D-Net

package eu.dnetlib.openaire.user.security;

import com.google.gson.JsonObject;

import eu.dnetlib.openaire.user.MigrationUser;

import io.jsonwebtoken.Claims;

import io.jsonwebtoken.Jwts;

import io.jsonwebtoken.SignatureAlgorithm;

import org.apache.log4j.Logger;

import org.mitre.openid.connect.model.OIDCAuthenticationToken;

import org.mitre.openid.connect.model.UserInfo;

import java.io.UnsupportedEncodingException;

import java.net.URLEncoder;

import java.text.ParseException;

import java.util.Date;

public class JWTGenerator {

    private static final Logger logger = Logger.getLogger(JWTGenerator.class);

    public static String generateToken(MigrationUser u, String secret) {

        Claims claims = Jwts.claims().setSubject(u.getUsername());

        claims.put("fullname", u.getFullname() + "");

        claims.put("userId", u.getId() + "");

        claims.put("email", u.getEmail() + "");

        claims.put("role", u.getRoleId());

        //expiration

        long nowMillis = System.currentTimeMillis();

        Date now = new Date(nowMillis);

        long ttlMillis = 1800000;

        long expMillis = nowMillis + ttlMillis;

        Date exp = new Date(expMillis);

        return Jwts.builder()

                .setClaims(claims)

                .setExpiration(exp)

                .signWith(SignatureAlgorithm.HS512, secret)

                .compact();

    }

    public static String generateToken(OIDCAuthenticationToken authOIDC, String secret) {

        try {

            JsonObject userInfo = authOIDC.getUserInfo().getSource();

            Claims claims = Jwts.claims().setSubject(authOIDC.getUserInfo().getSub());

            claims.put("fullname", URLEncoder.encode(authOIDC.getUserInfo().getName(), "UTF-8") + "");

            if (authOIDC.getUserInfo().getGivenName() == null){

                logger.info("User: " + authOIDC.getUserInfo().getName() + "doesn't have first name");

                claims.put("firstname", URLEncoder.encode(" ", "UTF-8") + "");

            } else {

                claims.put("firstname", URLEncoder.encode(authOIDC.getUserInfo().getGivenName(), "UTF-8") + "");

            }

            if (authOIDC.getUserInfo().getFamilyName() == null){

                logger.info("User: " + authOIDC.getUserInfo().getName() + "doesn't have first name");

                claims.put("lastname", URLEncoder.encode(" ", "UTF-8") + "");

            } else {

                claims.put("lastname", URLEncoder.encode(authOIDC.getUserInfo().getFamilyName(), "UTF-8") + "");

            }

            claims.put("email", authOIDC.getUserInfo().getEmail() + "");

//            claims.put("role", URLEncoder.encode(userInfo.getAsJsonArray("edu_person_entitlements").toString(), "UTF-8") + "");

//

//            if (userInfo.getAsJsonArray("eduPersonScopedAffiliation").toString() != null) {

//                claims.put("role", URLEncoder.encode(userInfo.getAsJsonArray("edu_person_scoped_affiliations").toString(), "UTF-8") + "");

//            }

            if (userInfo.getAsJsonArray("edu_person_entitlements") == null){

                logger.info("User: " + authOIDC.getUserInfo().getName() + "doesn't have role");

                claims.put("role", URLEncoder.encode(" ", "UTF-8") + "");

            } else {

                claims.put("role", URLEncoder.encode(userInfo.getAsJsonArray("edu_person_entitlements").toString(), "UTF-8") + "");

            }

            //TODO remove, We don't need it but if we are going to use it, we need to check if the user has affiliation

            //claims.put("edu_person_scoped_affiliations", URLEncoder.encode(userInfo.getAsJsonArray("edu_person_scoped_affiliations").toString(), "UTF-8") + "");

            //TODO remove

            //TODO THIS IS TEST

//            claims.put("fullname", URLEncoder.encode("Σοφία Μπαλτζή", "UTF-8") + "");

//            claims.put("firstname", URLEncoder.encode("Σοφία", "UTF-8") + "");

//            claims.put("lastname", URLEncoder.encode("Μπαλτζή", "UTF-8") + "");

