ayyoob
8 years ago
parent
e45682806f
commit
ca53efdab0
@ -0,0 +1,567 @@
|
||||
/*
|
||||
* Copyright (c) 2016, WSO2 Inc. (http://www.wso2.org) All Rights Reserved.
|
||||
*
|
||||
* WSO2 Inc. licenses this file to you under the Apache License,
|
||||
* Version 2.0 (the "License"); you may not use this file except
|
||||
* in compliance with the License.
|
||||
* You may obtain a copy of the License at
|
||||
*
|
||||
* http://www.apache.org/licenses/LICENSE-2.0
|
||||
*
|
||||
* Unless required by applicable law or agreed to in writing,
|
||||
* software distributed under the License is distributed on an
|
||||
* "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND,
|
||||
* either express or implied. See the License for the
|
||||
* specific language governing permissions and limitations
|
||||
* under the License.
|
||||
*/
|
||||
|
||||
var utils = function () {
|
||||
var log = new Log("/modules/oauth/token-handler-utils.js");
|
||||
|
||||
var configs = require('/configs/portal.js').config();
|
||||
var constants = require("/modules/constants.js");
|
||||
var carbon = require("carbon");
|
||||
|
||||
//noinspection JSUnresolvedVariable
|
||||
var Base64 = Packages.org.apache.commons.codec.binary.Base64;
|
||||
//noinspection JSUnresolvedVariable
|
||||
var String = Packages.java.lang.String;
|
||||
|
||||
var publicMethods = {};
|
||||
var privateMethods = {};
|
||||
|
||||
publicMethods["encode"] = function (payload) {
|
||||
return String(Base64.encodeBase64(String(payload).getBytes()));
|
||||
};
|
||||
|
||||
publicMethods["decode"] = function (payload) {
|
||||
return String(Base64.decodeBase64(String(payload).getBytes()));
|
||||
};
|
||||
|
||||
/**
|
||||
* Check whether this application is oauth enable or not
|
||||
* @returns boolean if oauth enable
|
||||
*/
|
||||
publicMethods["checkOAuthEnabled"] = function () {
|
||||
if (constants.AUTHORIZATION_TYPE_OAUTH === configs["authorization"]["activeMethod"]) {
|
||||
return true;
|
||||
}
|
||||
return false;
|
||||
};
|
||||
|
||||
/**
|
||||
* Set access token into xml http request header
|
||||
* @param xhr xml http request
|
||||
* @returns {*} xhr which has access token it's header
|
||||
*/
|
||||
publicMethods["setAccessToken"] = function (xhr, callback) {
|
||||
var accessToken;
|
||||
if (publicMethods.checkOAuthEnabled()) {
|
||||
try {
|
||||
accessToken = parse(session.get(constants.ACCESS_TOKEN_PAIR_IDENTIFIER_FOR_PORTAL))["accessToken"];
|
||||
xhr.setRequestHeader(constants.AUTHORIZATION_HEADER, constants.BEARER_PREFIX + accessToken);
|
||||
} catch (exception) {
|
||||
log.error("Access token hasn't been set yet, " + exception);
|
||||
} finally {
|
||||
callback(xhr);
|
||||
}
|
||||
}
|
||||
callback(xhr);
|
||||
};
|
||||
|
||||
/**
|
||||
* Get access token of current logged user
|
||||
* @param callBack response with access token
|
||||
*/
|
||||
publicMethods["getAccessToken"] = function (callBack) {
|
||||
var accessToken = null;
|
||||
if (publicMethods.checkOAuthEnabled()) {
|
||||
try {
|
||||
accessToken = parse(session.get(constants.ACCESS_TOKEN_PAIR_IDENTIFIER_FOR_PORTAL))["accessToken"];
|
||||
} catch (exception) {
|
||||
