fixes after merge

core/src/main/java/org/keycloak/RSATokenVerifier.java

@@ -29,10 +29,10 @@ import java.security.PublicKey;
  */
 public class RSATokenVerifier {
 
-    private TokenVerifier tokenVerifier;
+    private final TokenVerifier<AccessToken> tokenVerifier;
 
     private RSATokenVerifier(String tokenString) {
-        this.tokenVerifier = TokenVerifier.create(tokenString);
+        this.tokenVerifier = TokenVerifier.create(tokenString, AccessToken.class).withDefaultChecks();
     }
 
     public static RSATokenVerifier create(String tokenString) {

core/src/main/java/org/keycloak/TokenVerifier.java

@@ -18,7 +18,8 @@
 package org.keycloak;
 
 import org.keycloak.common.VerificationException;
-import org.keycloak.jose.jws.Algorithm;
+import org.keycloak.exceptions.TokenNotActiveException;
+import org.keycloak.exceptions.TokenSignatureInvalidException;
 import org.keycloak.jose.jws.AlgorithmType;
 import org.keycloak.jose.jws.JWSHeader;
 import org.keycloak.jose.jws.JWSInput;
@@ -26,67 +27,280 @@ import org.keycloak.jose.jws.JWSInputException;
 import org.keycloak.jose.jws.crypto.HMACProvider;
 import org.keycloak.jose.jws.crypto.RSAProvider;
 import org.keycloak.representations.AccessToken;
+import org.keycloak.representations.JsonWebToken;
 import org.keycloak.util.TokenUtil;
 
 import javax.crypto.SecretKey;
 import java.security.PublicKey;
+import java.util.*;
+import java.util.logging.Level;
+import java.util.logging.Logger;
 
 /**
  * @author <a href="mailto:bill@burkecentral.com">Bill Burke</a>
  * @version $Revision: 1 $
  */
-public class TokenVerifier {
+public class TokenVerifier<T extends JsonWebToken> {
 
-    private final String tokenString;
+    private static final Logger LOG = Logger.getLogger(TokenVerifier.class.getName());
+
+    // This interface is here as JDK 7 is a requirement for this project.
+    // Once JDK 8 would become mandatory, java.util.function.Predicate would be used instead.
+
+    /**
+     * Functional interface of checks that verify some part of a JWT.
+     * @param <T> Type of the token handled by this predicate.
+     */
+    // @FunctionalInterface
+    public static interface Predicate<T extends JsonWebToken> {
+        /**
+         * Performs a single check on the given token verifier.
+         * @param t Token, guaranteed to be non-null.
+         * @return
+         * @throws VerificationException
+         */
+        boolean test(T t) throws VerificationException;
+    }
+
+    public static final Predicate<JsonWebToken> SUBJECT_EXISTS_CHECK = new Predicate<JsonWebToken>() {
+        @Override
+        public boolean test(JsonWebToken t) throws VerificationException {
+            String subject = t.getSubject();
+            if (subject == null) {
+                throw new VerificationException("Subject missing in token");
+            }
+
+            return true;
+        }
+    };
+
+    /**
+     * Check for token being neither expired nor used before it gets valid.
+     * @see JsonWebToken#isActive()
+     */
+    public static final Predicate<JsonWebToken> IS_ACTIVE = new Predicate<JsonWebToken>() {
+        @Override
+        public boolean test(JsonWebToken t) throws VerificationException {
+            if (! t.isActive()) {
+                throw new TokenNotActiveException(t, "Token is not active");
+            }
+
+            return true;
+        }
+    };
+
+    public static class RealmUrlCheck implements Predicate<JsonWebToken> {
+
+        private static final RealmUrlCheck NULL_INSTANCE = new RealmUrlCheck(null);
+
+        private final String realmUrl;
+
+        public RealmUrlCheck(String realmUrl) {
+            this.realmUrl = realmUrl;
+        }
+
+        @Override
+        public boolean test(JsonWebToken t) throws VerificationException {
+            if (this.realmUrl == null) {
+                throw new VerificationException("Realm URL not set");
+            }
+
+            if (! this.realmUrl.equals(t.getIssuer())) {
+                throw new VerificationException("Invalid token issuer. Expected '" + this.realmUrl + "', but was '" + t.getIssuer() + "'");
+            }
+
+            return true;
+        }
+    };
+
+    public static class TokenTypeCheck implements Predicate<JsonWebToken> {
+
+        private static final TokenTypeCheck INSTANCE_BEARER = new TokenTypeCheck(TokenUtil.TOKEN_TYPE_BEARER);
+
+        private final String tokenType;
+
+        public TokenTypeCheck(String tokenType) {
+            this.tokenType = tokenType;
+        }
+
+        @Override
+        public boolean test(JsonWebToken t) throws VerificationException {
+            if (! tokenType.equalsIgnoreCase(t.getType())) {
+                throw new VerificationException("Token type is incorrect. Expected '" + tokenType + "' but was '" + t.getType() + "'");
+            }
+            return true;
+        }
+    };
+
+    private String tokenString;
+    private Class<? extends T> clazz;
     private PublicKey publicKey;
     private SecretKey secretKey;
     private String realmUrl;
+    private String expectedTokenType = TokenUtil.TOKEN_TYPE_BEARER;
     private boolean checkTokenType = true;
-    private boolean checkActive = true;
     private boolean checkRealmUrl = true;
+    private final LinkedList<Predicate<? super T>> checks = new LinkedList<>();
 
