Merge pull request #30 from tryflux/client_credentials

adhesivee · web-flow · commit 223ce15497d8 · 2018-10-16T23:06:38.000+02:00
Add support for client credentials grant
diff --git a/oauth2-server-core/src/main/java/nl/myndocs/oauth2/CallRouter.kt b/oauth2-server-core/src/main/java/nl/myndocs/oauth2/CallRouter.kt
@@ -1,6 +1,10 @@
 package nl.myndocs.oauth2
 
 import nl.myndocs.oauth2.authenticator.Authorizer
+import nl.myndocs.oauth2.client.AuthorizedGrantType.AUTHORIZATION_CODE
+import nl.myndocs.oauth2.client.AuthorizedGrantType.CLIENT_CREDENTIALS
+import nl.myndocs.oauth2.client.AuthorizedGrantType.PASSWORD
+import nl.myndocs.oauth2.client.AuthorizedGrantType.REFRESH_TOKEN
 import nl.myndocs.oauth2.exception.*
 import nl.myndocs.oauth2.identity.UserInfo
 import nl.myndocs.oauth2.request.*
@@ -38,7 +42,7 @@ class CallRouter(
         }
 
         try {
-            val allowedGrantTypes = setOf("password", "authorization_code", "refresh_token")
+            val allowedGrantTypes = setOf(PASSWORD, AUTHORIZATION_CODE, REFRESH_TOKEN, CLIENT_CREDENTIALS)
             val grantType = callContext.formParameters["grant_type"]
                     ?: throw InvalidRequestException("'grant_type' not given")
 
@@ -50,6 +54,7 @@ class CallRouter(
                 "password" -> routePasswordGrant(callContext, tokenService)
                 "authorization_code" -> routeAuthorizationCodeGrant(callContext, tokenService)
                 "refresh_token" -> routeRefreshTokenGrant(callContext, tokenService)
+                "client_credentials" -> routeClientCredentialsGrant(callContext, tokenService)
             }
         } catch (oauthException: OauthException) {
             callContext.respondStatus(STATUS_BAD_REQUEST)
@@ -71,6 +76,16 @@ class CallRouter(
         callContext.respondJson(tokenResponse.toMap())
     }
 
+    fun routeClientCredentialsGrant(callContext: CallContext, tokenService: TokenService) {
+        val tokenResponse = tokenService.authorize(ClientCredentialsRequest(
+            callContext.formParameters["client_id"],
+            callContext.formParameters["client_secret"],
+            callContext.formParameters["scope"]
+        ))
+
+        callContext.respondJson(tokenResponse.toMap())
+    }
+
     fun routeRefreshTokenGrant(callContext: CallContext, tokenService: TokenService) {
         val accessToken = tokenService.refresh(
                 RefreshTokenRequest(
diff --git a/oauth2-server-core/src/main/java/nl/myndocs/oauth2/Oauth2TokenService.kt b/oauth2-server-core/src/main/java/nl/myndocs/oauth2/Oauth2TokenService.kt
@@ -119,6 +119,31 @@ class Oauth2TokenService(
         return accessToken.toTokenResponse()
     }
 
+    override fun authorize(clientCredentialsRequest: ClientCredentialsRequest): TokenResponse {
+        throwExceptionIfUnverifiedClient(clientCredentialsRequest)
+
+        val requestedClient = clientService.clientOf(clientCredentialsRequest.clientId!!) ?: throw InvalidClientException()
+
+        val scopes = clientCredentialsRequest.scope
+            ?.let { ScopeParser.parseScopes(it).toSet() }
+            ?: requestedClient.clientScopes
+
+        val accessToken = accessTokenConverter.convertToToken(
+            username = null,
+            clientId = clientCredentialsRequest.clientId,
+            requestedScopes = scopes,
+            refreshToken = refreshTokenConverter.convertToToken(
+                username = null,
+                clientId = clientCredentialsRequest.clientId,
+                requestedScopes = scopes
+            )
+        )
+
+        tokenStore.storeAccessToken(accessToken)
+
+        return accessToken.toTokenResponse()
+    }
+
     override fun refresh(refreshTokenRequest: RefreshTokenRequest): TokenResponse {
         throwExceptionIfUnverifiedClient(refreshTokenRequest)
 
