Package org.forgerock.openig.fapi.authorization

Class AbstractFapiAuthorizeRequestValidationFilter

java.lang.Object
org.forgerock.openig.fapi.authorization.AbstractFapiAuthorizeRequestValidationFilter
All Implemented Interfaces:
Filter
Direct Known Subclasses:
FapiAuthorizeRequestValidationFilter, FapiParRequestValidationFilter
public abstract class AbstractFapiAuthorizeRequestValidationFilter extends Object implements Filter
Abstract Filter for validating that authorize requests are FAPI compliant.

This Filter is meant to be extended to provide implementations which are specific to particular OAuth2.0 endpoints that handle such requests respectively /authorize and /par.

  • Constructor Details

    • AbstractFapiAuthorizeRequestValidationFilter

      protected AbstractFapiAuthorizeRequestValidationFilter(Set<String> allowedHttpMethods, Set<String> endpointRequiredClaims)
      Build the filter with a list of specific endpoint required claims that must be present in the request JWT.

      The FAPI Advanced part 1 spec section 5.2.2.1 states that: if it is desired to provide the authenticated user's identifier to the client in the token response, the authorization server shall support the authentication request as in Section 3.1.2.1 of OIDC Authentication Request.

      The OIDC spec states that scope, response_type, client_id and redirect are required.

      Also FAPI Advanced Part 1, part 5.2.2.3 states that request shall require the nonce parameter defined in Section 3.1.2.1 of OIDC in the authentication request. See Client requesting openid scope or Clients not requesting openid scope.

      Parameters:
      allowedHttpMethods - set of http method allowed by the specific endpoint, must not be null
      endpointRequiredClaims - the specific endpoint required claims, must not be null

  • Method Details

    • filter

      public Promise<Response,NeverThrowsException> filter(Context context, Request request, Handler next)
      Description copied from interface: Filter
      Filters the request and/or response of an exchange. To pass the request to the next filter or handler in the chain, the filter calls next.handle(context, request).

      This method may elect not to pass the request to the next filter or handler, and instead handle the request itself. It can achieve this by merely avoiding a call to next.handle(context, request) and creating its own response object. The filter is also at liberty to replace a response with another of its own by intercepting the response returned by the next handler.

      Specified by:
      filter in interface Filter
      Parameters:
      context - The request context.
      request - The request.
      next - The next filter or handler in the chain to handle the request.
      Returns:
      A Promise representing the response to be returned to the client.

    • createAuthorizationRequest

      protected abstract AuthorizationRequest createAuthorizationRequest(Request request)
      Create a specific AuthorizationRequest for the endpoint.
      Parameters:
      request - the request to use
      Returns:
      the AuthorizationRequest created

    • errorResponse

      protected static Promise<Response,NeverThrowsException> errorResponse(AuthorizationRequestException e)
      Build a Response promise from the given AuthorizationRequestException with Status.BAD_REQUEST status code.
      Parameters:
      e - the exception to use
      Returns:
      the Response built

    • checkEndpointSpecificClaims

      protected abstract void checkEndpointSpecificClaims(JwtClaimsSet requestJwtClaimSet) throws AuthorizationRequestException
      Check specific claim combinations to the request type.
      Parameters:
      requestJwtClaimSet - - the claims found in the JAR object of the request
      Throws:
      AuthorizationRequestException