log.error("Access token hasn't been set yet, " + exception);
|
||||
} finally {
|
||||
callBack(accessToken);
|
||||
}
|
||||
}
|
||||
callBack(accessToken);
|
||||
};
|
||||
|
||||
/**
|
||||
* Create error message which adhere to xml http response object
|
||||
* @param statusCode response status code
|
||||
* @param status response status
|
||||
* @param responseText response message
|
||||
* @returns {{statusCode: *, status: *, responseText: *}}
|
||||
*/
|
||||
publicMethods["createXHRObject"] = function (statusCode, status, responseText) {
|
||||
return {"statusCode": statusCode, "status": status, "responseText": responseText};
|
||||
};
|
||||
|
||||
/**
|
||||
* check whether user already logged to system before invoking any apis
|
||||
* @param callBack
|
||||
*/
|
||||
publicMethods["isUserAuthorized"] = function (callBack) {
|
||||
if (session.get("Loged") !== constants.LOGIN_MESSAGE) {
|
||||
callBack(false);
|
||||
} else {
|
||||
callBack(true);
|
||||
}
|
||||
};
|
||||
|
||||
/**
|
||||
* Get identity provider uir
|
||||
* @returns {*}
|
||||
*/
|
||||
publicMethods["getIdPServerURL"] = function () {
|
||||
return configs["authorization"]["methods"]["oauth"]["attributes"]["oauthProvider"]["tokenServiceURL"];
|
||||
};
|
||||
|
||||
/**
|
||||
* Get an Access token pair based on client secret
|
||||
* @param encodedClientKeys {{clientId:"", clientSecret:""}}
|
||||
* @param scope eg: PRODUCTION
|
||||
* @param idPServer identity provider url
|
||||
* @returns {{accessToken: *, refreshToken: *}}
|
||||
*/
|
||||
publicMethods["getTokenWithClientSecretType"] = function (encodedClientKeys, scope, idPServer) {
|
||||
var xhr = new XMLHttpRequest();
|
||||
var tokenEndpoint = idPServer;
|
||||
xhr.open(constants.HTTP_POST, tokenEndpoint, false);
|
||||
xhr.setRequestHeader(constants.CONTENT_TYPE_IDENTIFIER, constants.APPLICATION_X_WWW_FOR_URLENCODED);
|
||||
xhr.setRequestHeader(constants.AUTHORIZATION_HEADER, constants.BASIC_PREFIX + encodedClientKeys);
|
||||
xhr.send("grant_type=client_credentials&scope=" + scope);
|
||||
var tokenPair = {};
|
||||
if (xhr.status == constants.HTTP_ACCEPTED) {
|
||||
var data = parse(xhr.responseText);
|
||||
tokenPair.refreshToken = data.refresh_token;
|
||||
tokenPair.accessToken = data.access_token;
|
||||
} else if (xhr.status == constants.HTTP_USER_NOT_AUTHENTICATED) {
|
||||
log.error("Error in obtaining token with client secret grant type, You are not authenticated yet");
|
||||
return null;
|
||||
} else {
|
||||
log.error("Error in obtaining token with client secret grant type, This might be a problem with client meta " +
|
||||
"data which required for client secret grant type");
|
||||
return null;
|
||||
}
|
||||
return tokenPair;
|
||||
};
|
||||
|
||||
|
||||
/**
|
||||
* This will create client id and client secret for a given application
|
||||
* @param properties "callbackUrl": "",
|
||||
* "clientName": "",
|
||||
* "owner": "",
|
||||
* "applicationType": "",
|
||||
* "grantType": "",
|
||||
* "saasApp" :"",
|
||||
* "dynamicClientRegistrationEndPoint" : ""
|
||||
*
|
||||
* @returns {{clientId:*, clientSecret:*}}
|
||||
*/
|
||||
