Xinwen Deng / aem-src

/*
 * Decompiled with CFR 0_118.
 * 
 * Could not load the following classes:
 *  com.adobe.granite.crypto.CryptoException
 *  com.adobe.granite.crypto.CryptoSupport
 *  com.adobe.granite.keystore.KeyStoreService
 *  com.adobe.granite.oauth.jwt.JwsBuilder
 *  com.adobe.granite.oauth.jwt.JwsBuilderFactory
 *  com.adobe.granite.oauth.jwt.JwsValidator
 *  javax.jcr.RepositoryException
 *  javax.jcr.Session
 *  javax.servlet.Servlet
 *  javax.servlet.ServletException
 *  javax.servlet.http.HttpServlet
 *  javax.servlet.http.HttpServletRequest
 *  javax.servlet.http.HttpServletResponse
 *  org.apache.felix.scr.annotations.Activate
 *  org.apache.felix.scr.annotations.Component
 *  org.apache.felix.scr.annotations.Modified
 *  org.apache.felix.scr.annotations.Properties
 *  org.apache.felix.scr.annotations.Property
 *  org.apache.felix.scr.annotations.Reference
 *  org.apache.felix.scr.annotations.Service
 *  org.apache.jackrabbit.api.security.user.Authorizable
 *  org.apache.jackrabbit.api.security.user.Group
 *  org.apache.jackrabbit.api.security.user.User
 *  org.apache.jackrabbit.oak.spi.security.ConfigurationParameters
 *  org.apache.jackrabbit.oak.spi.security.authorization.AuthorizationConfiguration
 *  org.apache.oltu.oauth2.as.request.OAuthTokenRequest
 *  org.apache.oltu.oauth2.as.response.OAuthASResponse
 *  org.apache.oltu.oauth2.as.response.OAuthASResponse$OAuthTokenResponseBuilder
 *  org.apache.oltu.oauth2.common.exception.OAuthProblemException
 *  org.apache.oltu.oauth2.common.exception.OAuthSystemException
 *  org.apache.oltu.oauth2.common.message.OAuthResponse
 *  org.apache.oltu.oauth2.common.message.OAuthResponse$OAuthErrorResponseBuilder
 *  org.apache.oltu.oauth2.common.message.types.GrantType
 *  org.apache.oltu.oauth2.common.utils.OAuthUtils
 *  org.apache.oltu.oauth2.jwt.ClaimsSet
 *  org.apache.oltu.oauth2.jwt.Header
 *  org.apache.oltu.oauth2.jwt.JWT
 *  org.apache.oltu.oauth2.jwt.io.JWTReader
 *  org.apache.oltu.oauth2.jwt.request.JWTOAuthRequest
 *  org.apache.sling.api.resource.LoginException
 *  org.apache.sling.api.resource.ResourceResolver
 *  org.apache.sling.api.resource.ResourceResolverFactory
 *  org.apache.sling.commons.osgi.OsgiUtil
 *  org.apache.sling.jcr.api.SlingRepository
 *  org.osgi.framework.BundleContext
 *  org.slf4j.Logger
 *  org.slf4j.LoggerFactory
 */
package com.adobe.granite.oauth.server.impl;

