import com.nimbusds.oauth2.sdk.token.AccessToken; //导入依赖的package包/类
public IdTokenRequest(Subject subject, OIDCClientInformation client, Scope scope, Instant authenticationTime,
		ACR acr, AMR amr, SessionID sessionId, Nonce nonce, AccessToken accessToken, AuthorizationCode code) {
	Objects.requireNonNull(subject, "subject must not be null");
	Objects.requireNonNull(client, "client must not be null");
	Objects.requireNonNull(scope, "scope must not be null");
	Objects.requireNonNull(authenticationTime, "authenticationTime must not be null");
	Objects.requireNonNull(acr, "acr must not be null");
	Objects.requireNonNull(amr, "amr must not be null");
	if (!scope.contains(OIDCScopeValue.OPENID)) {
		throw new IllegalArgumentException("Scope '" + OIDCScopeValue.OPENID + "' is required");
	}
	this.subject = subject;
	this.client = client;
	this.scope = scope;
	this.authenticationTime = authenticationTime;
	this.acr = acr;
	this.amr = amr;
	this.sessionId = sessionId;
	this.nonce = nonce;
	this.accessToken = accessToken;
	this.code = code;
}
 

import com.nimbusds.oauth2.sdk.token.AccessToken; //导入依赖的package包/类
@Override
public Tokens grant(TokenRequest tokenRequest) throws GeneralException {
	if (!(tokenRequest.getAuthorizationGrant() instanceof RefreshTokenGrant)) {
		throw new GeneralException(OAuth2Error.UNSUPPORTED_GRANT_TYPE);
	}

	RefreshToken refreshToken = ((RefreshTokenGrant) tokenRequest.getAuthorizationGrant()).getRefreshToken();
	RefreshTokenContext context = this.refreshTokenStore.load(refreshToken);

	Subject subject = context.getSubject();
	ClientID clientId = context.getClientId();
	Scope originalScope = context.getScope();

	OIDCClientInformation client = this.clientRepository.findById(clientId);
	AccessTokenRequest accessTokenRequest = new AccessTokenRequest(subject, client, originalScope);
	AccessToken accessToken = this.tokenService.createAccessToken(accessTokenRequest);
	RefreshToken updatedRefreshToken = null;

	if (this.updateRefreshToken) {
		this.refreshTokenStore.revoke(refreshToken);
		RefreshTokenRequest refreshTokenRequest = new RefreshTokenRequest(subject, clientId, originalScope);
		updatedRefreshToken = this.tokenService.createRefreshToken(refreshTokenRequest);
	}

	return new Tokens(accessToken, updatedRefreshToken);
}
 

import com.nimbusds.oauth2.sdk.token.AccessToken; //导入依赖的package包/类
@Override
public Tokens grant(TokenRequest tokenRequest) throws GeneralException {
	if (!(tokenRequest.getAuthorizationGrant() instanceof ClientCredentialsGrant)) {
		throw new GeneralException(OAuth2Error.UNSUPPORTED_GRANT_TYPE);
	}

	ClientID clientId = tokenRequest.getClientAuthentication().getClientID();
	Subject subject = new Subject(clientId.getValue());

	OIDCClientInformation client = this.clientRepository.findById(clientId);
	Scope scope = this.scopeResolver.resolve(subject, tokenRequest.getScope(), client.getOIDCMetadata());
	AccessTokenRequest accessTokenRequest = new AccessTokenRequest(subject, client, scope);
	AccessToken accessToken = this.tokenService.createAccessToken(accessTokenRequest);

	return new Tokens(accessToken, null);
}
 

import com.nimbusds.oauth2.sdk.token.AccessToken; //导入依赖的package包/类
private OIDCClientInformation resolveAndValidateClient(ClientID clientId, ProtectedResourceRequest request)
		throws GeneralException {
	OIDCClientInformation client = this.clientRepository.findById(clientId);

