001/* 002 * oauth2-oidc-sdk 003 * 004 * Copyright 2012-2021, Connect2id Ltd and contributors. 005 * 006 * Licensed under the Apache License, Version 2.0 (the "License"); you may not use 007 * this file except in compliance with the License. You may obtain a copy of the 008 * License at 009 * 010 * http://www.apache.org/licenses/LICENSE-2.0 011 * 012 * Unless required by applicable law or agreed to in writing, software distributed 013 * under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR 014 * CONDITIONS OF ANY KIND, either express or implied. See the License for the 015 * specific language governing permissions and limitations under the License. 016 */ 017 018package com.nimbusds.oauth2.sdk.ciba; 019 020 021import java.net.URI; 022 023import net.jcip.annotations.Immutable; 024import net.minidev.json.JSONObject; 025 026import com.nimbusds.common.contenttype.ContentType; 027import com.nimbusds.oauth2.sdk.ParseException; 028import com.nimbusds.oauth2.sdk.http.HTTPRequest; 029import com.nimbusds.oauth2.sdk.token.BearerAccessToken; 030import com.nimbusds.oauth2.sdk.token.Tokens; 031import com.nimbusds.oauth2.sdk.util.JSONObjectUtils; 032import com.nimbusds.openid.connect.sdk.token.OIDCTokens; 033 034 035/** 036 * CIBA token push delivery to the client notification endpoint. 037 * 038 * <p>Example HTTP request: 039 * 040 * <pre> 041 * POST /cb HTTP/1.1 042 * Host: client.example.com 043 * Authorization: Bearer 8d67dc78-7faa-4d41-aabd-67707b374255 044 * Content-Type: application/json 045 * 046 * { 047 * "auth_req_id": "1c266114-a1be-4252-8ad1-04986c5b9ac1", 048 * "access_token": "G5kXH2wHvUra0sHlDy1iTkDJgsgUO1bN", 049 * "token_type": "Bearer", 050 * "refresh_token": "4bwc0ESC_IAhflf-ACC_vjD_ltc11ne-8gFPfA2Kx16", 051 * "expires_in": 120, 052 * "id_token": "eyJhbGciOiJSUzI1NiIsImtpZCI6IjE2NzcyNiJ9.eyJpc3MiOiJ 053 * odHRwczovL3NlcnZlci5leGFtcGxlLmNvbSIsInN1YiI6IjI0ODI4OTc2MTAwMS 054 * IsImF1ZCI6InM2QmhkUmtxdDMiLCJlbWFpbCI6ImphbmVkb2VAZXhhbXBsZS5jb 055 * 20iLCJleHAiOjE1Mzc4MTk4MDMsImlhdCI6MTUzNzgxOTUwMywiYXRfaGFzaCI6 056 * Ild0MGtWRlhNYWNxdm5IZXlVMDAwMXciLCJ1cm46b3BlbmlkOnBhcmFtczpqd3Q 057 * 6Y2xhaW06cnRfaGFzaCI6InNIYWhDdVNwWENSZzVta0REdnZyNHciLCJ1cm46b3 058 * BlbmlkOnBhcmFtczpqd3Q6Y2xhaW06YXV0aF9yZXFfaWQiOiIxYzI2NjExNC1hM 059 * WJlLTQyNTItOGFkMS0wNDk4NmM1YjlhYzEifQ.SGB5_a8E7GjwtoYrkFyqOhLK6 060 * L8-Wh1nLeREwWj30gNYOZW_ZB2mOeQ5yiXqeKJeNpDPssGUrNo-3N-CqNrbmVCb 061 * XYTwmNB7IvwE6ZPRcfxFV22oou-NS4-3rEa2ghG44Fi9D9fVURwxrRqgyezeD3H 062 * HVIFUnCxHUou3OOpj6aOgDqKI4Xl2xJ0-kKAxNR8LljUp64OHgoS-UO3qyfOwIk 063 * IAR7o4OTK_3Oy78rJNT0Y0RebAWyA81UDCSf_gWVBp-EUTI5CdZ1_odYhwB9OWD 064 * W1A22Sf6rmjhMHGbQW4A9Z822yiZZveuT_AFZ2hi7yNp8iFPZ8fgPQJ5pPpjA7u 065 * dg" 066 * } 067 * </pre> 068 * 069 * <p>Related specifications: 070 * 071 * <ul> 072 * <li>OpenID Connect CIBA Flow - Core 1.0, section 10.3.1. 073 * </ul> 074 */ 075@Immutable 076public class CIBATokenDelivery extends CIBAPushCallback { 077 078 079 /** 080 * The tokens. 081 */ 082 private final Tokens tokens; 083 084 085 /** 086 * Creates a new CIBA push token delivery for OAuth 2.0. 087 * 088 * @param endpoint The client notification endpoint. Must not be 089 * {@code null}. 090 * @param accessToken The client notification token. Must not be 091 * {@code null}. 092 * @param authRequestID The CIBA request ID. Must not be {@code null}. 093 * @param tokens The OAuth 2.0 tokens to deliver. Must not be 094 * {@code null}. 