[java-idp-oidc] branch main updated: JOIDC-21 - Use token authentication for OIDC dynamic client registration
Henri Mikkonen
henri.mikkonen at iki.fi
Tue Mar 15 08:00:57 UTC 2022
This is an automated email from the git hooks/post-receive script.
hjmikkon pushed a commit to branch main
in repository java-idp-oidc.
View the commit online:
http://git.shibboleth.net/view/?p=java-idp-oidc.git;a=commit;h=ea8df86c4dd7b388e054f4b2a04cec775586b99b
The following commit(s) were added to refs/heads/main by this push:
new ea8df86c JOIDC-21 - Use token authentication for OIDC dynamic client registration
ea8df86c is described below
commit ea8df86c4dd7b388e054f4b2a04cec775586b99b
Author: Henri Mikkonen <henri.mikkonen at iki.fi>
AuthorDate: Tue Mar 15 09:59:08 2022 +0200
JOIDC-21 - Use token authentication for OIDC dynamic client registration
https://shibboleth.atlassian.net/browse/JOIDC-21
Added HTTP-Basic auth support for the CLI tool. This way the CLI is still
functional if the flow is configured to require HTTP-Basic auth.
---
idp-oidc-extension-impl/pom.xml | 5 +
.../cli/IssueRegistrationAccessTokenArguments.java | 32 +++++-
.../op/cli/IssueRegistrationAccessTokenCLI.java | 114 +++++++++++++++++++++
.../idp/plugin/oidc/op/bin/issue-access-token.bat | 2 +-
.../idp/plugin/oidc/op/bin/issue-access-token.sh | 2 +-
5 files changed, 149 insertions(+), 6 deletions(-)
diff --git a/idp-oidc-extension-impl/pom.xml b/idp-oidc-extension-impl/pom.xml
index f87b0e40..242ca21d 100644
--- a/idp-oidc-extension-impl/pom.xml
+++ b/idp-oidc-extension-impl/pom.xml
@@ -81,6 +81,11 @@
<artifactId>idp-ui</artifactId>
<scope>provided</scope>
</dependency>
+ <dependency>
+ <groupId>net.shibboleth.idp</groupId>
+ <artifactId>idp-installer</artifactId>
+ <scope>provided</scope>
+ </dependency>
<dependency>
<groupId>net.shibboleth.oidc</groupId>
<artifactId>oidc-common-attribute-api</artifactId>
diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/cli/IssueRegistrationAccessTokenArguments.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/cli/IssueRegistrationAccessTokenArguments.java
index 8e2c5764..25367534 100644
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/cli/IssueRegistrationAccessTokenArguments.java
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/cli/IssueRegistrationAccessTokenArguments.java
@@ -19,6 +19,8 @@ package net.shibboleth.idp.plugin.oidc.op.cli;
import java.io.UnsupportedEncodingException;
import java.net.URLEncoder;
+import java.nio.charset.StandardCharsets;
+import java.util.Base64;
import javax.annotation.Nonnull;
import javax.annotation.Nullable;
@@ -26,6 +28,7 @@ import javax.annotation.Nullable;
import com.beust.jcommander.Parameter;
import net.shibboleth.idp.cli.AbstractCommandLineArguments;
+import net.shibboleth.utilities.java.support.primitive.StringSupport;
/** Command line processing for issue-registration-access-token flow. */
public class IssueRegistrationAccessTokenArguments extends AbstractCommandLineArguments {
@@ -56,13 +59,22 @@ public class IssueRegistrationAccessTokenArguments extends AbstractCommandLineAr
/** Flag to signal one-time use of the token. */
@Parameter(names = {"-o", "--onetime"}, required = false, description = "Flag to signal one-time use of the token")
- @Nullable private boolean onetime;
+ @Nullable private String onetime;
+
+ /** Username to be used in the HTTP-Basic authentication. */
+ @Parameter(names = {"-user", "--username"}, required = false, description = "Username to be used in HTTP-Basic Auth")
+ @Nullable private String username;
+
+ /** Password to be used in the HTTP-Basic authentication. */
+ @Parameter(names = {"-pwd", "--password"}, required = false, password = true,
+ description = "Password to be used in HTTP-Basic Auth")
+ @Nullable private String password;
/**
* Constructor.
*/
public IssueRegistrationAccessTokenArguments() {
- onetime = true;
+ onetime = "true";
}
/** {@inheritDoc} */
@@ -101,13 +113,25 @@ public class IssueRegistrationAccessTokenArguments extends AbstractCommandLineAr
.append(URLEncoder.encode(metadata, "UTF-8"))
.append("&" + URL_PARAM_RELYING_PARTY_ID + "=")
.append(URLEncoder.encode(relyingPartyId, "UTF-8"))
- .append("&" + URL_PARAM_ONE_TIME_TOKEN + "=" + onetime);
+ .append("&" + URL_PARAM_ONE_TIME_TOKEN + "=" + "true".equalsIgnoreCase(onetime));
} catch (final UnsupportedEncodingException e) {
// UTF-8 is a required encoding.
throw new RuntimeException("URL encoding failed", e);
}
return builder;
- }
+ }
+ /**
+ * Builds the HTTP-Basic value to be used in the Authorization -header, containing username and password.
+ *
+ * @return The value to be used in the Authorization -header, or null if username or password didn't have a value.