	if (client != null) {
		AccessToken requestAccessToken = request.getAccessToken();
		BearerAccessToken registrationAccessToken = client.getRegistrationAccessToken();
		BearerAccessToken apiAccessToken = this.apiAccessToken;

		if (requestAccessToken.equals(registrationAccessToken) || requestAccessToken.equals(apiAccessToken)) {
			return client;
		}
	}

	throw new GeneralException(BearerTokenError.INVALID_TOKEN);
}
 

import com.nimbusds.oauth2.sdk.token.AccessToken; //导入依赖的package包/类
@Override
protected UserInfoSuccessResponse userInfoRequestInt(UserInfoRequest userReq, HttpServletResponse resp)
		throws IOException {
	// extract values from request
	AccessToken at = userReq.getAccessToken();

	// get values from honest OP for comparison
	AccessToken refAt = (AccessToken) stepCtx.get(OPContextConstants.HONEST_ACCESSTOKEN);

	// compare values
	Object fo = stepCtx.get(OPContextConstants.USERINFO_INFORMATIONLEAK_FUTURE);
	CompletableFuture<TestStepResult> f = (CompletableFuture<TestStepResult>) fo;
	if (f != null) {
		if (refAt != null && refAt.equals(at)) {
			logger.log("Detected Honest AccessToken in Evil OP.");
			f.complete(TestStepResult.FAIL);
		} else if (at != null) {
			logger.log("Detected unknown AccessToken in Evil OP.");
			f.complete(TestStepResult.FAIL);
		}
	}

	return super.userInfoRequestInt(userReq, resp);
}
 

import com.nimbusds.oauth2.sdk.token.AccessToken; //导入依赖的package包/类
@Nullable
protected UserInfoSuccessResponse userInfoRequestInt(UserInfoRequest userReq, HttpServletResponse resp)
		throws IOException {
	AccessToken at = userReq.getAccessToken();
	if (at == null) {
		UserInfoErrorResponse errorResp = new UserInfoErrorResponse(BearerTokenError.MISSING_TOKEN);
		sendErrorResponse("User Info", errorResp, resp);
		return null;
	}
	//AccessTokenHash atHash = AccessTokenHash.compute(at, JWSAlgorithm.RS256);

	UserInfo ui = getUserInfo();

	UserInfoSuccessResponse uiResp = new UserInfoSuccessResponse(ui);
	return uiResp;
}
 

import com.nimbusds.oauth2.sdk.token.AccessToken; //导入依赖的package包/类
protected AuthenticationMechanismOutcome complete(JWTClaimsSet claims, AccessToken accessToken, String returnURL, HttpServerExchange exchange, boolean redirect) throws Exception {
	OIDCPrincipal principal = new OIDCPrincipalExt(claims, accessToken);
	Account account = new AccountImpl(principal);
	account = identityManager.verify(account);
	if (account == null) {
		LOG.warning(String.format("OIDC subject %s not found in identity manager", principal.getName()));
		exchange.getSecurityContext().authenticationFailed("OIDC subject not found in identity manager", mechanismName);
		OIDCContext oidcContext = exchange.getAttachment(OIDCContext.ATTACHMENT_KEY);
		oidcContext.setError(true);
		return AuthenticationMechanismOutcome.NOT_AUTHENTICATED;
	}
	exchange.getSecurityContext().authenticationComplete(account, mechanismName, true);
	if (redirect) {
		exchange.getResponseHeaders().put(Headers.LOCATION, returnURL != null && !returnURL.isEmpty() ? returnURL : "/");
		exchange.setStatusCode(HttpServletResponse.SC_FOUND);
		exchange.endExchange();
	}
	LOG.fine("authentificated " + principal);
	return AuthenticationMechanismOutcome.AUTHENTICATED;
}
 

import com.nimbusds.oauth2.sdk.token.AccessToken; //导入依赖的package包/类
/**
 * TODO
 * To create a mock access token. We do not use it for anything yet. 
 * 
 * @return mock access token.
 */
private AccessToken getMockAccessToken() {
    if (getAuthenticationRequest().getResponseType().contains(ResponseType.Value.TOKEN)){
        return new BearerAccessToken();
    }
    return null;
}
 

