Skip to content

Commit 8c822c0

Browse files
jricherjricher
committed
detached whitelist from approved sites, closes mitreid-connect#781 
1 parent 2d6be48 commit 8c822c0

File tree

10 files changed

+12
-152
lines changed

10 files changed

+12
-152
lines changed

‎openid-connect-common/src/main/java/org/mitre/openid/connect/model/ApprovedSite.java‎

Lines changed: 0 additions & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -82,9 +82,6 @@ public class ApprovedSite {
8282
// this should include all information for what data to access
8383
private Set<String> allowedScopes;
8484

85-
// If this AP is a WS, link to the WS
86-
private WhitelistedSite whitelistedSite;
87-
8885
//Link to any access tokens approved through this stored decision
8986
private Set<OAuth2AccessTokenEntity> approvedAccessTokens = Sets.newHashSet();
9087

@@ -215,26 +212,6 @@ public void setTimeoutDate(Date timeoutDate) {
215212
this.timeoutDate = timeoutDate;
216213
}
217214

218-
/**
219-
* Does this AP entry correspond to a WS?
220-
* @return
221-
*/
222-
@Transient
223-
public Boolean getIsWhitelisted() {
224-
return (whitelistedSite != null);
225-
}
226-
227-
228-
@ManyToOne
229-
@JoinColumn(name="whitelisted_site_id")
230-
public WhitelistedSite getWhitelistedSite() {
231-
return whitelistedSite;
232-
}
233-
234-
public void setWhitelistedSite(WhitelistedSite whitelistedSite) {
235-
this.whitelistedSite = whitelistedSite;
236-
}
237-
238215
/**
239216
* Has this approval expired?
240217
* @return

‎openid-connect-common/src/main/java/org/mitre/openid/connect/service/ApprovedSiteService.java‎

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -21,7 +21,6 @@
2121
import java.util.Set;
2222

2323
import org.mitre.openid.connect.model.ApprovedSite;
24-
import org.mitre.openid.connect.model.WhitelistedSite;
2524
import org.springframework.security.oauth2.provider.ClientDetails;
2625

2726
/**
@@ -33,7 +32,7 @@
3332
public interface ApprovedSiteService {
3433

3534

36-
public ApprovedSite createApprovedSite(String clientId, String userId, Date timeoutDate, Set<String> allowedScopes, WhitelistedSite whitelistedSite);
35+
public ApprovedSite createApprovedSite(String clientId, String userId, Date timeoutDate, Set<String> allowedScopes);
3736

3837
/**
3938
* Return a collection of all ApprovedSites

‎openid-connect-server-webapp/src/main/webapp/resources/js/admin.js‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -801,7 +801,6 @@ var AppRouter = Backbone.Router.extend({
801801
this.updateSidebar('user/approved');
802802

803803
var view = new ApprovedSiteListView({model:this.approvedSiteList, clientList: this.clientList, systemScopeList: this.systemScopeList});
804-
805804
view.load(
806805
function(collection, response, options) {
807806
$('#content').html(view.render().el);

‎openid-connect-server-webapp/src/main/webapp/resources/js/grant.js‎

Lines changed: 6 additions & 36 deletions
Original file line numberDiff line numberDiff line change
@@ -70,7 +70,6 @@ var ApprovedSiteListView = Backbone.View.extend({
7070
$(this.el).html($('#tmpl-grant-table').html());
7171

7272
var approvedSiteCount = 0;
73-
var whitelistCount = 0;
7473

7574
var _self = this;
7675

@@ -80,17 +79,10 @@ var ApprovedSiteListView = Backbone.View.extend({
8079

8180
if (client != null) {
8281

83-
if (approvedSite.get('whitelistedSite') != null) {
84-
var view = new ApprovedSiteView({model: approvedSite, client: client, systemScopeList: this.options.systemScopeList});
85-
view.parentView = _self;
86-
$('#grant-whitelist-table', this.el).append(view.render().el);
87-
whitelistCount = whitelistCount + 1;
88-
} else {
89-
var view = new ApprovedSiteView({model: approvedSite, client: client, systemScopeList: this.options.systemScopeList});
90-
view.parentView = _self;
91-
$('#grant-table', this.el).append(view.render().el);
92-
approvedSiteCount = approvedSiteCount + 1;
93-
}
82+
var view = new ApprovedSiteView({model: approvedSite, client: client, systemScopeList: this.options.systemScopeList});
83+
view.parentView = _self;
84+
$('#grant-table', this.el).append(view.render().el);
85+
approvedSiteCount = approvedSiteCount + 1;
9486

