Source code

001package com.nimbusds.oauth2.sdk.tokenexchange;
002
003
004import com.nimbusds.oauth2.sdk.AuthorizationGrant;
005import com.nimbusds.oauth2.sdk.GrantType;
006import com.nimbusds.oauth2.sdk.OAuth2Error;
007import com.nimbusds.oauth2.sdk.ParseException;
008import com.nimbusds.oauth2.sdk.id.Audience;
009import com.nimbusds.oauth2.sdk.token.Token;
010import com.nimbusds.oauth2.sdk.token.TokenTypeURI;
011import com.nimbusds.oauth2.sdk.token.TypelessToken;
012import com.nimbusds.oauth2.sdk.util.CollectionUtils;
013import com.nimbusds.oauth2.sdk.util.MultivaluedMapUtils;
014import com.nimbusds.oauth2.sdk.util.StringUtils;
015import net.jcip.annotations.Immutable;
016
017import java.util.*;
018
019
020/**
021 * OAuth 2.0 token exchange grant.
022 *
023 * <p>Related specifications:
024 *
025 * <ul>
026 *     <li>OAuth 2.0 Token Exchange (RFC 8693)
027 * </ul>
028 */
029@Immutable
030public class TokenExchangeGrant extends AuthorizationGrant {
031        
032        
033        /**
034         * The grant type.
035         */
036        public static final GrantType GRANT_TYPE = GrantType.TOKEN_EXCHANGE;
037        
038        
039        /**
040         * The subject token representing the identity of the party on behalf
041         * of whom the request is being made.
042         */
043        private final Token subjectToken;
044        
045        
046        /**
047         * Identifier for the type of the subject token.
048         */
049        private final TokenTypeURI subjectTokenType;
050        
051        
052        /**
053         * Optional token representing the identity of the acting party.
054         */
055        private final Token actorToken;
056        
057        
058        /**
059         * Identifier for the type of the actor token, if present.
060         */
061        private final TokenTypeURI actorTokenType;
062        
063        
064        /**
065         * Optional identifier for the requested type of security token.
066         */
067        private final TokenTypeURI requestedTokenType;
068        
069        
070        /**
071         * Optional audience for the requested security token.
072         */
073        private final List<Audience> audience;
074        
075        
076        /**
077         * Creates a new token exchange grant.
078         *
079         * @param subjectToken     The subject token representing the identity
080         *                         of the party on behalf of whom the request
081         *                         is being made. Must not be {@code null}.
082         * @param subjectTokenType Identifier for the type of the subject
083         *                         token. Must not be {@code null}.
084         */
085        public TokenExchangeGrant(final Token subjectToken,
086                                  final TokenTypeURI subjectTokenType) {
087                
088                this(subjectToken, subjectTokenType, null, null, null, null);
089        }
090        
091        
092        /**
093         * Creates a new token exchange grant.
094         *
095         * @param subjectToken       The subject token representing the
096         *                           identity of the party on behalf of whom
097         *                           the request is being made. Must not be
098         *                           {@code null}.
099         * @param subjectTokenType   Identifier for the type of the subject
100         *                           token. Must not be {@code null}.
101         * @param actorToken         Optional token representing the identity
102         *                           of the acting party, {@code null} if not
103         *                           specified.
104         * @param actorTokenType     Identifier for the type of the actor
105         *                           token, if present.
106         * @param requestedTokenType Optional identifier for the requested type
107         *                           of security token, {@code null} if not
108         *                           specified.
109         * @param audience           Optional audience for the requested
110         *                           security token, {@code null} if not
111         *                           specified.
112         */
113        public TokenExchangeGrant(final Token subjectToken,
114                                  final TokenTypeURI subjectTokenType,
115                                  final Token actorToken,
116                                  final TokenTypeURI actorTokenType,
117                                  final TokenTypeURI requestedTokenType,
118                                  final List<Audience> audience) {
119                
120                super(GRANT_TYPE);
121                this.subjectToken = Objects.requireNonNull(subjectToken);
122                this.subjectTokenType = Objects.requireNonNull(subjectTokenType);
123                this.actorToken = actorToken;
124                
125                if (actorToken != null && actorTokenType == null) {
126                        throw new IllegalArgumentException("If an actor token is specified the actor token type must not be null");
127                }
128                this.actorTokenType = actorTokenType;
129                
130                this.requestedTokenType = requestedTokenType;
131                this.audience = audience;
132        }
133        
134        
135        /**
136         * Returns the subject token representing the identity of the party on
137         * behalf of whom the request is being made.
138         *
139         * @return The subject token.
140         */
141        public Token getSubjectToken() {
142                
143                return subjectToken;
144        }
145        
146        
147        /**
148         * Returns the identifier for the type of the subject token.
149         *
150         * @return The subject token type identifier.
151         */
152        public TokenTypeURI getSubjectTokenType() {
153                
154                return subjectTokenType;
155        }
156        
157        
158        /**
159         * Returns the optional token representing the identity of the acting
160         * party.
161         *
162         * @return The actor token, {@code null} if not specified.
163         */
164        public Token getActorToken() {
165                
166                return actorToken;
167        }
168        
169        
170        /**
171         * Returns the identifier for the type of the optional actor token, if
172         * present.
173         *
174         * @return The actor token type identifier, {@code null} if not
175         *         present.
176         */
177        public TokenTypeURI getActorTokenType() {
178                
179                return actorTokenType;
180        }
181        
182        
183        /**
184         * Returns the optional identifier for the requested type of security
185         * token.
186         *
187         * @return The requested token type, {@code null} if not specified.
