Hi Thorsten, All,
I've updated OAuth2 SessionAuthenticityTokenProvider interface on the
trunk.
The reason for that is that at the moment the only way for
Redirection-based services to return the redirection state as part of
the authorization decision is to use form hidden fields. That would
include properties like client id, redirect URI, state, audience, client
code verifier, and scope.
This is not difficult to implement but this approach has its own
drawbacks. One of the alternative is to pack these data into an
encrypted session token. Hence this interface has been updated, and a
specific implementation, JoseSessionTokenProvider is now shipped, users
would be able to come with their own implementations. The existing
implementations do not have to do anything about it, apart from the
minor migration effort.
Thorsten, you provided the initial patch which introduced the interface.
Would you prefer to keep this change on the trunk only or reckon it
would be OK to push it down to 3.0.x ? If anyone else on the users list
customized the session creation process and would prefer to keep the
latest update on the trunk only (3.1.0-SNAPSHOT) then let me know please
Thanks, Sergey
http://git-wip-us.apache.org/repos/asf/cxf/blob/27c2c25d/rt/rs/security/oauth-parent/oauth2/src/main/java/org/apache/cxf/rs/security/oauth2/provider/SessionAuthenticityTokenProvider.java
----------------------------------------------------------------------
diff --git
a/rt/rs/security/oauth-parent/oauth2/src/main/java/org/apache/cxf/rs/security/oauth2/provider/SessionAuthenticityTokenProvider.java
b/rt/rs/security/oauth-parent/oauth2/src/main/java/org/apache/cxf/rs/security/oauth2/provider/SessionAuthenticityTokenProvider.java
index 741acb0..02cee8b 100644
---
a/rt/rs/security/oauth-parent/oauth2/src/main/java/org/apache/cxf/rs/security/oauth2/provider/SessionAuthenticityTokenProvider.java
+++
b/rt/rs/security/oauth-parent/oauth2/src/main/java/org/apache/cxf/rs/security/oauth2/provider/SessionAuthenticityTokenProvider.java
@@ -22,6 +22,7 @@ package org.apache.cxf.rs.security.oauth2.provider;
import javax.ws.rs.core.MultivaluedMap;
import org.apache.cxf.jaxrs.ext.MessageContext;
+import org.apache.cxf.rs.security.oauth2.common.OAuthRedirectionState;
import org.apache.cxf.rs.security.oauth2.common.UserSubject;
/**
@@ -31,21 +32,23 @@ import org.apache.cxf.rs.security.oauth2.common.UserSubject;
public interface SessionAuthenticityTokenProvider {
/**
- * Creates a new session token and stores it
+ * Create a new session token and stores it
*
* @param mc the {@link MessageContext} of this request
* @param params redirection-based grant request parameters
* @param subject authenticated end user
+ * @param secData
* @return the created session token
*/
String createSessionToken(MessageContext mc,
MultivaluedMap<String, String> params,
- UserSubject subject);
+ UserSubject subject,
+ OAuthRedirectionState secData);
/**
- * Retrieves the stored session token
+ * Retrieve the stored session token
*
- * @param mc the {@link MessageContext} of this request
+ * @param mc the {@link MessageContext} of this request
* @param params grant authorization parameters
* @param subject authenticated end user
* @return the stored token
@@ -55,7 +58,7 @@ public interface SessionAuthenticityTokenProvider {
UserSubject subject);
/**
- * Removes the stored session token
+ * Remove the stored session token
*
* @param mc the {@link MessageContext} of this request
* @param params grant authorization parameters
@@ -65,4 +68,16 @@ public interface SessionAuthenticityTokenProvider {
MultivaluedMap<String, String> params,
UserSubject subject);
+ /**
+ * Expand the session token
+ *
+ * @param mc the {@link MessageContext} of this request
+ * @param sessionToken the token
+ * @param subject authenticated end user
+ * @return the expanded token or null
+ */
+ OAuthRedirectionState getSessionState(MessageContext messageContext,
+ String sessionToken,
+ UserSubject subject);
+
}
