Skip to content

Commit d280ca4

Browse files
jricherjricher
committed
login hints now handled in a slightly smarter (and more pluggable) manner, closes mitreid-connect#851 
1 parent 98e1d26 commit d280ca4

File tree

5 files changed

+188
-12
lines changed

5 files changed

+188
-12
lines changed

‎openid-connect-common/src/main/java/org/mitre/openid/connect/service/LoginHintExtracter.java‎

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
/*******************************************************************************
2+
* Copyright 2015 The MITRE Corporation
3+
* and the MIT Kerberos and Internet Trust Consortium
4+
*
5+
* Licensed under the Apache License, Version 2.0 (the "License");
6+
* you may not use this file except in compliance with the License.
7+
* You may obtain a copy of the License at
8+
*
9+
* http://www.apache.org/licenses/LICENSE-2.0
10+
*
11+
* Unless required by applicable law or agreed to in writing, software
12+
* distributed under the License is distributed on an "AS IS" BASIS,
13+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14+
* See the License for the specific language governing permissions and
15+
* limitations under the License.
16+
*******************************************************************************/
17+
18+
package org.mitre.openid.connect.service;
19+
20+
/**
21+
* @author jricher
22+
*
23+
*/
24+
public interface LoginHintExtracter {
25+
26+
/**
27+
* @param loginHint
28+
* @return
29+
*/
30+
public String extractHint(String loginHint);
31+
32+
}

‎openid-connect-server/src/main/java/org/mitre/openid/connect/filter/AuthorizationRequestFilter.java‎

Lines changed: 11 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -19,6 +19,8 @@
1919
*/
2020
package org.mitre.openid.connect.filter;
2121

22+
import static org.mitre.openid.connect.request.ConnectRequestParameters.*;
23+
2224
import java.io.IOException;
2325
import java.net.URISyntaxException;
2426
import java.util.Date;
@@ -37,6 +39,8 @@
3739
import org.apache.http.client.utils.URIBuilder;
3840
import org.mitre.oauth2.model.ClientDetailsEntity;
3941
import org.mitre.oauth2.service.ClientDetailsEntityService;
42+
import org.mitre.openid.connect.service.LoginHintExtracter;
43+
import org.mitre.openid.connect.service.impl.RemoveLoginHintsWithHTTP;
4044
import org.mitre.openid.connect.web.AuthenticationTimeStamper;
4145
import org.slf4j.Logger;
4246
import org.slf4j.LoggerFactory;
@@ -53,16 +57,6 @@
5357
import com.google.common.base.Splitter;
5458
import com.google.common.base.Strings;
5559

56-
import static org.mitre.openid.connect.request.ConnectRequestParameters.ERROR;
57-
import static org.mitre.openid.connect.request.ConnectRequestParameters.LOGIN_HINT;
58-
import static org.mitre.openid.connect.request.ConnectRequestParameters.LOGIN_REQUIRED;
59-
import static org.mitre.openid.connect.request.ConnectRequestParameters.MAX_AGE;
60-
import static org.mitre.openid.connect.request.ConnectRequestParameters.PROMPT;
61-
import static org.mitre.openid.connect.request.ConnectRequestParameters.PROMPT_LOGIN;
62-
import static org.mitre.openid.connect.request.ConnectRequestParameters.PROMPT_NONE;
63-
import static org.mitre.openid.connect.request.ConnectRequestParameters.PROMPT_SEPARATOR;
64-
import static org.mitre.openid.connect.request.ConnectRequestParameters.STATE;
65-
6660
/**
6761
* @author jricher
6862
*
@@ -87,6 +81,9 @@ public class AuthorizationRequestFilter extends GenericFilterBean {
8781
@Autowired
8882
private RedirectResolver redirectResolver;
8983

84+
@Autowired(required = false)
85+
private LoginHintExtracter loginHintExtracter = new RemoveLoginHintsWithHTTP();
86+
9087
/**
9188
*
9289
*/
@@ -115,8 +112,10 @@ public void doFilter(ServletRequest req, ServletResponse res, FilterChain chain)
115112
}
116113

117114
// save the login hint to the session
118-
if (authRequest.getExtensions().get(LOGIN_HINT) != null) {
119-
session.setAttribute(LOGIN_HINT, authRequest.getExtensions().get(LOGIN_HINT));
115+
// but first check to see if the login hint makes any sense
116+
String loginHint = loginHintExtracter.extractHint((String) authRequest.getExtensions().get(LOGIN_HINT));
117+
if (!Strings.isNullOrEmpty(loginHint)) {
118+
session.setAttribute(LOGIN_HINT, loginHint);
120119
} else {
121120
session.removeAttribute(LOGIN_HINT);
122121
}

‎openid-connect-server/src/main/java/org/mitre/openid/connect/service/impl/MatchLoginHintsAgainstUsers.java‎

