Skip to content

Commit 5d017d7

Browse files
sberyozkinsberyozkin
committed
Minor update
1 parent e5c5a0f commit 5d017d7

File tree

3 files changed

+32
-21
lines changed

3 files changed

+32
-21
lines changed

‎extensions/oidc-client/runtime/src/main/java/io/quarkus/oidc/client/runtime/OidcClientImpl.java‎

Lines changed: 27 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -40,6 +40,12 @@
4040

4141
public class OidcClientImpl implements OidcClient {
4242

43+
private enum Operation {
44+
Get,
45+
Refresh,
46+
Revoke
47+
}
48+
4349
private static final Logger LOG = Logger.getLogger(OidcClientImpl.class);
4450
private static final String CLIENT_ID_ATTRIBUTE = "client-id";
4551
private static final String DEFAULT_OIDC_CLIENT_ID = "Default";
@@ -95,7 +101,7 @@ public Uni<Tokens> getTokens(Map<String, String> additionalGrantParameters) {
95101
throw new OidcClientException(
96102
"Only 'refresh_token' grant is supported, please call OidcClient#refreshTokens method instead");
97103
}
98-
return getJsonResponse(OidcEndpoint.Type.TOKEN, tokenGrantParams, additionalGrantParameters, false);
104+
return getJsonResponse(OidcEndpoint.Type.TOKEN, tokenGrantParams, additionalGrantParameters, Operation.Get);
99105
}
100106

101107
@Override
@@ -106,7 +112,7 @@ public Uni<Tokens> refreshTokens(String refreshToken, Map<String, String> additi
106112
}
107113
MultiMap refreshGrantParams = copyMultiMap(commonRefreshGrantParams);
108114
refreshGrantParams.add(OidcConstants.REFRESH_TOKEN_VALUE, refreshToken);
109-
return getJsonResponse(OidcEndpoint.Type.TOKEN, refreshGrantParams, additionalGrantParameters, true);
115+
return getJsonResponse(OidcEndpoint.Type.TOKEN, refreshGrantParams, additionalGrantParameters, Operation.Refresh);
110116
}
111117

112118
@Override
@@ -122,7 +128,7 @@ public Uni<Boolean> revokeAccessToken(String accessToken, Map<String, String> ad
122128
tokenRevokeParams.set(OidcConstants.REVOCATION_TOKEN, accessToken);
123129
return postRequest(requestProps, OidcEndpoint.Type.TOKEN_REVOCATION, client.postAbs(tokenRevokeUri),
124130
tokenRevokeParams,
125-
additionalParameters, false)
131+
additionalParameters, Operation.Revoke)
126132
.transform(resp -> toRevokeResponse(requestProps, resp));
127133
} else {
128134
LOG.debugf("%s OidcClient can not revoke the access token because the revocation endpoint URL is not set");
@@ -155,18 +161,18 @@ private Boolean toRevokeResponse(OidcRequestContextProperties requestProps, Http
155161
private Uni<Tokens> getJsonResponse(
156162
OidcEndpoint.Type endpointType, MultiMap formBody,
157163
Map<String, String> additionalGrantParameters,
158-
boolean refresh) {
164+
Operation op) {
159165
//Uni needs to be lazy by default, we don't send the request unless
160166
//something has subscribed to it. This is important for the CAS state
161167
//management in TokensHelper
162-
String currentGrantType = refresh ? OidcConstants.REFRESH_TOKEN_GRANT : grantType;
168+
String currentGrantType = isRefresh(op) ? OidcConstants.REFRESH_TOKEN_GRANT : grantType;
163169
final OidcRequestContextProperties requestProps = getRequestProps(currentGrantType);
164170
return Uni.createFrom().deferred(new Supplier<Uni<? extends Tokens>>() {
165171
@Override
166172
public Uni<Tokens> get() {
167173
return postRequest(requestProps, endpointType, client.postAbs(tokenRequestUri), formBody,
168-
additionalGrantParameters, refresh)
169-
.transform(resp -> emitGrantTokens(requestProps, resp, refresh));
174+
additionalGrantParameters, op)
175+
.transform(resp -> emitGrantTokens(requestProps, resp, op));
170176
}
171177
});
172178
}
@@ -176,7 +182,7 @@ private UniOnItem<HttpResponse<Buffer>> postRequest(
176182
OidcEndpoint.Type endpointType, HttpRequest<Buffer> request,
177183
MultiMap formBody,
178184
Map<String, String> additionalGrantParameters,
179-
boolean refresh) {
185+
Operation op) {
180186
MultiMap body = formBody;
181187
request.putHeader(HttpHeaders.CONTENT_TYPE.toString(),
182188
HttpHeaders.APPLICATION_X_WWW_FORM_URLENCODED.toString());
@@ -199,14 +205,14 @@ private UniOnItem<HttpResponse<Buffer>> postRequest(
199205
if (clientAssertion == null) {
200206
String errorMessage = String.format(
201207
"%s OidcClient can not complete the %s grant request because a JWT bearer client_assertion is missing",
202-
oidcConfig.id().get(), (refresh ? OidcConstants.REFRESH_TOKEN_GRANT : grantType));
208+
oidcConfig.id().get(), (isRefresh(op) ? OidcConstants.REFRESH_TOKEN_GRANT : grantType));
203209
LOG.error(errorMessage);
204210
throw new OidcClientException(errorMessage);
205211
}
206212
body.set(OidcConstants.CLIENT_ASSERTION_TYPE, OidcConstants.JWT_BEARER_CLIENT_ASSERTION_TYPE);
207213
} else if (clientJwtKey != null) {
208214
// if it is a refresh then a map has already been copied
209-
body = !refresh ? copyMultiMap(body) : body;
215+
body = !isRefresh(op) ? copyMultiMap(body) : body;
210216
String jwt = OidcCommonUtils.signJwtWithKey(oidcConfig, tokenRequestUri, clientJwtKey);
211217