9587
}
9688

@@ -102,36 +94,15 @@ var ApprovedSiteListView = Backbone.View.extend({
10294
},
10395

10496
togglePlaceholder:function() {
105-
// count the whitelisted and non-whitelisted entries
106-
var wl = 0;
107-
var gr = 0;
108-
for (var i = 0; i < this.model.length; i++) {
109-
if (this.model.at(i).get('whitelistedSite') != null) {
110-
wl += 1;
111-
} else {
112-
gr += 1;
113-
}
114-
}
115-
116-
if (wl > 0) {
117-
$('#grant-whitelist-table', this.el).show();
118-
$('#grant-whitelist-table-empty', this.el).hide();
119-
} else {
120-
$('#grant-whitelist-table', this.el).hide();
121-
$('#grant-whitelist-table-empty', this.el).show();
122-
}
123-
if (gr > 0) {
97+
// count entries
98+
if (this.model.length > 0) {
12499
$('#grant-table', this.el).show();
125100
$('#grant-table-empty', this.el).hide();
126101
} else {
127102
$('#grant-table', this.el).hide();
128103
$('#grant-table-empty', this.el).show();
129104
}
130105

131-
$('#approvde-site-count', this.el).html(gr);
132-
$('#whitelist-count', this.el).html(wl);
133-
134-
135106
},
136107

137108
refreshTable:function(e) {
@@ -231,7 +202,6 @@ var ApprovedSiteView = Backbone.View.extend({
231202
$('.client-more-info-block', this.el).html(this.moreInfoTemplate({client: this.options.client.toJSON()}));
232203

233204
this.$('.dynamically-registered').tooltip({title: $.t('grant.grant-table.dynamically-registered')});
234-
this.$('.whitelisted-site').tooltip({title: $.t('grant.grant-table.whitelisted-site')});
235205
this.$('.tokens').tooltip({title: $.t('grant.grant-table.active-tokens')});
236206
$(this.el).i18n();
237207
return this;

‎openid-connect-server-webapp/src/main/webapp/resources/template/grant.html‎

Lines changed: 1 addition & 38 deletions
Original file line numberDiff line numberDiff line change
@@ -22,16 +22,7 @@
2222
<button class="btn btn-small refresh-table"><i class="icon-refresh"></i> <span data-i18n="common.refresh">Refresh</span></button>
2323
</div>
2424

25-
<div class="tabbable">
26-
27-
<ul class="nav nav-tabs">
28-
<li class="active"><a data-target="#grant-approved-tab" data-toggle="tab" href="#"><span data-i18n="grant.grant-table.approved-sites">Approved Sites</span> <span class="label label-info" id="approvde-site-count">?</span></a></li>
29-
<li><a data-target="#grant-whitelist-tab" data-toggle="tab" href="#"><span data-i18n="grant.grant-table.whitelisted-sites">Whitelisted Sites</span> <span class="label label-info" id="whitelist-count">?</span></a></li>
30-
</ul>
31-
32-
<div class="tab-content">
33-
34-
<div class="tab-pane active" id="grant-approved-tab">
25+
<div id="grant-approved-tab">
3526

3627
<p data-i18n="grant.grant-table.text">These are sites you have approved manually. If the same site asks for the same access in the future, it will
3728
be granted without prompting.</p>
@@ -55,34 +46,6 @@
5546

