import org.springframework.security.oauth2.common.exceptions.UnauthorizedClientException; //导入依赖的package包/类
@ApiOperation(value = "ID card login")
@RequestMapping(method = {GET, POST}, value = "/idLogin")
@ResponseBody
public IdCardLoginResponse idLogin(@RequestHeader(value = "ssl_client_verify") String clientCertificateVerification,
                                   @RequestHeader(value = "ssl_client_cert") String clientCertificate,
                                   @RequestHeader(value = "x-authorization") String crossAuthorizationToken,
                                   @ApiIgnore HttpServletResponse response,
                                   @ApiIgnore HttpMethod httpMethod) throws IOException {
    if (!Objects.equals(crossAuthorizationToken, idCardSecretToken)) {
        throw new UnauthorizedClientException("Invalid X-Authorization");
    }
    if (!"SUCCESS".equals(clientCertificateVerification)) {
        throw new UnauthorizedClientException("Client certificate not verified");
    }
    idCardAuthService.checkCertificate(clientCertificate);

    if (httpMethod.equals(HttpMethod.GET)) {
        response.sendRedirect(frontendUrl + "?login=idCard");
    }
    return IdCardLoginResponse.success();
}
 

import org.springframework.security.oauth2.common.exceptions.UnauthorizedClientException; //导入依赖的package包/类
@ResponseBody
@Order(Ordered.HIGHEST_PRECEDENCE)
@ExceptionHandler(Throwable.class)
public final ResponseEntity<Result<String>> handleUncaughtException(final Throwable exception, final WebRequest
        request) {
    // adds information about encountered error to application log
    LOG.error(MessageHelper.getMessage("logger.error", request.getDescription(true)), exception);
    HttpStatus code = HttpStatus.OK;

    String message;
    if (exception instanceof FileNotFoundException) {
        // any details about real path of a resource should be normally prevented to send to the client
        message = MessageHelper.getMessage("error.io.not.found");
    } else if (exception instanceof DataAccessException) {
        // any details about data access error should be normally prevented to send to the client,
        // as its message can contain information about failed SQL query or/and database schema
        if (exception instanceof BadSqlGrammarException) {
            // for convenience we need to provide detailed information about occurred BadSqlGrammarException,
            // but it can be retrieved
            SQLException root = ((BadSqlGrammarException) exception).getSQLException();
            if (root.getNextException() != null) {
                LOG.error(MessageHelper.getMessage("logger.error.root.cause", request.getDescription(true)),
                    root.getNextException());
            }
            message = MessageHelper.getMessage("error.sql.bad.grammar");
        } else {
            message = MessageHelper.getMessage("error.sql");
        }
    } else if (exception instanceof UnauthorizedClientException) {
        message = exception.getMessage();
        code = HttpStatus.UNAUTHORIZED;
    } else {
        message = exception.getMessage();
    }

    return new ResponseEntity<>(Result.error(StringUtils.defaultString(StringUtils.trimToNull(message),
                                   MessageHelper.getMessage("error" + ".default"))), code);
}
 

import org.springframework.security.oauth2.common.exceptions.UnauthorizedClientException; //导入依赖的package包/类
@Transactional(propagation = Propagation.REQUIRES_NEW)
private void checkIfSSSUserInfoIsKnown(User user, String accessTokenValue) throws IOException {
    user = userService.findById(user.getId());
    UserSSSInfo userSSSInfo = userSSSInfoService.findByUser(user);
    // if the sss user id is already known to the server do nothing
    if (userSSSInfo == null) {
        // else authenticate towards the sss to retrieve the sss user id
        // and save that user id in the ldocs database
        SSSAuthDto sssAuthDto = null;
        try {
            sssAuthDto = sssClient.authenticate(accessTokenValue);
            String sssUserId = sssAuthDto.getUser();
            userSSSInfoService.addUserSSSInfo(user.getId(), sssUserId);
        } catch (UserNotAuthorizedException e) {
            e.printStackTrace();
            throw new UnauthorizedClientException("oidc token invalid");
        }
    }
}
 