//            claims.put("email", "sofie.mpl@gmail.com" + "");

//            claims.put("edu_person_scoped_affiliations", "faculty");

            Date exp = new Date(authOIDC.getIdToken().getJWTClaimsSet().getExpirationTime().getTime());

            //TODO DELETE LOGS

//            logger.info("\n////////////////////////////////////////////////////////////////////////////////////////////////\n");

//            logger.info("fullName: " + authOIDC.getUserInfo().getName());

//            logger.info("firstName: " + authOIDC.getUserInfo().getGivenName());

//            logger.info("lastName: " + authOIDC.getUserInfo().getFamilyName());

//            logger.info("email: " + authOIDC.getUserInfo().getEmail());

//            //logger.info("Check everything");

//            logger.info("locale: " + authOIDC.getUserInfo().getSource());

//            logger.info("role: " + userInfo.getAsJsonArray("edu_person_entitlements").toString());

//            //logger.info("affiliation: " + userInfo.getAsJsonArray("edu_person_scoped_affiliations").toString());

//            logger.info("expirationTime: " + exp);

//            logger.info("\n////////////////////////////////////////////////////////////////////////////////////////////////\n");

            return Jwts.builder()

                    .setClaims(claims)

                    .setExpiration(exp)

                    .signWith(SignatureAlgorithm.HS512, secret)

                    .compact();

        } catch (ParseException e) {

            e.printStackTrace();

            logger.error("JWT Parse Exception from getting Expiration Time ", e);

            return "error";

        } catch (UnsupportedEncodingException e) {

            e.printStackTrace();

            logger.error("UnsupportedEncodingException UTF-8 ", e);

            return "error";

        }

    }

    //TODO DELETE IF IT IS NOT NECESSARY

    public static String generateAccessToken(OIDCAuthenticationToken authOIDC, String secret) {

        Claims claims = Jwts.claims().setId(authOIDC.getAccessTokenValue());

        //TODO DELETE LOGS

        logger.info("\n////////////////////////////////////////////////////////////////////////////////////////////////\n");

        logger.info("access token: " + authOIDC.getAccessTokenValue());

        logger.info("\n////////////////////////////////////////////////////////////////////////////////////////////////\n");

        return Jwts.builder()

                .setClaims(claims)

                .signWith(SignatureAlgorithm.HS512, secret)

                .compact();

    }

    public static String generateToken(UserInfo user, String secret) {

        try {

            JsonObject userInfo = user.getSource();

        Claims claims = Jwts.claims().setSubject(user.getSub());

        claims.put("email", user.getEmail() + "");

            claims.put("role", URLEncoder.encode(userInfo.getAsJsonArray("edu_person_entitlements").toString(), "UTF-8") + "");

        return Jwts.builder()

                .setClaims(claims)

                .signWith(SignatureAlgorithm.HS512, secret)

                .compact();

        } catch (UnsupportedEncodingException e) {

            e.printStackTrace();

            logger.error("UnsupportedEncodingException UTF-8 ", e);

            return "error";

        }

    }

}

// How to add it manually

//        long nowMillis = System.currentTimeMillis();

//        //This is my token

//        try {

//            String jwt = Jwts.builder()

//                    .setSubject("Argiro")

//                    .setExpiration(new Date(nowMillis+1800000))

//                    .claim("fullname", "Argiro Kokogianaki")

//                    .claim("id", "8")

//                    .claim("email", "argiro@gmail.com")

//                    .claim("role","2")

//                    .signWith(

//                            SignatureAlgorithm.HS512,

//                            "my-very-secret".getBytes("UTF-8")

//                    )

//                    .compact();

package eu.dnetlib.openaire.user.security;

import com.sun.org.apache.xpath.internal.SourceTree;

import org.apache.log4j.Logger;

import org.mitre.openid.connect.model.OIDCAuthenticationToken;

import org.springframework.security.core.Authentication;

import org.springframework.security.core.context.SecurityContextHolder;

import org.springframework.security.web.authentication.AuthenticationSuccessHandler;

import javax.servlet.ServletException;

import javax.servlet.http.Cookie;

import javax.servlet.http.HttpServletRequest;

import javax.servlet.http.HttpServletResponse;

import java.io.IOException;

import java.net.URLEncoder;

import java.text.ParseException;

import java.util.Date;

/**

 * Created by stefanos on 9/5/2017.