188         */
189        public TokenTypeURI getRequestedTokenType() {
190                
191                return requestedTokenType;
192        }
193        
194        
195        /**
196         * Returns the optional audience for the requested security token.
197         *
198         * @return The audience, {@code null} if not specified.
199         */
200        public List<Audience> getAudience() {
201                
202                return audience;
203        }
204        
205        
206        @Override
207        public Map<String, List<String>> toParameters() {
208                
209                Map<String, List<String>> params = new LinkedHashMap<>();
210                
211                params.put("grant_type", Collections.singletonList(GRANT_TYPE.getValue()));
212                
213                if (CollectionUtils.isNotEmpty(audience)) {
214                        params.put("audience", Audience.toStringList(audience));
215                }
216                
217                if (requestedTokenType != null) {
218                        params.put("requested_token_type", Collections.singletonList(requestedTokenType.getURI().toString()));
219                }
220                
221                params.put("subject_token", Collections.singletonList(subjectToken.getValue()));
222                params.put("subject_token_type", Collections.singletonList(subjectTokenType.getURI().toString()));
223                
224                if (actorToken != null) {
225                        params.put("actor_token", Collections.singletonList(actorToken.getValue()));
226                        params.put("actor_token_type", Collections.singletonList(actorTokenType.getURI().toString()));
227                }
228                
229                return params;
230        }
231        
232        
233        private static List<Audience> parseAudience(final Map<String, List<String>> params) {
234                
235                List<String> audienceList = params.get("audience");
236                
237                if (CollectionUtils.isEmpty(audienceList)) {
238                        return null;
239                }
240                
241                return Audience.create(audienceList);
242        }
243        
244        
245        private static TokenTypeURI parseTokenType(final Map<String, List<String>> params, final String key, final boolean mandatory)
246                throws ParseException {
247                
248                String tokenTypeString = MultivaluedMapUtils.getFirstValue(params, key);
249                
250                if (StringUtils.isBlank(tokenTypeString)) {
251                        if (mandatory) {
252                                String msg = String.format("Missing or empty %s parameter", key);
253                                throw new ParseException(msg, OAuth2Error.INVALID_REQUEST.appendDescription(": " + msg));
254                        } else {
255                                return null;
256                        }
257                }
258                
259                try {
260                        return TokenTypeURI.parse(tokenTypeString);
261                } catch (ParseException uriSyntaxException) {
262                        String msg = "Invalid " + key + " " + tokenTypeString;
263                        throw new ParseException(msg, OAuth2Error.INVALID_REQUEST.appendDescription(": " + msg));
264                }
265        }
266        
267        
268        private static TypelessToken parseToken(final Map<String, List<String>> params, final String key, final boolean mandatory)
269                throws ParseException {
270                
271                String tokenString = MultivaluedMapUtils.getFirstValue(params, key);
272                
273                if (StringUtils.isBlank(tokenString)) {
274                        
275                        if (mandatory) {
276                                String msg = String.format("Missing or empty %s parameter", key);
277                                throw new ParseException(msg, OAuth2Error.INVALID_REQUEST.appendDescription(": " + msg));
278                        } else {
279                                return null;
280                        }
281                }
282                
283                return new TypelessToken(tokenString);
284        }
285        
286        
287        /**
288         * Parses a token exchange grant from the specified request body
289         * parameters.
290         *
291         * <p>Example:
292         *
293         * <pre>
294         * grant_type=urn:ietf:params:oauth:grant-type:token-exchange
295         * resource=https://backend.example.com/api
296         * subject_token=accVkjcJyb4BWCxGsndESCJQbdFMogUC5PbRDqceLTC
297         * subject_token_type=urn:ietf:params:oauth:token-type:access_token
298         * </pre>
299         *
300         * @param params The parameters.
301         *
302         * @return The token exchange grant.
303         *
304         * @throws ParseException If parsing failed.
305         */
306        public static TokenExchangeGrant parse(final Map<String, List<String>> params)
307                throws ParseException {
308                
309                GrantType.ensure(GRANT_TYPE, params);
310                
311                List<Audience> audience = parseAudience(params);
312                TokenTypeURI requestedTokenType = parseTokenType(params, "requested_token_type", false);
313                TypelessToken subjectToken = parseToken(params, "subject_token", true);
314                TokenTypeURI subjectTokenType = parseTokenType(params, "subject_token_type", true);
315                TypelessToken actorToken = parseToken(params, "actor_token", false);
316                TokenTypeURI actorTokenType = parseTokenType(params, "actor_token_type", false);
317                
318                return new TokenExchangeGrant(subjectToken, subjectTokenType, actorToken, actorTokenType, requestedTokenType, audience);
319        }
320        
321        
322        @Override
323        public boolean equals(final Object o) {
324                
325                if (this == o) return true;
326                
327                if (!(o instanceof TokenExchangeGrant)) return false;
328                
329                TokenExchangeGrant that = (TokenExchangeGrant) o;
330                
331                return
332                        getSubjectToken().equals(that.getSubjectToken()) &&
333                        getSubjectTokenType().equals(that.getSubjectTokenType()) &&
334                        
335                        Objects.equals(getActorToken(), that.getActorToken()) &&
336                        Objects.equals(getActorTokenType(), that.getActorTokenType()) &&
337                        Objects.equals(getRequestedTokenType(), that.getRequestedTokenType()) &&
338                        Objects.equals(getAudience(), that.getAudience());
339        }
340        
341        
342        @Override
343        public int hashCode() {
344                return Objects.hash(
345                        getSubjectToken(),
346                        getSubjectTokenType(),
347                        getActorToken(),
348                        getActorTokenType(),
349                        getRequestedTokenType(),
350                        getAudience()
351                );
352        }
353}