import com.nimbusds.oauth2.sdk.http.HTTPResponse; //导入依赖的package包/类
public static String getUserMembershipsV1(String accessToken) throws Exception {
    final String userMembershipRestAPIv1 = "https://graph.windows.net/me/memberOf?api-version=1.6";
    final URL url = new URL(userMembershipRestAPIv1);

    final HttpURLConnection conn = (HttpURLConnection) url.openConnection();
    // Set the appropriate header fields in the request header.
    conn.setRequestProperty("api-version", "1.6");
    conn.setRequestProperty("Authorization", accessToken);
    conn.setRequestProperty("Accept", "application/json;odata=minimalmetadata");
    final String responseInJson = getResponseStringFromConn(conn);
    final int responseCode = conn.getResponseCode();
    if (responseCode == HTTPResponse.SC_OK) {
        return responseInJson;
    } else {
        throw new Exception(responseInJson);
    }
}
 

import com.nimbusds.oauth2.sdk.http.HTTPResponse; //导入依赖的package包/类
@Override
public Response handle(HTTPRequest httpRequest, OIDCResourceReference reference) throws Exception
{
    Issuer issuer = this.manager.getIssuer();
    List<SubjectType> subjectTypes = Arrays.asList(SubjectType.PUBLIC);
    URI jwkSetURI = this.manager.createEndPointURI(JWKOIDCEndpoint.HINT);

    OIDCProviderMetadata metadata = new OIDCProviderMetadata(issuer, subjectTypes, jwkSetURI);

    metadata.setAuthorizationEndpointURI(this.manager.createEndPointURI(AuthorizationOIDCEndpoint.HINT));
    metadata.setTokenEndpointURI(this.manager.createEndPointURI(TokenOIDCEndpoint.HINT));
    metadata.setUserInfoEndpointURI(this.manager.createEndPointURI(UserInfoOIDCEndpoint.HINT));

    return new ContentResponse(CommonContentTypes.APPLICATION_JSON, metadata.toJSONObject().toString(),
        HTTPResponse.SC_OK);
}
 

import com.nimbusds.oauth2.sdk.http.HTTPResponse; //导入依赖的package包/类
public Principal updateUserInfo(URI userInfoEndpoint, IDTokenClaimsSet idToken, BearerAccessToken accessToken)
    throws IOException, ParseException, OIDCException, XWikiException, QueryException
{
    // Get OIDC user info
    UserInfoRequest userinfoRequest = new UserInfoRequest(userInfoEndpoint, accessToken);
    HTTPRequest userinfoHTTP = userinfoRequest.toHTTPRequest();
    userinfoHTTP.setHeader("User-Agent", this.getClass().getPackage().getImplementationTitle() + '/'
        + this.getClass().getPackage().getImplementationVersion());
    HTTPResponse httpResponse = userinfoHTTP.send();
    UserInfoResponse userinfoResponse = UserInfoResponse.parse(httpResponse);

    if (!userinfoResponse.indicatesSuccess()) {
        UserInfoErrorResponse error = (UserInfoErrorResponse) userinfoResponse;
        throw new OIDCException("Failed to get user info", error.getErrorObject());
    }

    UserInfoSuccessResponse userinfoSuccessResponse = (UserInfoSuccessResponse) userinfoResponse;
    UserInfo userInfo = userinfoSuccessResponse.getUserInfo();

    // Update/Create XWiki user
    return updateUser(idToken, userInfo);
}
 

import com.nimbusds.oauth2.sdk.http.HTTPResponse; //导入依赖的package包/类
/**
	 * Client registration
	 * If the provider supports dynamic registration, a new client can be registered using the client registration process:
	 * 
	 * @param initialAccessToken the initial access token
	 * @throws SerializeException the serialize exception
	 * @throws IOException Signals that an I/O exception has occurred.
	 * @throws ParseException the parse exception
	 * @throws KeyStoreException
	 * @throws CertificateException
	 * @throws NoSuchAlgorithmException
	 * @throws KeyManagementException
	 */
	public void registerClient(BearerAccessToken initialAccessToken) throws SerializeException, IOException, ParseException, KeyManagementException, NoSuchAlgorithmException, CertificateException, KeyStoreException {