     private JWSInput jws;
-    private AccessToken token;
+    private T token;
 
-    protected TokenVerifier(String tokenString) {
+    protected TokenVerifier(String tokenString, Class<T> clazz) {
         this.tokenString = tokenString;
+        this.clazz = clazz;
     }
 
-    public static TokenVerifier create(String tokenString) {
-        return new TokenVerifier(tokenString);
+    protected TokenVerifier(T token) {
+        this.token = token;
     }
 
-    public TokenVerifier publicKey(PublicKey publicKey) {
+    /**
+     * Creates an instance of {@code TokenVerifier} from the given string on a JWT of the given class.
+     * The token verifier has no checks defined. Note that the checks are only tested when
+     * {@link #verify()} method is invoked.
+     * @param <T> Type of the token
+     * @param tokenString String representation of JWT
+     * @param clazz Class of the token
+     * @return
+     */
+    public static <T extends JsonWebToken> TokenVerifier<T> create(String tokenString, Class<T> clazz) {
+        return new TokenVerifier(tokenString, clazz);
+    }
+
+    /**
+     * Creates an instance of {@code TokenVerifier} from the given string on a JWT of the given class.
+     * The token verifier has no checks defined. Note that the checks are only tested when
+     * {@link #verify()} method is invoked.
+     * @return
+     */
+    public static <T extends JsonWebToken> TokenVerifier<T> create(T token) {
+        return new TokenVerifier(token);
+    }
+
+    /**
+     * Adds default checks to the token verification:
+     * <ul>
+     * <li>Realm URL (JWT issuer field: {@code iss}) has to be defined and match realm set via {@link #realmUrl(java.lang.String)} method</li>
+     * <li>Subject (JWT subject field: {@code sub}) has to be defined</li>
+     * <li>Token type (JWT type field: {@code typ}) has to be {@code Bearer}. The type can be set via {@link #tokenType(java.lang.String)} method</li>
+     * <li>Token has to be active, ie. both not expired and not used before its validity (JWT issuer fields: {@code exp} and {@code nbf})</li>
+     * </ul>
+     * @return This token verifier.
+     */
+    public TokenVerifier<T> withDefaultChecks()  {
+        return withChecks(
+          RealmUrlCheck.NULL_INSTANCE,
+          SUBJECT_EXISTS_CHECK,
+          TokenTypeCheck.INSTANCE_BEARER,
+          IS_ACTIVE
+        );
+    }
+
+    private void removeCheck(Class<? extends Predicate<?>> checkClass) {
+        for (Iterator<Predicate<? super T>> it = checks.iterator(); it.hasNext();) {
+            if (it.next().getClass() == checkClass) {
+                it.remove();
+            }
+        }
+    }
+
+    private void removeCheck(Predicate<? super T> check) {
+        checks.remove(check);
+    }
+
+    private <P extends Predicate<? super T>> TokenVerifier<T> replaceCheck(Class<? extends Predicate<?>> checkClass, boolean active, P predicate) {
+        removeCheck(checkClass);
+        if (active) {
+            checks.add(predicate);
+        }
+        return this;
+    }
+
+    private <P extends Predicate<? super T>> TokenVerifier<T> replaceCheck(Predicate<? super T> check, boolean active, P predicate) {
+        removeCheck(check);
+        if (active) {
+            checks.add(predicate);
+        }
+        return this;
+    }
+
+    /**
+     * Will test the given checks in {@link #verify()} method in addition to already set checks.
+     * @param checks
+     * @return
+     */
+    public TokenVerifier<T> withChecks(Predicate<? super T>... checks) {
+        if (checks != null) {
+            this.checks.addAll(Arrays.asList(checks));
+        }
+        return this;
+    }
+
+    /**
+     * Sets the key for verification of RSA-based signature.
+     * @param publicKey
+     * @return
+     */
+    public TokenVerifier<T> publicKey(PublicKey publicKey) {
         this.publicKey = publicKey;
         return this;
     }
 