publicMethods["getDynamicClientAppCredentials"] = function (username) {
|
||||
// setting up dynamic client application properties
|
||||
var dcAppProperties = {
|
||||
"applicationType": configs["authorization"]["methods"]["oauth"]["attributes"]["oauthProvider"]["appRegistration"]["appType"],
|
||||
"clientName": configs["authorization"]["methods"]["oauth"]["attributes"]["oauthProvider"]["appRegistration"]["clientName"],
|
||||
"owner": configs["authorization"]["methods"]["oauth"]["attributes"]["oauthProvider"]["appRegistration"]["owner"],
|
||||
"tokenScope": configs["authorization"]["methods"]["oauth"]["attributes"]["oauthProvider"]["appRegistration"]["tokenScope"],
|
||||
"grantType": configs["authorization"]["methods"]["oauth"]["attributes"]["oauthProvider"]["appRegistration"]["grantType"],
|
||||
"callbackUrl": configs["authorization"]["methods"]["oauth"]["attributes"]["oauthProvider"]["appRegistration"]["callbackUrl"],
|
||||
"saasApp" : configs["authorization"]["methods"]["oauth"]["attributes"]["oauthProvider"]["appRegistration"]["saasApp"]
|
||||
};
|
||||
|
||||
var tenantDomain = carbon.server.tenantDomain({username: username});
|
||||
if (!tenantDomain) {
|
||||
log.error("{/modules/oauth/token-handler-utils.js} Error in retrieving tenant " +
|
||||
"based client application credentials. Unable to obtain a valid tenant domain for provided username "+
|
||||
username +"- getDynamicClientAppCredentials(x)");
|
||||
return null;
|
||||
} else {
|
||||
var cachedTenantBasedClientAppCredentials = privateMethods.
|
||||
getCachedTenantBasedClientAppCredentials(tenantDomain);
|
||||
if (cachedTenantBasedClientAppCredentials) {
|
||||
return cachedTenantBasedClientAppCredentials;
|
||||
} else {
|
||||
// calling dynamic client app registration service endpoint
|
||||
var requestURL = configs["authorization"]["methods"]["oauth"]["attributes"]["oauthProvider"]["appRegistration"]
|
||||
["dynamicClientAppRegistrationServiceURL"];
|
||||
var requestPayload = dcAppProperties;
|
||||
var token = publicMethods.encode(configs["authorization"]["methods"]["oauth"]["attributes"]["oauthProvider"]
|
||||
["appRegistration"]["owner"] + ":" + configs["authorization"]["methods"]["oauth"]["attributes"]
|
||||
["oauthProvider"]["appRegistration"]["password"]);
|
||||
var xhr = new XMLHttpRequest();
|
||||
xhr.open("POST", requestURL, false);
|
||||
xhr.setRequestHeader("Content-Type", "application/json");
|
||||
xhr.setRequestHeader("Authorization", "Basic "+ token);
|
||||
xhr.send(stringify(requestPayload));
|
||||
var dynamicClientAppCredentials = {};
|
||||
if (xhr["status"] == 201 || xhr["status"] == 200 && xhr["responseText"]) {
|
||||
var responsePayload = parse(xhr["responseText"]);
|
||||
var clientId = responsePayload["client_id"];
|
||||
var clientSecret = responsePayload["client_secret"];
|
||||
if(typeof clientId == "undefined"){
|
||||
clientId = responsePayload["clientId"];
|
||||
}
|
||||
if(typeof clientSecret == "undefined"){
|
||||
clientSecret = responsePayload["clientSecret"];
|
||||
}
|
||||
dynamicClientAppCredentials["clientId"] = clientId;
|
||||
dynamicClientAppCredentials["clientSecret"] = clientSecret;
|
||||
privateMethods.