5647
</div>
5748

58-
<div class="tab-pane" id="grant-whitelist-tab">
59-
60-
<p data-i18n="grant.grant-table.pre-approved">These are sites that have been pre-approved by an administrator.</p>
61-
<p class="text-warning" data-i18n="[html]grant.grant-table.whitelist-note"><b>NOTE:</b> If you revoke them here, they will automatically be re-approved on your next visit wthout prompting.</p>
62-
63-
<div id="grant-whitelist-table-empty" class="alert alert-info" data-i18n="grant.grant-table.no-whitelisted">
64-
You have not accessed any whitelisted sites.
65-
</div>
66-
67-
<table id="grant-whitelist-table" class="table table-hover table-striped">
68-
<thead>
69-
<tr>
70-
<th></th>
71-
<th data-i18n="grant.grant-table.application">Application</th>
72-
<th><i class="icon-time"></i></th>
73-
<th><i class="icon-edit"></i></th>
74-
</tr>
75-
</thead>
76-
<tbody>
77-
</tbody>
78-
</table>
79-
80-
</div>
81-
82-
</div>
83-
84-
</div>
85-
8649
<div class="well well-small">
8750
<button class="btn btn-small refresh-table"><i class="icon-refresh"></i> <span data-i18n="common.refresh">Refresh</span></button>
8851
</div>

‎openid-connect-server/src/main/java/org/mitre/openid/connect/service/impl/DefaultApprovedSiteService.java‎

Lines changed: 1 addition & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -23,7 +23,6 @@
2323
import org.mitre.oauth2.model.OAuth2AccessTokenEntity;
2424
import org.mitre.oauth2.repository.OAuth2TokenRepository;
2525
import org.mitre.openid.connect.model.ApprovedSite;
26-
import org.mitre.openid.connect.model.WhitelistedSite;
2726
import org.mitre.openid.connect.repository.ApprovedSiteRepository;
2827
import org.mitre.openid.connect.service.ApprovedSiteService;
2928
import org.mitre.openid.connect.service.StatsService;
@@ -99,8 +98,7 @@ public void remove(ApprovedSite approvedSite) {
9998

10099
@Override
101100
@Transactional
102-
public ApprovedSite createApprovedSite(String clientId, String userId, Date timeoutDate, Set<String> allowedScopes,
103-
WhitelistedSite whitelistedSite) {
101+
public ApprovedSite createApprovedSite(String clientId, String userId, Date timeoutDate, Set<String> allowedScopes) {
104102

105103
ApprovedSite as = approvedSiteRepository.save(new ApprovedSite());
106104

@@ -111,7 +109,6 @@ public ApprovedSite createApprovedSite(String clientId, String userId, Date time
111109
as.setUserId(userId);
112110
as.setTimeoutDate(timeoutDate);
113111
as.setAllowedScopes(allowedScopes);
114-
as.setWhitelistedSite(whitelistedSite);
115112

116113
return save(as);
117114

‎openid-connect-server/src/main/java/org/mitre/openid/connect/service/impl/MITREidDataService_1_0.java‎

Lines changed: 1 addition & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -493,7 +493,6 @@ private SavedUserAuthentication readSavedUserAuthentication(JsonReader reader) t
493493
}
494494

495495
Map<Long, Long> grantOldToNewIdMap = new HashMap<>();
496-
Map<Long, Long> grantToWhitelistedSiteRefs = new HashMap<>();
497496
Map<Long, Set<Long>> grantToAccessTokensRefs = new HashMap<>();
498497

499498
/**
@@ -553,7 +552,7 @@ private void readGrants(JsonReader reader) throws IOException {
553552
Long newId = approvedSiteRepository.save(site).getId();
554553
grantOldToNewIdMap.put(currentId, newId);
555554
if (whitelistedSiteId != null) {
556-
grantToWhitelistedSiteRefs.put(currentId, whitelistedSiteId);
555+
logger.debug("Ignoring whitelisted site marker on approved site.");
557556
}
558557
if (tokenIds != null) {
559558
grantToAccessTokensRefs.put(currentId, tokenIds);
@@ -894,16 +893,6 @@ private void fixObjectReferences() {
894893
tokenRepository.saveAccessToken(accessToken);
895894
}
896895
accessTokenToIdTokenRefs.clear();
897-
for (Long oldGrantId : grantToWhitelistedSiteRefs.keySet()) {
898-
Long oldWhitelistedSiteId = grantToWhitelistedSiteRefs.get(oldGrantId);
899-
Long newWhitelistedSiteId = whitelistedSiteOldToNewIdMap.get(oldWhitelistedSiteId);
900-
WhitelistedSite wlSite = wlSiteRepository.getById(newWhitelistedSiteId);
901-
Long newGrantId = grantOldToNewIdMap.get(oldGrantId);
902-
ApprovedSite approvedSite = approvedSiteRepository.getById(newGrantId);
903-
approvedSite.setWhitelistedSite(wlSite);
904-
approvedSiteRepository.save(approvedSite);
905-
}
906-
grantToWhitelistedSiteRefs.clear();
907896
whitelistedSiteOldToNewIdMap.clear();
908897
for (Long oldGrantId : grantToAccessTokensRefs.keySet()) {
909898
Set<Long> oldAccessTokenIds = grantToAccessTokensRefs.get(oldGrantId);