-    public TokenVerifier secretKey(SecretKey secretKey) {
+    /**
+     * Sets the key for verification of HMAC-based signature.
+     * @param secretKey
+     * @return 
+     */
+    public TokenVerifier<T> secretKey(SecretKey secretKey) {
         this.secretKey = secretKey;
         return this;
     }
 
-    public TokenVerifier realmUrl(String realmUrl) {
+    /**
+     * @deprecated This method is here only for backward compatibility with previous version of {@code TokenVerifier}.
+     * @return This token verifier
+     */
+    public TokenVerifier<T> realmUrl(String realmUrl) {
         this.realmUrl = realmUrl;
-        return this;
+        return replaceCheck(RealmUrlCheck.class, checkRealmUrl, new RealmUrlCheck(realmUrl));
     }
 
-    public TokenVerifier checkTokenType(boolean checkTokenType) {
+    /**
+     * @deprecated This method is here only for backward compatibility with previous version of {@code TokenVerifier}.
+     * @return This token verifier
+     */
+    public TokenVerifier<T> checkTokenType(boolean checkTokenType) {
         this.checkTokenType = checkTokenType;
-        return this;
+        return replaceCheck(TokenTypeCheck.class, this.checkTokenType, new TokenTypeCheck(expectedTokenType));
     }
 
-    public TokenVerifier checkActive(boolean checkActive) {
-        this.checkActive = checkActive;
-        return this;
+    /**
+     * @deprecated This method is here only for backward compatibility with previous version of {@code TokenVerifier}.
+     * @return This token verifier
+     */
+    public TokenVerifier<T> tokenType(String tokenType) {
+        this.expectedTokenType = tokenType;
+        return replaceCheck(TokenTypeCheck.class, this.checkTokenType, new TokenTypeCheck(expectedTokenType));
     }
 
-    public TokenVerifier checkRealmUrl(boolean checkRealmUrl) {
+    /**
+     * @deprecated This method is here only for backward compatibility with previous version of {@code TokenVerifier}.
+     * @return This token verifier
+     */
+    public TokenVerifier<T> checkActive(boolean checkActive) {
+        return replaceCheck(IS_ACTIVE, checkActive, IS_ACTIVE);
+    }
+
+    /**
+     * @deprecated This method is here only for backward compatibility with previous version of {@code TokenVerifier}.
+     * @return This token verifier
+     */
+    public TokenVerifier<T> checkRealmUrl(boolean checkRealmUrl) {
         this.checkRealmUrl = checkRealmUrl;
-        return this;
+        return replaceCheck(RealmUrlCheck.class, this.checkRealmUrl, new RealmUrlCheck(realmUrl));
     }
 