import com.nimbusds.oauth2.sdk.token.AccessToken; //导入依赖的package包/类
@Override
public Tokens grant(TokenRequest tokenRequest) throws GeneralException {
	if (!(tokenRequest.getAuthorizationGrant() instanceof ResourceOwnerPasswordCredentialsGrant)) {
		throw new GeneralException(OAuth2Error.UNSUPPORTED_GRANT_TYPE);
	}

	Scope requestedScope = tokenRequest.getScope();
	if (!requestedScope.contains(OIDCScopeValue.OPENID)) {
		throw new GeneralException(
				OAuth2Error.INVALID_SCOPE.setDescription("The scope must include an \"openid\" value"));
	}

	Subject subject = this.passwordAuthenticationHandler
			.authenticate((ResourceOwnerPasswordCredentialsGrant) tokenRequest.getAuthorizationGrant());
	ClientID clientId = tokenRequest.getClientAuthentication().getClientID();

	OIDCClientInformation client = this.clientRepository.findById(clientId);
	Scope scope = this.scopeResolver.resolve(subject, requestedScope, client.getOIDCMetadata());
	AccessTokenRequest accessTokenRequest = new AccessTokenRequest(subject, client, scope);
	AccessToken accessToken = this.tokenService.createAccessToken(accessTokenRequest);
	RefreshToken refreshToken = null;

	if (client.getOIDCMetadata().getGrantTypes().contains(GrantType.REFRESH_TOKEN)) {
		RefreshTokenRequest refreshTokenRequest = new RefreshTokenRequest(subject, clientId, scope);
		refreshToken = this.tokenService.createRefreshToken(refreshTokenRequest);
	}

	return new Tokens(accessToken, refreshToken);
}
 

import com.nimbusds.oauth2.sdk.token.AccessToken; //导入依赖的package包/类
private void validateAccessToken(AccessToken requestAccessToken) throws GeneralException {
	BearerAccessToken apiAccessToken = this.apiAccessToken;

	if (requestAccessToken == null || !requestAccessToken.equals(apiAccessToken)) {
		throw new GeneralException(BearerTokenError.INVALID_TOKEN);
	}
}
 

import com.nimbusds.oauth2.sdk.token.AccessToken; //导入依赖的package包/类
private AuthenticationSuccessResponse handleImplicitFlow(AuthenticationRequest authRequest,
		OIDCClientInformation client, HttpServletRequest request, Subject subject) throws GeneralException {
	ResponseType responseType = authRequest.getResponseType();
	ResponseMode responseMode = authRequest.impliedResponseMode();
	URI redirectUri = authRequest.getRedirectionURI();
	Scope requestedScope = authRequest.getScope();
	State state = authRequest.getState();
	Nonce nonce = authRequest.getNonce();

	Instant authenticationTime = Instant.ofEpochMilli(request.getSession().getCreationTime());
	ACR acr = this.acr;
	AMR amr = AMR.PWD;
	SessionID sessionId = new SessionID(request.getSession().getId());
	State sessionState = this.sessionManagementEnabled ? State.parse(sessionId.getValue()) : null;

	Scope scope = this.scopeResolver.resolve(subject, requestedScope, client.getOIDCMetadata());
	AccessToken accessToken = null;

	if (responseType.contains(ResponseType.Value.TOKEN)) {
		AccessTokenRequest accessTokenRequest = new AccessTokenRequest(subject, client, scope);
		accessToken = this.tokenService.createAccessToken(accessTokenRequest);
	}