095 */ 096 public CIBATokenDelivery(final URI endpoint, 097 final BearerAccessToken accessToken, 098 final AuthRequestID authRequestID, 099 final Tokens tokens) { 100 101 super(endpoint, accessToken, authRequestID); 102 103 if (tokens == null) { 104 throw new IllegalArgumentException("The tokens must not be null"); 105 } 106 this.tokens = tokens; 107 } 108 109 110 /** 111 * Creates a new CIBA push token delivery for OpenID Connect. 112 * 113 * @param endpoint The client notification endpoint. Must not be 114 * {@code null}. 115 * @param accessToken The client notification token. Must not be 116 * {@code null}. 117 * @param authRequestID The CIBA request ID. Must not be {@code null}. 118 * @param oidcTokens The OpenID Connect tokens to deliver. Must not 119 * be {@code null}. 120 */ 121 public CIBATokenDelivery(final URI endpoint, 122 final BearerAccessToken accessToken, 123 final AuthRequestID authRequestID, 124 final OIDCTokens oidcTokens) { 125 126 super(endpoint, accessToken, authRequestID); 127 128 if (oidcTokens == null) { 129 throw new IllegalArgumentException("The OpenID Connect tokens must not be null"); 130 } 131 this.tokens = oidcTokens; 132 } 133 134 135 @Override 136 public boolean indicatesSuccess() { 137 138 return true; 139 } 140 141 142 /** 143 * Returns the OAuth 2.0 tokens. 144 * 145 * @return The tokens. 146 */ 147 public Tokens getTokens() { 148 149 return tokens; 150 } 151 152 153 /** 154 * Returns the OpenID Connect tokens if present. 155 * 156 * @return The OpenID Connect tokens, {@code null} if none. 157 */ 158 public OIDCTokens getOIDCTokens() { 159 160 return getTokens() instanceof OIDCTokens ? getTokens().toOIDCTokens() : null; 161 } 162 163 164 @Override 165 public HTTPRequest toHTTPRequest() { 166 167 HTTPRequest httpRequest = new HTTPRequest(HTTPRequest.Method.POST, getEndpointURI()); 168 httpRequest.setAuthorization(getAccessToken().toAuthorizationHeader()); 169 httpRequest.setEntityContentType(ContentType.APPLICATION_JSON); 170 JSONObject jsonObject = new JSONObject(); 171 jsonObject.put("auth_req_id", getAuthRequestID().getValue()); 172 jsonObject.putAll(getTokens().toJSONObject()); 173 httpRequest.setQuery(jsonObject.toJSONString()); 174 return httpRequest; 175 } 176 177 178 /** 179 * Parses a CIBA push token delivery from the specified HTTP request. 180 * 181 * @param httpRequest The HTTP request. Must not be {@code null}. 182 * 183 * @return The CIBA push token delivery. 184 * 185 * @throws ParseException If parsing failed. 186 */ 187 public static CIBATokenDelivery parse(final HTTPRequest httpRequest) 188 throws ParseException { 189 190 URI uri = httpRequest.getURI(); 191 httpRequest.ensureMethod(HTTPRequest.Method.POST); 192 httpRequest.ensureEntityContentType(ContentType.APPLICATION_JSON); 193 194 BearerAccessToken clientNotificationToken = BearerAccessToken.parse(httpRequest); 195 196 AuthRequestID authRequestID = new AuthRequestID( 197 JSONObjectUtils.getString( 198 httpRequest.getQueryAsJSONObject(), 199 "auth_req_id")); 200 201 JSONObject jsonObject = httpRequest.getQueryAsJSONObject(); 202 203 if (jsonObject.get("id_token") != null) { 204 return new CIBATokenDelivery( 205 uri, 206 clientNotificationToken, 207 authRequestID, 208 OIDCTokens.parse(jsonObject)); 209 } else { 210 return new CIBATokenDelivery( 211 uri, 212 clientNotificationToken, 213 authRequestID, 214 Tokens.parse(jsonObject)); 215 } 216 } 217}