|
||||
setCachedTenantBasedClientAppCredentials(tenantDomain, dynamicClientAppCredentials);
|
||||
} else if (xhr["status"] == 400) {
|
||||
log.error("{/modules/oauth/token-handler-utils.js - getDynamicClientAppCredentials()} " +
|
||||
"Bad request. Invalid data provided as dynamic client application properties.");
|
||||
dynamicClientAppCredentials = null;
|
||||
} else {
|
||||
log.error("{/modules/oauth/token-handler-utils.js - getDynamicClientAppCredentials()} " +
|
||||
"Error in retrieving dynamic client credentials.");
|
||||
dynamicClientAppCredentials = null;
|
||||
}
|
||||
// returning dynamic client credentials
|
||||
return dynamicClientAppCredentials;
|
||||
}
|
||||
}
|
||||
};
|
||||
|
||||
/**
|
||||
* If gateway is enable, apiManagerClientAppRegistrationServiceURL is used to create oauth application
|
||||
* @param username username of current logged user
|
||||
* @returns {{clientId:*, clientSecret:*}}
|
||||
*/
|
||||
publicMethods["getTenantBasedClientAppCredentials"] = function (username) {
|
||||
if (!username) {
|
||||
log.error("{/modules/oauth/token-handler-utils.js} Error in retrieving tenant " +
|
||||
"based client app credentials. No username " +
|
||||
"as input - getTenantBasedClientAppCredentials(x)");
|
||||
return null;
|
||||
} else {
|
||||
//noinspection JSUnresolvedFunction, JSUnresolvedVariable
|
||||
var tenantDomain = carbon.server.tenantDomain({username: username});
|
||||
|
||||
if (!tenantDomain) {
|
||||
log.error("{/modules/oauth/token-handler-utils.js} Error in retrieving tenant " +
|
||||
"based client application credentials. Unable to obtain a valid tenant domain for provided " +
|
||||
"username - getTenantBasedClientAppCredentials(x, y)");
|
||||
return null;
|
||||
} else {
|
||||
var cachedTenantBasedClientAppCredentials = privateMethods.
|
||||
getCachedTenantBasedClientAppCredentials(tenantDomain);
|
||||
if (cachedTenantBasedClientAppCredentials) {
|
||||
return cachedTenantBasedClientAppCredentials;
|
||||
} else {
|
||||
var adminUsername = configs["authorization"]["methods"]["oauth"]["attributes"]["adminUser"];
|
||||
var adminUserTenantId = configs["authorization"]["methods"]["oauth"]["attributes"]
|
||||
["adminUserTenantId"];
|
||||
//claims required for jwtAuthenticator.
|
||||
var claims = {"http://wso2.org/claims/enduserTenantId": adminUserTenantId,
|
||||
"http://wso2.org/claims/enduser": adminUsername};
|
||||
var jwtToken = publicMethods.getJwtToken(adminUsername, claims);
|
||||
// register a tenant based client app at API Manager
|
||||
var applicationName = configs["authorization"]["methods"]["oauth"]["attributes"]["oauthProvider"]
|
||||
["appRegistration"]["clientName"] + "_" + tenantDomain;
|
||||
var requestURL = configs["authorization"]["methods"]["oauth"]["attributes"]["oauthProvider"]
|
||||
["appRegistration"]["apiManagerClientAppRegistrationServiceURL"] +
|
||||
"?tenantDomain=" + tenantDomain + "&applicationName=" + applicationName;
|
||||
var xhr = new XMLHttpRequest();
|
||||
xhr.open("POST", requestURL, false);
|
||||
xhr.setRequestHeader("Content-Type", "application/json");
|
||||
xhr.setRequestHeader("X-JWT-Assertion", "" + jwtToken);
|
||||
xhr.send();
|
||||
if ((xhr["status"] == 201 || xhr["status"] == 200) && xhr["responseText"]) {
|
||||
var responsePayload = parse(xhr["responseText"]);
|
||||
var tenantBasedClientAppCredentials = {};
|
||||
var clientId = responsePayload["client_id"];
|
||||
var clientSecret = responsePayload["client_secret"];
|
||||
if(typeof clientId == "undefined"){
|
||||
clientId = responsePayload["clientId"];
|
||||
}
|
||||
if(typeof clientSecret == "undefined"){
|
||||
clientSecret = responsePayload["clientSecret"];
|
||||
}
|
||||
tenantBasedClientAppCredentials["clientId"] = clientId;
|
||||
tenantBasedClientAppCredentials["clientSecret"] = clientSecret;
|
||||
privateMethods.
