Skip to content

Commit 28515b8

Browse files
TakahikoKawasakiTakahikoKawasaki
authored
Merge pull request #62 from authlete/feature/client-attestation
[feature] OAuth 2.0 Attestation-Based Client Authentication
2 parents 9602fa6 + f15a8f8 commit 28515b8

File tree

6 files changed

+131
-31
lines changed

6 files changed

+131
-31
lines changed

‎pom.xml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -12,9 +12,9 @@
1212
<properties>
1313
<project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
1414

15-
<authlete.java.common.version>4.2</authlete.java.common.version>
16-
<authlete.java.jaxrs.version>2.70</authlete.java.jaxrs.version>
17-
<authlete.cbor.version>1.14</authlete.cbor.version>
15+
<authlete.java.common.version>4.3</authlete.java.common.version>
16+
<authlete.java.jaxrs.version>2.79</authlete.java.jaxrs.version>
17+
<authlete.cbor.version>1.18</authlete.cbor.version>
1818
<javax.servlet-api.version>3.0.1</javax.servlet-api.version>
1919
<jersey.version>2.30.1</jersey.version>
2020
<jetty.version>9.4.27.v20200227</jetty.version>

‎src/main/java/com/authlete/jaxrs/server/api/PushedAuthReqEndpoint.java‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -86,6 +86,11 @@ private Params buildParams(
8686
// Even the call of the setHtm(String) method can be omitted, too.
8787
// When "htm" is not set, "POST" is used as the default value.
8888

89+
// OAuth 2.0 Attestation-Based Client Authentication
90+
params.setClientAttestation( request.getHeader("OAuth-Client-Attestation"))
91+
.setClientAttestationPop(request.getHeader("OAuth-Client-Attestation-PoP"))
92+
;
93+
8994
return params;
9095
}
9196
}

‎src/main/java/com/authlete/jaxrs/server/api/RevocationEndpoint.java‎

Lines changed: 41 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright (C) 2016 Authlete, Inc.
2+
* Copyright (C) 2016-2024 Authlete, Inc.
33
*
44
* Licensed under the Apache License, Version 2.0 (the "License");
55
* you may not use this file except in compliance with the License.
@@ -17,24 +17,27 @@
1717
package com.authlete.jaxrs.server.api;
1818

1919

20+
import javax.servlet.http.HttpServletRequest;
2021
import javax.ws.rs.Consumes;
21-
import javax.ws.rs.HeaderParam;
2222
import javax.ws.rs.POST;
2323
import javax.ws.rs.Path;
24+
import javax.ws.rs.core.Context;
2425
import javax.ws.rs.core.HttpHeaders;
2526
import javax.ws.rs.core.MediaType;
2627
import javax.ws.rs.core.MultivaluedMap;
2728
import javax.ws.rs.core.Response;
29+
import com.authlete.common.api.AuthleteApi;
2830
import com.authlete.common.api.AuthleteApiFactory;
2931
import com.authlete.jaxrs.BaseRevocationEndpoint;
32+
import com.authlete.jaxrs.RevocationRequestHandler.Params;
3033

3134

3235
/**
3336
* An implementation of revocation endpoint (<a href=
34-
* "http://tools.ietf.org/html/rfc7009">RFC 7009</a>).
37+
* "https://www.rfc-editor.org/rfc/rfc7009.html">RFC 7009</a>).
3538
*
36-
* @see <a href="http://tools.ietf.org/html/rfc7009"
37-
* >RFC 7009, OAuth 2.0 Token Revocation</a>
39+
* @see <a href="https://www.rfc-editor.org/rfc/rfc7009.html"
40+
* >RFC 7009: OAuth 2.0 Token Revocation</a>
3841
*
3942
* @author Takahiko Kawasaki
4043
*/
@@ -44,16 +47,46 @@ public class RevocationEndpoint extends BaseRevocationEndpoint
4447
/**
4548
* The revocation endpoint for {@code POST} method.
4649
*
47-
* @see <a href="http://tools.ietf.org/html/rfc7009#section-2.1"
50+
* @see <a href="https://www.rfc-editor.org/rfc/rfc7009.html#section-2.1"
4851
* >RFC 7009, 2.1. Revocation Request</a>
4952
*/
5053
@POST
5154
@Consumes(MediaType.APPLICATION_FORM_URLENCODED)
5255
public Response post(
53-
@HeaderParam(HttpHeaders.AUTHORIZATION) String authorization,
56+
@Context HttpServletRequest request,
5457
MultivaluedMap<String, String> parameters)
5558
{
59+
// Authlete API
60+
AuthleteApi authleteApi = AuthleteApiFactory.getDefaultApi();
61+
62+
// Parameters for Authlete's /auth/revocation API
63+
Params params = buildParams(request, parameters);
64+
5665
// Handle the revocation request.
57-
return handle(AuthleteApiFactory.getDefaultApi(), parameters, authorization);
66+
return handle(authleteApi, params);
67+
}
68+
69+
70+
private Params buildParams(
71+
HttpServletRequest request, MultivaluedMap<String, String> parameters)
72+
{
73+
Params params = new Params();
74+
75+
// RFC 6749
76+
// The OAuth 2.0 Authorization Framework
77+
params.setParameters(parameters)
78+
.setAuthorization(request.getHeader(HttpHeaders.AUTHORIZATION))
79+
;
80+
81+
// MTLS
82+
// RFC 8705 : OAuth 2.0 Mutual-TLS Client Authentication and Certificate-Bound Access Tokens
83+
params.setClientCertificatePath(extractClientCertificateChain(request));
84+
85+
// OAuth 2.0 Attestation-Based Client Authentication
86+
params.setClientAttestation( request.getHeader("OAuth-Client-Attestation"))
87+
.setClientAttestationPop(request.getHeader("OAuth-Client-Attestation-PoP"))
88+
;
89+
90+
return params;
5891
}
5992
}

