[ELY-2034] Add OpenID Connect mechanism implementation

ELY_Messages.txt

@@ -118,9 +118,9 @@
 21000 - 21999
 22000 - 22499    wildfly-elytron-http-form
 22500 - 22999    wildfly-elytron-http-spnego
-23000 - 23999
-24000 - 24999
-25000 - 25999
+23000 - 23999    wildfly-elytron-http-oidc
+24000 - 24999    wildfly-elytron-jose-jwk
+25000 - 25999    wildfly-elytron-jose-jws
 26000 - 26999
 27000 - 27999
 28000 - 28999

http/base/pom.xml

@@ -64,6 +64,10 @@
             <groupId>org.wildfly.common</groupId>
             <artifactId>wildfly-common</artifactId>
         </dependency>
+        <dependency>
+            <groupId>org.jboss.spec.javax.servlet</groupId>
+            <artifactId>jboss-servlet-api_3.1_spec</artifactId>
+        </dependency>
     </dependencies>
 
 </project>

http/base/src/main/java/org/wildfly/security/http/HttpExchangeSpi.java

@@ -27,6 +27,7 @@
 import java.util.List;
 import java.util.Map;
 import java.util.Set;
+import java.util.function.Supplier;
 
 import javax.net.ssl.SSLPeerUnverifiedException;
 import javax.net.ssl.SSLSession;
@@ -282,4 +283,11 @@ default boolean resumeRequest() {
          return false;
      }
 
+    /**
+     * Set the request input stream supplier. The default implementation does nothing.
+     *
+     * @param requestInputStreamSupplier the request input stream supplier
+     */
+    default void setRequestInputStreamSupplier(Supplier<InputStream> requestInputStreamSupplier) {}
+
 }

http/base/src/main/java/org/wildfly/security/http/HttpServerRequest.java

@@ -25,6 +25,7 @@
 import java.util.List;
 import java.util.Map;
 import java.util.Set;
+import java.util.function.Supplier;
 
 import javax.net.ssl.SSLSession;
 
@@ -267,4 +268,12 @@ default String getRemoteUser() {
      */
     boolean resumeRequest();
 
+    /**
+     * Set the request input stream supplier. The default implementation does nothing.
+     *
+     * @param requestInputStreamSupplier the request input stream supplier
+     */
+    default void setRequestInputStreamSupplier(Supplier<InputStream> requestInputStreamSupplier) {}
+
+
 }

