Skip to content

Commit 2a5357f

Browse files
yannicktrinhyannicktrinh
committed
GitBug:17644 ([NetKit] OpenID support)
#17644
1 parent d5bd728 commit 2a5357f

File tree

1 file changed

+62
-53
lines changed

1 file changed

+62
-53
lines changed

‎Project/Sources/Classes/OAuth2Provider.4dm‎

Lines changed: 62 additions & 53 deletions
Original file line numberDiff line numberDiff line change
@@ -23,12 +23,14 @@ property clientAssertionType : Text // When authenticating with certificate thi
2323
property thumbprint : Text // used to set x5t in JWT (x5t = BASE64URL-ENCODE(BYTEARRAY(thumbprint)))
2424
property browserAutoOpen : Boolean // If true, the class will automatically open the URL in signed mode to handle the authentication process (default is True)
2525

26+
property state : Text
27+
property nonce : Text // For OpenID Connect
28+
2629
property _scope : Text
2730
property _authenticateURI : Text
2831
property _tokenURI : Text
2932
property _grantType : Text
3033
property _codeVerifier : Text
31-
property _state : Text
3234

3335
property enableDebugLog : Boolean // Enable HTTP Server debug log for Debug purposes only
3436

@@ -234,7 +236,11 @@ Class constructor($inParams : Object)
234236
This.clientAssertionType:="urn:ietf:params:oauth:client-assertion-type:jwt-bearer"
235237
End if
236238

237-
This._state:=Generate UUID
239+
This.state:=Choose(Value type($inParams.state)=Is text; $inParams.state; Generate UUID)
240+
If (Value type($inParams.nonce)#Is undefined)
241+
This.nonce:=String($inParams.nonce)
242+
End if
243+
238244
This.browserAutoOpen:=Choose(Value type($inParams.browserAutoOpen)=Is undefined; True; Bool($inParams.browserAutoOpen))
239245

240246
End if
@@ -426,7 +432,7 @@ Function _getAuthorizationCode() : Text
426432

427433
Else
428434

429-
var $state : Text:=This._state
435+
var $state : Text:=This.state
430436

431437
Use (Storage)
432438
If (Storage.requests=Null)
@@ -473,21 +479,21 @@ Function _getAuthorizationCode() : Text
473479
Function _getToken_SignedIn($bUseRefreshToken : Boolean) : Object
474480

475481
var $result : Object:=Null
476-
var $params : Text
482+
var $params : cs.URL:=cs.URL.new()
477483
var $bSendRequest : Boolean:=True
478484
If ($bUseRefreshToken)
479-
480-
$params:="client_id="+This.clientId
485+
486+
$params.addQueryParameter("client_id"; This.clientId)
481487
If (Length(This.scope)>0)
482-
$params+="&scope="+cs.Tools.me.urlEncode(This.scope)
483-
End if
484-
$params+="&refresh_token="+This.token.refresh_token
485-
$params+="&grant_type=refresh_token"
488+
$params.addQueryParameter("scope"; cs.Tools.me.urlEncode(This.scope))
489+
End if
490+
$params.addQueryParameter("refresh_token"; This.token.refresh_token)
491+
$params.addQueryParameter("grant_type"; "refresh_token")
486492
If (Length(This.clientSecret)>0)
487-
$params+="&client_secret="+This.clientSecret
488-
End if
489-
490-
Else
493+
$params.addQueryParameter("client_secret"; This.clientSecret)
494+
End if
495+
496+
Else
491497

492498
If (Length(String(This.redirectURI))>0)
493499

@@ -523,19 +529,19 @@ Function _getToken_SignedIn($bUseRefreshToken : Boolean) : Object
523529
var $authorizationCode : Text:=This._getAuthorizationCode()
524530

525531
If (Length($authorizationCode)>0)
526-
527-
$params:="client_id="+This.clientId
528-
$params+="&grant_type=authorization_code"
529-
$params+="&code="+$authorizationCode
530-
$params+="&redirect_uri="+cs.Tools.me.urlEncode(This.redirectURI)
532+
533+
$params.addQueryParameter("client_id"; This.clientId)
534+
$params.addQueryParameter("grant_type"; "authorization_code")
535+
$params.addQueryParameter("code"; $authorizationCode)
536+
$params.addQueryParameter("redirect_uri"; cs.Tools.me.urlEncode(This.redirectURI))
531537
If (This.PKCEEnabled)
532-
$params+="&code_verifier="+This.codeVerifier
538+
$params.addQueryParameter("code_verifier"; This.codeVerifier)
533539
End if
534540
If (Length(This.clientSecret)>0)
535-
$params+="&client_secret="+This.clientSecret
541+
$params.addQueryParameter("client_secret"; This.clientSecret)
536542
End if
537-
$params+="&scope="+cs.Tools.me.urlEncode(This.scope)
538-
543+
$params.addQueryParameter("scope"; cs.Tools.me.urlEncode(This.scope))
544+
539545
Else
540546

541547
$bSendRequest:=False
@@ -555,7 +561,7 @@ Function _getToken_SignedIn($bUseRefreshToken : Boolean) : Object
555561

556562
If ($bSendRequest)
557563

558-
$result:=This._sendTokenRequest($params)
564+
$result:=This._sendTokenRequest($params.getQueryString())
559565

560566
End if
561567

@@ -568,7 +574,7 @@ Function _getToken_SignedIn($bUseRefreshToken : Boolean) : Object
568574
Function _getToken_Service() : Object
569575

