001/*
002 * oauth2-oidc-sdk
003 *
004 * Copyright 2012-2016, Connect2id Ltd and contributors.
005 *
006 * Licensed under the Apache License, Version 2.0 (the "License"); you may not use
007 * this file except in compliance with the License. You may obtain a copy of the
008 * License at
009 *
010 *    http://www.apache.org/licenses/LICENSE-2.0
011 *
012 * Unless required by applicable law or agreed to in writing, software distributed
013 * under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR
014 * CONDITIONS OF ANY KIND, either express or implied. See the License for the
015 * specific language governing permissions and limitations under the License.
016 */
017
018package com.nimbusds.openid.connect.sdk;
019
020
021import com.nimbusds.common.contenttype.ContentType;
022import com.nimbusds.oauth2.sdk.ParseException;
023import com.nimbusds.oauth2.sdk.ProtectedResourceRequest;
024import com.nimbusds.oauth2.sdk.SerializeException;
025import com.nimbusds.oauth2.sdk.http.HTTPRequest;
026import com.nimbusds.oauth2.sdk.token.AccessToken;
027import com.nimbusds.oauth2.sdk.util.URLUtils;
028import net.jcip.annotations.Immutable;
029
030import java.net.URI;
031import java.util.*;
032
033
034/**
035 * UserInfo request. Used to retrieve the consented claims about the end-user.
036 *
037 * <p>Example HTTP GET request with a Bearer token:
038 *
039 * <pre>
040 * GET /userinfo HTTP/1.1
041 * Host: server.example.com
042 * Authorization: Bearer Eabeeduphee3aiviehahreacaoNg2thu
043 * </pre>
044 *
045 * <p>Example HTTP GET request with a DPoP token and proof:
046 *
047 * <pre>
048 * GET /userinfo HTTP/1.1
049 * Host: server.example.com
050 * Authorization: DPoP jo4kahphoh1ath4INaochohLeeshaiyo
051 * DPoP: eyJ0eXAiOiJkcG9wK2p3dCIsImFsZyI6IkVTMjU2IiwiandrIjp7Imt0eSI6Ik...
052 * </pre>
053 *
054 * <p>Related specifications:
055 *
056 * <ul>
057 *     <li>OpenID Connect Core 1.0
058 *     <li>OAuth 2.0 Bearer Token Usage (RFC6750)
059 *     <li>OAuth 2.0 Demonstrating Proof-of-Possession at the Application Layer
060 *         (DPoP) (RFC 9449)
061 * </ul>
062 */
063@Immutable
064public class UserInfoRequest extends ProtectedResourceRequest {
065
066
067        /**
068         * The HTTP method.
069         */
070        private final HTTPRequest.Method httpMethod;
071        
072        
073        /**
074         * Creates a new UserInfo HTTP GET request.
075         *
076         * @param endpoint    The URI of the UserInfo endpoint. May be
077         *                    {@code null} if the {@link #toHTTPRequest} method
078         *                    is not going to be used.
079         * @param accessToken An access token for the request. Must not be
080         *                    {@code null}.
081         */
082        public UserInfoRequest(final URI endpoint, final AccessToken accessToken) {
083        
084                this(endpoint, HTTPRequest.Method.GET, accessToken);
085        }
086        
087        
088        /**
089         * Creates a new UserInfo request.
090         *
091         * @param endpoint    The URI of the UserInfo endpoint. May be
092         *                    {@code null} if the {@link #toHTTPRequest} method
093         *                    is not going to be used.
094         * @param httpMethod  The HTTP method. Must be HTTP GET or POST and not 
095         *                    {@code null}.
096         * @param accessToken An access token for the request. Must not be
097         *                    {@code null}.
098         */
099        public UserInfoRequest(final URI endpoint, final HTTPRequest.Method httpMethod, final AccessToken accessToken) {
100        
101                super(endpoint, Objects.requireNonNull(accessToken));
102                this.httpMethod = Objects.requireNonNull(httpMethod);
103        }
104        
105        
106        /**
107         * Gets the HTTP method for this UserInfo request.
108         *
109         * @return The HTTP method.
110         */
111        public HTTPRequest.Method getMethod() {
112        
113                return httpMethod;
114        }
115        
116        
117        @Override
118        public HTTPRequest toHTTPRequest() {
119                
120                if (getEndpointURI() == null)
121                        throw new SerializeException("The endpoint URI is not specified");
122
123                HTTPRequest httpRequest = new HTTPRequest(httpMethod, getEndpointURI());
124                
125                switch (httpMethod) {
126                
127                        case GET:
128                                httpRequest.setAuthorization(getAccessToken().toAuthorizationHeader());
129                                break;
130                                
131                        case POST:
132                                httpRequest.setEntityContentType(ContentType.APPLICATION_URLENCODED);
133                                Map<String, List<String>> params = new HashMap<>();
134                                params.put("access_token", Collections.singletonList(getAccessToken().getValue()));
135                                httpRequest.setBody(URLUtils.serializeParameters(params));
136                                break;
137                        
138                        default:
139                                throw new SerializeException("Unexpected HTTP method: " + httpMethod);
140                }
141                
142                return httpRequest;
143        }
144        
145        
146        /**
147         * Parses the specified HTTP request for a UserInfo request.
148         *
149         * @param httpRequest The HTTP request. Must not be {@code null}.
150         *
151         * @return The UserInfo request.
152         *
153         * @throws ParseException If the HTTP request couldn't be parsed to a 
154         *                        UserInfo request.
155         */
156        public static UserInfoRequest parse(final HTTPRequest httpRequest)
157                throws ParseException {
158                
159                return new UserInfoRequest(
160                        httpRequest.getURI(),
161                        httpRequest.getMethod(),
162                        AccessToken.parse(httpRequest)
163                );
164        }
165}