http/oidc/pom.xml

@@ -0,0 +1,102 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!--
+  ~ JBoss, Home of Professional Open Source.
+  ~ Copyright 2020 Red Hat, Inc., and individual contributors
+  ~ as indicated by the @author tags.
+  ~
+  ~ Licensed under the Apache License, Version 2.0 (the "License");
+  ~ you may not use this file except in compliance with the License.
+  ~ You may obtain a copy of the License at
+  ~
+  ~     http://www.apache.org/licenses/LICENSE-2.0
+  ~
+  ~ Unless required by applicable law or agreed to in writing, software
+  ~ distributed under the License is distributed on an "AS IS" BASIS,
+  ~ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  ~ See the License for the specific language governing permissions and
+  ~ limitations under the License.
+  -->
+
+<project xmlns="http://maven.apache.org/POM/4.0.0"
+         xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
+
+    <parent>
+        <groupId>org.wildfly.security</groupId>
+        <artifactId>wildfly-elytron-parent</artifactId>
+        <version>1.15.7.CR1-SNAPSHOT</version>
+        <relativePath>../../pom.xml</relativePath>
+    </parent>
+
+    <modelVersion>4.0.0</modelVersion>
+
+    <artifactId>wildfly-elytron-http-oidc</artifactId>
+
+    <name>WildFly Elytron - HTTP OIDC</name>
+    <description>WildFly Security HTTP OIDC Mechanism Implementation</description>
+
+    <dependencies>
+        <dependency>
+            <groupId>org.wildfly.security</groupId>
+            <artifactId>wildfly-elytron-auth-server</artifactId>
+        </dependency>
+        <dependency>        
+            <groupId>org.wildfly.security</groupId>
+            <artifactId>wildfly-elytron-credential</artifactId>
+        </dependency>    
+        <dependency>
+            <groupId>org.wildfly.security</groupId>
+            <artifactId>wildfly-elytron-http</artifactId>
+        </dependency>
+        <dependency>
+            <groupId>org.wildfly.security</groupId>
+            <artifactId>wildfly-elytron-json-util</artifactId>
+        </dependency>
+        <dependency>
+            <groupId>org.wildfly.security</groupId>
+            <artifactId>wildfly-elytron-jose-jwk</artifactId>
+        </dependency>
+        <dependency>
+            <groupId>org.wildfly.security</groupId>
+            <artifactId>wildfly-elytron-mechanism</artifactId>
+        </dependency>
+
+        <dependency>
+            <groupId>org.jboss.logging</groupId>
+            <artifactId>jboss-logging-processor</artifactId>
+            <scope>provided</scope>
+        </dependency>
+        <dependency>
+            <groupId>org.kohsuke.metainf-services</groupId>
+            <artifactId>metainf-services</artifactId>
+            <scope>provided</scope>
+        </dependency>
+
+        <dependency>
+            <groupId>org.wildfly.common</groupId>
+            <artifactId>wildfly-common</artifactId>
+        </dependency>
+
+        <dependency>
+            <groupId>org.apache.httpcomponents</groupId>
+            <artifactId>httpclient</artifactId>
+        </dependency>
+
+        <dependency>
+            <groupId>org.jboss.spec.javax.servlet</groupId>
+            <artifactId>jboss-servlet-api_3.1_spec</artifactId>
+            <scope>provided</scope>
+        </dependency>
+        <dependency>
+            <groupId>org.jboss.spec.javax.json</groupId>
+            <artifactId>jboss-json-api_1.0_spec</artifactId>
+            <scope>provided</scope>
+        </dependency>
+        <dependency>
+            <groupId>org.bitbucket.b_c</groupId>
+            <artifactId>jose4j</artifactId>
+        </dependency>
+
+    </dependencies>
+
+</project>

http/oidc/src/main/java/org/wildfly/security/http/oidc/AccessAndIDTokenResponse.java

@@ -0,0 +1,130 @@
+/*
+ * JBoss, Home of Professional Open Source.
+ * Copyright 2021 Red Hat, Inc., and individual contributors
+ * as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ */
+
+package org.wildfly.security.http.oidc;
+
+import java.util.HashMap;
+import java.util.Map;
+
+import com.fasterxml.jackson.annotation.JsonAnyGetter;
+import com.fasterxml.jackson.annotation.JsonAnySetter;
+import com.fasterxml.jackson.annotation.JsonProperty;
+
+/**
+ * A representation of an OpenID Connect token response that contains both an access token
+ * and an ID token as per the <a href="https://openid.net/specs/openid-connect-core-1_0.html#TokenResponse">OpenID Connect Core 1.0</a>
+ * specification.
+ *
+ * @author <a href="mailto:[email protected]">Bill Burke</a>
+ * @author <a href="mailto:[email protected]">Farah Juma</a>
+ */
+public class AccessAndIDTokenResponse {
+
+    @JsonProperty("access_token")
+    protected String accessToken;
+
+    @JsonProperty("token_type")
+    protected String tokenType;
+
+    @JsonProperty("expires_in")
+    protected long expiresIn;
+
+    @JsonProperty("refresh_token")
+    protected String refreshToken;
+
+    @JsonProperty("id_token")
+    protected String idToken;
+
+    protected Map<String, Object> otherClaims = new HashMap<>();
+
+    // OIDC Financial API Read Only Profile : scope MUST be returned in the response from Token Endpoint
+    @JsonProperty("scope")
+    protected String scope;
+
+    // Keycloak-specific property
+    @JsonProperty("not-before-policy")
+    protected int notBeforePolicy;
+
+    public String getAccessToken() {
+        return accessToken;
+    }
+
+    public void setAccessToken(String accessToken) {
+        this.accessToken = accessToken;
+    }
+
+    public String getTokenType() {
+        return tokenType;
+    }
+
+    public void setTokenType(String tokenType) {
+        this.tokenType = tokenType;
+    }
+
+    public long getExpiresIn() {
+        return expiresIn;
+    }
+
+    public void setExpiresIn(long expiresIn) {
+        this.expiresIn = expiresIn;
+    }
+
+    public String getRefreshToken() {
+        return refreshToken;
+    }
+
+    public void setRefreshToken(String refreshToken) {
+        this.refreshToken = refreshToken;
+    }
+
+    public String getScope() {
+        return scope;
+    }
+
+    public void setScope(String scope) {
+        this.scope = scope;
+    }
+
+    public String getIDToken() {
+        return idToken;
+    }
+
+    public void setIDToken(String idToken) {
+        this.idToken = idToken;
+    }
+
+    public int getNotBeforePolicy() {
+        return notBeforePolicy;
+    }
+
+    public void setNotBeforePolicy(int notBeforePolicy) {
+        this.notBeforePolicy = notBeforePolicy;
+    }
+
+
+    @JsonAnyGetter
+    public Map<String, Object> getOtherClaims() {
+        return otherClaims;
+    }
+
+    @JsonAnySetter
+    public void setOtherClaims(String name, Object value) {
+        otherClaims.put(name, value);
+    }
+
+}