‎openid-connect-server/src/main/java/org/mitre/openid/connect/service/impl/MITREidDataService_1_1.java‎

Lines changed: 1 addition & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -503,7 +503,6 @@ private SavedUserAuthentication readSavedUserAuthentication(JsonReader reader) t
503503
}
504504

505505
Map<Long, Long> grantOldToNewIdMap = new HashMap<>();
506-
Map<Long, Long> grantToWhitelistedSiteRefs = new HashMap<>();
507506
Map<Long, Set<Long>> grantToAccessTokensRefs = new HashMap<>();
508507

509508
/**
@@ -563,7 +562,7 @@ private void readGrants(JsonReader reader) throws IOException {
563562
Long newId = approvedSiteRepository.save(site).getId();
564563
grantOldToNewIdMap.put(currentId, newId);
565564
if (whitelistedSiteId != null) {
566-
grantToWhitelistedSiteRefs.put(currentId, whitelistedSiteId);
565+
logger.debug("Ignoring whitelisted site marker on approved site.");
567566
}
568567
if (tokenIds != null) {
569568
grantToAccessTokensRefs.put(currentId, tokenIds);
@@ -908,16 +907,6 @@ private void fixObjectReferences() {
908907
tokenRepository.saveAccessToken(accessToken);
909908
}
910909
accessTokenToIdTokenRefs.clear();
911-
for (Long oldGrantId : grantToWhitelistedSiteRefs.keySet()) {
912-
Long oldWhitelistedSiteId = grantToWhitelistedSiteRefs.get(oldGrantId);
913-
Long newWhitelistedSiteId = whitelistedSiteOldToNewIdMap.get(oldWhitelistedSiteId);
914-
WhitelistedSite wlSite = wlSiteRepository.getById(newWhitelistedSiteId);
915-
Long newGrantId = grantOldToNewIdMap.get(oldGrantId);
916-
ApprovedSite approvedSite = approvedSiteRepository.getById(newGrantId);
917-
approvedSite.setWhitelistedSite(wlSite);
918-
approvedSiteRepository.save(approvedSite);
919-
}
920-
grantToWhitelistedSiteRefs.clear();
921910
for (Long oldGrantId : grantToAccessTokensRefs.keySet()) {
922911
Set<Long> oldAccessTokenIds = grantToAccessTokensRefs.get(oldGrantId);
923912
Set<OAuth2AccessTokenEntity> tokens = new HashSet<>();

‎openid-connect-server/src/main/java/org/mitre/openid/connect/service/impl/MITREidDataService_1_2.java‎

Lines changed: 0 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -295,7 +295,6 @@ private void writeGrants(JsonWriter writer) throws IOException {
295295
writer.name("userId").value(site.getUserId());
296296
writer.name("allowedScopes");
297297
writeNullSafeArray(writer, site.getAllowedScopes());
298-
writer.name("whitelistedSiteId").value(site.getIsWhitelisted() ? site.getWhitelistedSite().getId() : null);
299298
Set<OAuth2AccessTokenEntity> tokens = site.getApprovedAccessTokens();
300299
writer.name("approvedAccessTokens");
301300
writer.beginArray();
@@ -780,7 +779,6 @@ private SavedUserAuthentication readSavedUserAuthentication(JsonReader reader) t
780779
}
781780

782781
Map<Long, Long> grantOldToNewIdMap = new HashMap<>();
783-
Map<Long, Long> grantToWhitelistedSiteRefs = new HashMap<>();
784782
Map<Long, Set<Long>> grantToAccessTokensRefs = new HashMap<>();
785783