@@ -293,7 +318,7 @@ class Oauth2TokenService(
     override fun userInfo(accessToken: String): UserInfo {
         val storedAccessToken = tokenStore.accessToken(accessToken) ?: throw InvalidGrantException()
         val client = clientService.clientOf(storedAccessToken.clientId) ?: throw InvalidClientException()
-        val identity = identityService.identityOf(client, storedAccessToken.username)
+        val identity = storedAccessToken.username?.let { identityService.identityOf(client, it) }
                 ?: throw InvalidIdentityException()
 
         return UserInfo(
diff --git a/oauth2-server-core/src/main/java/nl/myndocs/oauth2/TokenService.kt b/oauth2-server-core/src/main/java/nl/myndocs/oauth2/TokenService.kt
@@ -13,6 +13,8 @@ interface TokenService {
 
     fun authorize(authorizationCodeRequest: AuthorizationCodeRequest): TokenResponse
 
+    fun authorize(clientCredentialsRequest: ClientCredentialsRequest): TokenResponse
+
     fun refresh(refreshTokenRequest: RefreshTokenRequest): TokenResponse
 
     fun redirect(
diff --git a/oauth2-server-core/src/main/java/nl/myndocs/oauth2/client/AuthorizedGrantType.kt b/oauth2-server-core/src/main/java/nl/myndocs/oauth2/client/AuthorizedGrantType.kt
@@ -5,4 +5,5 @@ object AuthorizedGrantType {
     const val REFRESH_TOKEN = "refresh_token"
     const val PASSWORD = "password"
     const val AUTHORIZATION_CODE = "authorization_code"
+    const val CLIENT_CREDENTIALS = "client_credentials"
 }
diff --git a/oauth2-server-core/src/main/java/nl/myndocs/oauth2/request/ClientCredentialsRequest.kt b/oauth2-server-core/src/main/java/nl/myndocs/oauth2/request/ClientCredentialsRequest.kt
@@ -0,0 +1,9 @@
+package nl.myndocs.oauth2.request
+
+data class ClientCredentialsRequest(
+    override val clientId: String?,
+    override val clientSecret: String?,
+    val scope: String?
+) : ClientRequest{
+    val grant_type = "client_credentials"
+}
diff --git a/oauth2-server-core/src/main/java/nl/myndocs/oauth2/token/AccessToken.kt b/oauth2-server-core/src/main/java/nl/myndocs/oauth2/token/AccessToken.kt
@@ -6,7 +6,7 @@ data class AccessToken(
         val accessToken: String,
         val tokenType: String,
         override val expireTime: Instant,
-        val username: String,
+        val username: String?,
         val clientId: String,
         val scopes: Set<String>,
         val refreshToken: RefreshToken?
diff --git a/oauth2-server-core/src/main/java/nl/myndocs/oauth2/token/RefreshToken.kt b/oauth2-server-core/src/main/java/nl/myndocs/oauth2/token/RefreshToken.kt
@@ -5,7 +5,7 @@ import java.time.Instant
 data class RefreshToken(
         val refreshToken: String,
         override val expireTime: Instant,
-        val username: String,
+        val username: String?,
         val clientId: String,
         val scopes: Set<String>
 ) : ExpirableToken
diff --git a/oauth2-server-core/src/main/java/nl/myndocs/oauth2/token/converter/AccessTokenConverter.kt b/oauth2-server-core/src/main/java/nl/myndocs/oauth2/token/converter/AccessTokenConverter.kt
@@ -4,5 +4,5 @@ import nl.myndocs.oauth2.token.AccessToken
 import nl.myndocs.oauth2.token.RefreshToken
 
 interface AccessTokenConverter {
-    fun convertToToken(username: String, clientId: String, requestedScopes: Set<String>, refreshToken: RefreshToken?): AccessToken
+    fun convertToToken(username: String?, clientId: String, requestedScopes: Set<String>, refreshToken: RefreshToken?): AccessToken
 }
diff --git a/oauth2-server-core/src/main/java/nl/myndocs/oauth2/token/converter/RefreshTokenConverter.kt b/oauth2-server-core/src/main/java/nl/myndocs/oauth2/token/converter/RefreshTokenConverter.kt
@@ -4,5 +4,6 @@ import nl.myndocs.oauth2.token.RefreshToken
 
 interface RefreshTokenConverter {
     fun convertToToken(refreshToken: RefreshToken): RefreshToken = convertToToken(refreshToken.username, refreshToken.clientId, refreshToken.scopes)
-    fun convertToToken(username: String, clientId: String, requestedScopes: Set<String>): RefreshToken
+  
+    fun convertToToken(username: String?, clientId: String, requestedScopes: Set<String>): RefreshToken
 }
diff --git a/oauth2-server-core/src/main/java/nl/myndocs/oauth2/token/converter/UUIDAccessTokenConverter.kt b/oauth2-server-core/src/main/java/nl/myndocs/oauth2/token/converter/UUIDAccessTokenConverter.kt
@@ -9,7 +9,7 @@ class UUIDAccessTokenConverter(
         private val accessTokenExpireInSeconds: Int = 3600
 ) : AccessTokenConverter {
 