import com.adobe.granite.crypto.CryptoException;
import com.adobe.granite.crypto.CryptoSupport;
import com.adobe.granite.keystore.KeyStoreService;
import com.adobe.granite.oauth.jwt.JwsBuilder;
import com.adobe.granite.oauth.jwt.JwsBuilderFactory;
import com.adobe.granite.oauth.jwt.JwsValidator;
import com.adobe.granite.oauth.server.OAuth2ResourceServer;
import com.adobe.granite.oauth.server.impl.OAuth2GraniteIssuer;
import com.adobe.granite.oauth.server.impl.helper.OAuth2Helper;
import java.io.IOException;
import java.io.PrintWriter;
import java.security.Key;
import java.security.KeyPair;
import java.security.Principal;
import java.security.PublicKey;
import java.util.Collections;
import java.util.Iterator;
import java.util.Map;
import java.util.Set;
import javax.jcr.RepositoryException;
import javax.jcr.Session;
import javax.servlet.Servlet;
import javax.servlet.ServletException;
import javax.servlet.http.HttpServlet;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import org.apache.felix.scr.annotations.Activate;
import org.apache.felix.scr.annotations.Component;
import org.apache.felix.scr.annotations.Modified;
import org.apache.felix.scr.annotations.Properties;
import org.apache.felix.scr.annotations.Property;
import org.apache.felix.scr.annotations.Reference;
import org.apache.felix.scr.annotations.Service;
import org.apache.jackrabbit.api.security.user.Authorizable;
import org.apache.jackrabbit.api.security.user.Group;
import org.apache.jackrabbit.api.security.user.User;
import org.apache.jackrabbit.oak.spi.security.ConfigurationParameters;
import org.apache.jackrabbit.oak.spi.security.authorization.AuthorizationConfiguration;
import org.apache.oltu.oauth2.as.request.OAuthTokenRequest;
import org.apache.oltu.oauth2.as.response.OAuthASResponse;
import org.apache.oltu.oauth2.common.exception.OAuthProblemException;
import org.apache.oltu.oauth2.common.exception.OAuthSystemException;
import org.apache.oltu.oauth2.common.message.OAuthResponse;
import org.apache.oltu.oauth2.common.message.types.GrantType;
import org.apache.oltu.oauth2.common.utils.OAuthUtils;
import org.apache.oltu.oauth2.jwt.ClaimsSet;
import org.apache.oltu.oauth2.jwt.Header;
import org.apache.oltu.oauth2.jwt.JWT;
import org.apache.oltu.oauth2.jwt.io.JWTReader;
import org.apache.oltu.oauth2.jwt.request.JWTOAuthRequest;
import org.apache.sling.api.resource.LoginException;
import org.apache.sling.api.resource.ResourceResolver;
import org.apache.sling.api.resource.ResourceResolverFactory;
import org.apache.sling.commons.osgi.OsgiUtil;
import org.apache.sling.jcr.api.SlingRepository;
import org.osgi.framework.BundleContext;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;

/*
 * This class specifies class file version 49.0 but uses Java 6 signatures.  Assumed Java 6.
 */
@Component(immediate=1, metatype=1, label="%oauth.token.endpoint.name", description="%oauth.token.endpoint.description")
@Service(value={Servlet.class})
@Properties(value={@Property(name="service.description", value={"OAuth2 Token Endpoint Servlet"}), @Property(name="oauth.issuer", value={"Adobe Granite"}), @Property(name="oauth.access.token.expires.in", value={"3600"}), @Property(name="alias", value={"/oauth/token"})})
public class OAuth2TokenEndpointServlet
extends HttpServlet {
    private static final long serialVersionUID = -5800923073209065538L;
    private final Logger logger;
    private static final String REFRESH_TOKEN_EXPIRES_IN = "31536000";
    protected static final String DEFAULT_SERVLET_PATH = "/oauth/token";
    protected static final String OAUTH_SERVLET_PATH = "alias";
    protected static final String OAUTH_ISSUER_NAME = "oauth.issuer";
    protected static final String OAUTH_TOKEN_EXPIRES_IN = "oauth.access.token.expires.in";
    protected static final String OAUTH_ISSUER_NAME_DEFAULT = "Adobe Granite";
    @Reference
    private SlingRepository repository;
    @Reference
    private CryptoSupport cryptoSupport;
    @Reference
    private JwsBuilderFactory jwsBuilderFactory;
    @Reference
    JwsValidator jwsValidator;
    @Reference
    KeyStoreService keyStoreService;
    @Reference
    ResourceResolverFactory resourceResolverFactory;
    @Reference
    private OAuth2ResourceServer oAuth2ResourceServer;
    @Reference
    private AuthorizationConfiguration authorizationConfiguration;
    private String oauthIssuerName;
    private String tokenExpiresIn;
    private String oauthServletPath;

    public OAuth2TokenEndpointServlet() {
        this.logger = LoggerFactory.getLogger(this.getClass());
    }