//		System.out.println("Client metadata");
//		System.out.println(metadata.toJSONObject());

		// Make registration request
		OIDCClientRegistrationRequest registrationRequest = new OIDCClientRegistrationRequest(providerMetadata.getRegistrationEndpointURI(), clientMetadata, initialAccessToken);
		HTTPResponse regHTTPResponse = registrationRequest.toHTTPRequest().send(null, Trust.getSocketFactory(trustStoreFile));

		// Parse and check response
		ClientRegistrationResponse registrationResponse = OIDCClientRegistrationResponseParser.parse(regHTTPResponse);

		if (registrationResponse instanceof ClientRegistrationErrorResponse) {
			ClientRegistrationErrorResponse errorResponse = ((ClientRegistrationErrorResponse) registrationResponse);
			ErrorObject error = errorResponse.getErrorObject();
			System.err.println(this.getClass().getSimpleName() + " - " + errorResponse.indicatesSuccess());
			System.err.println("Dynamic Client Registration failed, Error:");
			System.err.println(errorResponse);
			System.err.println(error);
			System.err.println(regHTTPResponse.getStatusCode());
			System.err.println(regHTTPResponse.getContent());
			System.err.println(regHTTPResponse.getWWWAuthenticate());
			System.err.println(regHTTPResponse.getLocation());
		} else {
			clientInformation = ((OIDCClientInformationResponse) registrationResponse).getOIDCClientInformation();
			clientID = clientInformation.getID();
		}
	}
 

import com.nimbusds.oauth2.sdk.http.HTTPResponse; //导入依赖的package包/类
/**
 * UserInfo Request
 * Using the access token, information about the end user can be obtained by making a user info request
 * 
 * @throws KeyStoreException
 * @throws CertificateException
 * @throws NoSuchAlgorithmException
 * @throws KeyManagementException
 * @throws ParseException
 * @throws IOException
 * @throws FileNotFoundException
 */
public void requestUserInfo() throws KeyManagementException, NoSuchAlgorithmException, CertificateException, KeyStoreException, ParseException, FileNotFoundException, IOException {
	if (accessToken == null) {
		System.err.println(this.getClass().getSimpleName() + " - Access Token null, stopping UserInfo retrieval");
		return;
	}

	UserInfoRequest userInfoReq = new UserInfoRequest(
			userInfoEndpointURI,
			(BearerAccessToken) accessToken);

	HTTPResponse userInfoHTTPResp = null;
	userInfoHTTPResp = userInfoReq.toHTTPRequest().send(null, Trust.getSocketFactory(trustStoreFile));

	UserInfoResponse userInfoResponse = null;
	userInfoResponse = UserInfoResponse.parse(userInfoHTTPResp);

	if (userInfoResponse instanceof UserInfoErrorResponse) {
		UserInfoErrorResponse errorResponse = ((UserInfoErrorResponse) userInfoResponse);
		ErrorObject error = errorResponse.getErrorObject();

		System.err.println(this.getClass().getSimpleName() + " - " + errorResponse.indicatesSuccess());
		System.err.println("Userinfo retrieval failed:");
		System.err.println(errorResponse);
		System.err.println(error);
		System.err.println(error.getHTTPStatusCode());
		System.err.println(userInfoHTTPResp.getStatusCode());
		System.err.println(userInfoHTTPResp.getContent());
		System.err.println(userInfoHTTPResp.getWWWAuthenticate());
		System.err.println(userInfoHTTPResp.getLocation());
	}

	UserInfoSuccessResponse successResponse = (UserInfoSuccessResponse) userInfoResponse;
	userInfoClaims = successResponse.getUserInfo().toJSONObject();
}
 

import com.nimbusds.oauth2.sdk.http.HTTPResponse; //导入依赖的package包/类
@Override
public void validate(final OidcCredentials credentials, final WebContext context) throws HttpAction {
    init(context);