570576
var $result : Object:=Null
571-
var $params : Text
577+
var $params : cs.URL:=cs.URL.new()
572578
var $jwt : cs._JWT
573579
var $options : Object
574580
var $bearer : Text
@@ -592,8 +598,8 @@ Function _getToken_Service() : Object
592598
$jwt:=cs._JWT.new($options)
593599
$bearer:=$jwt.generate()
594600

595-
$params:="grant_type="+cs.Tools.me.urlEncode(This.grantType)
596-
$params+="&assertion="+$bearer
601+
$params.addQueryParameter("grant_type"; cs.Tools.me.urlEncode(This.grantType))
602+
$params.addQueryParameter("assertion"; $bearer)
597603

598604
: (This._useJWTBearerAssertionType())
599605
// See documentation of https://learn.microsoft.com/en-us/entra/identity-platform/certificate-credentials
@@ -613,24 +619,24 @@ Function _getToken_Service() : Object
613619
$bearer:=$jwt.generate()
614620

615621
// See documentation of https://learn.microsoft.com/en-us/entra/identity-platform/v2-oauth2-client-creds-grant-flow#second-case-access-token-request-with-a-certificate
616-
$params:="grant_type="+This.grantType
617-
$params+="&client_id="+This.clientId
618-
$params+="&scope="+cs.Tools.me.urlEncode(This.scope)
619-
$params+="&client_assertion_type="+cs.Tools.me.urlEncode(This.clientAssertionType)
620-
$params+="&client_assertion="+$bearer
621-
622+
$params.addQueryParameter("grant_type"; This.grantType)
623+
$params.addQueryParameter("client_id"; This.clientId)
624+
$params.addQueryParameter("scope"; cs.Tools.me.urlEncode(This.scope))
625+
$params.addQueryParameter("client_assertion_type"; cs.Tools.me.urlEncode(This.clientAssertionType))
626+
$params.addQueryParameter("client_assertion"; $bearer)
627+
622628
Else
623-
624-
$params:="client_id="+This.clientId
629+
630+
$params.addQueryParameter("client_id"; This.clientId)
625631
If (Length(This.scope)>0)
626-
$params+="&scope="+cs.Tools.me.urlEncode(This.scope)
632+
$params.addQueryParameter("scope"; cs.Tools.me.urlEncode(This.scope))
627633
End if
628-
$params+="&client_secret="+This.clientSecret
629-
$params+="&grant_type="+This.grantType
634+
$params.addQueryParameter("client_secret"; This.clientSecret)
635+
$params.addQueryParameter("grant_type"; This.grantType)
630636

631637
End case
632638

633-
$result:=This._sendTokenRequest($params)
639+
$result:=This._sendTokenRequest($params.getQueryString())
634640

635641
return $result
636642

@@ -918,34 +924,37 @@ Function get authenticateURI() : Text
918924
If (This._isSignedIn())
919925

920926
var $scope : Text:=This.scope
921-
var $state : Text:=This._state
927+
var $state : Text:=This.state
922928
var $redirectURI : Text:=This.redirectURI
923-
var $urlParams : Text
929+
var $urlParams : cs.URL:=cs.URL.new()
924930

925-
$urlParams:="?client_id="+This.clientId
926-
$urlParams+="&response_type=code"
931+
$urlParams.addQueryParameter("client_id"; This.clientId)
932+
$urlParams.addQueryParameter("response_type"; "code")
927933
If (Length(String($scope))>0)
928-
$urlParams+="&scope="+cs.Tools.me.urlEncode($scope)
934+
$urlParams.addQueryParameter("scope"; cs.Tools.me.urlEncode($scope))
929935
End if
930-
$urlParams+="&state="+String($state)
931-
$urlParams+="&response_mode=query"
932-
$urlParams+="&redirect_uri="+cs.Tools.me.urlEncode($redirectURI)
936+
$urlParams.addQueryParameter("state"; String($state))
937+
$urlParams.addQueryParameter("response_mode"; "query")
938+
$urlParams.addQueryParameter("redirect_uri"; cs.Tools.me.urlEncode($redirectURI))
933939
If (This.PKCEEnabled)
934-
$urlParams+="&code_challenge="+This._generateCodeChallenge(This.codeVerifier)
935-
$urlParams+="&code_challenge_method="+String(This.PKCEMethod)
940+
$urlParams.addQueryParameter("code_challenge"; This._generateCodeChallenge(This.codeVerifier))
941+
$urlParams.addQueryParameter("code_challenge_method"; String(This.PKCEMethod))
936942
Else
937943
If (Length(String(This.accessType))>0)
938-
$urlParams+="&access_type="+This.accessType
944+
$urlParams.addQueryParameter("access_type"; This.accessType)
939945
End if
940946
If (Length(String(This.loginHint))>0)
941-
$urlParams+="&login_hint="+This.loginHint
947+
$urlParams.addQueryParameter("login_hint"; This.loginHint)
942948
End if
943949
If (Length(String(This.prompt))>0)
944-
$urlParams+="&prompt="+This.prompt
950+
$urlParams.addQueryParameter("prompt"; This.prompt)
945951
End if
946952
End if
953+
If (Length(String(This.nonce))>0)
954+
$urlParams.addQueryParameter("nonce"; This.nonce)
955+
End if
947956

948-
$authenticateURI+=$urlParams
957+
$authenticateURI+=$urlParams.getQueryString()
949958
End if
950959

951960
return $authenticateURI

0 commit comments

Comments
 (0)