 */

public class FrontEndLinkURIAuthenticationSuccessHandler implements AuthenticationSuccessHandler {

    private static final Logger logger = Logger.getLogger(FrontEndLinkURIAuthenticationSuccessHandler.class);

    private String frontEndURI;

    private String frontPath;

    private String frontDomain;

    @Override

    public void onAuthenticationSuccess(HttpServletRequest request, HttpServletResponse response, Authentication authentication) throws IllegalArgumentException, IOException   {

        OIDCAuthenticationToken authOIDC = (OIDCAuthenticationToken) authentication;

        try {

            Cookie jwt = new Cookie("XCsrfToken", JWTGenerator.generateToken(authOIDC, "my-very-secret"));

            Cookie accessToken = new Cookie("AccessToken", authOIDC.getAccessTokenValue());

            // Expire the cookies in four hours (4 * 3600)

            jwt.setMaxAge(14400);

            accessToken.setMaxAge(14400);

            //TODO DELETE LOG

            logger.info("\n////////////////////////////////////////////////////////////////////////////////////////////////\n");

            logger.info("access token: " + authOIDC.getAccessTokenValue());

            logger.info("\n////////////////////////////////////////////////////////////////////////////////////////////////\n");

            jwt.setPath(frontPath);

            jwt.setDomain(frontDomain);

            accessToken.setPath(frontPath);

            accessToken.setDomain(frontDomain);

            response.addCookie(jwt);

            response.addCookie(accessToken);

            response.sendRedirect(frontEndURI);

        } catch (IOException e) {

            logger.error("IOException in redirection ", e);

            throw new IOException(e);

        }catch (IllegalArgumentException e) {

            logger.error("IllegalArgumentException in redirection ", e);

            throw new IllegalArgumentException(e);

        }

    }

    public String getFrontEndURI() {

        return frontEndURI;

    }

    public void setFrontEndURI(String frontEndURI) {

        this.frontEndURI = frontEndURI;

    }

    public String getFrontPath() {

        return frontPath;

    }

    public void setFrontPath(String frontPath) {

        this.frontPath = frontPath;

    }

    public String getFrontDomain() {

        return frontDomain;

    }

    public void setFrontDomain(String frontDomain) {

        this.frontDomain = frontDomain;

    }

}

package eu.dnetlib.openaire.user.api.services;

import com.fasterxml.jackson.core.JsonProcessingException;

import com.fasterxml.jackson.databind.ObjectMapper;

import com.google.gson.Gson;

import com.google.gson.JsonObject;

import com.google.gson.JsonParser;

import com.unboundid.ldap.sdk.LDAPException;

import eu.dnetlib.openaire.user.LDAPUser;

import eu.dnetlib.openaire.user.MigrationUser;

import eu.dnetlib.openaire.user.Role;

import eu.dnetlib.openaire.user.dao.RoleDAO;

import eu.dnetlib.openaire.user.dao.SQLMigrationUserDAO;

import eu.dnetlib.openaire.user.ldap.MUserActionsLDAP;

import eu.dnetlib.openaire.user.security.JWTGenerator;

import eu.dnetlib.openaire.user.store.DataSourceConnector;

import org.apache.log4j.Logger;

import org.mitre.openid.connect.model.UserInfo;

import org.springframework.beans.factory.annotation.Autowired;

import org.springframework.http.*;

import org.springframework.http.HttpMethod;

import org.springframework.stereotype.Component;

import org.springframework.web.client.RestTemplate;

import javax.ws.rs.*;

import javax.ws.rs.core.MediaType;

import javax.ws.rs.core.Response;

import java.io.OutputStream;

import java.sql.SQLException;

/**

 * Created by sofia on 24/11/2016.

