Skip to content

Commit 29ec962

Browse files
enricovianelloenricovianello
committed
Removed AT expiration in case of infinite token
Bump version to 1.3.6-cnaf-20231129
1 parent da282b8 commit 29ec962

File tree

8 files changed

+91
-84
lines changed

8 files changed

+91
-84
lines changed

‎Jenkinsfile‎

Lines changed: 1 addition & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,7 @@ pipeline {
1515

1616
stage('deploy') {
1717
steps {
18-
sh "mvn -U -B clean deploy"
18+
sh "mvn -U -B clean package deploy"
1919
}
2020
}
2121

@@ -27,18 +27,4 @@ pipeline {
2727
}
2828
}
2929
}
30-
31-
post {
32-
failure {
33-
slackSend color: 'danger', message: "${env.JOB_NAME} - #${env.BUILD_NUMBER} Failure (<${env.BUILD_URL}|Open>)"
34-
}
35-
36-
changed {
37-
script{
38-
if('SUCCESS'.equals(currentBuild.result)) {
39-
slackSend color: 'good', message: "${env.JOB_NAME} - #${env.BUILD_NUMBER} Back to normal (<${env.BUILD_URL}|Open>)"
40-
}
41-
}
42-
}
43-
}
4430
}

‎openid-connect-client/pom.xml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -22,7 +22,7 @@
2222
<parent>
2323
<artifactId>openid-connect-parent</artifactId>
2424
<groupId>org.mitre</groupId>
25-
<version>1.3.6.cnaf-20231113</version>
25+
<version>1.3.6.cnaf-20231129</version>
2626
<relativePath>..</relativePath>
2727
</parent>
2828
<artifactId>openid-connect-client</artifactId>

‎openid-connect-common/pom.xml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -22,7 +22,7 @@
2222
<parent>
2323
<artifactId>openid-connect-parent</artifactId>
2424
<groupId>org.mitre</groupId>
25-
<version>1.3.6.cnaf-20231113</version>
25+
<version>1.3.6.cnaf-20231129</version>
2626
<relativePath>..</relativePath>
2727
</parent>
2828
<artifactId>openid-connect-common</artifactId>

‎openid-connect-common/src/main/java/org/mitre/oauth2/service/OAuth2TokenEntityService.java‎

Lines changed: 21 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -27,37 +27,40 @@
2727
import org.springframework.security.oauth2.provider.token.AuthorizationServerTokenServices;
2828
import org.springframework.security.oauth2.provider.token.ResourceServerTokenServices;
2929

30-
public interface OAuth2TokenEntityService extends AuthorizationServerTokenServices, ResourceServerTokenServices {
30+
@SuppressWarnings("deprecation")
31+
public interface OAuth2TokenEntityService
32+
extends AuthorizationServerTokenServices, ResourceServerTokenServices {
3133

32-
@Override
33-
public OAuth2AccessTokenEntity readAccessToken(String accessTokenValue);
34+
@Override
35+
public OAuth2AccessTokenEntity readAccessToken(String accessTokenValue);
3436

35-
public OAuth2RefreshTokenEntity getRefreshToken(String refreshTokenValue);
37+
public OAuth2RefreshTokenEntity getRefreshToken(String refreshTokenValue);
3638

37-
public void revokeRefreshToken(OAuth2RefreshTokenEntity refreshToken);
39+
public void revokeRefreshToken(OAuth2RefreshTokenEntity refreshToken);
3840

39-
public void revokeAccessToken(OAuth2AccessTokenEntity accessToken);
41+
public void revokeAccessToken(OAuth2AccessTokenEntity accessToken);
4042

41-
public List<OAuth2AccessTokenEntity> getAccessTokensForClient(ClientDetailsEntity client);
43+
public List<OAuth2AccessTokenEntity> getAccessTokensForClient(ClientDetailsEntity client);
4244

43-
public List<OAuth2RefreshTokenEntity> getRefreshTokensForClient(ClientDetailsEntity client);
45+
public List<OAuth2RefreshTokenEntity> getRefreshTokensForClient(ClientDetailsEntity client);
4446

45-
public void clearExpiredTokens();
47+
public void clearExpiredTokens();
4648

47-
public OAuth2AccessTokenEntity saveAccessToken(OAuth2AccessTokenEntity accessToken);
49+
public OAuth2AccessTokenEntity saveAccessToken(OAuth2AccessTokenEntity accessToken);
4850