    @Activate
    @Modified
    private void activate(BundleContext context, Map<String, Object> config) {
        this.oauthIssuerName = OsgiUtil.toString((Object)config.get("oauth.issuer"), (String)"Adobe Granite");
        this.tokenExpiresIn = OsgiUtil.toString((Object)config.get("oauth.access.token.expires.in"), (String)"3600");
        this.oauthServletPath = OsgiUtil.toString((Object)config.get("alias"), (String)"/oauth/token");
    }

    protected void doPost(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
        block8 : {
            try {
                String grantType = request.getParameter("grant_type");
                if (GrantType.AUTHORIZATION_CODE.toString().equals(grantType)) {
                    this.handleAuthorizationCodeGrantType(request, response);
                    break block8;
                }
                if (GrantType.REFRESH_TOKEN.toString().equals(grantType)) {
                    this.handleRefreshTokenGrantType(request, response);
                    break block8;
                }
                if (GrantType.JWT_BEARER.toString().equals(grantType)) {
                    this.handleJwtBearerGrantType(request, response);
                    break block8;
                }
                throw OAuthUtils.handleOAuthProblemException((String)"Invalid grant_type parameter value");
            }
            catch (OAuthSystemException e) {
                OAuth2Helper.handleOAuthSystemException(e, response);
            }
            catch (OAuthProblemException e) {
                OAuthResponse r = null;
                try {
                    r = OAuthResponse.errorResponse((int)400).error(e).buildJSONMessage();
                    response.setStatus(r.getResponseStatus());
                    PrintWriter pw = response.getWriter();
                    pw.print(r.getBody());
                    pw.flush();
                    response.sendError(400);
                }
                catch (OAuthSystemException e1) {
                    OAuth2Helper.handleOAuthSystemException(e1, response);
                }
            }
        }
    }

    private void handleAuthorizationCodeGrantType(HttpServletRequest request, HttpServletResponse response) throws OAuthSystemException, OAuthProblemException, IOException {
        String refreshToken;
        String accessToken;
        OAuthTokenRequest oauthRequest = new OAuthTokenRequest(request);
        String authzCode = oauthRequest.getCode();
        if (this.validAuthorizationCode(authzCode)) {
            this.validateClient(oauthRequest, authzCode);
            String subject = this.getSubject(authzCode);
            String scopes = (String)((JWT)new JWTReader().read(authzCode)).getClaimsSet().getCustomField("scope", String.class);
            accessToken = this.generateAccessToken(oauthRequest.getClientId(), subject, scopes);
            Set<String> scopesSet = OAuth2Helper.getScopesSet(scopes);
            refreshToken = null;
            if (scopesSet.contains("offline_access")) {
                this.logger.debug("generating refresh token");
                refreshToken = this.generateRefreshToken(oauthRequest.getClientId(), subject, scopes);
            }
        } else {
            OAuthProblemException oAuthProblemException = OAuthProblemException.error((String)"invalid_grant", (String)"Invalid code");
            throw oAuthProblemException;
        }
        this.validResponse(response, accessToken, refreshToken);
    }

    private void handleRefreshTokenGrantType(HttpServletRequest request, HttpServletResponse response) throws OAuthSystemException, OAuthProblemException, IOException {
        OAuthTokenRequest oauthRequest = new OAuthTokenRequest(request);
        String refreshToken = oauthRequest.getRefreshToken();
        if (!this.validRefreshToken(refreshToken)) {
            OAuthProblemException oAuthProblemException = OAuthProblemException.error((String)"invalid_grant", (String)"Invalid refresh token");
            throw oAuthProblemException;
        }
        this.validateClient(oauthRequest, refreshToken);
        String subject = this.getSubject(refreshToken);
        String scopes = (String)((JWT)new JWTReader().read(refreshToken)).getClaimsSet().getCustomField("scope", String.class);
        String accessToken = this.generateAccessToken(oauthRequest.getClientId(), subject, scopes);
        this.validResponse(response, accessToken, null);
    }

