorization.getAttribute(KnifeHttpHeaders.APP_TOKEN);
100+
if (appTokenValue != null) {
101+
knifeAuthorization.setAccessTokenAppToken(appTokenValue);
102+
}
104103

105-
String userAgentValue = shouldBeNewAuthorization.getAttribute(KnifeHttpHeaders.USER_AGENT);
106-
if (!StringUtils.isEmpty(userAgentValue)) {
107-
knifeAuthorization.setAccessTokenUserAgent(userAgentValue);
108-
}
104+
String userAgentValue = shouldBeNewAuthorization.getAttribute(KnifeHttpHeaders.USER_AGENT);
105+
if (!StringUtils.isEmpty(userAgentValue)) {
106+
knifeAuthorization.setAccessTokenUserAgent(userAgentValue);
107+
}
109108

110-
String remoteIp = shouldBeNewAuthorization.getAttribute(KnifeHttpHeaders.X_Forwarded_For);
111-
if (remoteIp != null) {
112-
knifeAuthorization.setAccessTokenRemoteIp(remoteIp);
113-
}
109+
String remoteIp = shouldBeNewAuthorization.getAttribute(KnifeHttpHeaders.X_Forwarded_For);
110+
if (remoteIp != null) {
111+
knifeAuthorization.setAccessTokenRemoteIp(remoteIp);
112+
}
114113

115-
knifeAuthorization.setAttributes(shouldBeNewAuthorization);
116-
knifeAuthorization.setAccessTokenType(shouldBeNewAuthorization.getAuthorizationGrantType().getValue());
117-
knifeAuthorization.setAccessTokenScopes(String.join(",", shouldBeNewAuthorization.getAuthorizedScopes()));
114+
knifeAuthorization.setAccessTokenType(shouldBeNewAuthorization.getAuthorizationGrantType().getValue());
115+
knifeAuthorization.setAccessTokenScopes(String.join(",", shouldBeNewAuthorization.getAuthorizedScopes()));
118116

119-
// Token Expiration
120-
knifeAuthorization.setAccessTokenIssuedAt(LocalDateTime.ofInstant(Instant.now(), ZoneId.systemDefault()));
121-
if (shouldBeNewAuthorization.getAccessToken() != null && shouldBeNewAuthorization.getAccessToken().getToken().getExpiresAt() != null) {
122-
knifeAuthorization.setAccessTokenExpiresAt(LocalDateTime.ofInstant(shouldBeNewAuthorization.getAccessToken().getToken().getExpiresAt(), ZoneId.systemDefault()));
123-
}
117+
// Token Expiration
118+
knifeAuthorization.setAccessTokenIssuedAt(LocalDateTime.ofInstant(Instant.now(), ZoneId.systemDefault()));
119+
if (shouldBeNewAuthorization.getAccessToken() != null && shouldBeNewAuthorization.getAccessToken().getToken().getExpiresAt() != null) {
120+
knifeAuthorization.setAccessTokenExpiresAt(LocalDateTime.ofInstant(shouldBeNewAuthorization.getAccessToken().getToken().getExpiresAt(), ZoneId.systemDefault()));
121+
}
124122

125-
// Token Expiration
126-
knifeAuthorization.setRefreshTokenIssuedAt(LocalDateTime.ofInstant(Instant.now(), ZoneId.systemDefault()));
127-
if (shouldBeNewAuthorization.getRefreshToken() != null && shouldBeNewAuthorization.getRefreshToken().getToken().getExpiresAt() != null) {
128-
knifeAuthorization.setRefreshTokenExpiresAt(LocalDateTime.ofInstant(shouldBeNewAuthorization.getRefreshToken().getToken().getExpiresAt(), ZoneId.systemDefault()));
123+
// Token Expiration
124+
knifeAuthorization.setRefreshTokenIssuedAt(LocalDateTime.ofInstant(Instant.now(), ZoneId.systemDefault()));
125+
if (shouldBeNewAuthorization.getRefreshToken() != null && shouldBeNewAuthorization.getRefreshToken().getToken().getExpiresAt() != null) {
126+
knifeAuthorization.setRefreshTokenExpiresAt(LocalDateTime.ofInstant(shouldBeNewAuthorization.getRefreshToken().getToken().getExpiresAt(), ZoneId.systemDefault()));
127+
}
128+
knifeAuthorization.setAuthorizationGrantType(shouldBeNewAuthorization.getAttribute("grant_type"));
129129
}
130-
knifeAuthorization.setAuthorizationGrantType(shouldBeNewAuthorization.getAttribute("grant_type"));
131130