212218
if (OidcCommonUtils.isClientSecretPostJwtAuthRequired(oidcConfig.credentials())) {
@@ -227,11 +233,11 @@ private UniOnItem<HttpResponse<Buffer>> postRequest(
227233
body.add(OidcConstants.CLIENT_ASSERTION, jwt);
228234
}
229235
} else if (OidcCommonUtils.isClientSecretPostAuthRequired(oidcConfig.credentials())) {
230-
body = !refresh ? copyMultiMap(body) : body;
236+
body = !isRefresh(op) ? copyMultiMap(body) : body;
231237
body.set(OidcConstants.CLIENT_ID, oidcConfig.clientId().get());
232238
body.set(OidcConstants.CLIENT_SECRET, OidcCommonUtils.clientSecret(oidcConfig.credentials()));
233239
} else {
234-
body = !refresh ? copyMultiMap(body) : body;
240+
body = !isRefresh(op) ? copyMultiMap(body) : body;
235241
body = copyMultiMap(body).set(OidcConstants.CLIENT_ID, oidcConfig.clientId().get());
236242
}
237243
if (!additionalGrantParameters.isEmpty()) {
@@ -241,7 +247,8 @@ private UniOnItem<HttpResponse<Buffer>> postRequest(
241247
}
242248
}
243249
if (LOG.isDebugEnabled()) {
244-
LOG.debugf("Token endpoint: %s, request params: %s, headers: %s", request.uri(), body, request.headers());
250+
LOG.debugf("%s token: url : %s, headers: %s, request params: %s", op.name(), request.uri(), request.headers(),
251+
body);
245252
}
246253
// Retry up to three times with a one-second delay between the retries if the connection is closed
247254
Buffer buffer = OidcCommonUtils.encodeForm(body);
@@ -258,10 +265,10 @@ private UniOnItem<HttpResponse<Buffer>> postRequest(
258265
return response.onItem();
259266
}
260267

261-
private Tokens emitGrantTokens(OidcRequestContextProperties requestProps, HttpResponse<Buffer> resp, boolean refresh) {
268+
private Tokens emitGrantTokens(OidcRequestContextProperties requestProps, HttpResponse<Buffer> resp, Operation op) {
262269
Buffer buffer = OidcCommonUtils.filterHttpResponse(requestProps, resp, responseFilters, OidcEndpoint.Type.TOKEN);
263270
if (resp.statusCode() == 200) {
264-
LOG.debugf("%s OidcClient has %s the tokens", oidcConfig.id().get(), (refresh ? "refreshed" : "acquired"));
271+
LOG.debugf("%s OidcClient has %s the tokens", oidcConfig.id().get(), (isRefresh(op) ? "refreshed" : "acquired"));
265272
JsonObject json = buffer.toJsonObject();
266273
// access token
267274
final String accessToken = json.getString(oidcConfig.grant().accessTokenProperty());
@@ -277,7 +284,7 @@ private Tokens emitGrantTokens(OidcRequestContextProperties requestProps, HttpRe
277284
} else {
278285
String errorMessage = buffer.toString();
279286
LOG.debugf("%s OidcClient has failed to complete the %s grant request: status: %d, error message: %s",
280-
oidcConfig.id().get(), (refresh ? OidcConstants.REFRESH_TOKEN_GRANT : grantType), resp.statusCode(),
287+
oidcConfig.id().get(), (isRefresh(op) ? OidcConstants.REFRESH_TOKEN_GRANT : grantType), resp.statusCode(),
281288
errorMessage);
282289
throw new OidcClientException(errorMessage);
283290
}
@@ -372,4 +379,8 @@ private HttpRequest<Buffer> filterHttpRequest(
372379
OidcClientConfig getConfig() {
373380
return oidcConfig;
374381
}
382+
383+
static boolean isRefresh(Operation op) {
384+
return op == Operation.Refresh;
385+
}
375386
}