	IdTokenRequest idTokenRequest = new IdTokenRequest(subject, client, scope, authenticationTime, acr, amr,
			sessionId, nonce, accessToken, null);
	JWT idToken = this.tokenService.createIdToken(idTokenRequest);

	return new AuthenticationSuccessResponse(redirectUri, null, idToken, accessToken, state, sessionState,
			responseMode);
}
 

import com.nimbusds.oauth2.sdk.token.AccessToken; //导入依赖的package包/类
private AuthenticationSuccessResponse handleHybridFlow(AuthenticationRequest authRequest,
		OIDCClientInformation client, HttpServletRequest request, Subject subject) throws GeneralException {
	ResponseType responseType = authRequest.getResponseType();
	ResponseMode responseMode = authRequest.impliedResponseMode();
	ClientID clientId = authRequest.getClientID();
	URI redirectUri = authRequest.getRedirectionURI();
	Scope requestedScope = authRequest.getScope();
	State state = authRequest.getState();
	CodeChallenge codeChallenge = authRequest.getCodeChallenge();
	CodeChallengeMethod codeChallengeMethod = authRequest.getCodeChallengeMethod();
	Nonce nonce = authRequest.getNonce();

	Instant authenticationTime = Instant.ofEpochMilli(request.getSession().getCreationTime());
	ACR acr = this.acr;
	AMR amr = AMR.PWD;
	SessionID sessionId = new SessionID(request.getSession().getId());
	State sessionState = this.sessionManagementEnabled ? State.parse(sessionId.getValue()) : null;

	Scope scope = this.scopeResolver.resolve(subject, requestedScope, client.getOIDCMetadata());
	AuthorizationCodeContext context = new AuthorizationCodeContext(subject, clientId, redirectUri, scope,
			authenticationTime, acr, amr, sessionId, codeChallenge, codeChallengeMethod, nonce);
	AuthorizationCode code = this.authorizationCodeService.create(context);
	AccessToken accessToken = null;

	if (responseType.contains(ResponseType.Value.TOKEN)) {
		AccessTokenRequest accessTokenRequest = new AccessTokenRequest(subject, client, scope);
		accessToken = this.tokenService.createAccessToken(accessTokenRequest);
	}

	JWT idToken = null;

	if (responseType.contains(OIDCResponseTypeValue.ID_TOKEN)) {
		IdTokenRequest idTokenRequest = new IdTokenRequest(subject, client, scope, authenticationTime, acr, amr,
				sessionId, nonce, accessToken, code);
		idToken = this.tokenService.createIdToken(idTokenRequest);
	}

	return new AuthenticationSuccessResponse(redirectUri, code, idToken, accessToken, state, sessionState,
			responseMode);
}
 

import com.nimbusds.oauth2.sdk.token.AccessToken; //导入依赖的package包/类
@Nullable
protected OIDCTokenResponse tokenRequestInt(TokenRequest tokenReq, HttpServletResponse resp)
		throws GeneralSecurityException, JOSEException, ParseException {
	ClientAuthentication auth = tokenReq.getClientAuthentication();
	ClientID clientId = auth != null ? auth.getClientID() : tokenReq.getClientID();
	AuthorizationGrant grant = tokenReq.getAuthorizationGrant();
	CodeHash cHash = null;
	if (grant != null && grant.getType() == GrantType.AUTHORIZATION_CODE) {
		AuthorizationCodeGrant codeGrant = (AuthorizationCodeGrant) grant;
		cHash = CodeHash.compute(codeGrant.getAuthorizationCode(), JWSAlgorithm.RS256);
	}

	AccessToken at = new BearerAccessToken();
	AccessTokenHash atHash = AccessTokenHash.compute(at, JWSAlgorithm.RS256);
	// save access token if honest op
	if (type == OPType.HONEST) {
		stepCtx.put(OPContextConstants.HONEST_ACCESSTOKEN, at);
	}

	Nonce nonce = (Nonce) stepCtx.get(OPContextConstants.AUTH_REQ_NONCE);

	JWT idToken = getIdToken(clientId, nonce, atHash, cHash);