    final AuthorizationCode code = credentials.getCode();
    // if we have a code
    if (code != null) {
        try {
            // Token request
            final TokenRequest request = new TokenRequest(configuration.getProviderMetadata().getTokenEndpointURI(), this.clientAuthentication,
                    new AuthorizationCodeGrant(code, new URI(configuration.getCallbackUrl())));
            HTTPRequest tokenHttpRequest = request.toHTTPRequest();
            tokenHttpRequest.setConnectTimeout(configuration.getConnectTimeout());
            tokenHttpRequest.setReadTimeout(configuration.getReadTimeout());

            final HTTPResponse httpResponse = tokenHttpRequest.send();
            logger.debug("Token response: status={}, content={}", httpResponse.getStatusCode(),
                    httpResponse.getContent());

            final TokenResponse response = OIDCTokenResponseParser.parse(httpResponse);
            if (response instanceof TokenErrorResponse) {
                throw new TechnicalException("Bad token response, error=" + ((TokenErrorResponse) response).getErrorObject());
            }
            logger.debug("Token response successful");
            final OIDCTokenResponse tokenSuccessResponse = (OIDCTokenResponse) response;

            // save tokens in credentials
            final OIDCTokens oidcTokens = tokenSuccessResponse.getOIDCTokens();
            credentials.setAccessToken(oidcTokens.getAccessToken());
            credentials.setRefreshToken(oidcTokens.getRefreshToken());
            credentials.setIdToken(oidcTokens.getIDToken());

        } catch (final URISyntaxException | IOException | ParseException e) {
            throw new TechnicalException(e);
        }
    }
}
 

import com.nimbusds.oauth2.sdk.http.HTTPResponse; //导入依赖的package包/类
protected void sendResponse(String typeName, Response errorResp, HttpServletResponse resp) throws IOException {
	HTTPResponse httpResp = errorResp.toHTTPResponse();
	ServletUtils.applyHTTPResponse(httpResp, resp);

	resp.flushBuffer();
	logger.log("Returning " + typeName + " Response.");
	logger.logHttpResponse(resp, httpResp.getContent());
}
 

import com.nimbusds.oauth2.sdk.http.HTTPResponse; //导入依赖的package包/类
protected void sendErrorResponse(String typeName, ErrorResponse errorResp, HttpServletResponse resp) throws IOException {
	HTTPResponse httpResp = errorResp.toHTTPResponse();
	ServletUtils.applyHTTPResponse(httpResp, resp);

	resp.flushBuffer();
	logger.log("Returning " + typeName + " Error Response.");
	logger.logHttpResponse(resp, httpResp.getContent());
}
 

import com.nimbusds.oauth2.sdk.http.HTTPResponse; //导入依赖的package包/类
protected OIDCTokenResponse fetchToken(AuthorizationCode authCode, HttpServerExchange exchange) throws Exception {
	URI redirectURI = new URI(RedirectBuilder.redirect(exchange, redirectPath));
	TokenRequest tokenReq = new TokenRequest(oidcProvider.getTokenURI(), oidcProvider.getClientId(), new AuthorizationCodeGrant(authCode, redirectURI));
	HTTPResponse tokenHTTPResp = tokenReq.toHTTPRequest().send();
	TokenResponse tokenResponse = OIDCTokenResponseParser.parse(tokenHTTPResp);
	if (tokenResponse instanceof TokenErrorResponse) {
		ErrorObject error = ((TokenErrorResponse) tokenResponse).getErrorObject();
		throw new IllegalStateException(String.format("OIDC TokenRequest error: code %s description: %s", error.getCode(), error.getDescription()));
	}
	return (OIDCTokenResponse) tokenResponse;
}
 

import com.nimbusds.oauth2.sdk.http.HTTPResponse; //导入依赖的package包/类
protected UserInfoSuccessResponse fetchProfile(BearerAccessToken accessToken) throws Exception {
	UserInfoRequest userInfoReq = new UserInfoRequest(oidcProvider.getUserInfoURI(), accessToken);
	HTTPResponse userInfoHTTPResp = userInfoReq.toHTTPRequest().send();
	UserInfoResponse userInfoResponse = UserInfoResponse.parse(userInfoHTTPResp);
	if (userInfoResponse instanceof UserInfoErrorResponse) {
		ErrorObject error = ((UserInfoErrorResponse) userInfoResponse).getErrorObject();
		throw new IllegalStateException(String.format("OIDC UserInfoRequest error: code %s description: %s", error.getCode(), error.getDescription()));
	}
	return (UserInfoSuccessResponse) userInfoResponse;
}
 