-    override fun convertToToken(username: String, clientId: String, requestedScopes: Set<String>, refreshToken: RefreshToken?): AccessToken {
+    override fun convertToToken(username: String?, clientId: String, requestedScopes: Set<String>, refreshToken: RefreshToken?): AccessToken {
         return AccessToken(
                 UUID.randomUUID().toString(),
                 "bearer",
diff --git a/oauth2-server-core/src/main/java/nl/myndocs/oauth2/token/converter/UUIDRefreshTokenConverter.kt b/oauth2-server-core/src/main/java/nl/myndocs/oauth2/token/converter/UUIDRefreshTokenConverter.kt
@@ -7,7 +7,7 @@ import java.util.*
 class UUIDRefreshTokenConverter(
         private val refreshTokenExpireInSeconds: Int = 86400
 ) : RefreshTokenConverter {
-    override fun convertToToken(username: String, clientId: String, requestedScopes: Set<String>): RefreshToken {
+    override fun convertToToken(username: String?, clientId: String, requestedScopes: Set<String>): RefreshToken {
         return RefreshToken(
                 UUID.randomUUID().toString(),
                 Instant.now().plusSeconds(refreshTokenExpireInSeconds.toLong()),
diff --git a/oauth2-server-core/src/test/java/nl/myndocs/oauth2/ClientCredentialsTokenServiceTest.kt b/oauth2-server-core/src/test/java/nl/myndocs/oauth2/ClientCredentialsTokenServiceTest.kt
@@ -0,0 +1,106 @@
+package nl.myndocs.oauth2
+
+import io.mockk.every
+import io.mockk.impl.annotations.InjectMockKs
+import io.mockk.impl.annotations.MockK
+import io.mockk.impl.annotations.RelaxedMockK
+import io.mockk.junit5.MockKExtension
+import io.mockk.verify
+import nl.myndocs.oauth2.client.AuthorizedGrantType
+import nl.myndocs.oauth2.client.Client
+import nl.myndocs.oauth2.client.ClientService
+import nl.myndocs.oauth2.exception.InvalidClientException
+import nl.myndocs.oauth2.identity.IdentityService
+import nl.myndocs.oauth2.request.ClientCredentialsRequest
+import nl.myndocs.oauth2.token.AccessToken
+import nl.myndocs.oauth2.token.RefreshToken
+import nl.myndocs.oauth2.token.TokenStore
+import nl.myndocs.oauth2.token.converter.AccessTokenConverter
+import nl.myndocs.oauth2.token.converter.CodeTokenConverter
+import nl.myndocs.oauth2.token.converter.RefreshTokenConverter
+import org.junit.jupiter.api.Assertions
+import org.junit.jupiter.api.Test
+import org.junit.jupiter.api.extension.ExtendWith
+import java.time.Instant
+
+@ExtendWith(MockKExtension::class)
+internal class ClientCredentialsTokenServiceTest {
+    @MockK
+    lateinit var identityService: IdentityService
+    @MockK
+    lateinit var clientService: ClientService
+    @RelaxedMockK
+    lateinit var tokenStore: TokenStore
+    @MockK
+    lateinit var accessTokenConverter: AccessTokenConverter
+    @MockK
+    lateinit var refreshTokenConverter: RefreshTokenConverter
+    @MockK
+    lateinit var codeTokenConverter: CodeTokenConverter
+
+    @InjectMockKs
+    lateinit var tokenService: Oauth2TokenService
+
+    private val clientId = "client-foo"
+    private val clientSecret = "client-secret"
+    private val scope = "scope1"
+    private val scopes = setOf(scope)
+    private val clientCredentialsRequest = ClientCredentialsRequest(clientId, clientSecret, scope)
+
+    @Test
+    fun validClientCredentialsGrant() {
+        val client = Client(clientId, emptySet(), emptySet(), setOf(AuthorizedGrantType.CLIENT_CREDENTIALS))
+        val refreshToken = RefreshToken("test", Instant.now(), null, clientId, scopes)
+        val accessToken = AccessToken("test", "bearer", Instant.now(), null, clientId, scopes, refreshToken)
+
+        every { clientService.clientOf(clientId) } returns client
+        every { clientService.validClient(client, clientSecret) } returns true
+        every { refreshTokenConverter.convertToToken(null, clientId, scopes) } returns refreshToken
+        every { accessTokenConverter.convertToToken(null, clientId, scopes, refreshToken) } returns accessToken
+
+        tokenService.authorize(clientCredentialsRequest)
+
+        verify { tokenStore.storeAccessToken(accessToken) }
+    }
+
+    @Test
+    fun nonExistingClientException() {
+        every { clientService.clientOf(clientId) } returns null
+
+        Assertions.assertThrows(
+            InvalidClientException::class.java
+        ) { tokenService.authorize(clientCredentialsRequest) }
+    }
+
+    @Test
+    fun invalidClientException() {
+        val client = Client(clientId, emptySet(), emptySet(), setOf(AuthorizedGrantType.CLIENT_CREDENTIALS))
+        every { clientService.clientOf(clientId) } returns client
+        every { clientService.validClient(client, clientSecret) } returns false
+
+        Assertions.assertThrows(
+            InvalidClientException::class.java
+        ) { tokenService.authorize(clientCredentialsRequest) }
+    }
+
+    @Test
+    fun clientScopesAsFallback() {
+        val clientCredentialsRequest = ClientCredentialsRequest(
+            clientId,
+            clientSecret,
+            null
+        )
+
+        val client = Client(clientId, setOf("scope1", "scope2"), setOf(), setOf(AuthorizedGrantType.CLIENT_CREDENTIALS))
+        val requestScopes = setOf("scope1", "scope2")
+        val refreshToken = RefreshToken("test", Instant.now(), null, clientId, requestScopes)
+        val accessToken = AccessToken("test", "bearer", Instant.now(), null, clientId, requestScopes, refreshToken)
+
+        every { clientService.clientOf(clientId) } returns client
+        every { clientService.validClient(client, clientSecret) } returns true
+        every { refreshTokenConverter.convertToToken(null, clientId, requestScopes) } returns refreshToken
+        every { accessTokenConverter.convertToToken(null, clientId, requestScopes, refreshToken) } returns accessToken
+
+        tokenService.authorize(clientCredentialsRequest)
+    }
+}