http/oidc/src/main/java/org/wildfly/security/http/oidc/AccessToken.java

@@ -0,0 +1,98 @@
+/*
+ * JBoss, Home of Professional Open Source.
+ * Copyright 2021 Red Hat, Inc., and individual contributors
+ * as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ */
+
+package org.wildfly.security.http.oidc;
+
+import java.util.HashMap;
+import java.util.List;
+import java.util.Map;
+
+import org.jose4j.jwt.JwtClaims;
+
+/**
+ * Representation of an access token.
+ *
+ * @author <a href="mailto:[email protected]">Farah Juma</a>
+ */
+public class AccessToken extends JsonWebToken {
+
+    private static final String ALLOWED_ORIGINS = "allowed-origins";
+    private static final String REALM_ACCESS = "realm_access";
+    private static final String RESOURCE_ACCESS = "resource_access";
+
+    /**
+     * Construct a new instance.
+     *
+     * @param jwtClaims the JWT claims for this instance (may not be {@code null})
+     */
+    public AccessToken(JwtClaims jwtClaims) {
+        super(jwtClaims);
+    }
+
+    /**
+     * Get the allowed-origins claim.
+     *
+     * @return the allowed-origins claim
+     */
+    public List<String> getAllowedOrigins() {
+        return getStringListClaimValue(ALLOWED_ORIGINS);
+    }
+
+    /**
+     * Get the realm_access claim.
+     *
+     * @return the realm_access claim
+     * @throws IllegalArgumentException if the realm_access claim is malformed
+     */
+    public RealmAccessClaim getRealmAccessClaim() {
+        Object realmAccessValue = getClaimValue(REALM_ACCESS);
+        return realmAccessValue == null ? null : new RealmAccessClaim((Map<String, Object>) realmAccessValue);
+    }
+
+    /**
+     * Get the resource_access claim.
+     *
+     * @return the resource_access claim
+     * @throws IllegalArgumentException if the resource_access claim is malformed
+     */
+    public Map<String, RealmAccessClaim> getResourceAccessClaim() {
+        Object resourceAccessValue = getClaimValue(RESOURCE_ACCESS);
+        if (resourceAccessValue == null) {
+            return null;
+        }
+        Map<String, Object> resourceAccessValueMap = (Map<String, Object>) resourceAccessValue;
+        Map<String, RealmAccessClaim> resourceAccessClaim = new HashMap<>(resourceAccessValueMap.size());
+        for (String key : resourceAccessClaim.keySet()) {
+            Object val = resourceAccessValueMap.get(key);
+            resourceAccessClaim.put(key, val == null ? null : new RealmAccessClaim((Map<String, Object>)val));
+        }
+        return resourceAccessClaim;
+    }
+
+    /**
+     * Get the resource_access claim.
+     *
+     * @param resource the resource
+     * @return the resource_access claim
+     * @throws IllegalArgumentException if the resource_access claim is malformed
+     */
+    public RealmAccessClaim getResourceAccessClaim(String resource) {
+        Map<String, RealmAccessClaim> realmAccessClaimMap = getResourceAccessClaim();
+        return realmAccessClaimMap == null ? null : realmAccessClaimMap.get(resource);
+    }
+}