49-
public OAuth2RefreshTokenEntity saveRefreshToken(OAuth2RefreshTokenEntity refreshToken);
51+
public OAuth2RefreshTokenEntity saveRefreshToken(OAuth2RefreshTokenEntity refreshToken);
5052

51-
@Override
52-
public OAuth2AccessTokenEntity getAccessToken(OAuth2Authentication authentication);
53+
@Override
54+
public OAuth2AccessTokenEntity getAccessToken(OAuth2Authentication authentication);
5355

54-
public OAuth2AccessTokenEntity getAccessTokenById(Long id);
56+
public OAuth2AccessTokenEntity getAccessTokenById(Long id);
5557

56-
public OAuth2RefreshTokenEntity getRefreshTokenById(Long id);
58+
public OAuth2RefreshTokenEntity getRefreshTokenById(Long id);
5759

58-
public Set<OAuth2AccessTokenEntity> getAllAccessTokensForUser(String name);
60+
public Set<OAuth2AccessTokenEntity> getAllAccessTokensForUser(String name);
5961

60-
public Set<OAuth2RefreshTokenEntity> getAllRefreshTokensForUser(String name);
62+
public Set<OAuth2RefreshTokenEntity> getAllRefreshTokensForUser(String name);
63+
64+
public OAuth2AccessTokenEntity getRegistrationAccessTokenForClient(ClientDetailsEntity client);
6165

62-
public OAuth2AccessTokenEntity getRegistrationAccessTokenForClient(ClientDetailsEntity client);
6366
}

‎openid-connect-server/pom.xml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -23,7 +23,7 @@
2323
<parent>
2424
<groupId>org.mitre</groupId>
2525
<artifactId>openid-connect-parent</artifactId>
26-
<version>1.3.6.cnaf-20231113</version>
26+
<version>1.3.6.cnaf-20231129</version>
2727
<relativePath>..</relativePath>
2828
</parent>
2929
<build>

‎openid-connect-server/src/main/java/org/mitre/oauth2/service/impl/DefaultOAuth2ProviderTokenService.java‎

Lines changed: 12 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -75,6 +75,7 @@
7575
* @author jricher
7676
*
7777
*/
78+
@SuppressWarnings("deprecation")
7879
@Service("defaultOAuth2ProviderTokenService")
7980
public class DefaultOAuth2ProviderTokenService implements OAuth2TokenEntityService {
8081

@@ -163,7 +164,8 @@ private OAuth2RefreshTokenEntity clearExpiredRefreshToken(OAuth2RefreshTokenEnti
163164
@Override
164165
@Transactional(value = "defaultTransactionManager")
165166
public OAuth2AccessTokenEntity createAccessToken(OAuth2Authentication authentication)
166-
throws AuthenticationException, InvalidClientException {
167+
throws AuthenticationException {
168+
167169
if (authentication != null && authentication.getOAuth2Request() != null) {
168170
// look up our client
169171
OAuth2Request request = authentication.getOAuth2Request();
@@ -220,13 +222,12 @@ public OAuth2AccessTokenEntity createAccessToken(OAuth2Authentication authentica
220222
token.setScope(scopeService.toStrings(scopes));
221223

222224
// make it always expire
223-
if (client.getAccessTokenValiditySeconds() != null && client.getAccessTokenValiditySeconds() > 0) {
225+
if (client.getAccessTokenValiditySeconds() != null
226+
&& client.getAccessTokenValiditySeconds() > 0) {
224227
Date expiration =
225228
new Date(System.currentTimeMillis() + (client.getAccessTokenValiditySeconds() * 1000L));
226229

227230
token.setExpiration(expiration);
228-
} else {
229-
token.setExpiration(new Date(System.currentTimeMillis()));
230231
}
231232

232233
// attach the authorization so that we can look it up later
@@ -263,9 +264,7 @@ public OAuth2AccessTokenEntity createAccessToken(OAuth2Authentication authentica
263264
OAuth2AccessTokenEntity savedToken = saveAccessToken(enhancedToken);
264265

265266
if (savedToken.getRefreshToken() != null) {
266-
tokenRepository.saveRefreshToken(savedToken.getRefreshToken()); // make sure we save any
267-
// changes that might have
268-
// been enhanced
267+
tokenRepository.saveRefreshToken(savedToken.getRefreshToken());
269268
}
270269