+ */
+ public String getBasicAuthHeader() {
+ if (StringSupport.trimOrNull(username) == null || StringSupport.trimOrNull(password) == null) {
+ return null;
+ }
+ final String rawHeader = username + ":" + password;
+ return "Basic " + Base64.getEncoder().encodeToString(rawHeader.getBytes(StandardCharsets.UTF_8));
+ }
}
\ No newline at end of file
diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/cli/IssueRegistrationAccessTokenCLI.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/cli/IssueRegistrationAccessTokenCLI.java
new file mode 100644
index 00000000..a2bf9213
--- /dev/null
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/cli/IssueRegistrationAccessTokenCLI.java
@@ -0,0 +1,114 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.idp.plugin.oidc.op.cli;
+
+import java.io.BufferedReader;
+import java.io.IOException;
+import java.io.InputStream;
+import java.io.InputStreamReader;
+import java.net.HttpURLConnection;
+import java.net.MalformedURLException;
+import java.net.URL;
+
+import javax.annotation.Nonnull;
+
+import com.beust.jcommander.JCommander;
+
+/**
+ * Entry point for command line tool interacting with the registration access token issuance flow.
+ *
+ * Based on <pre>net.shibboleth.idp.cli.CLI</pre>, adding a feature to inject authorization-header for HTTP-Basic auth.
+ */
+public final class IssueRegistrationAccessTokenCLI {
+
+ /** Constructor. */
+ private IssueRegistrationAccessTokenCLI() {
+
+ }
+
+ /**
+ * Command line entry point.
+ *
+ * @param args command line arguments
+ * @throws SecurityException from the object construction
+ * @throws ReflectiveOperationException from the object construction
+ * @throws IllegalArgumentException from the object construction
+ */
+ public static void main(@Nonnull final String[] args) throws ReflectiveOperationException,
+ SecurityException, IllegalArgumentException {
+
+ final IssueRegistrationAccessTokenArguments arguments = new IssueRegistrationAccessTokenArguments();
+
+ final JCommander jc = new JCommander(arguments);
+ jc.parse(args);
+ if (arguments.isUsage()) {
+ jc.usage();
+ return;
+ }
+ try {
+ arguments.validate();
+ } catch (final IllegalArgumentException e) {
+ errorAndExit(e.getMessage());
+ }
+
+ doRequest(arguments);
+ }
+
+ /**
+ * Make a request using the arguments established.
+ *
+ * @param args the populated command line arguments
+ */
+ private static void doRequest(@Nonnull final IssueRegistrationAccessTokenArguments args) {
+ URL url = null;
+ try {
+ url = args.buildURL();
+ final HttpURLConnection connection = (HttpURLConnection) url.openConnection();
+ final String authorization = args.getBasicAuthHeader();
+ if (authorization != null) {
+ System.out.println("Using HTTP-Basic authentication");
+ connection.setRequestProperty("Authorization", authorization);
+ }
+ try (final InputStream stream = connection.getInputStream()) {
+ try (final InputStreamReader reader = new InputStreamReader(stream)) {
+ try (final BufferedReader in = new BufferedReader(reader)) {
+ String line;
+ while((line = in.readLine()) != null) {
+ System.out.println(line);
+ }
+ }
+ }
+ }
+ } catch (final MalformedURLException e) {
+ errorAndExit(e.getMessage());
+ } catch (final IOException e) {
+ errorAndExit((url != null ? "(" + url.toString() + ") " : "") + e.getMessage());
+ }
+ }
+
+ /**
+ * Logs, as an error, the error message and exits the program.
+ *
+ * @param errorMessage error message
+ */
+ private static void errorAndExit(@Nonnull final String errorMessage) {
+ System.err.println(errorMessage);
+ System.exit(1);
+ }
+
+}
\ No newline at end of file
diff --git a/idp-oidc-extension-impl/src/main/resources/net/shibboleth/idp/plugin/oidc/op/bin/issue-access-token.bat b/idp-oidc-extension-impl/src/main/resources/net/shibboleth/idp/plugin/oidc/op/bin/issue-access-token.bat
index 90e90c00..722013dd 100644
--- a/idp-oidc-extension-impl/src/main/resources/net/shibboleth/idp/plugin/oidc/op/bin/issue-access-token.bat
+++ b/idp-oidc-extension-impl/src/main/resources/net/shibboleth/idp/plugin/oidc/op/bin/issue-access-token.bat
@@ -1,4 +1,4 @@
@echo off
setlocal
-"%~dp0\runclass.bat" -Dnet.shibboleth.idp.cli.arguments=net.shibboleth.idp.plugin.oidc.op.cli.IssueRegistrationAccessTokenArguments net.shibboleth.idp.cli.CLI %*
\ No newline at end of file
+"%~dp0\runclass.bat" -Dnet.shibboleth.idp.cli.arguments=net.shibboleth.idp.plugin.oidc.op.cli.IssueRegistrationAccessTokenArguments net.shibboleth.idp.plugin.oidc.op.cli.IssueRegistrationAccessTokenCLI %*
diff --git a/idp-oidc-extension-impl/src/main/resources/net/shibboleth/idp/plugin/oidc/op/bin/issue-access-token.sh b/idp-oidc-extension-impl/src/main/resources/net/shibboleth/idp/plugin/oidc/op/bin/issue-access-token.sh
index 2f5d7e48..ac97a617 100644
--- a/idp-oidc-extension-impl/src/main/resources/net/shibboleth/idp/plugin/oidc/op/bin/issue-access-token.sh
+++ b/idp-oidc-extension-impl/src/main/resources/net/shibboleth/idp/plugin/oidc/op/bin/issue-access-token.sh
@@ -5,4 +5,4 @@ declare LOCATION
LOCATION=$(dirname $0)
$LOCATION/runclass.sh -Dnet.shibboleth.idp.cli.arguments=net.shibboleth.idp.plugin.oidc.op.cli.IssueRegistrationAccessTokenArguments \
- net.shibboleth.idp.cli.CLI "$@"
\ No newline at end of file
+ net.shibboleth.idp.plugin.oidc.op.cli.IssueRegistrationAccessTokenCLI "$@"
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list