-    public TokenVerifier parse() throws VerificationException {
+    public TokenVerifier<T> parse() throws VerificationException {
         if (jws == null) {
             if (tokenString == null) {
                 throw new VerificationException("Token not set");
@@ -100,7 +314,7 @@ public class TokenVerifier {
 
 
             try {
-                token = jws.readJsonContent(AccessToken.class);
+                token = jws.readJsonContent(clazz);
             } catch (JWSInputException e) {
                 throw new VerificationException("Failed to read access token from JWT", e);
             }
@@ -108,8 +322,10 @@ public class TokenVerifier {
         return this;
     }
 
-    public AccessToken getToken() throws VerificationException {
-        parse();
+    public T getToken() throws VerificationException {
+        if (token == null) {
+            parse();
+        }
         return token;
     }
 
@@ -118,53 +334,97 @@ public class TokenVerifier {
         return jws.getHeader();
     }
 
-    public TokenVerifier verify() throws VerificationException {
-        parse();
-
-        if (checkRealmUrl && realmUrl == null) {
-            throw new VerificationException("Realm URL not set");
-        }
-
+    public void verifySignature() throws VerificationException {
         AlgorithmType algorithmType = getHeader().getAlgorithm().getType();
 
-        if (AlgorithmType.RSA.equals(algorithmType)) {
-            if (publicKey == null) {
-                throw new VerificationException("Public key not set");
-            }
+        if (null == algorithmType) {
+            throw new VerificationException("Unknown or unsupported token algorithm");
+        } else switch (algorithmType) {
+            case RSA:
+                if (publicKey == null) {
+                    throw new VerificationException("Public key not set");
+                }
+                if (!RSAProvider.verify(jws, publicKey)) {
+                    throw new TokenSignatureInvalidException(token, "Invalid token signature");
+                }   break;
+            case HMAC:
+                if (secretKey == null) {
+                    throw new VerificationException("Secret key not set");
+                }
+                if (!HMACProvider.verify(jws, secretKey)) {
+                    throw new TokenSignatureInvalidException(token, "Invalid token signature");
+                }   break;
+            default:
+                throw new VerificationException("Unknown or unsupported token algorithm");
+        }
+    }
 
-            if (!RSAProvider.verify(jws, publicKey)) {
-                throw new VerificationException("Invalid token signature");
-            }
-        } else if (AlgorithmType.HMAC.equals(algorithmType)) {
-            if (secretKey == null) {
-                throw new VerificationException("Secret key not set");
-            }
-
-            if (!HMACProvider.verify(jws, secretKey)) {
-                throw new VerificationException("Invalid token signature");
-            }
-        } else {
-            throw new VerificationException("Unknown or unsupported token algorith");
+    public TokenVerifier<T> verify() throws VerificationException {
+        if (getToken() == null) {
+            parse();
+        }
+        if (jws != null) {
+            verifySignature();
         }
 
-        String user = token.getSubject();
-        if (user == null) {
-            throw new VerificationException("Subject missing in token");
-        }
-
-        if (checkRealmUrl && !realmUrl.equals(token.getIssuer())) {
-            throw new VerificationException("Invalid token issuer. Expected '" + realmUrl + "', but was '" + token.getIssuer() + "'");
-        }
-
-        if (checkTokenType && !TokenUtil.TOKEN_TYPE_BEARER.equalsIgnoreCase(token.getType())) {
-            throw new VerificationException("Token type is incorrect. Expected '" + TokenUtil.TOKEN_TYPE_BEARER + "' but was '" + token.getType() + "'");
-        }
-
-        if (checkActive && !token.isActive()) {
-            throw new VerificationException("Token is not active");
+        for (Predicate<? super T> check : checks) {
+            if (! check.test(getToken())) {
+                throw new VerificationException("JWT check failed for check " + check);
+            }
         }
 