271270
return savedToken;
@@ -281,8 +280,9 @@ private OAuth2RefreshTokenEntity createRefreshToken(ClientDetailsEntity client,
281280
JWTClaimsSet.Builder refreshClaims = new JWTClaimsSet.Builder();
282281

283282

284-
// make it expire if necessary
285-
if (client.getRefreshTokenValiditySeconds() != null) {
283+
// set RT's expiration value, otherwise leaves null
284+
if (client.getRefreshTokenValiditySeconds() != null
285+
&& client.getRefreshTokenValiditySeconds() > 0) {
286286
Date expiration =
287287
new Date(System.currentTimeMillis() + (client.getRefreshTokenValiditySeconds() * 1000L));
288288
refreshToken.setExpiration(expiration);
@@ -386,7 +386,8 @@ public OAuth2AccessTokenEntity refreshAccessToken(String refreshTokenValue,
386386

387387
token.setClient(client);
388388

389-
if (client.getAccessTokenValiditySeconds() != null) {
389+
if (client.getAccessTokenValiditySeconds() != null
390+
&& client.getAccessTokenValiditySeconds() > 0) {
390391
Date expiration =
391392
new Date(System.currentTimeMillis() + (client.getAccessTokenValiditySeconds() * 1000L));
392393
token.setExpiration(expiration);
@@ -609,4 +610,5 @@ public OAuth2AccessTokenEntity getRegistrationAccessTokenForClient(ClientDetails
609610

610611
return null;
611612
}
613+
612614
}

‎openid-connect-server/src/test/java/org/mitre/oauth2/service/impl/TestDefaultOAuth2ProviderTokenService.java‎

Lines changed: 53 additions & 37 deletions
Original file line numberDiff line numberDiff line change
@@ -29,7 +29,7 @@
2929
import static org.junit.Assert.fail;
3030
import static org.mockito.AdditionalAnswers.returnsFirstArg;
3131
import static org.mockito.Matchers.any;
32-
import static org.mockito.Matchers.anySet;
32+
import static org.mockito.Matchers.anySetOf;
3333
import static org.mockito.Matchers.anyString;
3434
import static org.mockito.Mockito.atLeastOnce;
3535
import static org.mockito.Mockito.mock;
@@ -54,6 +54,7 @@
5454
import org.mitre.oauth2.repository.OAuth2TokenRepository;
5555
import org.mitre.oauth2.service.ClientDetailsEntityService;
5656
import org.mitre.oauth2.service.SystemScopeService;
57+
import org.mitre.openid.connect.service.ApprovedSiteService;
5758
import org.mockito.InjectMocks;
5859
import org.mockito.Matchers;
5960
import org.mockito.Mock;
@@ -75,18 +76,20 @@
7576
*
7677
*/
7778
@RunWith(MockitoJUnitRunner.class)
79+
@SuppressWarnings("deprecation")
7880
public class TestDefaultOAuth2ProviderTokenService {
7981

8082
// Grace period for time-sensitive tests.
8183
private static final long DELTA = 100L;
8284

85+
private static final String clientId = "test_client";
86+
private static final String badClientId = "bad_client";
87+
private static final Set<String> scope =
88+
newHashSet("openid", "profile", "email", "offline_access");
89+
8390
// Test Fixture:
84-
private OAuth2Authentication authentication;
8591
private ClientDetailsEntity client;
8692
private ClientDetailsEntity badClient;
87-
private String clientId = "test_client";
88-
private String badClientId = "bad_client";
89-
private Set<String> scope = newHashSet("openid", "profile", "email", "offline_access");
9093
private OAuth2RefreshTokenEntity refreshToken;
9194
private OAuth2AccessTokenEntity accessToken;
9295
private String refreshTokenValue = "refresh_token_value";
@@ -99,6 +102,9 @@ public class TestDefaultOAuth2ProviderTokenService {
99102
private AuthenticationHolderEntity storedAuthHolder;
100103
private Set<String> storedScope;
101104

105+
@Mock
106+
private OAuth2Authentication authentication;
107+
102108
@Mock
103109
private OAuth2TokenRepository tokenRepository;
104110

@@ -114,6 +120,9 @@ public class TestDefaultOAuth2ProviderTokenService {
114120
@Mock
115121
private SystemScopeService scopeService;
116122