	OIDCTokens tokens = new OIDCTokens(idToken, at, null);
	OIDCTokenResponse tokenRes = new OIDCTokenResponse(tokens);

	return tokenRes;
}
 

import com.nimbusds.oauth2.sdk.token.AccessToken; //导入依赖的package包/类
protected AuthenticationMechanismOutcome processOIDCAuthResponse(HttpServerExchange exchange) {
	try {
		AuthenticationResponse authResp = authenticate(exchange);

		if (authResp instanceof AuthenticationErrorResponse) {
			ErrorObject error = ((AuthenticationErrorResponse) authResp).getErrorObject();
			throw new IllegalStateException(String.format("OIDC Authentication error: code %s description: %s", error.getCode(), error.getDescription()));
		}

		AuthenticationSuccessResponse successResponse = (AuthenticationSuccessResponse) authResp;

		// could store returnURL/state
		// in session but state is encrypted
		State state = successResponse.getState();
		String returnURL = restoreState(state != null ? state.getValue() : null, exchange);

		AuthorizationCode authCode = successResponse.getAuthorizationCode();
		JWT idToken = successResponse.getIDToken();
		AccessToken accessToken = successResponse.getAccessToken();

		if (idToken == null && authCode != null) {
			OIDCTokenResponse tokenResponse = fetchToken(authCode, exchange);
			idToken = tokenResponse.getOIDCTokens().getIDToken();
			accessToken = tokenResponse.getOIDCTokens().getAccessToken();
		}
		validateToken(idToken, exchange, true);
		return complete(idToken.getJWTClaimsSet(), accessToken, returnURL, exchange, true);

	} catch (Exception e) {
		LOG.log(Level.SEVERE, "", e);
		OIDCContext oidcContext = exchange.getAttachment(OIDCContext.ATTACHMENT_KEY);
		oidcContext.setError(true);
		exchange.getSecurityContext().authenticationFailed("OIDC auth response processing failed", mechanismName);
		return AuthenticationMechanismOutcome.NOT_ATTEMPTED;
	}

}
 

import com.nimbusds.oauth2.sdk.token.AccessToken; //导入依赖的package包/类
@Override
public Response handle(HTTPRequest httpRequest, OIDCResourceReference reference) throws Exception
{
    // Parse the request
    UserInfoRequest request = UserInfoRequest.parse(httpRequest);

    // Get the token associated to the user
    AccessToken accessToken = request.getAccessToken();

    // UserInfoSuccessResponse
    return null;
}
 

import com.nimbusds.oauth2.sdk.token.AccessToken; //导入依赖的package包/类
public OIDCConsent getConsent(AccessToken accessToken) throws QueryException, XWikiException
{
    Map<String, String> entries = new HashMap<>();

    entries.put(OIDCConsent.FIELD_ACCESSTOKEN, accessToken.getValue());

    return getConsent(entries);
}
 

import com.nimbusds.oauth2.sdk.token.AccessToken; //导入依赖的package包/类
public void setAccessToken(AccessToken accessToken)
{
    if (accessToken == null) {
        removeField(FIELD_ACCESSTOKEN);
    } else {
        setStringValue(FIELD_ACCESSTOKEN, accessToken.getValue());
    }
}
 

import com.nimbusds.oauth2.sdk.token.AccessToken; //导入依赖的package包/类
/**
 * Single entry point for all login functionalities.
 * 
 * @param type login type (maps to a specific configuration file)
 * @param request
 * @param response
 * @param session
 * @throws OSDIConfigurationException
 */
@RequestMapping(value = "/login/{type}", method = RequestMethod.GET)
public void login(@PathVariable String type, HttpServletRequest request, HttpServletResponse response,
		HttpSession session) throws OSDIConfigurationException {
	// get configuration for the requested type
	OSDIConfigurationKVP configuration = (OSDIConfigurationKVP)loadConfiguration(request); 
	if(request.getParameter("code") == null || request.getParameter("code").trim().isEmpty()) {
		// 1st step: called by the app login page
		oAuthService.login(configuration, request, response, session);
	} else {
		// 2nd step: OAuth 2.0 service callback
		String state = request.getParameter("state");
		// check 
		if (session.getAttribute("state") == null || !state.equals(request.getSession().getAttribute("state"))) {
            throw new IllegalArgumentException("Login failed");
		} else {
			// retrieve access token
			AccessToken token = oAuthService.getToken(configuration, request.getParameter("code"));
			if(token != null) {
				// redirect back to the client
				oAuthService.returnToClient(configuration, response, session, token);
			} else {
				throw new IllegalArgumentException("Login failed");
			}
		}
	}
	
