1
|
package eu.dnetlib.openaire.usermanagement.security;
|
2
|
|
3
|
import com.google.gson.JsonObject;
|
4
|
import eu.dnetlib.openaire.user.pojos.migration.MigrationUser;
|
5
|
import io.jsonwebtoken.Claims;
|
6
|
import io.jsonwebtoken.Jwts;
|
7
|
import io.jsonwebtoken.SignatureAlgorithm;
|
8
|
import org.apache.log4j.Logger;
|
9
|
import org.mitre.openid.connect.model.OIDCAuthenticationToken;
|
10
|
import org.mitre.openid.connect.model.UserInfo;
|
11
|
|
12
|
import java.io.UnsupportedEncodingException;
|
13
|
import java.net.URLEncoder;
|
14
|
import java.text.ParseException;
|
15
|
import java.util.Date;
|
16
|
|
17
|
public class JWTGenerator {
|
18
|
|
19
|
private static final Logger logger = Logger.getLogger(JWTGenerator.class);
|
20
|
|
21
|
public static String generateToken(MigrationUser u, String secret) {
|
22
|
Claims claims = Jwts.claims().setSubject(u.getUsername());
|
23
|
claims.put("fullname", u.getFullname() + "");
|
24
|
claims.put("userId", u.getId() + "");
|
25
|
claims.put("email", u.getEmail() + "");
|
26
|
claims.put("role", u.getRoleId());
|
27
|
|
28
|
//expiration
|
29
|
long nowMillis = System.currentTimeMillis();
|
30
|
Date now = new Date(nowMillis);
|
31
|
long ttlMillis = 1800000;
|
32
|
long expMillis = nowMillis + ttlMillis;
|
33
|
Date exp = new Date(expMillis);
|
34
|
|
35
|
return Jwts.builder()
|
36
|
.setClaims(claims)
|
37
|
.setExpiration(exp)
|
38
|
.signWith(SignatureAlgorithm.HS512, secret)
|
39
|
.compact();
|
40
|
}
|
41
|
|
42
|
public static String generateToken(OIDCAuthenticationToken authOIDC, String secret) {
|
43
|
|
44
|
try {
|
45
|
|
46
|
JsonObject userInfo = authOIDC.getUserInfo().getSource();
|
47
|
Claims claims = Jwts.claims().setSubject(authOIDC.getUserInfo().getSub());
|
48
|
claims.put("fullname", URLEncoder.encode(authOIDC.getUserInfo().getName(), "UTF-8") + "");
|
49
|
|
50
|
if (authOIDC.getUserInfo().getGivenName() == null){
|
51
|
logger.info("User: " + authOIDC.getUserInfo().getName() + "doesn't have first name");
|
52
|
claims.put("firstname", URLEncoder.encode(" ", "UTF-8") + "");
|
53
|
} else {
|
54
|
claims.put("firstname", URLEncoder.encode(authOIDC.getUserInfo().getGivenName(), "UTF-8") + "");
|
55
|
}
|
56
|
if (authOIDC.getUserInfo().getFamilyName() == null){
|
57
|
logger.info("User: " + authOIDC.getUserInfo().getName() + "doesn't have first name");
|
58
|
claims.put("lastname", URLEncoder.encode(" ", "UTF-8") + "");
|
59
|
} else {
|
60
|
claims.put("lastname", URLEncoder.encode(authOIDC.getUserInfo().getFamilyName(), "UTF-8") + "");
|
61
|
}
|
62
|
claims.put("email", authOIDC.getUserInfo().getEmail() + "");
|
63
|
|
64
|
// if (userInfo.getAsJsonArray("eduPersonScopedAffiliation").toString() != null) {
|
65
|
// claims.put("role", URLEncoder.encode(userInfo.getAsJsonArray("edu_person_scoped_affiliations").toString(), "UTF-8") + "");
|
66
|
// }
|
67
|
|
68
|
if (userInfo.getAsJsonArray("edu_person_entitlements") == null){
|
69
|
logger.info("User: " + authOIDC.getUserInfo().getName() + "doesn't have role");
|
70
|
claims.put("role", URLEncoder.encode(" ", "UTF-8") + "");
|
71
|
} else {
|
72
|
claims.put("role", URLEncoder.encode(userInfo.getAsJsonArray("edu_person_entitlements").toString(), "UTF-8") + "");
|
73
|
}
|
74
|
|
75
|
//TODO remove, We don't need it but if we are going to use it, we need to check if the user has affiliation
|
76
|