         return this;
     }
 
+    /**
+     * Creates an optional predicate from a predicate that will proceed with check but always pass.
+     * @param <T>
+     * @param mandatoryPredicate
+     * @return
+     */
+    public static <T extends JsonWebToken> Predicate<T> optional(final Predicate<T> mandatoryPredicate) {
+        return new Predicate<T>() {
+            @Override
+            public boolean test(T t) throws VerificationException {
+                try {
+                    if (! mandatoryPredicate.test(t)) {
+                        LOG.finer("[optional] predicate failed: " + mandatoryPredicate);
+                    }
+
+                    return true;
+                } catch (VerificationException ex) {
+                    LOG.log(Level.FINER, "[optional] predicate " + mandatoryPredicate + " failed.", ex);
+                    return true;
+                }
+            }
+        };
+    }
+
+    /**
+     * Creates a predicate that will proceed with checks of the given predicates
+     * and will pass if and only if at least one of the given predicates passes.
+     * @param <T>
+     * @param predicates
+     * @return
+     */
+    public static <T extends JsonWebToken> Predicate<T> alternative(final Predicate<? super T>... predicates) {
+        return new Predicate<T>() {
+            @Override
+            public boolean test(T t) throws VerificationException {
+                for (Predicate<? super T> predicate : predicates) {
+                    try {
+                        if (predicate.test(t)) {
+                            return true;
+                        }
+
+                        LOG.finer("[alternative] predicate failed: " + predicate);
+                    } catch (VerificationException ex) {
+                        LOG.log(Level.FINER, "[alternative] predicate " + predicate + " failed.", ex);
+                    }
+                }
+
+                return false;
+            }
+        };
+    }
 }

core/src/main/java/org/keycloak/exceptions/TokenNotActiveException.java

@@ -0,0 +1,44 @@
+/*
+ * Copyright 2017 Red Hat, Inc. and/or its affiliates
+ * and other contributors as indicated by the @author tags.
+ * 
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ * 
+ * http://www.apache.org/licenses/LICENSE-2.0
+ * 
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.keycloak.exceptions;
+
+import org.keycloak.representations.JsonWebToken;
+
+/**
+ * Exception thrown for cases when token is invalid due to time constraints (expired, or not yet valid).
+ * Cf. {@link JsonWebToken#isActive()}.
+ * @author hmlnarik
+ */
+public class TokenNotActiveException extends TokenVerificationException {
+
+    public TokenNotActiveException(JsonWebToken token) {
+        super(token);
+    }
+
+    public TokenNotActiveException(JsonWebToken token, String message) {
+        super(token, message);
+    }
+
+    public TokenNotActiveException(JsonWebToken token, String message, Throwable cause) {
+        super(token, message, cause);
+    }
+
+    public TokenNotActiveException(JsonWebToken token, Throwable cause) {
+        super(token, cause);
+    }
+
+}

core/src/main/java/org/keycloak/exceptions/TokenSignatureInvalidException.java

@@ -0,0 +1,43 @@
+/*
+ * Copyright 2017 Red Hat, Inc. and/or its affiliates
+ * and other contributors as indicated by the @author tags.
+ * 
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ * 
+ * http://www.apache.org/licenses/LICENSE-2.0
+ * 
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.keycloak.exceptions;
+
+import org.keycloak.representations.JsonWebToken;
+
+/**
+ * Thrown when token signature is invalid.
+ * @author hmlnarik
+ */
+public class TokenSignatureInvalidException extends TokenVerificationException {
+
+    public TokenSignatureInvalidException(JsonWebToken token) {
+        super(token);
+    }
+
+    public TokenSignatureInvalidException(JsonWebToken token, String message) {
+        super(token, message);
+    }
+
+    public TokenSignatureInvalidException(JsonWebToken token, String message, Throwable cause) {
+        super(token, message, cause);
+    }
+
+    public TokenSignatureInvalidException(JsonWebToken token, Throwable cause) {
+        super(token, cause);
+    }
+
+}