|
||||
setCachedTenantBasedClientAppCredentials(tenantDomain, tenantBasedClientAppCredentials);
|
||||
return tenantBasedClientAppCredentials;
|
||||
} else {
|
||||
log.error("{/modules/oauth/token-handler-utils.js} Error in retrieving tenant " +
|
||||
"based client application credentials from API " +
|
||||
"Manager - getTenantBasedClientAppCredentials(x, y)");
|
||||
return null;
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
};
|
||||
|
||||
/**
|
||||
* Caching oauth application credentials
|
||||
* @param tenantDomain tenant domain where application is been created
|
||||
* @param clientAppCredentials {{clientId:*, clientSecret:*}}
|
||||
*/
|
||||
privateMethods["setCachedTenantBasedClientAppCredentials"] = function (tenantDomain, clientAppCredentials) {
|
||||
var cachedTenantBasedClientAppCredentialsMap = application.get(constants["CACHED_CREDENTIALS_PORTAL_APP"]);
|
||||
if (!cachedTenantBasedClientAppCredentialsMap) {
|
||||
cachedTenantBasedClientAppCredentialsMap = {};
|
||||
cachedTenantBasedClientAppCredentialsMap[tenantDomain] = clientAppCredentials;
|
||||
application.put(constants["CACHED_CREDENTIALS_PORTAL_APP"], cachedTenantBasedClientAppCredentialsMap);
|
||||
} else if (!cachedTenantBasedClientAppCredentialsMap[tenantDomain]) {
|
||||
cachedTenantBasedClientAppCredentialsMap[tenantDomain] = clientAppCredentials;
|
||||
}
|
||||
};
|
||||
|
||||
/**
|
||||
* Get oauth application credentials from cache
|
||||
* @param tenantDomain tenant domain where application is been created
|
||||
* @returns {{clientId:*, clientSecret:*}}
|
||||
*/
|
||||
privateMethods["getCachedTenantBasedClientAppCredentials"] = function (tenantDomain) {
|
||||
var cachedTenantBasedClientAppCredentialsMap = application.get(constants["CACHED_CREDENTIALS_PORTAL_APP"]);
|
||||
if (!cachedTenantBasedClientAppCredentialsMap ||
|
||||
!cachedTenantBasedClientAppCredentialsMap[tenantDomain]) {
|
||||
return null;
|
||||
} else {
|
||||
return cachedTenantBasedClientAppCredentialsMap[tenantDomain];
|
||||
}
|
||||
};
|
||||
|
||||
/**
|
||||
* Get access token and refresh token using password grant type
|
||||
* @param username username of the logged user
|
||||
* @param password password of the logged user
|
||||
* @param encodedClientAppCredentials {{clientId:*, clientSecret:*}}
|
||||
* @param scopes scopes list
|
||||
* @returns {{accessToken: *, refreshToken: *}}
|
||||
*/
|
||||
publicMethods["getTokenPairAndScopesByPasswordGrantType"] = function (username, password
|
||||
, encodedClientAppCredentials, scopes) {
|
||||
if (!username || !password || !encodedClientAppCredentials || !scopes) {
|
||||
log.error("{/modules/oauth/token-handler-utils.js} Error in retrieving access token by password " +
|
||||
"grant type. No username, password, encoded client app credentials or scopes are " +
|
||||
"found - getTokenPairAndScopesByPasswordGrantType(a, b, c, d)");