 */

@Component(value = "test3service")

@Path("/users")

public class Test3Service {

    private static final Logger logger = Logger.getLogger(Test3Service.class);

    @Autowired

    private SQLMigrationUserDAO sqlMigrationUserDAO;

    @Autowired

    private MUserActionsLDAP mUserActionsLDAP;

    @Autowired

    private DataSourceConnector dataSourceConnector;

    @GET

    @Path("/{userId}")

    @Produces(MediaType.APPLICATION_JSON)

    public Response getUserById(@PathParam("userId") int userId) {

        try {

            MigrationUser mUser = sqlMigrationUserDAO.fetchById(userId);

            // Invalide user ID

            if (mUser == null) {

                String errorMessageJson = compose404Message("Cannot find user with id " + userId + ".");

                return Response

                        .status(Response.Status.NOT_FOUND)

                        .entity(errorMessageJson)

                        .type(MediaType.APPLICATION_JSON)

                        .build();

            }

            return Response.status(200).entity(composeDataResponse(mUser)).build();

        }

        catch (SQLException e) {

            return Response

                    .status(Response.Status.INTERNAL_SERVER_ERROR)

                    .entity(compose500Message("Fail to fetch users.", e))

                    .type(MediaType.APPLICATION_JSON)

                    .build();

        }

    }

     /* How to check @browser ../authenticate/?username=MY_USERNAME&password=MY_PASSWORD

     * http://localhost:8080/uoa-user-management-1.0.0-SNAPSHOT/api/users/authenticate?username=sba&password=12345678

    @GET

    @Path("/authenticate")

    @Produces(MediaType.APPLICATION_JSON)

    public Response authenticateUserGET(@QueryParam("username") String username, @QueryParam("password") String password)

    {

        return commonAuthenticateFunction(username, password);

    }*/

    @POST

    @Path("/authenticates")

    @Produces(MediaType.APPLICATION_JSON)

    @Consumes(MediaType.APPLICATION_JSON)

    public Response authenticateUserPOST(String input) {

        JsonObject jsonObject = new JsonParser().parse(input).getAsJsonObject();

        String username = jsonObject.get("username").getAsString();

        String password = jsonObject.get("password").getAsString();

        return commonAuthenticateFunction(username, password);

    }

    private Response commonAuthenticateFunction(String username, String password)

    {

        try {

            boolean usernameExists = mUserActionsLDAP.usernameExists(username);

            // if user was not found

            if (!usernameExists) {

                String errorMessageJson = compose401Message("Wrong credentials.");

                return Response

                        .status(Response.Status.UNAUTHORIZED)

                        .entity(errorMessageJson)

                        .type(MediaType.APPLICATION_JSON)

                        .build();

            }

            boolean authenticated = mUserActionsLDAP.authenticate(username, password);

            // if user was not authenticated

            if (!authenticated) {

                return Response

                        .status(Response.Status.UNAUTHORIZED)

                        .entity(compose401Message("User " + username + " could not be authenticated."))

                        .type(MediaType.APPLICATION_JSON)

                        .build();

            }

            MigrationUser mUser = sqlMigrationUserDAO.fetchByUsername(username);

            // if user was not found in my db

            LDAPUser ldapUser = null;

            if (mUser == null) {

                mUser = new MigrationUser(username);

                ldapUser = mUserActionsLDAP.getUser(username);

                mUser.setFullname(ldapUser.getDisplayName());

                mUser.setEmail(ldapUser.getEmail());

                mUser.setRoleId(2);

                sqlMigrationUserDAO.insert(mUser);

            }

            return Response.status(200).entity(composeDataResponse(mUser)).type(MediaType.APPLICATION_JSON).build();

        } catch (LDAPException exc) {

            logger.error("Fail to connect to LDAP. ", exc);

            return Response

                    .status(Response.Status.INTERNAL_SERVER_ERROR)

                    .entity(compose500Message("LDAP error.", exc))

                    .type(MediaType.APPLICATION_JSON)

                    .build();

        } catch (SQLException exc) {

            logger.error("Fail to fetch users. ", exc);

            return Response

                    .status(Response.Status.INTERNAL_SERVER_ERROR)

                    .entity(compose500Message("Fail to fetch users.", exc))

                    .type(MediaType.APPLICATION_JSON)

                    .build();

        }

    }

    @GET

    @Path("/changeRole")

    @Produces(MediaType.APPLICATION_JSON)

    public Response changeRole(@QueryParam("roleId") int roleId, @QueryParam("userId") int userId)