786784
/**
@@ -792,7 +790,6 @@ private void readGrants(JsonReader reader) throws IOException {
792790
while (reader.hasNext()) {
793791
ApprovedSite site = new ApprovedSite();
794792
Long currentId = null;
795-
Long whitelistedSiteId = null;
796793
Set<Long> tokenIds = null;
797794
reader.beginObject();
798795
while (reader.hasNext()) {
@@ -821,8 +818,6 @@ private void readGrants(JsonReader reader) throws IOException {
821818
} else if (name.equals("allowedScopes")) {
822819
Set<String> allowedScopes = readSet(reader);
823820
site.setAllowedScopes(allowedScopes);
824-
} else if (name.equals("whitelistedSiteId")) {
825-
whitelistedSiteId = reader.nextLong();
826821
} else if (name.equals("approvedAccessTokens")) {
827822
tokenIds = readSet(reader);
828823
} else {
@@ -839,9 +834,6 @@ private void readGrants(JsonReader reader) throws IOException {
839834
reader.endObject();
840835
Long newId = approvedSiteRepository.save(site).getId();
841836
grantOldToNewIdMap.put(currentId, newId);
842-
if (whitelistedSiteId != null) {
843-
grantToWhitelistedSiteRefs.put(currentId, whitelistedSiteId);
844-
}
845837
if (tokenIds != null) {
846838
grantToAccessTokensRefs.put(currentId, tokenIds);
847839
}
@@ -1193,16 +1185,6 @@ private void fixObjectReferences() {
11931185
tokenRepository.saveAccessToken(accessToken);
11941186
}
11951187
accessTokenToIdTokenRefs.clear();
1196-
for (Long oldGrantId : grantToWhitelistedSiteRefs.keySet()) {
1197-
Long oldWhitelistedSiteId = grantToWhitelistedSiteRefs.get(oldGrantId);
1198-
Long newWhitelistedSiteId = whitelistedSiteOldToNewIdMap.get(oldWhitelistedSiteId);
1199-
WhitelistedSite wlSite = wlSiteRepository.getById(newWhitelistedSiteId);
1200-
Long newGrantId = grantOldToNewIdMap.get(oldGrantId);
1201-
ApprovedSite approvedSite = approvedSiteRepository.getById(newGrantId);
1202-
approvedSite.setWhitelistedSite(wlSite);
1203-
approvedSiteRepository.save(approvedSite);
1204-
}
1205-
grantToWhitelistedSiteRefs.clear();
12061188
for (Long oldGrantId : grantToAccessTokensRefs.keySet()) {
12071189
Set<Long> oldAccessTokenIds = grantToAccessTokensRefs.get(oldGrantId);
12081190
Set<OAuth2AccessTokenEntity> tokens = new HashSet<OAuth2AccessTokenEntity>();

‎openid-connect-server/src/main/java/org/mitre/openid/connect/token/TofuUserApprovalHandler.java‎

Lines changed: 1 addition & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -175,11 +175,6 @@ public AuthorizationRequest checkForPreApproval(AuthorizationRequest authorizati
175175
if (!alreadyApproved) {
176176
WhitelistedSite ws = whitelistedSiteService.getByClientId(clientId);
177177
if (ws != null && systemScopes.scopesMatch(ws.getAllowedScopes(), authorizationRequest.getScope())) {
178-
179-
//Create an approved site
180-
ApprovedSite newSite = approvedSiteService.createApprovedSite(clientId, userId, null, ws.getAllowedScopes(), ws);
181-
String newSiteId = newSite.getId().toString();
182-
authorizationRequest.getExtensions().put(APPROVED_SITE, newSiteId);
183178
authorizationRequest.setApproved(true);
184179

185180
setAuthTime(authorizationRequest);
@@ -253,7 +248,7 @@ public AuthorizationRequest updateAfterApproval(AuthorizationRequest authorizati
253248
timeout = cal.getTime();
254249
}
255250

256-
ApprovedSite newSite = approvedSiteService.createApprovedSite(clientId, userId, timeout, allowedScopes, null);
251+
ApprovedSite newSite = approvedSiteService.createApprovedSite(clientId, userId, timeout, allowedScopes);
257252
String newSiteId = newSite.getId().toString();
258253
authorizationRequest.getExtensions().put(APPROVED_SITE, newSiteId);
259254
}

0 commit comments

Comments
 (0)