    private void handleJwtBearerGrantType(HttpServletRequest request, HttpServletResponse response) throws OAuthSystemException, OAuthProblemException, IOException {
        String clientId;
        String scopes;
        JWTOAuthRequest jwtoAuthRequest = new JWTOAuthRequest(request);
        String assertion = jwtoAuthRequest.getAssertion();
        JWT token = (JWT)new JWTReader().read(assertion);
        String userId = this.validateAssertion(request, token, clientId = token.getClaimsSet().getIssuer(), scopes = (String)token.getClaimsSet().getCustomField("scope", String.class));
        if (userId == null) {
            OAuthProblemException oAuthProblemException = OAuthProblemException.error((String)"invalid_grant", (String)"Invalid assertion");
            throw oAuthProblemException;
        }
        String accessToken = this.generateAccessToken(clientId, userId, scopes);
        this.validResponse(response, accessToken, null);
    }

    private void validateClient(OAuthTokenRequest oauthRequest, String code) throws OAuthProblemException, OAuthSystemException {
        String aud;
        String clientId = oauthRequest.getClientId();
        if (!clientId.equals(aud = ((JWT)new JWTReader().read(code)).getClaimsSet().getAudience())) {
            this.logger.debug("the clientId from request parameter {} did not match the token aud {}", (Object)clientId, (Object)aud);
            OAuthProblemException oAuthProblemException = OAuthProblemException.error((String)"invalid_client", (String)"Invalid client");
            throw oAuthProblemException;
        }
        Session oauthServiceSession = null;
        try {
            String clientSecret;
            String redirectUri;
            oauthServiceSession = this.repository.loginService(null, null);
            Authorizable user = OAuth2Helper.getOAuthClientAuthorizable(oauthServiceSession, clientId);
            if (user == null) {
                this.logger.debug("validateClient: Invalid value {} for parameter client_id", (Object)clientId);
                OAuthProblemException oAuthProblemException = OAuthProblemException.error((String)"invalid_client", (String)"Invalid client");
                throw oAuthProblemException;
            }
            String clientSecretStored = this.cryptoSupport.unprotect(OAuth2Helper.getOAuthClientPropertyValue(user, clientId, "oauth:clientSecret"));
            if (!clientSecretStored.equals(clientSecret = oauthRequest.getClientSecret())) {
                this.logger.debug("validateClient: client secret did not match");
                OAuthProblemException oAuthProblemException = OAuthProblemException.error((String)"invalid_client", (String)"Invalid client");
                throw oAuthProblemException;
            }
            String redirectUriStored = OAuth2Helper.getOAuthClientPropertyValue(user, clientId, "oauth:redirectURI");
            if (!redirectUriStored.equalsIgnoreCase(redirectUri = oauthRequest.getRedirectURI())) {
                this.logger.debug("validateClient: The redirect URI in the request {} did not match a registered redirect URI {}", (Object)redirectUri, (Object)redirectUriStored);
                OAuthProblemException oAuthProblemException = OAuthProblemException.error((String)"redirect_uri_mismatch", (String)"");
                throw oAuthProblemException;
            }
        }
        catch (RepositoryException e) {
            this.logger.error("validateClient: failed while accessing repository", (Throwable)e);
            throw new OAuthSystemException("failed while accessing repository");
        }
        catch (CryptoException e) {
            this.logger.error("validateClient: failed while using crypto support", (Throwable)e);
            throw new OAuthSystemException(" failed while using crypto support");
        }
        finally {
            if (oauthServiceSession != null) {
                oauthServiceSession.logout();
            }
        }
    }

    private boolean validAuthorizationCode(String authorizationCode) {
        String contentType;
        boolean validAuthorizationCode = this.jwsValidator.validate(authorizationCode);
        if (validAuthorizationCode && !"code".equals(contentType = OAuth2Helper.getContentType(authorizationCode))) {
            validAuthorizationCode = false;
        }
        return validAuthorizationCode;
    }

    private boolean validRefreshToken(String refreshToken) {
        String contentType;
        boolean validRefreshToken = this.jwsValidator.validate(refreshToken);
        if (validRefreshToken && !"rt".equals(contentType = OAuth2Helper.getContentType(refreshToken))) {
            validRefreshToken = false;
        }
        return validRefreshToken;
    }