123+
@Mock
124+
private ApprovedSiteService approvedSiteService;
125+
117126
@InjectMocks
118127
private DefaultOAuth2ProviderTokenService service;
119128

@@ -122,9 +131,10 @@ public class TestDefaultOAuth2ProviderTokenService {
122131
*/
123132
@Before
124133
public void prepare() {
125-
reset(tokenRepository, authenticationHolderRepository, clientDetailsService, tokenEnhancer);
126134

127-
authentication = Mockito.mock(OAuth2Authentication.class);
135+
reset(tokenRepository, authenticationHolderRepository, clientDetailsService, tokenEnhancer,
136+
scopeService, approvedSiteService, authentication);
137+
128138
OAuth2Request clientAuth =
129139
new OAuth2Request(null, clientId, null, true, scope, null, null, null, null);
130140
when(authentication.getOAuth2Request()).thenReturn(clientAuth);
@@ -165,21 +175,24 @@ public void prepare() {
165175
when(authenticationHolderRepository.save(any(AuthenticationHolderEntity.class)))
166176
.thenReturn(storedAuthHolder);
167177

168-
when(scopeService.fromStrings(anySet())).thenAnswer(new Answer<Set<SystemScope>>() {
169-
@Override
170-
public Set<SystemScope> answer(InvocationOnMock invocation) throws Throwable {
171-
Object[] args = invocation.getArguments();
172-
Set<String> input = (Set<String>) args[0];
173-
Set<SystemScope> output = new HashSet<>();
174-
for (String scope : input) {
175-
output.add(new SystemScope(scope));
178+
when(scopeService.fromStrings(anySetOf(String.class)))
179+
.thenAnswer(new Answer<Set<SystemScope>>() {
180+
@Override
181+
@SuppressWarnings("unchecked")
182+
public Set<SystemScope> answer(InvocationOnMock invocation) throws Throwable {
183+
Object[] args = invocation.getArguments();
184+
Set<String> input = (Set<String>) args[0];
185+
Set<SystemScope> output = new HashSet<>();
186+
for (String scope : input) {
187+
output.add(new SystemScope(scope));
188+
}
189+
return output;
176190
}
177-
return output;
178-
}
179-
});
191+
});
180192

181-
when(scopeService.toStrings(anySet())).thenAnswer(new Answer<Set<String>>() {
193+
when(scopeService.toStrings(anySetOf(SystemScope.class))).thenAnswer(new Answer<Set<String>>() {
182194
@Override
195+
@SuppressWarnings("unchecked")
183196
public Set<String> answer(InvocationOnMock invocation) throws Throwable {
184197
Object[] args = invocation.getArguments();
185198
Set<SystemScope> input = (Set<SystemScope>) args[0];
@@ -191,19 +204,22 @@ public Set<String> answer(InvocationOnMock invocation) throws Throwable {
191204
}
192205
});
193206

194-
when(scopeService.scopesMatch(anySet(), anySet())).thenAnswer(new Answer<Boolean>() {
195-
@Override
196-
public Boolean answer(InvocationOnMock invocation) throws Throwable {
197-
Object[] args = invocation.getArguments();
198-
Set<String> expected = (Set<String>) args[0];
199-
Set<String> actual = (Set<String>) args[1];
200-
return expected.containsAll(actual);
201-
}
202-
});
203-
207+
when(scopeService.scopesMatch(anySetOf(String.class), anySetOf(String.class)))
208+
.thenAnswer(new Answer<Boolean>() {
209+
@Override
210+
@SuppressWarnings("unchecked")
211+
public Boolean answer(InvocationOnMock invocation) throws Throwable {
212+
Object[] args = invocation.getArguments();
213+
Set<String> expected = (Set<String>) args[0];
214+
Set<String> actual = (Set<String>) args[1];
215+
return expected.containsAll(actual);
216+
}
217+
});
218+
204219
// we're not testing restricted or reserved scopes here, just pass through
205-
when(scopeService.removeReservedScopes(anySet())).then(returnsFirstArg());
206-
when(scopeService.removeRestrictedAndReservedScopes(anySet())).then(returnsFirstArg());
220+
when(scopeService.removeReservedScopes(anySetOf(SystemScope.class))).then(returnsFirstArg());
221+
when(scopeService.removeRestrictedAndReservedScopes(anySetOf(SystemScope.class)))
222+
.then(returnsFirstArg());
207223