‎integration-tests/oidc-client-wiremock/src/test/java/io/quarkus/it/keycloak/KeycloakRealmResourceManager.java‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -41,7 +41,7 @@ public Map<String, String> start() {
4141
.aResponse()
4242
.withHeader("Content-Type", MediaType.APPLICATION_JSON)
4343
.withBody(
44-
"{\"access_token\":\"access_token_1\", \"expires_in\":4, \"refresh_token\":\"refresh_token_1\"}")));
44+
"{\"access_token\":\"access_token_1\", \"expires_in\":6, \"refresh_token\":\"refresh_token_1\"}")));
4545
server.stubFor(WireMock.post("/tokens-exchange")
4646
.withRequestBody(containing("grant_type=urn%3Aietf%3Aparams%3Aoauth%3Agrant-type%3Atoken-exchange"))
4747
.withRequestBody(containing("subject_token=token_to_be_exchanged"))
@@ -122,7 +122,7 @@ public Map<String, String> start() {
122122
.aResponse()
123123
.withHeader("Content-Type", MediaType.APPLICATION_JSON)
124124
.withBody(
125-
"{\"access_token\":\"access_token_2\", \"expires_in\":4, \"refresh_token\":\"refresh_token_2\", \"refresh_expires_in\":1}")));
125+
"{\"access_token\":\"access_token_2\", \"expires_in\":6, \"refresh_token\":\"refresh_token_2\", \"refresh_expires_in\":1}")));
126126

127127
server.stubFor(WireMock.post("/tokens-without-expires-in")
128128
.withRequestBody(matching("grant_type=client_credentials&client_id=quarkus-app&client_secret=secret"))

‎integration-tests/oidc-client-wiremock/src/test/java/io/quarkus/it/keycloak/OidcClientTest.java‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -112,15 +112,15 @@ public void testEchoTokensJwtBearerGrant() {
112112
@Test
113113
public void testEchoAndRefreshTokens() {
114114
// access_token_1 and refresh_token_1 are acquired using a password grant request.
115-
// access_token_1 expires in 4 seconds, refresh_token_1 has no lifespan limit as no `refresh_expires_in` property is returned.
115+
// access_token_1 expires in 6 seconds, refresh_token_1 has no lifespan limit as no `refresh_expires_in` property is returned.
116116
// "Default OidcClient has acquired the tokens" record is added to the log
117117
RestAssured.when().get("/frontend/echoToken")
118118
.then()
119119
.statusCode(200)
120120
.body(equalTo("access_token_1"));
121121

122122
// Wait until the access_token_1 has expired
123-
waitUntillAccessTokenHasExpired(5000);
123+
waitUntillAccessTokenHasExpired(7000);
124124

125125
// access_token_1 has expired, refresh_token_1 is assumed to be valid and used to acquire access_token_2 and refresh_token_2.
126126
// access_token_2 expires in 4 seconds, but refresh_token_2 - in 1 sec - it will expire by the time access_token_2 has expired
@@ -131,7 +131,7 @@ public void testEchoAndRefreshTokens() {
131131
.body(equalTo("access_token_2"));
132132

133133
// Wait until the access_token_2 has expired
134-
waitUntillAccessTokenHasExpired(5000);
134+
waitUntillAccessTokenHasExpired(7000);
135135

136136
// Both access_token_2 and refresh_token_2 have now expired therefore a password grant request is repeated,
137137
// as opposed to using a refresh token grant.

0 commit comments

Comments
 (0)