‎src/main/java/com/authlete/jaxrs/server/api/TokenEndpoint.java‎

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright (C) 2016-2020 Authlete, Inc.
2+
* Copyright (C) 2016-2024 Authlete, Inc.
33
*
44
* Licensed under the Apache License, Version 2.0 (the "License");
55
* you may not use this file except in compliance with the License.
@@ -139,6 +139,11 @@ private Params buildParams(
139139
// Even the call of the setHtm(String) method can be omitted, too.
140140
// When "htm" is not set, "POST" is used as the default value.
141141

142+
// OAuth 2.0 Attestation-Based Client Authentication
143+
params.setClientAttestation( request.getHeader("OAuth-Client-Attestation"))
144+
.setClientAttestationPop(request.getHeader("OAuth-Client-Attestation-PoP"))
145+
;
146+
142147
return params;
143148
}
144149

‎src/main/java/com/authlete/jaxrs/server/api/backchannel/BackchannelAuthenticationEndpoint.java‎

Lines changed: 38 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright (C) 2019 Authlete, Inc.
2+
* Copyright (C) 2019-2024 Authlete, Inc.
33
*
44
* Licensed under the Apache License, Version 2.0 (the "License");
55
* you may not use this file except in compliance with the License.
@@ -19,21 +19,22 @@
1919

2020
import javax.servlet.http.HttpServletRequest;
2121
import javax.ws.rs.Consumes;
22-
import javax.ws.rs.HeaderParam;
2322
import javax.ws.rs.POST;
2423
import javax.ws.rs.Path;
2524
import javax.ws.rs.core.Context;
2625
import javax.ws.rs.core.HttpHeaders;
2726
import javax.ws.rs.core.MediaType;
2827
import javax.ws.rs.core.MultivaluedMap;
2928
import javax.ws.rs.core.Response;
29+
import com.authlete.common.api.AuthleteApi;
3030
import com.authlete.common.api.AuthleteApiFactory;
31+
import com.authlete.jaxrs.BackchannelAuthenticationRequestHandler.Params;
3132
import com.authlete.jaxrs.BaseBackchannelAuthenticationEndpoint;
3233

3334

3435
/**
35-
* An implementation of backchannel authentication endpoint of CIBA (Client Initiated
36-
* Backchannel Authentication).
36+
* An implementation of backchannel authentication endpoint of CIBA (Client Initiated
37+
* Backchannel Authentication).
3738
*
3839
* @author Hideki Ikeda
3940
*/
@@ -46,15 +47,41 @@ public class BackchannelAuthenticationEndpoint extends BaseBackchannelAuthentica
4647
@POST
4748
@Consumes(MediaType.APPLICATION_FORM_URLENCODED)
4849
public Response post(
49-
@HeaderParam(HttpHeaders.AUTHORIZATION) String authorization,
50-
MultivaluedMap<String, String> parameters,
51-
@Context HttpServletRequest request)
50+
@Context HttpServletRequest request,
51+
MultivaluedMap<String, String> parameters)
5252
{
53-
String[] clientCertificates = extractClientCertificateChain(request);
53+
// Authlete API
54+
AuthleteApi authleteApi = AuthleteApiFactory.getDefaultApi();
55+
56+
// Parameters for Authlete's /backchannel/authentication API
57+
Params params = buildParams(request, parameters);
5458