}
 

import com.nimbusds.oauth2.sdk.token.AccessToken; //导入依赖的package包/类
@Override
public void returnToClient(OSDIConfigurationKVP configuration, HttpServletResponse response, HttpSession session, AccessToken token) {
	try {
		response.sendRedirect((String)session.getAttribute("returnPage") + "?token=" + token.toJSONString());
	} catch (IOException e) {
		throw new IllegalArgumentException("Error calling application page");
	}
	
}
 

import com.nimbusds.oauth2.sdk.token.AccessToken; //导入依赖的package包/类
@Override
public AccessToken createAccessToken(AccessTokenRequest accessTokenRequest) {
	Instant now = Instant.now();

	Subject subject = accessTokenRequest.getSubject();
	OIDCClientInformation client = accessTokenRequest.getClient();
	Scope scope = accessTokenRequest.getScope();

	Set<Audience> audiences = new LinkedHashSet<>();
	audiences.add(new Audience(this.issuer));

	for (Scope.Value value : scope) {
		String resource = this.resourceScopes.get(value);

		if (resource != null) {
			audiences.add(new Audience(resource));
		}
	}

	Date expirationTime = Date.from(now.plus(this.accessTokenLifetime));
	Date issueTime = Date.from(now);
	JWTID jwtId = new JWTID(UUID.randomUUID().toString());
	UserInfo userInfo = this.claimSource.load(subject, new HashSet<>(this.accessTokenSubjectClaims));
	userInfo.setClaim(this.accessTokenScopeClaim, scope);
	userInfo.setClaim(this.accessTokenClientIdClaim, client.getID());

	try {
		JWTAssertionDetails details = new JWTAssertionDetails(this.issuer, userInfo.getSubject(),
				new ArrayList<>(audiences), expirationTime, issueTime, issueTime, jwtId, userInfo.toJSONObject());
		SignedJWT accessToken;

		if (JWSAlgorithm.Family.HMAC_SHA.contains(this.accessTokenJwsAlgorithm)) {
			Secret secret = client.getSecret();

			accessToken = JWTAssertionFactory.create(details, this.accessTokenJwsAlgorithm, secret);
		}
		else if (JWSAlgorithm.Family.RSA.contains(this.accessTokenJwsAlgorithm)) {
			RSAKey rsaKey = (RSAKey) resolveJwk(this.accessTokenJwsAlgorithm);

			accessToken = JWTAssertionFactory.create(details, this.accessTokenJwsAlgorithm,
					rsaKey.toRSAPrivateKey(), rsaKey.getKeyID(), jcaProvider);
		}
		else if (JWSAlgorithm.Family.EC.contains(this.accessTokenJwsAlgorithm)) {
			ECKey ecKey = (ECKey) resolveJwk(this.accessTokenJwsAlgorithm);

			accessToken = JWTAssertionFactory.create(details, this.accessTokenJwsAlgorithm, ecKey.toECPrivateKey(),
					ecKey.getKeyID(), jcaProvider);
		}
		else {
			throw new KeyException("Unsupported algorithm: " + this.accessTokenJwsAlgorithm);
		}

		return new BearerAccessToken(accessToken.serialize(), this.accessTokenLifetime.getSeconds(), scope);
	}
	catch (JOSEException e) {
		throw new RuntimeException(e);
	}
}