26 | * {
27 | * "federations": [
28 | * (each element is mapped to {@link FederationConfig})
29 | * ]
30 | * }
31 | *
32 | *
33 | * @see FederationsConfigLoader
34 | */
35 | public class FederationsConfig implements Serializable
36 | {
37 | private static final long serialVersionUID = 1L;
38 |
39 |
40 | private FederationConfig[] federations;
41 |
42 |
43 | public FederationConfig[] getFederations()
44 | {
45 | return federations;
46 | }
47 |
48 |
49 | public FederationsConfig setFederations(FederationConfig[] federations)
50 | {
51 | this.federations = federations;
52 |
53 | return this;
54 | }
55 | }
56 |
--------------------------------------------------------------------------------
/src/main/java/com/authlete/jaxrs/server/ad/dto/PollAuthenticationRequest.java:
--------------------------------------------------------------------------------
1 | /*
2 | * Copyright (C) 2019 Authlete, Inc.
3 | *
4 | * Licensed under the Apache License, Version 2.0 (the "License");
5 | * you may not use this file except in compliance with the License.
6 | * You may obtain a copy of the License at
7 | *
8 | * http://www.apache.org/licenses/LICENSE-2.0
9 | *
10 | * Unless required by applicable law or agreed to in writing,
11 | * software distributed under the License is distributed on an
12 | * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND,
13 | * either express or implied. See the License for the specific
14 | * language governing permissions and limitations under the
15 | * License.
16 | */
17 | package com.authlete.jaxrs.server.ad.dto;
18 |
19 |
20 | /**
21 | * A class representing a request to
22 | * /api/authenticate/poll API of
23 | * Authlete CIBA authentication device simulator.
24 | *
25 | * @see Authlete CIBA authentication
26 | * device simulator
27 | *
28 | * @see
29 | * /api/authenticate/poll API
30 | *
31 | * @author Hideki Ikeda
32 | */
33 | public class PollAuthenticationRequest extends BaseAuthenticationRequest27 | * NOTE: The media type of SD-JWT VC has been changed from {@code vc+sd-jwt} to 28 | * {@code dc+sd-jwt} by OAuth-SD-JWT-VC PR 268: change media type from vc+sd-jwt to dc+sd-jwt. 30 | *
31 | * 32 | * @see OAuth-SD-JWT VC PR 268: change media type from vc+sd-jwt to dc+sd-jwt 34 | * 35 | * @see IETF 121 Dublin, SD-JWT/SD-JWT VC, Page 51 37 | */ 38 | public enum OrderFormat 39 | { 40 | DC_SD_JWT("dc+sd-jwt", new SdJwtOrderProcessor()), 41 | VC_SD_JWT("vc+sd-jwt", new SdJwtOrderProcessor()), 42 | MDOC("mso_mdoc", new MdocOrderProcessor()), 43 | ; 44 | 45 | 46 | private final String id; 47 | private final OrderProcessor processor; 48 | 49 | 50 | private OrderFormat(String id, OrderProcessor processor) 51 | { 52 | this.id = id; 53 | this.processor = processor; 54 | } 55 | 56 | 57 | public String getId() 58 | { 59 | return id; 60 | } 61 | 62 | 63 | public OrderProcessor getProcessor() 64 | { 65 | return processor; 66 | } 67 | 68 | 69 | public static OrderFormat byId(final String id) 70 | { 71 | return Arrays.stream(OrderFormat.values()) 72 | .filter(format -> format.getId().equals(id)) 73 | .findFirst() 74 | .orElse(null); 75 | } 76 | } 77 | -------------------------------------------------------------------------------- /src/main/webapp/css/device/authorization.css: -------------------------------------------------------------------------------- 1 | /* 2 | * Copyright (C) 2019 Authlete, Inc. 3 | * 4 | * Licensed under the Apache License, Version 2.0 (the "License"); 5 | * you may not use this file except in compliance with the License. 6 | * You may obtain a copy of the License at 7 | * 8 | * http://www.apache.org/licenses/LICENSE-2.0 9 | * 10 | * Unless required by applicable law or agreed to in writing, 11 | * software distributed under the License is distributed on an 12 | * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, 13 | * either express or implied. See the License for the specific 14 | * language governing permissions and limitations under the 15 | * License. 16 | */ 17 | 18 | .font-default 19 | { 20 | font-family: 'Source Sans Pro', 'Helvetica Neue', 'Segoe UI', 'Arial', sans-serif; 21 | -webkit-font-smoothing: antialiased; 22 | color: #666; 23 | } 24 | 25 | body { 26 | margin: 0; 27 | text-shadow: none; 28 | } 29 | 30 | p { 31 | margin-top: 0; 32 | } 33 | 34 | h3, h4 { 35 | color: steelblue; 36 | } 37 | 38 | .indent { 39 | margin-left: 15px; 40 | } 41 | 42 | #page_title { 43 | background: #F5F5F5; 44 | color: steelblue; 45 | padding: 0.5em; 46 | margin: 0; 47 | } 48 | 49 | #content { 50 | padding: 0 20px 20px; 51 | } 52 | 53 | #scope-list { 54 | margin-left: 20px; 55 | } 56 | 57 | #scope-list dt { 58 | font-weight: bold; 59 | } 60 | 61 | #scope-list dd { 62 | margin-bottom: 10px; 63 | } 64 | 65 | input { 66 | color: black; 67 | } 68 | 69 | #authorization-form-buttons { 70 | margin: 20px auto; 71 | } 72 | 73 | #authorize-button, #deny-button { 74 | display: inline-block; 75 | width: 150px; 76 | padding: 12px 0; 77 | margin: 13px; 78 | min-height: 26px; 79 | text-align: center; 80 | text-decoration: none; 81 | outline: 0; 82 | -webkit-transition: none; 83 | transition: none; 84 | } 85 | 86 | #authorize-button { 87 | background-color: #4285f4; 88 | color: white; 89 | } 90 | 91 | #authorize-button:hover { 92 | background-color: #1255f4; 93 | } 94 | 95 | #authorize-button:active { 96 | background-color: blue; 97 | } 98 | 99 | #deny-button { 100 | background-color: #f08080; 101 | color: white; 102 | } 103 | 104 | #deny-button:hover { 105 | background-color: #f05050; 106 | } 107 | 108 | #deny-button:active { 109 | background-color: red; 110 | } 111 | -------------------------------------------------------------------------------- /src/main/java/com/authlete/jaxrs/server/api/JwksEndpoint.java: -------------------------------------------------------------------------------- 1 | /* 2 | * Copyright (C) 2016 Authlete, Inc. 3 | * 4 | * Licensed under the Apache License, Version 2.0 (the "License"); 5 | * you may not use this file except in compliance with the License. 6 | * You may obtain a copy of the License at 7 | * 8 | * http://www.apache.org/licenses/LICENSE-2.0 9 | * 10 | * Unless required by applicable law or agreed to in writing, 11 | * software distributed under the License is distributed on an 12 | * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, 13 | * either express or implied. See the License for the specific 14 | * language governing permissions and limitations under the 15 | * License. 16 | */ 17 | package com.authlete.jaxrs.server.api; 18 | 19 | 20 | import javax.ws.rs.GET; 21 | import javax.ws.rs.Path; 22 | import javax.ws.rs.core.Response; 23 | import com.authlete.common.api.AuthleteApiFactory; 24 | import com.authlete.jaxrs.BaseJwksEndpoint; 25 | 26 | 27 | /** 28 | * An implementation of an endpoint to expose a JSON Web Key Set document 29 | * (RFC 7517). 30 | * 31 | *32 | * An OpenID Provider (OP) is required to expose its JSON Web Key Set document 33 | * (JWK Set) so that client applications can (1) verify signatures by the OP 34 | * and (2) encrypt their requests to the OP. The URI of a JWK Set endpoint can 35 | * be found as the value of {@code jwks_uri} in OpenID Provider Metadata if the OP supports OpenID 39 | * Connect Discovery 1.0. 40 | *