//claims.put("edu_person_scoped_affiliations", URLEncoder.encode(userInfo.getAsJsonArray("edu_person_scoped_affiliations").toString(), "UTF-8") + "");
|
77
|
|
78
|
//TODO remove
|
79
|
//TODO THIS IS TEST
|
80
|
// claims.put("fullname", URLEncoder.encode("Σοφία Μπαλτζή", "UTF-8") + "");
|
81
|
// claims.put("firstname", URLEncoder.encode("Σοφία", "UTF-8") + "");
|
82
|
// claims.put("lastname", URLEncoder.encode("Μπαλτζή", "UTF-8") + "");
|
83
|
// claims.put("email", "sofie.mpl@gmail.com" + "");
|
84
|
// claims.put("edu_person_scoped_affiliations", "faculty");
|
85
|
|
86
|
Date exp = new Date(authOIDC.getIdToken().getJWTClaimsSet().getExpirationTime().getTime());
|
87
|
// logger.info("expirationTime: "+ exp);
|
88
|
|
89
|
//TODO DELETE LOGS
|
90
|
// logger.info("\n////////////////////////////////////////////////////////////////////////////////////////////////\n");
|
91
|
// logger.info("fullName: " + authOIDC.getUserInfo().getName());
|
92
|
// logger.info("firstName: " + authOIDC.getUserInfo().getGivenName());
|
93
|
// logger.info("lastName: " + authOIDC.getUserInfo().getFamilyName());
|
94
|
// logger.info("email: " + authOIDC.getUserInfo().getEmail());
|
95
|
// //logger.info("Check everything");
|
96
|
// logger.info("locale: " + authOIDC.getUserInfo().getSource());
|
97
|
// logger.info("role: " + userInfo.getAsJsonArray("edu_person_entitlements").toString());
|
98
|
// //logger.info("affiliation: " + userInfo.getAsJsonArray("edu_person_scoped_affiliations").toString());
|
99
|
// logger.info("expirationTime: " + exp);
|
100
|
// logger.info("\n////////////////////////////////////////////////////////////////////////////////////////////////\n");
|
101
|
|
102
|
return Jwts.builder()
|
103
|
.setClaims(claims)
|
104
|
.setExpiration(exp)
|
105
|
.signWith(SignatureAlgorithm.HS512, secret)
|
106
|
.compact();
|
107
|
|
108
|
} catch (ParseException e) {
|
109
|
e.printStackTrace();
|
110
|
logger.error("JWT Parse Exception from getting Expiration Time ", e);
|
111
|
return "error";
|
112
|
} catch (UnsupportedEncodingException e) {
|
113
|
e.printStackTrace();
|
114
|
logger.error("UnsupportedEncodingException UTF-8 ", e);
|
115
|
return "error";
|
116
|
}
|
117
|
}
|
118
|
|
119
|
|
120
|
public static JsonObject generateJsonToken(OIDCAuthenticationToken authOIDC) {
|
121
|
try {
|
122
|
|
123
|
JsonObject userInfo = authOIDC.getUserInfo().getSource();
|
124
|
JsonObject userInfo2 = new JsonObject();
|
125
|
|
126
|
if (authOIDC.getUserInfo().getSub() == null) {
|
127
|
logger.info("User doesn't have sub");
|
128
|
userInfo2.addProperty("sub", "");
|
129
|
} else {
|
130
|
userInfo2.addProperty("sub", URLEncoder.encode(authOIDC.getUserInfo().getSub(), "UTF-8"));
|
131
|
}
|
132
|
if (authOIDC.getUserInfo().getName() == null) {
|
133
|
logger.info("User doesn't have fullname");
|
134
|
userInfo2.addProperty("fullname", "");
|
135
|
} else {
|
136
|
userInfo2.addProperty("fullname", URLEncoder.encode(authOIDC.getUserInfo().getName(), "UTF-8"));
|
137
|
}
|
138
|
if (authOIDC.getUserInfo().getGivenName() == null){
|
139
|
logger.info("User: " + authOIDC.getUserInfo().getName() + "doesn't have first name");
|
140
|
// userInfo2.addProperty("firstname", URLEncoder.encode(" ", "UTF-8") + "");
|
141
|
userInfo2.addProperty("firstname", "");
|
142
|
} else {
|
143
|
userInfo2.addProperty("firstname", URLEncoder.encode(authOIDC.getUserInfo().getGivenName(), "UTF-8") + "");
|
144
|
}
|
145
|
