Package org.forgerock.openig.filter.oauth2

Class OAuth2ResourceServerFilterHeaplet

java.lang.Object

org.forgerock.openig.heap.GenericHeaplet

org.forgerock.openig.filter.oauth2.OAuth2ResourceServerFilterHeaplet

All Implemented Interfaces:

Heaplet

public class OAuth2ResourceServerFilterHeaplet
extends GenericHeaplet

Validates a Request that contains an OAuth 2.0 access token.

This filter expects an OAuth 2.0 token to be available in the HTTP Authorization header:

Authorization: Bearer 1fc0e143-f248-4e50-9c13-1d710360cec9

It extracts the token and validate it against the tokenInfoEndpoint URL provided in the configuration.

 
 {
         "name": "ProtectedResourceFilter",
         "type": "OAuth2ResourceServerFilter",
         "config": {
           "scopes": [ "email", "profile" ],
           "tokenInfoEndpoint": "https://openam.example.com:8443/openam/oauth2/tokeninfo",
           "cacheExpiration": "2 minutes",
           "requireHttps": false,
           "providerHandler": "ClientHandler",
           "realm": "Informative realm name",
         }
 }
 
 

scopes, tokenInfoEndpoint and providerHandler are the 3 only mandatory configuration attributes.

If cacheExpiration is not set, the default is to keep the AccessTokenInfo objects for 1 minute. cacheExpiration is expressed using natural language (use zero or none to deactivate caching, any 0 valued duration will also deactivate it):

     
     "cacheExpiration": "2 minutes"
     "cacheExpiration": "3 days and 6 hours"
     "cacheExpiration": "5m" // 5 minutes
     "cacheExpiration": "10 min, 30 sec"
     "cacheExpiration": "zero" // no cache
     "cacheExpiration": "0 s" // no cache
     
 

providerHandler is a name reference to another handler available in the heap. It will be used to perform access token validation against the tokenInfoEndpoint URL. It is usually a reference to some ClientHandler.

The requireHttps optional attribute control if this filter only accepts requests targeting the HTTPS scheme. By default, it is enabled (only URI starting with https://... will be accepted, an Exception is thrown otherwise).

The realm optional attribute specifies the name of the realm used in the authentication challenges returned back to the client in case of errors.

See Also:

Duration

Field Summary

Fields

Modifier and Type	Field	Description
static String	DEFAULT_REALM_NAME	Name of the realm when none is specified in the heaplet.

Fields inherited from class org.forgerock.openig.heap.GenericHeaplet

config, heap, name, object, qualified

Constructor Summary

Constructors

Constructor	Description
OAuth2ResourceServerFilterHeaplet()

Method Summary

Modifier and Type	Method	Description
Object	create()	Called to request the heaplet create an object.
void	destroy()	Called to indicate that the object created by the heaplet is going to be dereferenced.

Methods inherited from class org.forgerock.openig.heap.GenericHeaplet

create, endpointRegistry, evaluatedWithHeapProperties, expression, start

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Field Detail

DEFAULT_REALM_NAME

public static final String DEFAULT_REALM_NAME

Name of the realm when none is specified in the heaplet.

See Also:

Constant Field Values

Constructor Detail

OAuth2ResourceServerFilterHeaplet

public OAuth2ResourceServerFilterHeaplet()

Method Detail

create

public Object create()
              throws HeapException

Description copied from class: GenericHeaplet

Called to request the heaplet create an object. Called by Heaplet.create(Name, JsonValue, Heap) after initializing the protected field members. Implementations should parse configuration but not acquire resources, start threads, or log any initialization messages. These tasks should be performed by the GenericHeaplet.start() method.

Specified by:

create in class GenericHeaplet

Returns:

The created object.

Throws:

HeapException - if an exception occurred during creation of the heap object or any of its dependencies.

destroy

public void destroy()

Description copied from interface: Heaplet

Called to indicate that the object created by the heaplet is going to be dereferenced. This gives the heaplet an opportunity to free any resources that are being held prior to its dereference.

Specified by:

destroy in interface Heaplet

Overrides:

destroy in class GenericHeaplet