41 | * 42 | * @see RFC 7517, JSON Web Key (JWK) 44 | * 45 | * @see OpenID Connect Core 1.0 47 | * 48 | * @see OpenID Connect Discovery 1.0 50 | * 51 | * @author Takahiko Kawasaki 52 | */ 53 | @Path("/api/jwks") 54 | public class JwksEndpoint extends BaseJwksEndpoint 55 | { 56 | /** 57 | * JWK Set endpoint. 58 | */ 59 | @GET 60 | public Response get() 61 | { 62 | // Handle the JWK Set request. 63 | return handle(AuthleteApiFactory.getDefaultApi()); 64 | } 65 | } 66 | -------------------------------------------------------------------------------- /src/main/java/com/authlete/jaxrs/server/ad/dto/PollAuthenticationResponse.java: -------------------------------------------------------------------------------- 1 | /* 2 | * Copyright (C) 2019 Authlete, Inc. 3 | * 4 | * Licensed under the Apache License, Version 2.0 (the "License"); 5 | * you may not use this file except in compliance with the License. 6 | * You may obtain a copy of the License at 7 | * 8 | * http://www.apache.org/licenses/LICENSE-2.0 9 | * 10 | * Unless required by applicable law or agreed to in writing, 11 | * software distributed under the License is distributed on an 12 | * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, 13 | * either express or implied. See the License for the specific 14 | * language governing permissions and limitations under the 15 | * License. 16 | */ 17 | package com.authlete.jaxrs.server.ad.dto; 18 | 19 | 20 | import java.io.Serializable; 21 | import javax.xml.bind.annotation.XmlElement; 22 | 23 | 24 | /** 25 | * A class representing a response from 26 | * /api/authenticate/poll API of 27 | * Authlete CIBA authentication device simulator. 28 | * 29 | * @see Authlete CIBA authentication 30 | * device simulator 31 | * 32 | * @see 33 | * /api/authenticate/poll API 34 | * 35 | * @author Hideki Ikeda 36 | */ 37 | public class PollAuthenticationResponse implements Serializable 38 | { 39 | private static final long serialVersionUID = 1L; 40 | 41 | 42 | @XmlElement(name = "request_id") 43 | private String requestId; 44 | 45 | 46 | /** 47 | * Get the ID of the request corresponding to this response. 48 | * 49 | * @return 50 | * The ID of the request corresponding to this response. 51 | */ 52 | public String getRequestId() 53 | { 54 | return requestId; 55 | } 56 | 57 | 58 | /** 59 | * Set the ID of the request corresponding to this response. 60 | * 61 | * @param requestId 62 | * The ID of the request corresponding to this response. 63 | * 64 | * @return 65 | * {@code this} object. 66 | */ 67 | public PollAuthenticationResponse setRequestId(String requestId) 68 | { 69 | this.requestId = requestId; 70 | 71 | return this; 72 | } 73 | } 74 | -------------------------------------------------------------------------------- /src/main/java/com/authlete/jaxrs/server/obb/model/Links.java: -------------------------------------------------------------------------------- 1 | /* 2 | * Copyright (C) 2021 Authlete, Inc. 3 | * 4 | * Licensed under the Apache License, Version 2.0 (the "License"); 5 | * you may not use this file except in compliance with the License. 6 | * You may obtain a copy of the License at 7 | * 8 | * http://www.apache.org/licenses/LICENSE-2.0 9 | * 10 | * Unless required by applicable law or agreed to in writing, software 11 | * distributed under the License is distributed on an "AS IS" BASIS, 12 | * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 13 | * See the License for the specific language governing permissions and 14 | * limitations under the License. 15 | */ 16 | package com.authlete.jaxrs.server.obb.model; 17 | 18 | 19 | import java.io.Serializable; 20 | 21 | 22 | /** 23 | * Links 24 | * 25 | * @see Links 27 | */ 28 | public class Links implements Serializable 29 | { 30 | private static final long serialVersionUID = 1L; 31 | 32 | 33 | private String self; 34 | private String first; 35 | private String prev; 36 | private String next; 37 | private String last; 38 | 39 | 40 | public String getSelf() 41 | { 42 | return self; 43 | } 44 | 45 | 46 | public Links setSelf(String self) 47 | { 48 | this.self = self; 49 | 50 | return this; 51 | } 52 | 53 | 54 | public String getFirst() 55 | { 56 | return first; 57 | } 58 | 59 | 60 | public Links setFirst(String first) 61 | { 62 | this.first = first; 63 | 64 | return this; 65 | } 66 | 67 | 68 | public String getPrev() 69 | { 70 | return prev; 71 | } 72 | 73 | 74 | public Links setPrev(String prev) 75 | { 76 | this.prev = prev; 77 | 78 | return this; 79 | } 80 | 81 | 82 | public String getNext() 83 | { 84 | return next; 85 | } 86 | 87 | 88 | public Links setNext(String next) 89 | { 90 | this.next = next; 91 | 92 | return this; 93 | } 94 | 95 | 96 | public String getLast() 97 | { 98 | return last; 99 | } 100 | 101 | 102 | public Links setLast(String last) 103 | { 104 | this.last = last; 105 | 106 | return this; 107 | } 108 | } 109 | -------------------------------------------------------------------------------- /src/main/java/com/authlete/jaxrs/server/obb/model/ResponseConsent.java: -------------------------------------------------------------------------------- 1 | /* 2 | * Copyright (C) 2021 Authlete, Inc. 3 | * 4 | * Licensed under the Apache License, Version 2.0 (the "License"); 5 | * you may not use this file except in compliance with the License. 6 | * You may obtain a copy of the License at 7 | * 8 | * http://www.apache.org/licenses/LICENSE-2.0 9 | * 10 | * Unless required by applicable law or agreed to in writing, software 11 | * distributed under the License is distributed on an "AS IS" BASIS, 12 | * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 13 | * See the License for the specific language governing permissions and 14 | * limitations under the License. 15 | */ 16 | package com.authlete.jaxrs.server.obb.model; 17 | 18 | 19 | import java.io.Serializable; 20 | import com.authlete.jaxrs.server.obb.util.ObbUtils; 21 | 22 | 23 | /** 24 | * ResponseConsent. 