if (authOIDC.getUserInfo().getFamilyName() == null){
|
146
|
logger.info("User: " + authOIDC.getUserInfo().getName() + "doesn't have first name");
|
147
|
// userInfo2.addProperty("lastname", URLEncoder.encode(" ", "UTF-8") + "");
|
148
|
userInfo2.addProperty("lastname", "");
|
149
|
} else {
|
150
|
userInfo2.addProperty("lastname", URLEncoder.encode(authOIDC.getUserInfo().getFamilyName(), "UTF-8") + "");
|
151
|
}
|
152
|
userInfo2.addProperty("email", authOIDC.getUserInfo().getEmail() + "");
|
153
|
|
154
|
if (userInfo.getAsJsonArray("edu_person_entitlements") == null){
|
155
|
logger.info("User: " + authOIDC.getUserInfo().getName() + "doesn't have role");
|
156
|
// userInfo2.addProperty("role", URLEncoder.encode(" ", "UTF-8") + "");
|
157
|
userInfo2.addProperty("role", "");
|
158
|
} else {
|
159
|
userInfo2.addProperty("role", URLEncoder.encode(userInfo.getAsJsonArray("edu_person_entitlements").toString(), "UTF-8") + "");
|
160
|
}
|
161
|
|
162
|
logger.info("UserINFO: " + userInfo2.toString());
|
163
|
return userInfo2;
|
164
|
|
165
|
} catch (UnsupportedEncodingException e) {
|
166
|
e.printStackTrace();
|
167
|
logger.error("UnsupportedEncodingException UTF-8 ", e);
|
168
|
JsonObject error = new JsonObject();
|
169
|
error.addProperty("error", "UnsupportedEncodingException UTF-8 " + e);
|
170
|
return error;
|
171
|
}
|
172
|
|
173
|
}
|
174
|
|
175
|
//TODO DELETE IF IT IS NOT NECESSARY
|
176
|
public static String generateAccessToken(OIDCAuthenticationToken authOIDC, String secret) {
|
177
|
Claims claims = Jwts.claims().setId(authOIDC.getAccessTokenValue());
|
178
|
|
179
|
//TODO DELETE LOGS
|
180
|
logger.info("\n////////////////////////////////////////////////////////////////////////////////////////////////\n");
|
181
|
logger.info("access token: " + authOIDC.getAccessTokenValue());
|
182
|
logger.info("\n////////////////////////////////////////////////////////////////////////////////////////////////\n");
|
183
|
|
184
|
return Jwts.builder()
|
185
|
.setClaims(claims)
|
186
|
.signWith(SignatureAlgorithm.HS512, secret)
|
187
|
.compact();
|
188
|
}
|
189
|
|
190
|
|
191
|
public static String generateToken(UserInfo user, String secret) {
|
192
|
try {
|
193
|
|
194
|
JsonObject userInfo = user.getSource();
|
195
|
|
196
|
Claims claims = Jwts.claims().setSubject(user.getSub());
|
197
|
claims.put("email", user.getEmail() + "");
|
198
|
claims.put("role", URLEncoder.encode(userInfo.getAsJsonArray("edu_person_entitlements").toString(), "UTF-8") + "");
|
199
|
|
200
|
return Jwts.builder()
|
201
|
.setClaims(claims)
|
202
|
.signWith(SignatureAlgorithm.HS512, secret)
|
203
|
.compact();
|
204
|
} catch (UnsupportedEncodingException e) {
|
205
|
e.printStackTrace();
|
206
|
logger.error("UnsupportedEncodingException UTF-8 ", e);
|
207
|
return "error";
|
208
|
}
|
209
|
}
|
210
|
|
211
|
}
|
212
|
|
213
|
|
214
|
|
215
|
|
216
|
// How to add it manually
|
217
|
// long nowMillis = System.currentTimeMillis();
|
218
|
// //This is my token
|
219
|
// try {
|
220
|
// String jwt = Jwts.builder()
|
221
|
// .setSubject("Argiro")
|
222
|
// .setExpiration(new Date(nowMillis+1800000))
|
223
|
// .claim("fullname", "Argiro Kokogianaki")
|
224
|
// .claim("id", "8")
|
225
|
// .claim("email", "argiro@gmail.com")
|
226
|
// .claim("role","2")
|
227
|
// .signWith(
|
228
|
// SignatureAlgorithm.HS512,
|
229
|
// "my-very-secret".getBytes("UTF-8")
|
230
|
// )
|
231
|
// .compact();
|