Package org.forgerock.oauth2.restlet

Class DeviceCodeVerificationResource

java.lang.Object

org.restlet.resource.Resource

org.restlet.resource.ServerResource

org.forgerock.openam.rest.service.RouterContextResource

org.forgerock.oauth2.restlet.ConsentRequiredResource

org.forgerock.oauth2.restlet.DeviceCodeVerificationResource

public class DeviceCodeVerificationResource
extends ConsentRequiredResource

A restlet resource for user codes

Since:

13.0.0

See Also:

OAuth 2.0 Protocol - Device Flow

Field Summary

Fields inherited from class org.forgerock.oauth2.restlet.ConsentRequiredResource

baseURLProviderFactory, xuiState

Constructor Summary

Constructors

Constructor

Description

DeviceCodeVerificationResource(XUIState xuiState, org.restlet.routing.Router router, BaseURLProviderFactory baseURLProviderFactory, OAuth2Representation representation, TokenStore tokenStore, OAuth2RequestFactory requestFactory, AuthorizationService authorizationService, OAuth2ProviderSettingsFactory providerSettingsFactory, ExceptionHandler exceptionHandler, ResourceOwnerSessionValidator resourceOwnerSessionValidator, ClientRegistrationStore clientRegistrationStore, OAuth2Utils oAuth2Utils, CsrfProtection csrfProtection)

Constructs user code verification resource for OAuth2 Device Flow

Method Summary

Modifier and Type	Method	Description
protected void	doCatch(Throwable throwable)	Handles any exception that is thrown when processing a OAuth2 authorization request.
org.restlet.representation.Representation	userCodeForm()	Handles GET requests to the OAuth2 device/user endpoint, returning a form to allow the user to submit their user code.
org.restlet.representation.Representation	verify(org.restlet.representation.Representation body)	Handles POST requests to the OAuth2 device/user endpoint.

Methods inherited from class org.forgerock.oauth2.restlet.ConsentRequiredResource

getDataModel

Methods inherited from class org.forgerock.openam.rest.service.RouterContextResource

getContext

Methods inherited from class org.restlet.resource.ServerResource

abort, commit, delete, delete, describeVariants, doConditionalHandle, doError, doHandle, doHandle, doHandle, doNegotiatedHandle, get, get, getAnnotation, getAnnotation, getAnnotations, getAttribute, getDescription, getInfo, getInfo, getName, getOnSent, getPreferredVariant, getRole, getVariants, getVariants, handle, hasAnnotations, head, head, isAnnotated, isAutoCommitting, isCommitted, isConditional, isExisting, isInRole, isNegotiated, options, options, patch, patch, post, post, put, put, redirectPermanent, redirectPermanent, redirectSeeOther, redirectSeeOther, redirectTemporary, redirectTemporary, setAllowedMethods, setAnnotated, setAttribute, setAutoCommitting, setChallengeRequests, setCommitted, setConditional, setCookieSettings, setDescription, setDimensions, setExisting, setLocationRef, setLocationRef, setName, setNegotiated, setOnSent, setProxyChallengeRequests, setServerInfo, setStatus, setStatus, setStatus, setStatus, updateAllowedMethods, updateDimensions

Methods inherited from class org.restlet.resource.Resource

doError, doInit, doRelease, getAllowedMethods, getApplication, getChallengeRequests, getChallengeResponse, getClientInfo, getConditions, getConnegService, getConverterService, getCookies, getCookieSettings, getDimensions, getHostRef, getLocationRef, getLogger, getMatrix, getMatrixValue, getMaxForwards, getMetadataService, getMethod, getOriginalRef, getProtocol, getProxyChallengeRequests, getProxyChallengeResponse, getQuery, getQueryValue, getRanges, getReference, getReferrerRef, getRequest, getRequestAttributes, getRequestCacheDirectives, getRequestEntity, getResponse, getResponseAttributes, getResponseCacheDirectives, getResponseEntity, getRootRef, getServerInfo, getStatus, getStatusService, init, isConfidential, isLoggable, release, setApplication, setQueryValue, setRequest, setResponse, toBoolean, toByte, toDouble, toFloat, toInteger, toLong, toObject, toRepresentation, toRepresentation, toRepresentation, toShort, toString

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, wait, wait, wait

Constructor Detail

DeviceCodeVerificationResource

@Inject
public DeviceCodeVerificationResource(XUIState xuiState,
                                      @Named("OAuth2Router")
                                      org.restlet.routing.Router router,
                                      BaseURLProviderFactory baseURLProviderFactory,
                                      OAuth2Representation representation,
                                      TokenStore tokenStore,
                                      OAuth2RequestFactory requestFactory,
                                      AuthorizationService authorizationService,
                                      OAuth2ProviderSettingsFactory providerSettingsFactory,
                                      ExceptionHandler exceptionHandler,
                                      ResourceOwnerSessionValidator resourceOwnerSessionValidator,
                                      ClientRegistrationStore clientRegistrationStore,
                                      OAuth2Utils oAuth2Utils,
                                      CsrfProtection csrfProtection)

Constructs user code verification resource for OAuth2 Device Flow

Parameters:

router - The base router

exceptionHandler - An instance of the ExceptionHandler.

oAuth2Utils - An OAuth2Utils instance.

csrfProtection - An instance of the CsrfProtection.

Method Detail

verify

@Post
public org.restlet.representation.Representation verify(org.restlet.representation.Representation body)
                                                 throws ServerException,
                                                        NotFoundException,
                                                        InvalidGrantException,
                                                        OAuth2RestletException

Handles POST requests to the OAuth2 device/user endpoint. Only a submitted form reaches this method: a bare navigation to the endpoint arrives as a GET, which any foreign origin can trigger with a plain link and which therefore never authorizes anything.

Throws:

ServerException

NotFoundException

InvalidGrantException

OAuth2RestletException

userCodeForm

@Get
public org.restlet.representation.Representation userCodeForm()

Handles GET requests to the OAuth2 device/user endpoint, returning a form to allow the user to submit their user code.

A GET never acts on a user code, whatever the request carries. It is the one request a foreign origin can make the resource owner's browser send with its session cookie attached - SameSite=Lax blocks a cross-site POST but not a top-level navigation - so it may only render this form.

A user code in the query string is not merely ignored, it is redirected away. The form has no action of its own, so it posts back to the address it was served from, and a code left in that address would be submitted alongside the one the user typed - which getSubmittedUserCode(org.forgerock.oauth2.core.OAuth2Request) then refuses, leaving whoever followed such a link with a bare 400 and no form to retry on. Serving the form only from an address that carries no code makes the query string that reaches the POST the user's own.

Returns:

The form to allow the user to submit their user code, or null if the request is being redirected to the same address without its user code.

doCatch

protected void doCatch(Throwable throwable)

Handles any exception that is thrown when processing a OAuth2 authorization request.

Overrides:

doCatch in class org.restlet.resource.ServerResource

Parameters:

throwable - The throwable.