25 | * 26 | * @see ResponseConsent 28 | */ 29 | public class ResponseConsent implements Serializable 30 | { 31 | private static final long serialVersionUID = 1L; 32 | 33 | 34 | private ResponseConsentData data; 35 | 36 | 37 | public ResponseConsent() 38 | { 39 | } 40 | 41 | 42 | public ResponseConsent(Consent consent, Links links, Meta meta) 43 | { 44 | data = new ResponseConsentData() 45 | .setConsentId(consent.getConsentId()) 46 | .setCreationDateTime(consent.getCreationDateTime()) 47 | .setStatus(consent.getStatus()) 48 | .setStatusUpdateDateTime(consent.getStatusUpdateDateTime()) 49 | .setPermissions(consent.getPermissions()) 50 | .setExpirationDateTime(consent.getExpirationDateTime()) 51 | .setLinks(links) 52 | .setMeta(meta) 53 | ; 54 | } 55 | 56 | 57 | public ResponseConsentData getData() 58 | { 59 | return data; 60 | } 61 | 62 | 63 | public ResponseConsent setData(ResponseConsentData data) 64 | { 65 | this.data = data; 66 | 67 | return this; 68 | } 69 | 70 | 71 | public static ResponseConsent create(Consent consent) 72 | { 73 | Links links = new Links().setSelf("/"); 74 | Meta meta = new Meta(1, 1, ObbUtils.formatNow()); 75 | 76 | return new ResponseConsent(consent, links, meta); 77 | } 78 | } 79 | -------------------------------------------------------------------------------- /src/main/java/com/authlete/jaxrs/server/ad/dto/AsyncAuthenticationResponse.java: -------------------------------------------------------------------------------- 1 | /* 2 | * Copyright (C) 2019 Authlete, Inc. 3 | * 4 | * Licensed under the Apache License, Version 2.0 (the "License"); 5 | * you may not use this file except in compliance with the License. 6 | * You may obtain a copy of the License at 7 | * 8 | * http://www.apache.org/licenses/LICENSE-2.0 9 | * 10 | * Unless required by applicable law or agreed to in writing, 11 | * software distributed under the License is distributed on an 12 | * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, 13 | * either express or implied. See the License for the specific 14 | * language governing permissions and limitations under the 15 | * License. 16 | */ 17 | package com.authlete.jaxrs.server.ad.dto; 18 | 19 | 20 | import java.io.Serializable; 21 | import javax.xml.bind.annotation.XmlElement; 22 | 23 | 24 | /** 25 | * A class representing a response from 26 | * /api/authenticate/async API of 27 | * Authlete CIBA authentication device simulator. 28 | * 29 | * @see Authlete CIBA authentication 30 | * device simulator 31 | * 32 | * @see 33 | * /api/authenticate/async API 34 | * 35 | * @author Hideki Ikeda 36 | */ 37 | public class AsyncAuthenticationResponse implements Serializable 38 | { 39 | private static final long serialVersionUID = 1L; 40 | 41 | 42 | @XmlElement(name = "request_id") 43 | private String requestId; 44 | 45 | 46 | /** 47 | * Get the ID of the request corresponding to this response. 48 | * 49 | * @return 50 | * The ID of the request corresponding to this response. 51 | */ 52 | public String getRequestId() 53 | { 54 | return requestId; 55 | } 56 | 57 | 58 | /** 59 | * Set the ID of the request corresponding to this response. 60 | * 61 | * @param requestId 62 | * The ID of the request corresponding to this response. 63 | * 64 | * @return 65 | * {@code this} object. 66 | */ 67 | public AsyncAuthenticationResponse setRequestId(String requestId) 68 | { 69 | this.requestId = requestId; 70 | 71 | return this; 72 | } 73 | } 74 | -------------------------------------------------------------------------------- /src/main/java/com/authlete/jaxrs/server/api/vci/CredentialJWKSetEndpoint.java: -------------------------------------------------------------------------------- 1 | /* 2 | * Copyright (C) 2023 Authlete, Inc. 3 | * 4 | * Licensed under the Apache License, Version 2.0 (the "License"); 5 | * you may not use this file except in compliance with the License. 6 | * You may obtain a copy of the License at 7 | * 8 | * http://www.apache.org/licenses/LICENSE-2.0 9 | * 10 | * Unless required by applicable law or agreed to in writing, 11 | * software distributed under the License is distributed on an 12 | * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, 13 | * either express or implied. See the License for the specific 14 | * language governing permissions and limitations under the 15 | * License. 16 | */ 17 | package com.authlete.jaxrs.server.api.vci; 18 | 19 | 20 | import javax.ws.rs.GET; 21 | import javax.ws.rs.Path; 22 | import javax.ws.rs.WebApplicationException; 23 | import javax.ws.rs.core.Response; 24 | import com.authlete.common.api.AuthleteApi; 25 | import com.authlete.common.api.AuthleteApiFactory; 26 | import com.authlete.common.dto.CredentialIssuerJwksRequest; 27 | import com.authlete.common.dto.CredentialIssuerJwksResponse; 28 | import com.authlete.jaxrs.server.util.ExceptionUtil; 29 | import com.authlete.jaxrs.server.util.ResponseUtil; 30 | 31 | 32 | @Path("/api/vci/jwks") 33 | public class CredentialJWKSetEndpoint extends AbstractCredentialEndpoint 34 | { 35 | @GET 36 | public Response get() 37 | { 38 | final AuthleteApi api = AuthleteApiFactory.getDefaultApi(); 39 | 40 | return process(api); 41 | } 42 | 43 | 44 | private Response process(final AuthleteApi api) 45 | throws WebApplicationException 46 | { 47 | final CredentialIssuerJwksRequest request = 48 | new CredentialIssuerJwksRequest() 49 | .setPretty(false); 50 | 51 | final CredentialIssuerJwksResponse response = 52 | api.credentialIssuerJwks(request); 53 | final String content = response.getResponseContent(); 54 | 55 | switch (response.getAction()) 56 | { 57 | case NOT_FOUND: 58 | return ResponseUtil.notFoundJson(content); 59 | 60 | case OK: 61 | return ResponseUtil.okJson(response.getResponseContent()); 62 | 63 | case INTERNAL_SERVER_ERROR: 64 | default: 65 | throw ExceptionUtil.internalServerErrorExceptionJson(content); 66 | } 67 | } 68 | } 69 | -------------------------------------------------------------------------------- /src/main/java/com/authlete/jaxrs/server/federation/ServerConfig.java: -------------------------------------------------------------------------------- 1 | /* 2 | * Copyright (C) 2022 Authlete, Inc. 3 | * 4 | * Licensed under the Apache License, Version 2.0 (the "License"); 5 | * you may not use this file except in compliance with the License. 6 | * You may obtain a copy of the License at 7 | * 8 | * http://www.apache.org/licenses/LICENSE-2.0 9 | * 10 | * Unless required by applicable law or agreed to in writing, software 11 | * distributed under the License is distributed on an "AS IS" BASIS, 12 | * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 13 | * See the License for the specific language governing permissions and 14 | * limitations under the License. 15 | */ 16 | package com.authlete.jaxrs.server.federation; 17 | 18 | 19 | import static com.authlete.jaxrs.server.federation.ConfigValidationHelper.ensureNotEmpty; 20 | import static com.authlete.jaxrs.server.federation.ConfigValidationHelper.ensureUri; 21 | import java.io.Serializable; 22 | 23 | 24 | /** 25 | * Server configuration for ID federation. 26 | * 27 | *
28 | * {
29 | * "name": "(display name of the OpenID Provider)",
30 | * "issuer": "(issuer identifier of the OpenID Provider)"
31 | * }
32 | *
33 | *
34 | *
35 | * The value of {@code "issuer"} must match the value of {@code "issuer"}
36 | * in the discovery document of the OpenID Provider. The OpenID Provider
37 | * must expose its discovery document at
38 | * {issuer}/.well-known/openid-configuration.