|
||||
return null;
|
||||
} else {
|
||||
// calling oauth provider token service endpoint
|
||||
var requestURL = configs["authorization"]["methods"]["oauth"]["attributes"]["oauthProvider"]
|
||||
["tokenServiceURL"];
|
||||
var requestPayload = "grant_type=password&username=" +
|
||||
username + "&password=" + password + "&scope=" + scopes;
|
||||
|
||||
var xhr = new XMLHttpRequest();
|
||||
xhr.open("POST", requestURL, false);
|
||||
xhr.setRequestHeader("Content-Type", "application/x-www-form-urlencoded");
|
||||
xhr.setRequestHeader("Authorization", "Basic " + encodedClientAppCredentials);
|
||||
xhr.send(requestPayload);
|
||||
|
||||
if (xhr["status"] == 200 && xhr["responseText"]) {
|
||||
var responsePayload = parse(xhr["responseText"]);
|
||||
var tokenData = {};
|
||||
tokenData["accessToken"] = responsePayload["access_token"];
|
||||
tokenData["refreshToken"] = responsePayload["refresh_token"];
|
||||
tokenData["scopes"] = responsePayload["scope"];
|
||||
return tokenData;
|
||||
} else {
|
||||
log.error("{/modules/oauth/token-handler-utils.js} Error in retrieving access token " +
|
||||
"by password grant type - getTokenPairAndScopesByPasswordGrantType(a, b, c, d)");
|
||||
return null;
|
||||
}
|
||||
}
|
||||
};
|
||||
|
||||
/**
|
||||
* Get access token and refresh token using SAML grant type
|
||||
* @param assertion
|
||||
* @param encodedClientAppCredentials
|
||||
* @param scopes
|
||||
* @returns {{accessToken: *, refreshToken: *}}
|
||||
*/
|
||||
publicMethods["getTokenPairAndScopesBySAMLGrantType"] = function (assertion, encodedClientAppCredentials, scopes) {
|
||||
if (!assertion || !encodedClientAppCredentials || !scopes) {
|
||||
log.error("{/modules/oauth/token-handler-utils.js} Error in retrieving access token by saml " +
|
||||
"grant type. No assertion, encoded client app credentials or scopes are " +
|
||||
"found - getTokenPairAndScopesBySAMLGrantType(x, y, z)");
|
||||
return null;
|
||||
} else {
|
||||
|
||||
var assertionXML = publicMethods.decode(assertion);
|
||||
/*
|
||||
TODO: make assertion extraction with proper parsing.
|
||||
Since Jaggery XML parser seem to add formatting which causes signature verification to fail.
|
||||
*/
|
||||
var assertionStartMarker = "<saml2:Assertion";
|
||||
var assertionEndMarker = "<\/saml2:Assertion>";
|
||||
var assertionStartIndex = assertionXML.indexOf(assertionStartMarker);
|
||||
var assertionEndIndex = assertionXML.indexOf(assertionEndMarker);
|
||||
|
||||
var extractedAssertion;
|
||||
if (assertionStartIndex == -1 || assertionEndIndex == -1) {
|
||||
log.error("{/modules/oauth/token-handler-utils.js} Error in retrieving access token by saml grant " +
|
||||
"type. Issue in assertion format - getTokenPairAndScopesBySAMLGrantType(x, y, z)");
|
||||
return null;
|
||||
} else {
|
||||
extractedAssertion = assertionXML.
