Class OpenIdAuthenticator
- java.lang.Object
-
- org.eclipse.jetty.security.authentication.LoginAuthenticator
-
- org.eclipse.jetty.security.openid.OpenIdAuthenticator
-
- All Implemented Interfaces:
Authenticator
public class OpenIdAuthenticator extends LoginAuthenticator
Implements authentication using OpenId Connect on top of OAuth 2.0.
The OpenIdAuthenticator redirects unauthenticated requests to the OpenID Connect Provider. The End-User is eventually redirected back with an Authorization Code to the /j_security_check URI within the context. The Authorization Code is then used to authenticate the user through the
OpenIdCredentials
andOpenIdLoginService
.Once a user is authenticated the OpenID Claims can be retrieved through an attribute on the session with the key
CLAIMS
. The full response containing the OAuth 2.0 Access Token can be obtained with the session attributeRESPONSE
.SessionAuthentication
is then used to wrap Authentication results so that they are associated with the session.
-
-
Nested Class Summary
Nested Classes Modifier and Type Class Description private static class
OpenIdAuthenticator.MRUMap
static class
OpenIdAuthenticator.OpenIdAuthentication
This Authentication represents a just completed OpenId Connect authentication.private static class
OpenIdAuthenticator.UriRedirectInfo
-
Nested classes/interfaces inherited from interface org.eclipse.jetty.security.Authenticator
Authenticator.AuthConfiguration, Authenticator.Factory
-
-
Field Summary
Fields Modifier and Type Field Description private boolean
_alwaysSaveUri
private OpenIdConfiguration
_configuration
private java.lang.String
_errorPage
private java.lang.String
_errorPath
private java.lang.String
_errorQuery
private java.security.SecureRandom
_secureRandom
static java.lang.String
CLAIMS
private static java.lang.String
CSRF_MAP
static java.lang.String
CSRF_TOKEN
Deprecated.static java.lang.String
ERROR_PAGE
static java.lang.String
ERROR_PARAMETER
static java.lang.String
J_METHOD
static java.lang.String
J_POST
static java.lang.String
J_SECURITY_CHECK
static java.lang.String
J_URI
private static Logger
LOG
static java.lang.String
RESPONSE
-
Fields inherited from class org.eclipse.jetty.security.authentication.LoginAuthenticator
_identityService, _loginService
-
-
Constructor Summary
Constructors Constructor Description OpenIdAuthenticator()
OpenIdAuthenticator(OpenIdConfiguration configuration, java.lang.String errorPage)
-
Method Summary
All Methods Instance Methods Concrete Methods Deprecated Methods Modifier and Type Method Description private java.util.Map<java.lang.String,OpenIdAuthenticator.UriRedirectInfo>
ensureCsrfMap(javax.servlet.http.HttpSession session)
java.lang.String
getAuthMethod()
protected java.lang.String
getChallengeUri(Request request)
private java.lang.String
getRedirectUri(javax.servlet.http.HttpServletRequest request)
boolean
isAlwaysSaveUri()
Deprecated.boolean
isErrorPage(java.lang.String pathInContext)
boolean
isJSecurityCheck(java.lang.String uri)
UserIdentity
login(java.lang.String username, java.lang.Object credentials, javax.servlet.ServletRequest request)
If the UserIdentity is not null after this method callsLoginService.login(String, Object, ServletRequest)
, it is assumed that the user is fully authenticated and we need to change the session id to prevent session fixation vulnerability.void
logout(javax.servlet.ServletRequest request)
void
prepareRequest(javax.servlet.ServletRequest request)
Called prior to validateRequest.private OpenIdAuthenticator.UriRedirectInfo
removeAndClearCsrfMap(javax.servlet.http.HttpSession session, java.lang.String csrf)
boolean
secureResponse(javax.servlet.ServletRequest req, javax.servlet.ServletResponse res, boolean mandatory, Authentication.User validatedUser)
is response secureprivate void
sendError(javax.servlet.http.HttpServletRequest request, javax.servlet.http.HttpServletResponse response, java.lang.String message)
Report an error case either by redirecting to the error page if it is defined, otherwise sending a 403 response.void
setAlwaysSaveUri(boolean alwaysSave)
Deprecated.void
setConfiguration(Authenticator.AuthConfiguration configuration)
Configure the Authenticatorprivate void
setErrorPage(java.lang.String path)
Authentication
validateRequest(javax.servlet.ServletRequest req, javax.servlet.ServletResponse res, boolean mandatory)
Validate a request-
Methods inherited from class org.eclipse.jetty.security.authentication.LoginAuthenticator
getLoginService, renewSession
-
-
-
-
Field Detail
-
LOG
private static final Logger LOG
-
CLAIMS
public static final java.lang.String CLAIMS
- See Also:
- Constant Field Values
-
RESPONSE
public static final java.lang.String RESPONSE
- See Also:
- Constant Field Values
-
ERROR_PAGE
public static final java.lang.String ERROR_PAGE
- See Also:
- Constant Field Values
-
J_URI
public static final java.lang.String J_URI
- See Also:
- Constant Field Values
-
J_POST
public static final java.lang.String J_POST
- See Also:
- Constant Field Values
-
J_METHOD
public static final java.lang.String J_METHOD
- See Also:
- Constant Field Values
-
J_SECURITY_CHECK
public static final java.lang.String J_SECURITY_CHECK
- See Also:
- Constant Field Values
-
ERROR_PARAMETER
public static final java.lang.String ERROR_PARAMETER
- See Also:
- Constant Field Values
-
CSRF_MAP
private static final java.lang.String CSRF_MAP
- See Also:
- Constant Field Values
-
CSRF_TOKEN
@Deprecated public static final java.lang.String CSRF_TOKEN
Deprecated.- See Also:
- Constant Field Values
-
_secureRandom
private final java.security.SecureRandom _secureRandom
-
_configuration
private OpenIdConfiguration _configuration
-
_errorPage
private java.lang.String _errorPage
-
_errorPath
private java.lang.String _errorPath
-
_errorQuery
private java.lang.String _errorQuery
-
_alwaysSaveUri
private boolean _alwaysSaveUri
-
-
Constructor Detail
-
OpenIdAuthenticator
public OpenIdAuthenticator()
-
OpenIdAuthenticator
public OpenIdAuthenticator(OpenIdConfiguration configuration, java.lang.String errorPage)
-
-
Method Detail
-
setConfiguration
public void setConfiguration(Authenticator.AuthConfiguration configuration)
Description copied from interface:Authenticator
Configure the Authenticator- Specified by:
setConfiguration
in interfaceAuthenticator
- Overrides:
setConfiguration
in classLoginAuthenticator
- Parameters:
configuration
- the configuration
-
getAuthMethod
public java.lang.String getAuthMethod()
- Returns:
- The name of the authentication method
-
setAlwaysSaveUri
@Deprecated public void setAlwaysSaveUri(boolean alwaysSave)
Deprecated.