39 | *
The application is requesting the following permissions.
46 | 47 |Do you grant authorization to the application?
59 | 60 | 66 |57 | * Arbitrary data can be set to this request parameter and the data will be 58 | * sent to the callback endpoint with the result of end-user authentication 59 | * and authorization. 60 | *
61 | * 62 | * @param state 63 | * Arbitrary data that will be sent to the callback endpoint with the 64 | * result of end-user authentication and authorization. 65 | * 66 | * @return 67 | * {@code this} object. 68 | */ 69 | public AsyncAuthenticationRequest setState(String state) 70 | { 71 | this.state = state; 72 | 73 | return this; 74 | } 75 | } 76 | -------------------------------------------------------------------------------- /src/main/java/com/authlete/jaxrs/server/util/ProcessingUtil.java: -------------------------------------------------------------------------------- 1 | package com.authlete.jaxrs.server.util; 2 | 3 | 4 | import static com.authlete.jaxrs.server.util.ExceptionUtil.badRequestException; 5 | import java.util.Date; 6 | import java.util.Map; 7 | import java.util.stream.Collectors; 8 | import javax.servlet.http.HttpServletRequest; 9 | import javax.servlet.http.HttpSession; 10 | import javax.ws.rs.core.MultivaluedMap; 11 | import com.authlete.common.types.User; 12 | import com.authlete.jaxrs.server.db.UserDao; 13 | 14 | 15 | public class ProcessingUtil 16 | { 17 | 18 | @SuppressWarnings("unchecked") 19 | public static50 | * If this method returns a non-empty array, links for ID federation 51 | * will be displayed in the authorization page. 52 | *
53 | */ 54 | public FederationConfig[] getFederations() 55 | { 56 | return federations; 57 | } 58 | 59 | 60 | /** 61 | * Set the configurations of ID federations. 62 | */ 63 | public AuthzPageModel setFederations(FederationConfig[] federations) 64 | { 65 | this.federations = federations; 66 | 67 | return this; 68 | } 69 | 70 | 71 | /** 72 | * Get the feedback message from the process of ID federation. 73 | * 74 | *75 | * If this method returns a non-null value, the message will be displayed 76 | * in the authorization page. 77 | *
78 | */ 79 | public String getFederationMessage() 80 | { 81 | return federationMessage; 82 | } 83 | 84 | 85 | /** 86 | * Set the feedback message from the process of ID federation. 87 | */ 88 | public AuthzPageModel setFederationMessage(String message) 89 | { 90 | this.federationMessage = message; 91 | 92 | return this; 93 | } 94 | } 95 | -------------------------------------------------------------------------------- /src/main/java/com/authlete/jaxrs/server/federation/FederationConfig.java: -------------------------------------------------------------------------------- 1 | /* 2 | * Copyright (C) 2022 Authlete, Inc. 3 | * 4 | * Licensed under the Apache License, Version 2.0 (the "License"); 5 | * you may not use this file except in compliance with the License. 6 | * You may obtain a copy of the License at 7 | * 8 | * http://www.apache.org/licenses/LICENSE-2.0 9 | * 10 | * Unless required by applicable law or agreed to in writing, software 11 | * distributed under the License is distributed on an "AS IS" BASIS, 12 | * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 13 | * See the License for the specific language governing permissions and 14 | * limitations under the License. 15 | */ 16 | package com.authlete.jaxrs.server.federation; 17 | 18 | 19 | import static com.authlete.jaxrs.server.federation.ConfigValidationHelper.ensureNotEmpty; 20 | import java.io.Serializable; 21 | 22 | 23 | /** 24 | * Configuration of ID federation. 25 | * 26 | *
27 | * {
28 | * "id": "(unique identifier among the configurations)",
29 | * "server": {
30 | * (mapped to {@link ServerConfig})
31 | * },
32 | * "client": {
33 | * (mapped to {@link ClientConfig})
34 | * }
35 | * }
36 | *
37 | *
38 | *
39 | * The value of {@code "id"} is used as federationId
40 | * in the following API paths.
41 | *
/api/federation/initiation/federationId
45 | * /api/federation/callback/federationId
46 | * ${model.notification}
44 |Enter required information below.