    private String getSubject(String authorizationCode) throws OAuthSystemException {
        if (authorizationCode != null) {
            return ((JWT)new JWTReader().read(authorizationCode)).getClaimsSet().getSubject();
        }
        this.logger.info("the provided authorization code is not valid");
        return null;
    }

    private String validateAssertion(HttpServletRequest request, JWT token, String clientId, String scopes) throws OAuthSystemException, OAuthProblemException {
        boolean validAssertion;
        String userId;
        userId = null;
        validAssertion = false;
        String algorithm = token.getHeader().getAlgorithm();
        if (clientId != null && "RS256".equals(algorithm)) {
            String audience = token.getClaimsSet().getAudience();
            if (this.getAudienceDomain(request).equals(audience)) {
                ResourceResolver resourceResolver = null;
                String scope = (String)token.getClaimsSet().getCustomField("scope", String.class);
                OAuth2Helper.validateScopes(this.oAuth2ResourceServer, OAuth2Helper.getScopesSet(scope), true);
                try {
                    resourceResolver = this.resourceResolverFactory.getServiceResourceResolver(null);
                    Session oauthServiceSession = (Session)resourceResolver.adaptTo(Session.class);
                    User authorizable = OAuth2Helper.getUser(oauthServiceSession, clientId);
                    if (authorizable != null) {
                        KeyPair keyPair = this.keyStoreService.getKeyStoreKeyPair(resourceResolver, authorizable.getID(), clientId);
                        Authorizable user = OAuth2Helper.getOAuthClientAuthorizable(oauthServiceSession, clientId);
                        if (this.isAllowedScope(user, scopes)) {
                            validAssertion = this.jwsValidator.validate(token.getRawString(), (Key)keyPair.getPublic());
                            if (user != null && validAssertion) {
                                userId = user.getID();
                            }
                        }
                    }
                }
                catch (LoginException e) {
                    this.logger.error("validateAssertion: failed to login", (Throwable)e);
                    throw new OAuthSystemException("failed to login");
                }
                catch (RepositoryException e) {
                    this.logger.error("validateAssertion: failed while accessing repository", (Throwable)e);
                    throw new OAuthSystemException("failed while accessing repository");
                }
                finally {
                    if (resourceResolver != null) {
                        resourceResolver.close();
                    }
                }
            }
        }
        if (validAssertion) {
            return userId;
        }
        return null;
    }

    private String generateAccessToken(String clientId, String subject, String scope) throws OAuthSystemException {
        OAuth2GraniteIssuer oauthIssuer = new OAuth2GraniteIssuer(this.jwsBuilderFactory.getInstance("HS256")).setSubject(subject).setAudience(clientId).setIssuer(this.oauthIssuerName).setExpiresIn(this.tokenExpiresIn);
        if (scope != null) {
            oauthIssuer.setScope(scope);
        }
        oauthIssuer.setCustomClaimsSetField("cty", "at");
        return oauthIssuer.accessToken();
    }

    private String generateRefreshToken(String clientId, String subject, String scope) throws OAuthSystemException {
        OAuth2GraniteIssuer oauthIssuer = new OAuth2GraniteIssuer(this.jwsBuilderFactory.getInstance("HS256")).setSubject(subject).setAudience(clientId).setIssuer(this.oauthIssuerName).setExpiresIn("31536000");
        if (scope != null) {
            oauthIssuer.setScope(scope);
        }
        oauthIssuer.setCustomClaimsSetField("cty", "rt");
        return oauthIssuer.refreshToken();
    }

    private void validResponse(HttpServletResponse response, String accessToken, String refreshToken) throws OAuthSystemException, IOException {
        OAuthASResponse.OAuthTokenResponseBuilder rt = OAuthASResponse.tokenResponse((int)200).setAccessToken(accessToken).setExpiresIn(this.tokenExpiresIn);
        if (refreshToken != null) {
            rt.setRefreshToken(refreshToken);
        }
        OAuthResponse r = rt.buildJSONMessage();
        response.setStatus(r.getResponseStatus());
        PrintWriter pw = response.getWriter();
        pw.print(r.getBody());
        pw.flush();
    }