import org.springframework.security.oauth2.common.exceptions.UnauthorizedClientException; //导入依赖的package包/类
/**
 * Refresh the access and refresh tokens if they are about to expire.
 *
 * @param httpServletRequest  the servlet request holding the current cookies. If no refresh cookie is present,
 *                            then we are out of luck.
 * @param httpServletResponse the servlet response that gets the new set-cookie headers, if they had to be
 *                            refreshed.
 * @return a new request to use downstream that contains the new cookies, if they had to be refreshed.
 * @throws InvalidTokenException if the tokens could not be refreshed.
 */
public HttpServletRequest refreshTokensIfExpiring(HttpServletRequest httpServletRequest, HttpServletResponse
    httpServletResponse) {
    HttpServletRequest newHttpServletRequest = httpServletRequest;
    //get access token from cookie
    Cookie accessTokenCookie = OAuth2CookieHelper.getAccessTokenCookie(httpServletRequest);
    if (mustRefreshToken(accessTokenCookie)) {        //we either have no access token, or it is expired, or it is about to expire
        //get the refresh token cookie and, if present, request new tokens
        Cookie refreshCookie = OAuth2CookieHelper.getRefreshTokenCookie(httpServletRequest);
        if (refreshCookie != null) {
            try {
                newHttpServletRequest = authenticationService.refreshToken(httpServletRequest, httpServletResponse, refreshCookie);
            } catch (HttpClientErrorException ex) {
                throw new UnauthorizedClientException("could not refresh OAuth2 token", ex);
            }
        } else if (accessTokenCookie != null) {
            log.warn("access token found, but no refresh token, stripping them all");
            OAuth2AccessToken token = tokenStore.readAccessToken(accessTokenCookie.getValue());
            if (token.isExpired()) {
                throw new InvalidTokenException("access token has expired, but there's no refresh token");
            }
        }
    }
    return newHttpServletRequest;
}
 

import org.springframework.security.oauth2.common.exceptions.UnauthorizedClientException; //导入依赖的package包/类
private void checkUpdatePermission(Person person) {
    if (SecurityContextHolder.getContext() == null) {
        throw new UnauthorizedClientException("Unauthorized");
    }
    Authentication auth = SecurityContextHolder.getContext().getAuthentication();
    BrowserUser user = (BrowserUser) auth.getPrincipal();

    if ((!person.getId().equals(user.getPerson().getId()) || person.getRole().equals(PersonRole.ROLE_ADMIN))
            && !user.getAuthorities().contains(new SimpleGrantedAuthority(PersonRole.ROLE_ADMIN.name()))) {
        throw new UnauthorizedClientException("Only admin can do this");
    }
}
 

import org.springframework.security.oauth2.common.exceptions.UnauthorizedClientException; //导入依赖的package包/类
@RequestMapping(method = RequestMethod.POST, value = "/document")
@Transactional(readOnly = false, rollbackFor = RuntimeException.class)
public Document createDocument(HttpServletRequest request,
                               @RequestBody Document document,
                               @RequestParam(defaultValue = "https://api.learning-layers.eu/o/oauth2") String issuer,
                               @RequestHeader(required = false) String Authorization,
                               @RequestParam(required = false) String discussionId, @RequestParam(required = false) String episodeId) throws IOException, ServletException {

    _authenticate(request, issuer, Authorization);

    // 3. Create the document in the database
    Document newDocument = documentService.save(document);
    if (document.getDescription() != null) {
        Attachment mainAttachment = newDocument.getAttachmentList().get(0);
        mainAttachment.setSource(document.getDescription().getBytes());
        //document.setDescription("");
        documentService.save(newDocument);

        if (episodeId != null) {
            DocumentSSSInfo documentSSSInfo = new DocumentSSSInfo();
            documentSSSInfo.setDocument(newDocument);
            documentSSSInfo.setEpisodeId(episodeId);
            documentSSSInfoService.addDocumentInfo(documentSSSInfo);
        }
    }

    // 4. Create the document in the SSS together with the link to the discussion
    // 4.1 Authenticate with the SSS
    // SSS auth Endpoint: http://test-ll.know-center.tugraz.at/layers.test/auth/auth/
    Authentication auth = SecurityContextHolder.getContext().getAuthentication();
    //if (auth instanceof AnonymousAuthenticationToken) {
    OIDCAuthenticationToken token = (OIDCAuthenticationToken) auth;
    SSSAuthDto sssAuthDto = null;
    try {
        sssAuthDto = sssClient.authenticate(token.getAccessTokenValue());
    } catch (UserNotAuthorizedException e) {
        request.logout();
        e.printStackTrace();
        throw new UnauthorizedClientException("oidc token invalid");
    }

    // 4.2 Create the according SSSLivingdocs entity
    try {
        SSSLivingdocsResponseDto sssLivingdocsResponseDto = sssClient.createDocument(document, discussionId, token.getAccessTokenValue());
    } catch (AuthenticationNotValidException eAuth) {
        throw new UserNotAuthorizedException();
    }

    // 4.3 Retrieve the list of email addresses that have access to the livingdocument in the SSS
    // TODO retrieve email addresses

    return newDocument;
    /*} else {
        throw new UnauthorizedClientException("anonymous user session");
    }*/
}