46 | 47 | 72 |33 | * An OpenID Provider that supports OpenID 35 | * Federation 1.0 must provide an endpoint that returns its entity 36 | * configuration in the JWT format. The URI of the endpoint is defined 37 | * as follows: 38 | *
39 | * 40 | *48 | * Entity ID is a URL that identifies an OpenID Provider (and other 49 | * entities including Relying Parties, Trust Anchors and Intermediate 50 | * Authorities) in the context of OpenID Federation 1.0. 51 | *
52 | * 53 | *54 | * Note that OpenID Federation 1.0 is supported since Authlete 2.3. 55 | *
56 | * 57 | * @see OpenID Federation 1.0 59 | */ 60 | @Path("/.well-known/openid-federation") 61 | public class FederationConfigurationEndpoint extends BaseFederationConfigurationEndpoint 62 | { 63 | /** 64 | * The request to Authlete's /federation/configuration API. 65 | */ 66 | private static final FederationConfigurationRequest REQUEST = 67 | new FederationConfigurationRequest() 68 | .setEntityTypes(new EntityType[] { 69 | EntityType.OPENID_PROVIDER, 70 | EntityType.OPENID_CREDENTIAL_ISSUER 71 | }); 72 | 73 | 74 | /** 75 | * Entity configuration endpoint. 76 | */ 77 | @GET 78 | public Response get() 79 | { 80 | // Handle the request to the endpoint. 81 | return handle(AuthleteApiFactory.getDefaultApi(), REQUEST); 82 | } 83 | } 84 | -------------------------------------------------------------------------------- /src/main/resources/ekyc-ida/examples/response/document_UKTDIF.json: -------------------------------------------------------------------------------- 1 | { 2 | "verified_claims": { 3 | "verification": { 4 | "trust_framework": "uk_tfida", 5 | "assurance_level": "medium", 6 | "assurance_process": { 7 | "policy": "gpg45", 8 | "procedure": "m1c", 9 | "assurance_details": [ 10 | { 11 | "assurance_type": "evidence_validation", 12 | "assurance_classification": "score_3", 13 | "evidence_ref": [ 14 | { 15 | "txn": "DL1-93h506th2f45hf", 16 | "evidence_metadata": { 17 | "evidence_classification": "score_3_strength" 18 | } 19 | } 20 | ] 21 | }, 22 | { 23 | "assurance_type": "verification", 24 | "assurance_classification": "score_3", 25 | "evidence_ref": [ 26 | { 27 | "txn": "v-93jfk284ugjfj2093" 28 | } 29 | ] 30 | } 31 | ] 32 | }, 33 | "time": "2021-06-06T05:32Z", 34 | "verification_process": "7675D80F-57E0-AB14-9543-26B41FC22", 35 | "evidence": [ 36 | { 37 | "type": "document", 38 | "check_details": [ 39 | { 40 | "check_method": "vpiruv", 41 | "organization": "doc_checker", 42 | "txn": "DL1-93h506th2f45hf", 43 | "time": "2021-06-08T11:41Z" 44 | }, 45 | { 46 | "check_method": "pvp", 47 | "organization": "face_checker", 48 | "txn": "v-93jfk284ugjfj2093", 49 | "time": "2021-06-08T11:42Z" 50 | } 51 | ], 52 | "time": "2021-06-06T05:33Z", 53 | "document_details": { 54 | "type": "driving_permit", 55 | "document_number": "I1234568", 56 | "date_of_issuance": "2019-09-05", 57 | "date_of_expiry": "2024-08-01", 58 | "issuer": { 59 | "name": "CA DMV", 60 | "country": "US", 61 | "country_code": "USA", 62 | "jurisdiction": "CA" 63 | } 64 | }, 65 | "attachments": [ 66 | { 67 | "desc": "scan of driving_permit", 68 | "content_type": "image/jpeg", 69 | "txn": "DL1-93h506th2f45hf", 70 | "content": "d16d2552e35582810e5a40e523716504525b6016ae96844ddc533163059b3067==" 71 | }, 72 | { 73 | "desc": "captured face", 74 | "content_type": "image/jpeg", 75 | "txn": "v-93jfk284ugjfj2093", 76 | "content": "6954697405687029456098270457602984756098274509687204576==" 77 | } 78 | ] 79 | } 80 | ] 81 | }, 82 | "claims": { 83 | "given_name": "Inga", 84 | "family_name": "Silverstone", 85 | "birthdate": "1991-11-06", 86 | "place_of_birth": { 87 | "country": "USA" 88 | }, 89 | "address": { 90 | "locality": "Shoshone", 91 | "postal_code": "CA 92384", 92 | "country": "USA", 93 | "street_address": "114 Old State Hwy 127" 94 | } 95 | } 96 | } 97 | } 98 | -------------------------------------------------------------------------------- /src/main/java/com/authlete/jaxrs/server/api/backchannel/AuthInfoHolder.java: -------------------------------------------------------------------------------- 1 | /* 2 | * Copyright (C) 2019 Authlete, Inc. 3 | * 4 | * Licensed under the Apache License, Version 2.0 (the "License"); 5 | * you may not use this file except in compliance with the License. 6 | * You may obtain a copy of the License at 7 | * 8 | * http://www.apache.org/licenses/LICENSE-2.0 9 | * 10 | * Unless required by applicable law or agreed to in writing, 11 | * software distributed under the License is distributed on an 12 | * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, 13 | * either express or implied. See the License for the specific 14 | * language governing permissions and limitations under the 15 | * License. 16 | */ 17 | package com.authlete.jaxrs.server.api.backchannel; 18 | 19 | 20 | import java.util.Map; 21 | import java.util.concurrent.ConcurrentHashMap; 22 | 23 | 24 | /** 25 | * The holder storing {@link AuthInfo information} required to complete processes 26 | * that are executed in {@link AsyncAuthenticationDeviceProcessor}. The information 27 | * is expected to be stored in the {@link AsyncAuthenticationDeviceProcessor#process() 28 | * process()} method of {@link AsyncAuthenticationDeviceProcessor} and retrieved 29 | * in {@link BackchannelAuthenticationCallbackEndpoint} to complete the processes. 30 | * 31 | *32 | * Note that this implementation is a dummy implementation and not suitable for 33 | * commercial use. 34 | *
35 | * 36 | * @see AuthInfo 37 | * 38 | * @see AsyncAuthenticationDeviceProcessor 39 | * 40 | * @see BackchannelAuthenticationCallbackEndpoint 41 | * 42 | * @author Hideki Ikeda 43 | */ 44 | public class AuthInfoHolder 45 | { 46 | private static final Map
68 | * Below is an example of API call, assuming certificates.pem
69 | * includes a client certificate and intermediate certificates.
70 | *
73 | * $ curl -k --key private.pem --cert certificates.pem https://example/api/test/obb 74 | *75 | */ 76 | @GET 77 | @Path("obb") 78 | public Response obb(@Context HttpServletRequest req) 79 | { 80 | Map
32 | * This loader loads configuration from a file. When the name of a configuration 33 | * file is not explicitly specified, in other words, when {@link #load()} method 34 | * is used, the file name is determined in the following order. 35 | *
36 | * 37 | *44 | * The content of the configuration file should be a JSON object that contains 45 | * {@code "federations"} as a top-level property. 46 | *
47 | * 48 | *
49 | * {
50 | * "federations": [
51 | * (each element is mapped to {@link FederationConfig})
52 | * ]
53 | * }
54 | *
55 | *
56 | * @see FederationsConfig
57 | */
58 | public class FederationsConfigLoader
59 | {
60 | private static final String DEFAULT_FILE = "federations.json";
61 | private static final String SYSPROP_FILE = "federations.file";
62 | private static final String ENVVAR_FILE = "FEDERATIONS_FILE";
63 |
64 |
65 | private static String determineFile()
66 | {
67 | // From the environment variable.