    private String getAudienceDomain(HttpServletRequest request) {
        String scheme = request.getScheme();
        String serverName = request.getServerName();
        int serverPort = request.getServerPort();
        StringBuilder url = new StringBuilder();
        url.append(scheme).append("://").append(serverName);
        if (!("https".equals(scheme) && serverPort == 443 || "http".equals(scheme) && serverPort == 80)) {
            url.append(":").append(serverPort);
        }
        url.append(this.oauthServletPath);
        return url.toString();
    }

    private boolean isAllowedScope(Authorizable user, String scopes) throws RepositoryException {
        Set<String> scopesSet = OAuth2Helper.getScopesSet(scopes);
        if (scopesSet.contains("replicate")) {
            User u = (User)user;
            if (u.isAdmin()) {
                return true;
            }
            ConfigurationParameters configurationParameters = this.authorizationConfiguration.getParameters();
            Set administrativePrincipals = (Set)configurationParameters.getConfigValue("administrativePrincipals", (Object)Collections.EMPTY_SET);
            Iterator it = user.memberOf();
            while (it.hasNext()) {
                Group g = (Group)it.next();
                if (!administrativePrincipals.contains(g.getPrincipal().getName())) continue;
                return true;
            }
            return false;
        }
        return true;
    }

    protected void bindRepository(SlingRepository slingRepository) {
        this.repository = slingRepository;
    }

    protected void unbindRepository(SlingRepository slingRepository) {
        if (this.repository == slingRepository) {
            this.repository = null;
        }
    }

    protected void bindCryptoSupport(CryptoSupport cryptoSupport) {
        this.cryptoSupport = cryptoSupport;
    }

    protected void unbindCryptoSupport(CryptoSupport cryptoSupport) {
        if (this.cryptoSupport == cryptoSupport) {
            this.cryptoSupport = null;
        }
    }

    protected void bindJwsBuilderFactory(JwsBuilderFactory jwsBuilderFactory) {
        this.jwsBuilderFactory = jwsBuilderFactory;
    }

    protected void unbindJwsBuilderFactory(JwsBuilderFactory jwsBuilderFactory) {
        if (this.jwsBuilderFactory == jwsBuilderFactory) {
            this.jwsBuilderFactory = null;
        }
    }

    protected void bindJwsValidator(JwsValidator jwsValidator) {
        this.jwsValidator = jwsValidator;
    }

    protected void unbindJwsValidator(JwsValidator jwsValidator) {
        if (this.jwsValidator == jwsValidator) {
            this.jwsValidator = null;
        }
    }

    protected void bindKeyStoreService(KeyStoreService keyStoreService) {
        this.keyStoreService = keyStoreService;
    }

    protected void unbindKeyStoreService(KeyStoreService keyStoreService) {
        if (this.keyStoreService == keyStoreService) {
            this.keyStoreService = null;
        }
    }

    protected void bindResourceResolverFactory(ResourceResolverFactory resourceResolverFactory) {
        this.resourceResolverFactory = resourceResolverFactory;
    }

    protected void unbindResourceResolverFactory(ResourceResolverFactory resourceResolverFactory) {
        if (this.resourceResolverFactory == resourceResolverFactory) {
            this.resourceResolverFactory = null;
        }
    }

    protected void bindOAuth2ResourceServer(OAuth2ResourceServer oAuth2ResourceServer) {
        this.oAuth2ResourceServer = oAuth2ResourceServer;
    }

    protected void unbindOAuth2ResourceServer(OAuth2ResourceServer oAuth2ResourceServer) {
        if (this.oAuth2ResourceServer == oAuth2ResourceServer) {
            this.oAuth2ResourceServer = null;
        }
    }

    protected void bindAuthorizationConfiguration(AuthorizationConfiguration authorizationConfiguration) {
        this.authorizationConfiguration = authorizationConfiguration;
    }

    protected void unbindAuthorizationConfiguration(AuthorizationConfiguration authorizationConfiguration) {
        if (this.authorizationConfiguration == authorizationConfiguration) {
            this.authorizationConfiguration = null;
        }
    }
}