-
isAlwaysSaveUri
@Deprecated public boolean isAlwaysSaveUri()
Deprecated.
-
setErrorPage
private void setErrorPage(java.lang.String path)
-
login
public UserIdentity login(java.lang.String username, java.lang.Object credentials, javax.servlet.ServletRequest request)
Description copied from class:LoginAuthenticator
If the UserIdentity is not null after this method callsLoginService.login(String, Object, ServletRequest)
, it is assumed that the user is fully authenticated and we need to change the session id to prevent session fixation vulnerability. If the UserIdentity is not necessarily fully authenticated, then subclasses must override this method and determine when the UserIdentity IS fully authenticated and renew the session id.- Overrides:
login
in classLoginAuthenticator
- Parameters:
username
- the username of the client to be authenticatedcredentials
- the user's credentialrequest
- the inbound request that needs authentication
-
logout
public void logout(javax.servlet.ServletRequest request)
- Overrides:
logout
in classLoginAuthenticator
-
prepareRequest
public void prepareRequest(javax.servlet.ServletRequest request)
Description copied from interface:Authenticator
Called prior to validateRequest. The authenticator can manipulate the request to update it with information that can be inspected prior to validateRequest being called. The primary purpose of this method is to satisfy the Servlet Spec 3.1 section 13.6.3 on handling Form authentication where the http method of the original request causing authentication is not the same as the http method resulting from the redirect after authentication.- Specified by:
prepareRequest
in interfaceAuthenticator
- Overrides:
prepareRequest
in classLoginAuthenticator
- Parameters:
request
- the request to manipulate
-
validateRequest
public Authentication validateRequest(javax.servlet.ServletRequest req, javax.servlet.ServletResponse res, boolean mandatory) throws ServerAuthException
Description copied from interface:Authenticator
Validate a request- Parameters:
req
- The requestres
- The responsemandatory
- True if authentication is mandatory.- Returns:
- An Authentication. If Authentication is successful, this will be a
Authentication.User
. If a response has been sent by the Authenticator (which can be done for both successful and unsuccessful authentications), then the result will implementAuthentication.ResponseSent
. If Authentication is not mandatory, then aAuthentication.Deferred
may be returned. - Throws:
ServerAuthException
- if unable to validate request
-
sendError
private void sendError(javax.servlet.http.HttpServletRequest request, javax.servlet.http.HttpServletResponse response, java.lang.String message) throws java.io.IOException
Report an error case either by redirecting to the error page if it is defined, otherwise sending a 403 response. If the message parameter is not null, a query parameter with a key ofERROR_PARAMETER
and value of the error message will be logged and added to the error redirect URI if the error page is defined.- Parameters:
request
- the request.response
- the response.message
- the reason for the error or null.- Throws:
java.io.IOException
- if sending the error fails for any reason.
-
isJSecurityCheck
public boolean isJSecurityCheck(java.lang.String uri)
-
isErrorPage
public boolean isErrorPage(java.lang.String pathInContext)
-
getRedirectUri
private java.lang.String getRedirectUri(javax.servlet.http.HttpServletRequest request)
-
getChallengeUri
protected java.lang.String getChallengeUri(Request request)
-
secureResponse
public boolean secureResponse(javax.servlet.ServletRequest req, javax.servlet.ServletResponse res, boolean mandatory, Authentication.User validatedUser)
Description copied from interface:Authenticator
is response secure- Parameters:
req
- the requestres
- the responsemandatory
- if security is mandatorvalidatedUser
- the user that was validated- Returns:
- true if response is secure
-
removeAndClearCsrfMap
private OpenIdAuthenticator.UriRedirectInfo removeAndClearCsrfMap(javax.servlet.http.HttpSession session, java.lang.String csrf)
-
ensureCsrfMap
private java.util.Map<java.lang.String,OpenIdAuthenticator.UriRedirectInfo> ensureCsrfMap(javax.servlet.http.HttpSession session)
-
-