68 | String file = getFileFromEnv();
69 |
70 | if (file == null)
71 | {
72 | // From the system property.
73 | file = getFileFromSysProp();
74 | }
75 |
76 | if (file == null)
77 | {
78 | // The default file.
79 | file = DEFAULT_FILE;
80 | }
81 |
82 | return file;
83 | }
84 |
85 |
86 | private static String getFileFromEnv()
87 | {
88 | return System.getenv(ENVVAR_FILE);
89 | }
90 |
91 |
92 | private static String getFileFromSysProp()
93 | {
94 | return System.getProperty(SYSPROP_FILE);
95 | }
96 |
97 |
98 | public static FederationsConfig load() throws IOException
99 | {
100 | return load(determineFile());
101 | }
102 |
103 |
104 | public static FederationsConfig load(String file) throws IOException
105 | {
106 | return load(Paths.get(file));
107 | }
108 |
109 |
110 | public static FederationsConfig load(Path path) throws IOException
111 | {
112 | try (Reader reader = Files.newBufferedReader(path, StandardCharsets.UTF_8))
113 | {
114 | return load(reader);
115 | }
116 | }
117 |
118 |
119 | public static FederationsConfig load(Reader reader) throws IOException
120 | {
121 | return new Gson().fromJson(reader, FederationsConfig.class);
122 | }
123 | }
124 |
--------------------------------------------------------------------------------
/src/main/java/com/authlete/jaxrs/server/api/PushedAuthReqEndpoint.java:
--------------------------------------------------------------------------------
1 | package com.authlete.jaxrs.server.api;
2 |
3 |
4 | import javax.servlet.http.HttpServletRequest;
5 | import javax.ws.rs.Consumes;
6 | import javax.ws.rs.POST;
7 | import javax.ws.rs.Path;
8 | import javax.ws.rs.core.Context;
9 | import javax.ws.rs.core.HttpHeaders;
10 | import javax.ws.rs.core.MediaType;
11 | import javax.ws.rs.core.MultivaluedMap;
12 | import javax.ws.rs.core.Response;
13 | import com.authlete.common.api.AuthleteApi;
14 | import com.authlete.common.api.AuthleteApiFactory;
15 | import com.authlete.jaxrs.BasePushedAuthReqEndpoint;
16 | import com.authlete.jaxrs.PushedAuthReqHandler.Params;
17 |
18 |
19 | /**
20 | * An implementation of a pushed authorization endpoint.
21 | *
22 | * @see OAuth 2.0 Pushed Authorization Requests
24 | *
25 | * @author Justin Richer
26 | *
27 | */
28 | @Path("/api/par")
29 | public class PushedAuthReqEndpoint extends BasePushedAuthReqEndpoint
30 | {
31 | /**
32 | * The pushed authorization request endpoint. This uses the
33 | * {@code POST} method and the same client authentication as
34 | * is available on the Token Endpoint.
35 | */
36 | @POST
37 | @Consumes(MediaType.APPLICATION_FORM_URLENCODED)
38 | public Response post(
39 | @Context HttpServletRequest request,
40 | MultivaluedMap17 | * This class is designed to check whether a session corresponding to a given 18 | * session ID exists. 19 | *
20 | * 21 | *22 | * To support the "OpenID Connect 24 | * Native SSO for Mobile Apps 1.0" specification (a.k.a. "Native SSO"), it 25 | * is necessary for the token endpoint implementation to verify whether the 26 | * session ID associated with a presented refresh token or subject token 27 | * exists. For this purpose, the {@link #isActiveSessionId(String)} method is 28 | * used. 29 | *
30 | * 31 | *32 | * When a token request compliant with Native SSO is processed by Authlete's 33 | * {@code /auth/token} API, the {@code action} field in the API response will 34 | * be {@link com.authlete.common.dto.TokenResponse.Action#NATIVE_SSO NATIVE_SSO}, 35 | * and the session ID corresponding to the refresh token or subject token will 36 | * be included as the value of the {@code sessionId} parameter. This value 37 | * should be passed to the {@link #isActiveSessionId(String)} method to 38 | * determine whether the session ID is still active. 39 | *
40 | * 41 | *42 | * Support for the Native SSO specification was introduced in Authlete 3.0. 43 | *
44 | * 45 | * @see OpenID Connect Native SSO for Mobile Apps 1.0 47 | */ 48 | @WebListener 49 | public class SessionTracker implements HttpSessionListener 50 | { 51 | private static final Set
28 | * {
29 | * "clientId": "(client ID issued by the OpenID Provider)",
30 | * "clientSecret": "(client secret issued by the OpenID Provider)",
31 | * "redirectUri": "(redirect URI registered to the OpenID Provider)",
32 | * "idTokenSignedResponseAlg": "(algorithm of ID Token signature)"
33 | * }
34 | *
35 | *
36 | * 37 | * {@code "clientId"} is the client ID issued to your client application by 38 | * the OpenID Provider. 39 | *
40 | * 41 | *42 | * If {@code "clientSecret"} is set, token requests made by {@link Federation} 43 | * will include an {@code Authorization} header for client authentication. 44 | * This behavior assumes that the token endpoint of the OpenID Provider 45 | * supports {@code client_secret_basic} as a method of client authentication. 46 | *
47 | * 48 | *
49 | * {@code "redirectUri"} must be a redirect URI that you have registered into
50 | * the OpenID Provider. For example,
51 | * http://localhost:8080/api/federation/callback/okta.