import com.nimbusds.oauth2.sdk.http.HTTPResponse; //导入依赖的package包/类
private Response evaluateContent(final String content) throws Exception
{
    String html = this.suExecutor.call(new Callable<String>()
    {
        @Override
        public String call() throws Exception
        {
            return xcontextProvider.get().getWiki().evaluateVelocity(content, "oidc");
        }
    }, SUPERADMIN_REFERENCE);

    return new ContentResponse(ContentResponse.CONTENTTYPE_HTML, html, HTTPResponse.SC_OK);
}
 

import com.nimbusds.oauth2.sdk.http.HTTPResponse; //导入依赖的package包/类
/**
 * @param type the type of the content
 * @param content the content to return
 * @param statusCode the status code to return
 */
public ContentResponse(ContentType type, String content, int statusCode)
{
    this.httpResponse = new HTTPResponse(statusCode);

    this.httpResponse.setContentType(type);
    this.httpResponse.setContent(content);
}
 

import com.nimbusds.oauth2.sdk.http.HTTPResponse; //导入依赖的package包/类
@Override
public HTTPResponse toHTTPResponse()
{
    HTTPResponse response = new HTTPResponse(HTTPResponse.SC_FOUND);
    response.setLocation(this.location);

    return response;
}
 

import com.nimbusds.oauth2.sdk.http.HTTPResponse; //导入依赖的package包/类
@Override
@SuppressWarnings("unchecked")
public U create(final OidcCredentials credentials, final WebContext context) throws HttpAction {
    init(context);

    final AccessToken accessToken = credentials.getAccessToken();

    // Create profile
    final U profile = getProfileFactory().get();
    profile.setAccessToken(accessToken);
    final JWT idToken = credentials.getIdToken();
    profile.setIdTokenString(idToken.getParsedString());
    // Check if there is a refresh token
    final RefreshToken refreshToken = credentials.getRefreshToken();
    if (refreshToken != null && !refreshToken.getValue().isEmpty()) {
        profile.setRefreshToken(refreshToken);
        logger.debug("Refresh Token successful retrieved");
    }

    try {

        // check idToken
        final Nonce nonce;
        if (configuration.isUseNonce()) {
            nonce = new Nonce((String) context.getSessionAttribute(OidcConfiguration.NONCE_SESSION_ATTRIBUTE));
        } else {
            nonce = null;
        }
        // Check ID Token
        final IDTokenClaimsSet claimsSet = this.idTokenValidator.validate(idToken, nonce);
        assertNotNull("claimsSet", claimsSet);
        profile.setId(claimsSet.getSubject());

        // User Info request
        if (configuration.getProviderMetadata().getUserInfoEndpointURI() != null && accessToken != null) {
            final UserInfoRequest userInfoRequest = new UserInfoRequest(configuration.getProviderMetadata().getUserInfoEndpointURI(), (BearerAccessToken) accessToken);
            final HTTPRequest userInfoHttpRequest = userInfoRequest.toHTTPRequest();
            userInfoHttpRequest.setConnectTimeout(configuration.getConnectTimeout());
            userInfoHttpRequest.setReadTimeout(configuration.getReadTimeout());
            final HTTPResponse httpResponse = userInfoHttpRequest.send();
            logger.debug("Token response: status={}, content={}", httpResponse.getStatusCode(),
                    httpResponse.getContent());

            final UserInfoResponse userInfoResponse = UserInfoResponse.parse(httpResponse);
            if (userInfoResponse instanceof UserInfoErrorResponse) {
                logger.error("Bad User Info response, error={}",
                        ((UserInfoErrorResponse) userInfoResponse).getErrorObject());
            } else {
                final UserInfoSuccessResponse userInfoSuccessResponse = (UserInfoSuccessResponse) userInfoResponse;
                final UserInfo userInfo = userInfoSuccessResponse.getUserInfo();
                if (userInfo != null) {
                    profile.addAttributes(userInfo.toJWTClaimsSet().getClaims());
                }
            }
        }