    {

        RoleDAO roleDAO = new RoleDAO();

        try

        {

            Role role = roleDAO.fetchById(roleId);

            if (role == null)

            {

                //fetch all roleids TODO

                String errorMessageJson = compose404Message("Cannot find role with id" + roleId + ".");

                return Response

                        .status(Response.Status.NOT_FOUND)

                        .entity(errorMessageJson)

                        .type(MediaType.APPLICATION_JSON)

                        .build();

            }

            MigrationUser mUser = sqlMigrationUserDAO.fetchById(userId);

            if (mUser == null)

            {

                String errorMessageJson = compose404Message("Cannot find user with id " + userId + ".");

                return Response

                        .status(Response.Status.NOT_FOUND)

                        .entity(errorMessageJson)

                        .type(MediaType.APPLICATION_JSON)

                        .build();

            }

            mUser.setRoleId(roleId);

            sqlMigrationUserDAO.update(mUser);

            return Response.status(200).entity(composeDataResponse(mUser)).build();

        }

        catch (SQLException exc)

        {

            return Response

                    .status(Response.Status.INTERNAL_SERVER_ERROR)

                    .entity(compose500Message("Fail to fetch users.", exc))

                    .type(MediaType.APPLICATION_JSON)

                    .build();

        }

    }

    @GET

    @Path("/getUserInfo")

    @Produces(MediaType.APPLICATION_JSON)

    public Response getUserInfo(@QueryParam("accessToken") String accessToken) throws JsonProcessingException {

        //return Response.status(404).entity(compose404Message("This is a test message.")).type(MediaType.APPLICATION_JSON).build();

        // call aai with accessToken

        RestTemplate restTemplate = new RestTemplate();

        HttpHeaders headers = new HttpHeaders();

        headers.add("Authorization","Bearer " + accessToken);

        HttpEntity request = new HttpEntity(null, headers);

        String fooResourceUrl = "https://aai.openminted.eu/oidc/userinfo";

        logger.info(restTemplate.exchange(fooResourceUrl, HttpMethod.GET, request, Object.class));

        ResponseEntity response1 = restTemplate.exchange(fooResourceUrl, HttpMethod.GET, request, Object.class);

        logger.info(response1.getBody().toString());

        ObjectMapper mapper = new ObjectMapper();

        return Response.status(response1.getStatusCode().value()).entity(mapper.writeValueAsString(response1.getBody())).type(MediaType.APPLICATION_JSON).build();

    }

    /* JSON Utility Methods */

    private String compose401Message(String message) {

        return  "{ \"status\" : \"error\", \"code\" : \"401\", \"message\" : \"  " + message +" \" }";

    }

    private String compose404Message(String message) {

        return  "{ \"status\" : \"error\", \"code\" : \"404\", \"message\" : \"  " + message +" \" }";

    }

    private String compose500Message(String message, Exception exception) {

        return  "{ \"status\" : \"fail\", \"code\" : \"500\", \"message\" : \"  " + message + "\", " +

                "\"description\" : \""+  exception.getMessage() +"\" }";

    }

    private String composeDataResponse(UserInfo user) {

        return "{ \"status\" : \"success\", \"code\": \"200\", " + "\"data\" : \"" + JWTGenerator.generateToken(user, "my-very-secret") + "\" }";

    }

    private String composeDataResponse(MigrationUser user) {

        //return "{ \"status\" : \"success\", \"code\": \"200\", " + "\"data\" : " + new Gson().toJson(user) + " }";

        return "{ \"status\" : \"success\", \"code\": \"200\", " + "\"data\" : \"" + JWTGenerator.generateToken(user, "my-very-secret") + "\" }";

    }

    private String composeDataResponse(LDAPUser user) {

        return " { \"status\" : \"success\", \"code\": \"200\", " + "\"data\" : " + new Gson().toJson(user) + " }";

    }

//        private String composeDataResponse(String username) {

//            return " { \"status\" : \"success\", \"code\": \"200\", " + "\"data\" : " + new Gson().toJson(username) + " }";

//        }

    private String composeDataResponse(String fullname) {

        return " { \"status\" : \"success\", \"code\": \"200\", " + "\"data\" : " + new Gson().toJson(fullname) + " }";

    }

}