52 | *
55 | * If {@code "idTokenSignedResponseAlg"} is omitted, {@code "RS256"} is used 56 | * as the default value. See technical documents of the OpenID Provider 57 | * about the actual algorithm it uses for signing ID tokens. 58 | *
59 | * 60 | * @see FederationConfig 61 | */ 62 | public class ClientConfig implements Serializable 63 | { 64 | private static final long serialVersionUID = 1L; 65 | 66 | 67 | private String clientId; 68 | private String clientSecret; 69 | private String redirectUri; 70 | private String idTokenSignedResponseAlg; 71 | 72 | 73 | public String getClientId() 74 | { 75 | return clientId; 76 | } 77 | 78 | 79 | public ClientConfig setClientId(String clientId) 80 | { 81 | this.clientId = clientId; 82 | 83 | return this; 84 | } 85 | 86 | 87 | public String getClientSecret() 88 | { 89 | return clientSecret; 90 | } 91 | 92 | 93 | public ClientConfig setClientSecret(String clientSecret) 94 | { 95 | this.clientSecret = clientSecret; 96 | 97 | return this; 98 | } 99 | 100 | 101 | public String getRedirectUri() 102 | { 103 | return redirectUri; 104 | } 105 | 106 | 107 | public ClientConfig setRedirectUri(String redirectUri) 108 | { 109 | this.redirectUri = redirectUri; 110 | 111 | return this; 112 | } 113 | 114 | 115 | public String getIdTokenSignedResponseAlg() 116 | { 117 | return idTokenSignedResponseAlg; 118 | } 119 | 120 | 121 | public ClientConfig setIdTokenSignedResponseAlg(String idTokenSignedResponseAlg) 122 | { 123 | this.idTokenSignedResponseAlg = idTokenSignedResponseAlg; 124 | 125 | return this; 126 | } 127 | 128 | 129 | public void validate() throws IllegalStateException 130 | { 131 | ensureNotEmpty("client/clientId", clientId); 132 | ensureNotEmpty("client/redirectUri", redirectUri); 133 | ensureUri("client/redirectUri", redirectUri); 134 | } 135 | } 136 | -------------------------------------------------------------------------------- /src/main/java/com/authlete/jaxrs/server/api/UserInfoRequestHandlerSpiImpl.java: -------------------------------------------------------------------------------- 1 | /* 2 | * Copyright (C) 2016-2022 Authlete, Inc. 3 | * 4 | * Licensed under the Apache License, Version 2.0 (the "License"); 5 | * you may not use this file except in compliance with the License. 6 | * You may obtain a copy of the License at 7 | * 8 | * http://www.apache.org/licenses/LICENSE-2.0 9 | * 10 | * Unless required by applicable law or agreed to in writing, 11 | * software distributed under the License is distributed on an 12 | * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, 13 | * either express or implied. See the License for the specific 14 | * language governing permissions and limitations under the 15 | * License. 16 | */ 17 | package com.authlete.jaxrs.server.api; 18 | 19 | 20 | import java.util.List; 21 | import java.util.Map; 22 | import com.authlete.common.assurance.VerifiedClaims; 23 | import com.authlete.common.assurance.constraint.VerifiedClaimsConstraint; 24 | import com.authlete.common.types.User; 25 | import com.authlete.jaxrs.server.db.DatasetDao; 26 | import com.authlete.jaxrs.server.db.UserDao; 27 | import com.authlete.jaxrs.server.db.VerifiedClaimsDao; 28 | import com.authlete.jaxrs.spi.UserInfoRequestHandlerSpiAdapter; 29 | 30 | 31 | /** 32 | * Implementation of {@link com.authlete.jaxrs.spi.UserInfoRequestHandlerSpi 33 | * UserInfoRequestHandlerSpi} interface which needs to be given to the 34 | * constructor of {@link com.authlete.jaxrs.UserInfoRequestHandler 35 | * UserInfoRequestHandler}. 36 | */ 37 | public class UserInfoRequestHandlerSpiImpl extends UserInfoRequestHandlerSpiAdapter 38 | { 39 | private User mUser; 40 | 41 | 42 | @Override 43 | public void prepareUserClaims(String subject, String[] claimNames) 44 | { 45 | // Look up a user who has the subject. 46 | mUser = UserDao.getBySubject(subject); 47 | } 48 | 49 | 50 | @Override 51 | public Object getUserClaim(String claimName, String languageTag) 52 | { 53 | // If looking up a user has failed in prepareUserClaims(). 54 | if (mUser == null) 55 | { 56 | // No claim is available. 57 | return null; 58 | } 59 | 60 | // Get the value of the claim. 61 | return mUser.getClaim(claimName, languageTag); 62 | } 63 | 64 | 65 | @Override 66 | public List33 | * An OpenID Provider that supports the "explicit" client registration defined 34 | * in OpenID Connect Federation 1.0 is supposed to provide a federation 36 | * registration endpoint that accepts explicit client registration requests. 37 | *
38 | * 39 | *40 | * The endpoint accepts {@code POST} requests whose {@code Content-Type} 41 | * is either of the following. 42 | *
43 | * 44 | *50 | * When the {@code Content-Type} of a request is 51 | * {@code application/entity-statement+jwt}, the content of the request is 52 | * the entity configuration of a relying party that is to be registered. 53 | *
54 | * 55 | *56 | * On the other hand, when the {@code Content-Type} of a request is 57 | * {@code application/trust-chain+json}, the content of the request is a 58 | * JSON array that contains entity statements in JWT format. The sequence 59 | * of the entity statements composes the trust chain of a relying party 60 | * that is to be registered. 61 | *
62 | * 63 | *64 | * On successful registration, the endpoint should return a kind of entity 65 | * statement (JWT) with the HTTP status code {@code 200 OK} and the content 66 | * type {@code application/jose}. 67 | *
68 | * 69 | *70 | * The discovery document (OpenID Connect 72 | * Discovery 1.0) should include the {@code federation_registration_endpoint} 73 | * server metadata that denotes the URL of the federation registration endpoint. 74 | *
75 | * 76 | *77 | * Note that OpenID Connect Federation 1.0 is supported since Authlete 2.3. 78 | *