Lines changed: 59 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,59 @@
1+
/*******************************************************************************
2+
* Copyright 2015 The MITRE Corporation
3+
* and the MIT Kerberos and Internet Trust Consortium
4+
*
5+
* Licensed under the Apache License, Version 2.0 (the "License");
6+
* you may not use this file except in compliance with the License.
7+
* You may obtain a copy of the License at
8+
*
9+
* http://www.apache.org/licenses/LICENSE-2.0
10+
*
11+
* Unless required by applicable law or agreed to in writing, software
12+
* distributed under the License is distributed on an "AS IS" BASIS,
13+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14+
* See the License for the specific language governing permissions and
15+
* limitations under the License.
16+
*******************************************************************************/
17+
18+
package org.mitre.openid.connect.service.impl;
19+
20+
import org.mitre.openid.connect.model.UserInfo;
21+
import org.mitre.openid.connect.service.LoginHintExtracter;
22+
import org.mitre.openid.connect.service.UserInfoService;
23+
import org.springframework.beans.factory.annotation.Autowired;
24+
25+
import com.google.common.base.Strings;
26+
27+
/**
28+
* Checks the login hint against the User Info collection, only populates it if a user is found.
29+
* @author jricher
30+
*
31+
*/
32+
public class MatchLoginHintsAgainstUsers implements LoginHintExtracter {
33+
34+
@Autowired
35+
private UserInfoService userInfoService;
36+
37+
/* (non-Javadoc)
38+
* @see org.mitre.openid.connect.service.LoginHintTester#useHint(java.lang.String)
39+
*/
40+
@Override
41+
public String extractHint(String loginHint) {
42+
if (Strings.isNullOrEmpty(loginHint)) {
43+
return null;
44+
} else {
45+
UserInfo user = userInfoService.getByEmailAddress(loginHint);
46+
if (user == null) {
47+
user = userInfoService.getByUsername(loginHint);
48+
if (user == null) {
49+
return null;
50+
} else {
51+
return user.getPreferredUsername();
52+
}
53+
} else {
54+
return user.getPreferredUsername();
55+
}
56+
}
57+
}
58+
59+
}

‎openid-connect-server/src/main/java/org/mitre/openid/connect/service/impl/PassAllLoginHints.java‎

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,38 @@
1+
/*******************************************************************************
2+
* Copyright 2015 The MITRE Corporation
3+
* and the MIT Kerberos and Internet Trust Consortium
4+
*
5+
* Licensed under the Apache License, Version 2.0 (the "License");
6+
* you may not use this file except in compliance with the License.
7+
* You may obtain a copy of the License at
8+
*
9+
* http://www.apache.org/licenses/LICENSE-2.0
10+
*
11+
* Unless required by applicable law or agreed to in writing, software
12+
* distributed under the License is distributed on an "AS IS" BASIS,
13+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14+
* See the License for the specific language governing permissions and
15+
* limitations under the License.
16+
*******************************************************************************/
17+
18+
package org.mitre.openid.connect.service.impl;
19+
20+
import org.mitre.openid.connect.service.LoginHintExtracter;
21+
22+
/**
23+
* Sends all login hints through to the login page regardless of setup.
24+
*
25+
* @author jricher
26+
*
27+
*/
28+
public class PassAllLoginHints implements LoginHintExtracter {
29+
30+
/* (non-Javadoc)
31+
* @see org.mitre.openid.connect.service.LoginHintTester#useHint(java.lang.String)
32+
*/
33+
@Override
34+
public String extractHint(String loginHint) {
35+
return loginHint;
36+
}
37+
38+
}

‎openid-connect-server/src/main/java/org/mitre/openid/connect/service/impl/RemoveLoginHintsWithHTTP.java‎

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,48 @@
1+
/*******************************************************************************
2+
* Copyright 2015 The MITRE Corporation
3+
* and the MIT Kerberos and Internet Trust Consortium
4+
*
5+
* Licensed under the Apache License, Version 2.0 (the "License");
6+
* you may not use this file except in compliance with the License.
7+
* You may obtain a copy of the License at
8+
*
9+
* http://www.apache.org/licenses/LICENSE-2.0
10+
*
11+
* Unless required by applicable law or agreed to in writing, software
12+
* distributed under the License is distributed on an "AS IS" BASIS,
13+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14+
* See the License for the specific language governing permissions and
15+
* limitations under the License.
16+
*******************************************************************************/
17+
18+
package org.mitre.openid.connect.service.impl;
19+
20+
import org.mitre.openid.connect.service.LoginHintExtracter;
21+
22+
import com.google.common.base.Strings;
23+
24+
/**
25+
* Passes login hints that don't start with "http"
26+
*
27+
* @author jricher
28+
*
29+
*/
30+
public class RemoveLoginHintsWithHTTP implements LoginHintExtracter {
31+
32+
/* (non-Javadoc)
33+
* @see org.mitre.openid.connect.service.LoginHintTester#useHint(java.lang.String)
34+
*/
35+
@Override
36+
public String extractHint(String loginHint) {
37+
if (Strings.isNullOrEmpty(loginHint)) {
38+
return null;
39+
} else {
40+
if (loginHint.startsWith("http")) {
41+
return null;
42+
} else {
43+
return loginHint;
44+
}
45+
}
46+
}
47+
48+
}

0 commit comments

Comments
 (0)