Original file line number	Diff line number	Diff line change
`@@ -5,4 +5,5 @@ object AuthorizedGrantType {`
`5`	`5`	`const val REFRESH_TOKEN = "refresh_token"`
`6`	`6`	`const val PASSWORD = "password"`
`7`	`7`	`const val AUTHORIZATION_CODE = "authorization_code"`
	`8`	`+ const val CLIENT_CREDENTIALS = "client_credentials"`
`8`	`9`	`}`
Original file line number	Diff line number	Diff line change
`@@ -4,5 +4,5 @@ import nl.myndocs.oauth2.token.AccessToken`
`4`	`4`	`import nl.myndocs.oauth2.token.RefreshToken`
`5`	`5`
`6`	`6`	`interface AccessTokenConverter {`
`7`		`- fun convertToToken(username: String, clientId: String, requestedScopes: Set<String>, refreshToken: RefreshToken?): AccessToken`
	`7`	`+ fun convertToToken(username: String?, clientId: String, requestedScopes: Set<String>, refreshToken: RefreshToken?): AccessToken`
`8`	`8`	`}`
Original file line number	Diff line number	Diff line change
`@@ -4,5 +4,6 @@ import nl.myndocs.oauth2.token.RefreshToken`
`4`	`4`
`5`	`5`	`interface RefreshTokenConverter {`
`6`	`6`	`fun convertToToken(refreshToken: RefreshToken): RefreshToken = convertToToken(refreshToken.username, refreshToken.clientId, refreshToken.scopes)`
`7`		`- fun convertToToken(username: String, clientId: String, requestedScopes: Set<String>): RefreshToken`
	`7`	`+`
	`8`	`+ fun convertToToken(username: String?, clientId: String, requestedScopes: Set<String>): RefreshToken`
`8`	`9`	`}`