79 | * 80 | * @see OpenID Connect Federation 1.0 82 | */ 83 | @Path("/api/federation/register") 84 | public class FederationRegistrationEndpoint extends BaseFederationRegistrationEndpoint 85 | { 86 | @POST 87 | @Consumes("application/entity-statement+jwt") 88 | public Response entityConfiguration(String jwt) 89 | { 90 | // Client registration by a relying party's entity configuration. 91 | return handle( 92 | AuthleteApiFactory.getDefaultApi(), 93 | request().setEntityConfiguration(jwt)); 94 | } 95 | 96 | 97 | @POST 98 | @Consumes("application/trust-chain+json") 99 | public Response trustChain(String json) 100 | { 101 | // Client registration by a relying party's trust chain. 102 | return handle( 103 | AuthleteApiFactory.getDefaultApi(), 104 | request().setTrustChain(json)); 105 | } 106 | 107 | 108 | private static FederationRegistrationRequest request() 109 | { 110 | return new FederationRegistrationRequest(); 111 | } 112 | } 113 | -------------------------------------------------------------------------------- /src/main/java/com/authlete/jaxrs/server/vc/VerifiableCredentialType.java: -------------------------------------------------------------------------------- 1 | /* 2 | * Copyright (C) 2023-2024 Authlete, Inc. 3 | * 4 | * Licensed under the Apache License, Version 2.0 (the "License"); 5 | * you may not use this file except in compliance with the License. 6 | * You may obtain a copy of the License at 7 | * 8 | * http://www.apache.org/licenses/LICENSE-2.0 9 | * 10 | * Unless required by applicable law or agreed to in writing, 11 | * software distributed under the License is distributed on an 12 | * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, 13 | * either express or implied. See the License for the specific 14 | * language governing permissions and limitations under the 15 | * License. 16 | */ 17 | package com.authlete.jaxrs.server.vc; 18 | 19 | 20 | import java.util.Arrays; 21 | import com.authlete.common.types.StandardClaims; 22 | 23 | 24 | /** 25 | * Verifiable Credential Type identified by the "{@code vct}" claim 26 | * in an SD-JWT VC. 27 | */ 28 | public enum VerifiableCredentialType 29 | { 30 | IDENTITY_CREDENTIAL( 31 | "https://credentials.example.com/identity_credential", 32 | new String[] { 33 | StandardClaims.GIVEN_NAME, 34 | StandardClaims.FAMILY_NAME, 35 | StandardClaims.BIRTHDATE 36 | } 37 | ), 38 | 39 | DIGITAL_CREDENTIAL( 40 | "https://credentials.example.com/digital_credential", 41 | new String[] { 42 | StandardClaims.GIVEN_NAME, 43 | StandardClaims.FAMILY_NAME, 44 | StandardClaims.BIRTHDATE 45 | } 46 | ), 47 | 48 | /** 49 | * The vct used in the POTENTIAL Interop Event Track 2. 51 | * 52 | *53 | *77 | * 78 | * @see POTENTIAL Interop Event Track 2 / description 80 | */ 81 | EUDI_PID_1( 82 | "urn:eu.europa.ec.eudi:pid:1", 83 | new String[] { 84 | StandardClaims.FAMILY_NAME, 85 | StandardClaims.GIVEN_NAME, 86 | StandardClaims.BIRTHDATE, 87 | "age_equal_or_over", 88 | "place_of_birth", 89 | StandardClaims.ADDRESS, 90 | "issuing_authority", 91 | "issuing_country", 92 | } 93 | ), 94 | ; 95 | 96 | 97 | private final String id; 98 | private final String[] claims; 99 | 100 | 101 | private VerifiableCredentialType(String id, String[] claims) 102 | { 103 | this.id = id; 104 | this.claims = claims; 105 | } 106 | 107 | 108 | public String getId() 109 | { 110 | return id; 111 | } 112 | 113 | 114 | public String[] getClaims() 115 | { 116 | return claims; 117 | } 118 | 119 | 120 | public static VerifiableCredentialType byId(final String id) 121 | { 122 | return Arrays.stream(VerifiableCredentialType.values()) 123 | .filter(format -> format.getId().equals(id)) 124 | .findFirst() 125 | .orElse(null); 126 | } 127 | } 128 | -------------------------------------------------------------------------------- /src/main/java/com/authlete/jaxrs/server/api/AuthorizationEndpoint.java: -------------------------------------------------------------------------------- 1 | /* 2 | * Copyright (C) 2016 Authlete, Inc. 3 | * 4 | * Licensed under the Apache License, Version 2.0 (the "License"); 5 | * you may not use this file except in compliance with the License. 6 | * You may obtain a copy of the License at 7 | * 8 | * http://www.apache.org/licenses/LICENSE-2.0 9 | * 10 | * Unless required by applicable law or agreed to in writing, 11 | * software distributed under the License is distributed on an 12 | * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, 13 | * either express or implied. See the License for the specific 14 | * language governing permissions and limitations under the 15 | * License. 16 | */ 17 | package com.authlete.jaxrs.server.api; 18 | 19 | 20 | import javax.servlet.http.HttpServletRequest; 21 | import javax.ws.rs.Consumes; 22 | import javax.ws.rs.GET; 23 | import javax.ws.rs.POST; 24 | import javax.ws.rs.Path; 25 | import javax.ws.rs.core.Context; 26 | import javax.ws.rs.core.MediaType; 27 | import javax.ws.rs.core.MultivaluedMap; 28 | import javax.ws.rs.core.Response; 29 | import javax.ws.rs.core.UriInfo; 30 | import com.authlete.common.api.AuthleteApiFactory; 31 | import com.authlete.jaxrs.BaseAuthorizationEndpoint; 32 | 33 | 34 | /** 35 | * An implementation of OAuth 2.0 authorization endpoint with OpenID Connect support. 36 | * 37 | * @see RFC 6749, 3.1. Authorization Endpoint 39 | * 40 | * @see OpenID Connect Core 1.0, 3.1.2. Authorization Endpoint (Authorization Code Flow) 42 | * 43 | * @see OpenID Connect Core 1.0, 3.2.2. Authorization Endpoint (Implicit Flow) 45 | * 46 | * @see OpenID Connect Core 1.0, 3.3.2. Authorization Endpoint (Hybrid Flow) 48 | * 49 | * @author Takahiko Kawasaki 50 | */ 51 | @Path("/api/authorization") 52 | public class AuthorizationEndpoint extends BaseAuthorizationEndpoint 53 | { 54 | /** 55 | * The authorization endpoint for {@code GET} method. 56 | * 57 | *54 | *
76 | *55 | * 58 | *vct 56 | *claims 57 | *59 | * 75 | *60 | * 62 | *urn:eu.europa.ec.eudi:pid:161 | *63 | * 74 | *64 | *
73 | *family_name65 | *given_name66 | *birthdate67 | *age_equal_or_over/1868 | *place_of_birth/locality69 | *address/formatted70 | *issuing_authority71 | *issuing_country72 | *
58 | * RFC 6749, 59 | * 3.1 Authorization Endpoint says that the authorization endpoint 60 | * MUST support {@code GET} method. 61 | *
62 | * 63 | * @see RFC 6749, 3.1 Authorization Endpoint 65 | */ 66 | @GET 67 | public Response get( 68 | @Context HttpServletRequest request, 69 | @Context UriInfo uriInfo) 70 | { 71 | // Handle the authorization request. 72 | return handle(request, uriInfo.getQueryParameters()); 73 | } 74 | 75 | 76 | /** 77 | * The authorization endpoint for {@code POST} method. 78 | * 79 | *80 | * RFC 6749, 81 | * 3.1 Authorization Endpoint says that the authorization endpoint 82 | * MAY support {@code POST} method. 83 | *
84 | * 85 | *86 | * In addition, OpenID Connect Core 1.0, 3.1.2.1. Authentication Request says 88 | * that the authorization endpoint MUST support {@code POST} method. 89 | *
90 | */ 91 | @POST 92 | @Consumes(MediaType.APPLICATION_FORM_URLENCODED) 93 | public Response post( 94 | @Context HttpServletRequest request, 95 | MultivaluedMap