        // add attributes of the ID token if they don't already exist
        for (final Map.Entry<String, Object> entry : idToken.getJWTClaimsSet().getClaims().entrySet()) {
            final String key = entry.getKey();
            final Object value = entry.getValue();
            if (profile.getAttribute(key) == null) {
                profile.addAttribute(key, value);
            }
        }

        return profile;

    } catch (final IOException | ParseException | JOSEException | BadJOSEException | java.text.ParseException e) {
        throw new TechnicalException(e);
    }
}
 

import com.nimbusds.oauth2.sdk.http.HTTPResponse; //导入依赖的package包/类
@Override
public HTTPResponse toHTTPResponse()
{
    return this.httpResponse;
}
 

import com.nimbusds.oauth2.sdk.http.HTTPResponse; //导入依赖的package包/类
@Override
public Response handle(HTTPRequest httpRequest, OIDCResourceReference reference) throws Exception
{
    // Parse the request
    AuthorizationResponse authorizationResponse = AuthorizationResponse.parse(httpRequest);

    // Validate state
    State state = authorizationResponse.getState();
    if (!Objects.equal(state, this.configuration.getSessionState())) {
        throw new OIDCException("Invalid state [" + state + "]");
    }
    // TODO: remove the state from the session ?

    // Deal with errors
    if (!authorizationResponse.indicatesSuccess()) {
        // Cast to error response
        AuthorizationErrorResponse errorResponse = (AuthorizationErrorResponse) authorizationResponse;

        // If impossible to authenticate without prompt, just ignore and redirect
        if (OIDCError.INTERACTION_REQUIRED.getCode().equals(errorResponse.getErrorObject().getCode())
            || OIDCError.LOGIN_REQUIRED.getCode().equals(errorResponse.getErrorObject().getCode())) {
            // Redirect to original request
            return new RedirectResponse(new URI(authorizationResponse.getState().getValue()));
        }
    }

    // Cast to success response
    AuthorizationSuccessResponse successResponse = (AuthorizationSuccessResponse) authorizationResponse;

    // Get authorization code
    AuthorizationCode code = successResponse.getAuthorizationCode();

    // Generate callback URL
    URI callback = this.oidc.createEndPointURI(CallbackOIDCEndpoint.HINT);

    // Get access token
    AuthorizationGrant authorizationGrant = new AuthorizationCodeGrant(code, callback);
    // TODO: setup some client authentication, secret, all that
    TokenRequest tokeRequest = new TokenRequest(this.configuration.getTokenOIDCEndpoint(),
        this.configuration.getClientID(), authorizationGrant);
    HTTPRequest tokenHTTP = tokeRequest.toHTTPRequest();
    tokenHTTP.setHeader("User-Agent", this.getClass().getPackage().getImplementationTitle() + '/'
        + this.getClass().getPackage().getImplementationVersion());
    HTTPResponse httpResponse = tokenHTTP.send();

    if (httpResponse.getStatusCode() != HTTPResponse.SC_OK) {
        TokenErrorResponse error = TokenErrorResponse.parse(httpResponse);
        throw new OIDCException("Failed to get access token", error.getErrorObject());
    }

    OIDCTokenResponse tokenResponse = OIDCTokenResponse.parse(httpResponse);

    IDTokenClaimsSet idToken = new IDTokenClaimsSet(tokenResponse.getOIDCTokens().getIDToken().getJWTClaimsSet());
    BearerAccessToken accessToken = tokenResponse.getTokens().getBearerAccessToken();

    HttpSession session = ((ServletSession) this.container.getSession()).getHttpSession();

    // Store the access token in the session
    this.configuration.setIdToken(idToken);
    this.configuration.setAccessToken(accessToken);

    // Update/Create XWiki user
    Principal principal = this.users.updateUserInfo(accessToken);

    // Remember user in the session
    session.setAttribute(SecurityRequestWrapper.PRINCIPAL_SESSION_KEY, principal);

    // TODO: put enough information in the cookie to automatically authenticate when coming back

    // Redirect to original request
    return new RedirectResponse(this.configuration.getSuccessRedirectURI());
}