208224
when(tokenEnhancer.enhance(any(OAuth2AccessTokenEntity.class), any(OAuth2Authentication.class)))
209225
.thenAnswer(new Answer<OAuth2AccessTokenEntity>() {
@@ -281,7 +297,7 @@ public void createAccessToken_noRefresh() {
281297
verify(authenticationHolderRepository).save(any(AuthenticationHolderEntity.class));
282298
verify(tokenEnhancer).enhance(any(OAuth2AccessTokenEntity.class), Matchers.eq(authentication));
283299
verify(tokenRepository).saveAccessToken(any(OAuth2AccessTokenEntity.class));
284-
verify(scopeService, atLeastOnce()).removeReservedScopes(anySet());
300+
verify(scopeService, atLeastOnce()).removeReservedScopes(anySetOf(SystemScope.class));
285301

286302
verify(tokenRepository, Mockito.never()).saveRefreshToken(any(OAuth2RefreshTokenEntity.class));
287303

@@ -303,7 +319,7 @@ public void createAccessToken_yesRefresh() {
303319
// Note: a refactor may be appropriate to only save refresh tokens once to the repository during
304320
// creation.
305321
verify(tokenRepository, atLeastOnce()).saveRefreshToken(any(OAuth2RefreshTokenEntity.class));
306-
verify(scopeService, atLeastOnce()).removeReservedScopes(anySet());
322+
verify(scopeService, atLeastOnce()).removeReservedScopes(anySetOf(SystemScope.class));
307323

308324
assertThat(token.getRefreshToken(), is(notNullValue()));
309325
}
@@ -330,7 +346,7 @@ public void createAccessToken_expiration() {
330346
Date lowerBoundRefreshTokens = new Date(start + (refreshTokenValiditySeconds * 1000L) - DELTA);
331347
Date upperBoundRefreshTokens = new Date(end + (refreshTokenValiditySeconds * 1000L) + DELTA);
332348

333-
verify(scopeService, atLeastOnce()).removeReservedScopes(anySet());
349+
verify(scopeService, atLeastOnce()).removeReservedScopes(anySetOf(SystemScope.class));
334350

335351
assertTrue(token.getExpiration().after(lowerBoundAccessTokens)
336352
&& token.getExpiration().before(upperBoundAccessTokens));
@@ -342,7 +358,7 @@ public void createAccessToken_expiration() {
342358
public void createAccessToken_checkClient() {
343359
OAuth2AccessTokenEntity token = service.createAccessToken(authentication);
344360

345-
verify(scopeService, atLeastOnce()).removeReservedScopes(anySet());
361+
verify(scopeService, atLeastOnce()).removeReservedScopes(anySetOf(SystemScope.class));
346362

347363
assertThat(token.getClient().getClientId(), equalTo(clientId));
348364
}
@@ -351,7 +367,7 @@ public void createAccessToken_checkClient() {
351367
public void createAccessToken_checkScopes() {
352368
OAuth2AccessTokenEntity token = service.createAccessToken(authentication);
353369

354-
verify(scopeService, atLeastOnce()).removeReservedScopes(anySet());
370+
verify(scopeService, atLeastOnce()).removeReservedScopes(anySetOf(SystemScope.class));
355371

356372
assertThat(token.getScope(), equalTo(scope));
357373
}
@@ -368,7 +384,7 @@ public void createAccessToken_checkAttachedAuthentication() {
368384

369385
assertThat(token.getAuthenticationHolder().getAuthentication(), equalTo(authentication));
370386
verify(authenticationHolderRepository).save(any(AuthenticationHolderEntity.class));
371-
verify(scopeService, atLeastOnce()).removeReservedScopes(anySet());
387+
verify(scopeService, atLeastOnce()).removeReservedScopes(anySetOf(SystemScope.class));
372388
}
373389

374390
@Test(expected = InvalidTokenException.class)

‎pom.xml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -20,7 +20,7 @@
2020
<modelVersion>4.0.0</modelVersion>
2121
<groupId>org.mitre</groupId>
2222
<artifactId>openid-connect-parent</artifactId>
23-
<version>1.3.6.cnaf-20231113</version>
23+
<version>1.3.6.cnaf-20231129</version>
2424
<name>MITREid Connect</name>
2525
<packaging>pom</packaging>
2626
<parent>

0 commit comments

Comments
 (0)