Package com.broadleafcommerce.auth.user.session.token.enhancer

Class ClientRestrictionAccessTokenEnhancer

java.lang.Object

com.broadleafcommerce.auth.user.session.token.enhancer.ClientRestrictionAccessTokenEnhancer

All Implemented Interfaces:

JwtAccessTokenEnhancer, org.springframework.core.Ordered

public class ClientRestrictionAccessTokenEnhancer
extends Object
implements JwtAccessTokenEnhancer

Provides claims "restrictions" and "restricted_authorities".

See Also:

• AccessTokenClaimKeys.ClientRestrictionClaims

Field Summary

Fields inherited from interface org.springframework.core.Ordered

HIGHEST_PRECEDENCE, LOWEST_PRECEDENCE

Constructor Summary

Constructors

Constructor	Description
ClientRestrictionAccessTokenEnhancer(AuthorizationServerService<AuthorizationServer> authorizationServerService, AuthorizedClientService<AuthorizedClient> authorizedClientService, TokenEnhancerUtility tokenEnhancerUtility, SecurityService securityService)

Method Summary

Modifier and Type	Method	Description
protected void	addTenantClaims(AuthorizedClient client, JwtTokenEnhancerContext context)
protected void	addVendorRestrictionClaims(Set<String> vendorTargets, JwtTokenEnhancerContext context)
protected Set<String>	convertValueToSet(Object vendorTargetsAttribute)
void	enhance(JwtTokenEnhancerContext context)	Evaluate the authentication and add claims as necessary.
protected AuthorizationServerService<AuthorizationServer>	getAuthorizationServerService()
protected AuthorizedClientService<AuthorizedClient>	getAuthorizedClientService()
protected Collection<String>	getGrantedAuthorities(JwtTokenEnhancerContext context)
protected Map<String,Map<String,Set<String>>>	getRestrictedAuthoritiesInScopes(Set<String> authorizedScopes, Collection<String> authorities, Map<String,Set<String>> restrictionTargetsByType)	Filter the restricted authorities that are in the authorized scopes.
protected SecurityService	getSecurityService()
protected TokenEnhancerUtility	getTokenEnhancerUtility()
protected boolean	shouldEnhance(JwtTokenEnhancerContext context)

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Methods inherited from interface com.broadleafcommerce.auth.user.session.token.enhancer.JwtAccessTokenEnhancer

getOrder

Constructor Details

ClientRestrictionAccessTokenEnhancer

public ClientRestrictionAccessTokenEnhancer(AuthorizationServerService<AuthorizationServer> authorizationServerService,
 AuthorizedClientService<AuthorizedClient> authorizedClientService,
 TokenEnhancerUtility tokenEnhancerUtility,
 SecurityService securityService)

Method Details

enhance

public void enhance(JwtTokenEnhancerContext context)

Description copied from interface: JwtAccessTokenEnhancer

Evaluate the authentication and add claims as necessary. A JwtTokenEnhancerContext contains User and client authentication tokens, authorization tokens, and access token claims.

Specified by:

enhance in interface JwtAccessTokenEnhancer

Parameters:

context - The JwtTokenEnhancerContext to evaluate.

addVendorRestrictionClaims

protected void addVendorRestrictionClaims(Set<String> vendorTargets,
 JwtTokenEnhancerContext context)

addTenantClaims

protected void addTenantClaims(AuthorizedClient client,
 JwtTokenEnhancerContext context)

getGrantedAuthorities

protected Collection<String> getGrantedAuthorities(JwtTokenEnhancerContext context)

shouldEnhance

protected boolean shouldEnhance(JwtTokenEnhancerContext context)

convertValueToSet

protected Set<String> convertValueToSet(Object vendorTargetsAttribute)

getRestrictedAuthoritiesInScopes

protected Map<String,Map<String,Set<String>>> getRestrictedAuthoritiesInScopes(Set<String> authorizedScopes,
 Collection<String> authorities,
 Map<String,Set<String>> restrictionTargetsByType)

Filter the restricted authorities that are in the authorized scopes. Create map entry for each of the relevant permissions with the given restriction targets.

Since AuthorizedClient does not have any RestrictedPermission or RestrictedRole, the restricted_authorities claim is essentially all the authorities in scope mapped with its restrictions.

Example: READ_PRODUCT:VENDOR:[vendor, vendor2]

Parameters:

authorizedScopes - The requested scopes that have been authorized.

authorities - The Set of all possible authorities (permissions) this client could potentially be granted.

restrictionTargetsByType - The restrictions to map with the given authorities

Returns:

a map of restricted authorities in the requested scopes

getAuthorizationServerService

protected AuthorizationServerService<AuthorizationServer> getAuthorizationServerService()

getAuthorizedClientService

protected AuthorizedClientService<AuthorizedClient> getAuthorizedClientService()

getTokenEnhancerUtility

protected TokenEnhancerUtility getTokenEnhancerUtility()

getSecurityService

protected SecurityService getSecurityService()