|
||||
substring(assertionStartIndex, assertionEndIndex) + assertionEndMarker;
|
||||
var encodedAssertion = publicMethods.encode(extractedAssertion);
|
||||
// calling oauth provider token service endpoint
|
||||
var requestURL = configs["authorization"]["methods"]["oauth"]["attributes"]["oauthProvider"]
|
||||
["tokenServiceURL"];
|
||||
var requestPayload = "grant_type=" + configs["authentication"]["methods"]["sso"]["attributes"]
|
||||
["samlGrantTypeName"] + "&" + "assertion=" + encodeURIComponent(encodedAssertion) + "&scope=" + scopes;
|
||||
var xhr = new XMLHttpRequest();
|
||||
xhr.open("POST", requestURL, false);
|
||||
xhr.setRequestHeader("Content-Type", "application/x-www-form-urlencoded");
|
||||
xhr.setRequestHeader("Authorization", "Basic " + encodedClientAppCredentials);
|
||||
xhr.send(requestPayload);
|
||||
|
||||
if (xhr["status"] == 200 && xhr["responseText"]) {
|
||||
var responsePayload = parse(xhr["responseText"]);
|
||||
var tokenData = {};
|
||||
tokenData["accessToken"] = responsePayload["access_token"];
|
||||
tokenData["refreshToken"] = responsePayload["refresh_token"];
|
||||
tokenData["scopes"] = responsePayload["scope"];
|
||||
return tokenData;
|
||||
} else {
|
||||
log.error("{/modules/oauth/token-handler-utils.js} Error in retrieving access token " +
|
||||
"by password grant type - getTokenPairAndScopesBySAMLGrantType(x, y, z)");
|
||||
return null;
|
||||
}
|
||||
}
|
||||
}
|
||||
};
|
||||
|
||||
/**
|
||||
* If access token is expired, try to refresh it using existing refresh token
|
||||
* @param callback
|
||||
*/
|
||||
publicMethods["refreshAccessToken"] = function (callback) {
|
||||
try {
|
||||
if (publicMethods.checkOAuthEnabled()) {
|
||||
var currentTokenPair = parse(session.get(constants["ACCESS_TOKEN_PAIR_IDENTIFIER_FOR_PORTAL"]));
|
||||
// currentTokenPair includes current access token as well as current refresh token
|
||||
var encodedClientAppCredentials
|
||||
= session.get(constants["ENCODED_TENANT_BASED_CLIENT_APP_CREDENTIALS_PORTAL_APP"]);
|
||||
if (!currentTokenPair || !encodedClientAppCredentials) {
|
||||
callback(false);
|
||||
throw new Error("{/modules/oauth/token-handlers.js} Error in refreshing tokens. Either the " +
|
||||
"token pair, encoded client app credentials or both input are not found under " +
|
||||
"session context - refreshTokenPair()");
|
||||
} else {
|
||||
var newTokenPair = publicMethods.
|
||||
getNewTokenPairByRefreshToken(currentTokenPair["refreshToken"], encodedClientAppCredentials);
|
||||
if (!newTokenPair) {
|
||||
log.error("{/app/modules/oauth/token-handlers.js} Error in refreshing token pair. " +
|
||||
"Unable to update session context with new access token pair - refreshTokenPair()");
|
||||
callback(false);
|
||||
} else {
|
||||
session.put(constants["ACCESS_TOKEN_PAIR_IDENTIFIER_FOR_PORTAL"], stringify(newTokenPair));
|
||||
callback(true);
|
||||
}
|
||||
}
|
||||
} else {
|
||||
log.error("You have not enable dynamic client yet");
|
||||
callback(false);
|
||||
}
|
||||
} catch (exception) {
|
||||
callback(false);
|
||||
throw "Error while refreshing existing access token, " + exception;
|
||||
}
|
||||
};
|
||||
|
||||
/**
|
||||
* Get access token and refresh token using refresh token grant type
|
||||
* @param refreshToken refresh token
|
||||
* @param encodedClientAppCredentials {{clientId:*, clientSecret:*}}
|
||||
* @param scopes
|
||||
* @returns {{accessToken: *, refreshToken: *}}
|
||||
*/
|
||||
publicMethods["getNewTokenPairByRefreshToken"] = function (refreshToken, encodedClientAppCredentials, scopes) {
|
||||
if (!refreshToken || !encodedClientAppCredentials) {
|
||||
log.error("{/modules/oauth/token-handler-utils.js} Error in retrieving new access token " +
|