5559
// Handle the backchannel authentication request.
56-
return handle(AuthleteApiFactory.getDefaultApi(),
57-
new BackchannelAuthenticationRequestHandlerSpiImpl(), parameters,
58-
authorization, clientCertificates);
60+
return handle(authleteApi,
61+
new BackchannelAuthenticationRequestHandlerSpiImpl(), params);
62+
}
63+
64+
65+
private Params buildParams(
66+
HttpServletRequest request, MultivaluedMap<String, String> parameters)
67+
{
68+
Params params = new Params();
69+
70+
// RFC 6749
71+
// The OAuth 2.0 Authorization Framework
72+
params.setParameters(parameters)
73+
.setAuthorization(request.getHeader(HttpHeaders.AUTHORIZATION))
74+
;
75+
76+
// MTLS
77+
// RFC 8705 : OAuth 2.0 Mutual-TLS Client Authentication and Certificate-Bound Access Tokens
78+
params.setClientCertificatePath(extractClientCertificateChain(request));
79+
80+
// OAuth 2.0 Attestation-Based Client Authentication
81+
params.setClientAttestation( request.getHeader("OAuth-Client-Attestation"))
82+
.setClientAttestationPop(request.getHeader("OAuth-Client-Attestation-PoP"))
83+
;
84+
85+
return params;
5986
}
6087
}

‎src/main/java/com/authlete/jaxrs/server/api/device/DeviceAuthorizationEndpoint.java‎

Lines changed: 38 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright (C) 2019 Authlete, Inc.
2+
* Copyright (C) 2019-2024 Authlete, Inc.
33
*
44
* Licensed under the Apache License, Version 2.0 (the "License");
55
* you may not use this file except in compliance with the License.
@@ -19,22 +19,26 @@
1919

2020
import javax.servlet.http.HttpServletRequest;
2121
import javax.ws.rs.Consumes;
22-
import javax.ws.rs.HeaderParam;
2322
import javax.ws.rs.POST;
2423
import javax.ws.rs.Path;
2524
import javax.ws.rs.core.Context;
2625
import javax.ws.rs.core.HttpHeaders;
2726
import javax.ws.rs.core.MediaType;
2827
import javax.ws.rs.core.MultivaluedMap;
2928
import javax.ws.rs.core.Response;
29+
import com.authlete.common.api.AuthleteApi;
3030
import com.authlete.common.api.AuthleteApiFactory;
3131
import com.authlete.jaxrs.BaseDeviceAuthorizationEndpoint;
32+
import com.authlete.jaxrs.DeviceAuthorizationRequestHandler.Params;
3233

3334

3435
/**
3536
* An implementation of device authorization endpoint of OAuth 2.0 Device Authorization
3637
* Grant (Device Flow).
3738
*
39+
* @see <a href="https://www.rfc-editor.org/rfc/rfc8628.html"
40+
* >RFC 8628: OAuth 2.0 Device Authorization Grant</a>
41+
*
3842
* @author Hideki Ikeda
3943
*/
4044
@Path("/api/device/authorization")
@@ -46,14 +50,40 @@ public class DeviceAuthorizationEndpoint extends BaseDeviceAuthorizationEndpoint
4650
@POST
4751
@Consumes(MediaType.APPLICATION_FORM_URLENCODED)
4852
public Response post(
49-
@HeaderParam(HttpHeaders.AUTHORIZATION) String authorization,
50-
MultivaluedMap<String, String> parameters,
51-
@Context HttpServletRequest request)
53+
@Context HttpServletRequest request,
54+
MultivaluedMap<String, String> parameters)
5255
{
53-
String[] clientCertificates = extractClientCertificateChain(request);
56+
// Authlete API
57+
AuthleteApi authleteApi = AuthleteApiFactory.getDefaultApi();
58+
59+
// Parameters for Authlete's /device/authorization API
60+
Params params = buildParams(request, parameters);
5461

5562
// Handle the device authorization request.
56-
return handle(AuthleteApiFactory.getDefaultApi(), parameters, authorization,
57-
clientCertificates);
63+
return handle(authleteApi, params);
64+
}
65+
66+
67+
private Params buildParams(
68+
HttpServletRequest request, MultivaluedMap<String, String> parameters)
69+
{
70+
Params params = new Params();
71+
72+
// RFC 6749
73+
// The OAuth 2.0 Authorization Framework
74+
params.setParameters(parameters)
75+
.setAuthorization(request.getHeader(HttpHeaders.AUTHORIZATION))
76+
;
77+
78+
// MTLS
79+
// RFC 8705 : OAuth 2.0 Mutual-TLS Client Authentication and Certificate-Bound Access Tokens
80+
params.setClientCertificatePath(extractClientCertificateChain(request));
81+
82+
// OAuth 2.0 Attestation-Based Client Authentication
83+
params.setClientAttestation( request.getHeader("OAuth-Client-Attestation"))
84+
.setClientAttestationPop(request.getHeader("OAuth-Client-Attestation-PoP"))
85+
;
86+
87+
return params;
5888
}
5989
}

0 commit comments

Comments
 (0)