131+
knifeAuthorization.setAttributes(shouldBeNewAuthorization);
132132

133133
knifeAuthorizationRepository.save(knifeAuthorization);
134134

‎src/main/java/io/github/patternknife/securityhelper/oauth2/api/domain/traditionaloauth/service/TraditionalOauthService.java

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -75,7 +75,7 @@ public TraditionalOauthService(RegisteredClientRepositoryImpl registeredClientRe
7575

7676

7777
public SpringSecurityTraditionalOauthDTO.TokenResponse createAccessToken(SpringSecurityTraditionalOauthDTO.TokenRequest accessTokenRequest,
78-
String authorizationHeader) {
78+
String authorizationHeader) throws KnifeOauth2AuthenticationException {
7979
try {
8080
BasicTokenResolver.BasicCredentials basicCredentials = BasicTokenResolver.parse(authorizationHeader).orElseThrow(() -> new KnifeOauth2AuthenticationException(ErrorMessages.builder().message("Header parsing error (header : " + authorizationHeader).userMessage(iSecurityUserExceptionMessageService.getUserMessage(DefaultSecurityUserExceptionMessage.AUTHENTICATION_WRONG_CLIENT_ID_SECRET)).build()));
8181

@@ -113,7 +113,7 @@ public SpringSecurityTraditionalOauthDTO.TokenResponse createAccessToken(SpringS
113113
}
114114

115115
public SpringSecurityTraditionalOauthDTO.TokenResponse refreshAccessToken(SpringSecurityTraditionalOauthDTO.TokenRequest refreshTokenRequest,
116-
String authorizationHeader) {
116+
String authorizationHeader) throws KnifeOauth2AuthenticationException {
117117
try {
118118
BasicTokenResolver.BasicCredentials basicCredentials = BasicTokenResolver.parse(authorizationHeader).orElseThrow(() -> new KnifeOauth2AuthenticationException(ErrorMessages.builder().message("Header parsing error (header : " + authorizationHeader).userMessage(iSecurityUserExceptionMessageService.getUserMessage(DefaultSecurityUserExceptionMessage.AUTHENTICATION_WRONG_CLIENT_ID_SECRET)).build()));
119119

@@ -156,7 +156,7 @@ public SpringSecurityTraditionalOauthDTO.TokenResponse refreshAccessToken(Spring
156156

157157

158158
public SpringSecurityTraditionalOauthDTO.AuthorizationCodeResponse createAuthorizationCode(SpringSecurityTraditionalOauthDTO.AuthorizationCodeRequest authorizationCodeRequest,
159-
String authorizationHeader) {
159+
String authorizationHeader) throws KnifeOauth2AuthenticationException {
160160
try {
161161

162162
BasicTokenResolver.BasicCredentials basicCredentials = BasicTokenResolver.parse(authorizationHeader)

‎src/main/resources/templates/consent.html

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -46,9 +46,9 @@ <h1 class="text-center text-primary">App permissions</h1>
4646
</div>
4747
<div class="row">
4848
<div class="col text-center">
49-
<form name="consent_form" method="post" th:action="${requestURI}">
49+
<form name="consent_form" method="post" th:action="${consentRequestURI}">
5050
<input type="hidden" name="client_id" th:value="${clientId}">
51-
<input type="hidden" name="state" th:value="${state}">
51+
<input type="hidden" name="redirect_uri" th:value="${redirectUri}">
5252
<input type="hidden" name="code" th:value="${code}">
5353

5454
<div th:each="scope: ${scopes}" class="form-check py-1">

0 commit comments

Comments
 (0)