||||
"by current refresh token. No refresh token or encoded client app credentials are " +
|
||||
"found - getNewTokenPairByRefreshToken(x, y, z)");
|
||||
return null;
|
||||
} else {
|
||||
var requestURL = configs["authorization"]["methods"]["oauth"]["attributes"]["oauthProvider"]
|
||||
["tokenServiceURL"];
|
||||
var requestPayload = "grant_type=refresh_token&refresh_token=" + refreshToken;
|
||||
if (scopes) {
|
||||
requestPayload = requestPayload + "&scope=" + scopes;
|
||||
}
|
||||
|
||||
var xhr = new XMLHttpRequest();
|
||||
xhr.open("POST", requestURL, false);
|
||||
xhr.setRequestHeader("Content-Type", "application/x-www-form-urlencoded");
|
||||
xhr.setRequestHeader("Authorization", "Basic " + encodedClientAppCredentials);
|
||||
xhr.send(requestPayload);
|
||||
|
||||
if (xhr["status"] == 200 && xhr["responseText"]) {
|
||||
var responsePayload = parse(xhr["responseText"]);
|
||||
var tokenPair = {};
|
||||
tokenPair["accessToken"] = responsePayload["access_token"];
|
||||
tokenPair["refreshToken"] = responsePayload["refresh_token"];
|
||||
return tokenPair;
|
||||
} else {
|
||||
log.error("{/modules/oauth/token-handler-utils.js} Error in retrieving new access token by " +
|
||||
"current refresh token - getNewTokenPairByRefreshToken(x, y, z)");
|
||||
return null;
|
||||
}
|
||||
}
|
||||
};
|
||||
|
||||
/**
|
||||
* Get access token using JWT grant type
|
||||
* @param clientAppCredentials {{clientId:*, clientSecret:*}}
|
||||
* @returns {{accessToken: *, refreshToken: *}}
|
||||
*/
|
||||
publicMethods["getAccessTokenByJWTGrantType"] = function (clientAppCredentials) {
|
||||
if (!clientAppCredentials) {
|
||||
log.error("{/modules/oauth/token-handler-utils.js} Error in retrieving new access token " +
|
||||
"by current refresh token. No client app credentials are found " +
|
||||
"as input - getAccessTokenByJWTGrantType(x)");
|
||||
return null;
|
||||
} else {
|
||||
var JWTClientManagerServicePackagePath =
|
||||
"org.wso2.carbon.identity.jwt.client.extension.service.JWTClientManagerService";
|
||||
//noinspection JSUnresolvedFunction, JSUnresolvedVariable
|
||||
var JWTClientManagerService = carbon.server.osgiService(JWTClientManagerServicePackagePath);
|
||||
//noinspection JSUnresolvedFunction
|
||||
var jwtClient = JWTClientManagerService.getJWTClient();
|
||||
// returning access token by JWT grant type
|
||||
return jwtClient.getAccessToken(clientAppCredentials["clientId"], clientAppCredentials["clientSecret"],
|
||||
configs["authorization"]["methods"]["oauth"]["attributes"]["oauthProvider"]["appRegistration"]["owner"],
|
||||
null)["accessToken"];
|
||||
}
|
||||
};
|
||||
|
||||
/**
|
||||
* Get jwt token
|
||||
* @param username username of logged user
|
||||
* @param claims claims which are required
|
||||
* @returns {"jwtToken"}
|
||||
*/
|
||||
publicMethods["getJwtToken"] = function (username, claims) {
|
||||
if (!username) {
|
||||
log.error("{/modules/oauth/token-handler-utils.js} Error in retrieving new jwt token");
|
||||
return null;
|
||||
} else {
|
||||
var JWTClientManagerServicePackagePath =
|
||||
"org.wso2.carbon.identity.jwt.client.extension.service.JWTClientManagerService";
|
||||
//noinspection JSUnresolvedFunction, JSUnresolvedVariable
|
||||
var JWTClientManagerService = carbon.server.osgiService(JWTClientManagerServicePackagePath);
|
||||
//noinspection JSUnresolvedFunction
|
||||
var jwtClient = JWTClientManagerService.getJWTClient();
|
||||
// returning access token by JWT grant type
|
||||
if (claims) {
|
||||
return jwtClient.getJwtToken(username, claims);
|
||||
} else {
|
||||
return jwtClient.getJwtToken(username);
|
||||
}
|
||||
}
|
||||
};
|
||||
return publicMethods;
|
||||
}();
|
||||
Loading…
Reference in new issue