core/src/main/java/org/keycloak/exceptions/TokenVerificationException.java

@@ -0,0 +1,54 @@
+/*
+ * Copyright 2017 Red Hat, Inc. and/or its affiliates
+ * and other contributors as indicated by the @author tags.
+ * 
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ * 
+ * http://www.apache.org/licenses/LICENSE-2.0
+ * 
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.keycloak.exceptions;
+
+import org.keycloak.common.VerificationException;
+import org.keycloak.representations.JsonWebToken;
+
+/**
+ * Exception thrown on failed verification of a token.
+ *
+ * @author hmlnarik
+ */
+public class TokenVerificationException extends VerificationException {
+
+    private final JsonWebToken token;
+
+    public TokenVerificationException(JsonWebToken token) {
+        this.token = token;
+    }
+
+    public TokenVerificationException(JsonWebToken token, String message) {
+        super(message);
+        this.token = token;
+    }
+
+    public TokenVerificationException(JsonWebToken token, String message, Throwable cause) {
+        super(message, cause);
+        this.token = token;
+    }
+
+    public TokenVerificationException(JsonWebToken token, Throwable cause) {
+        super(cause);
+        this.token = token;
+    }
+
+    public JsonWebToken getToken() {
+        return token;
+    }
+
+}

core/src/main/java/org/keycloak/representations/AccessToken.java

@@ -97,9 +97,6 @@ public class AccessToken extends IDToken {
         }
     }
 
-    @JsonProperty("client_session")
-    protected String clientSession;
-
     @JsonProperty("trusted-certs")
     protected Set<String> trustedCertificates;
 
@@ -156,10 +153,6 @@ public class AccessToken extends IDToken {
         return resourceAccess.get(resource);
     }
 
-    public String getClientSession() {
-        return clientSession;
-    }
-
     public Access addAccess(String service) {
         Access access = resourceAccess.get(service);
         if (access != null) return access;
@@ -168,11 +161,6 @@ public class AccessToken extends IDToken {
         return access;
     }
 
-    public AccessToken clientSession(String session) {
-        this.clientSession = session;
-        return this;
-    }
-
     @Override
     public AccessToken id(String id) {
         return (AccessToken) super.id(id);

core/src/main/java/org/keycloak/representations/RefreshToken.java

@@ -40,7 +40,6 @@ public class RefreshToken extends AccessToken {
      */
     public RefreshToken(AccessToken token) {
         this();
-        this.clientSession = token.getClientSession();
         this.issuer = token.issuer;
         this.subject = token.subject;
         this.issuedFor = token.issuedFor;

core/src/main/java/org/keycloak/representations/idm/RealmRepresentation.java

@@ -46,6 +46,8 @@ public class RealmRepresentation {
     protected Integer accessCodeLifespan;
     protected Integer accessCodeLifespanUserAction;
     protected Integer accessCodeLifespanLogin;
+    protected Integer actionTokenGeneratedByAdminLifespan;
+    protected Integer actionTokenGeneratedByUserLifespan;
     protected Boolean enabled;
     protected String sslRequired;
     @Deprecated
@@ -338,6 +340,22 @@ public class RealmRepresentation {
         this.accessCodeLifespanLogin = accessCodeLifespanLogin;
     }
 
+    public Integer getActionTokenGeneratedByAdminLifespan() {
+        return actionTokenGeneratedByAdminLifespan;
+    }
+
+    public void setActionTokenGeneratedByAdminLifespan(Integer actionTokenGeneratedByAdminLifespan) {
+        this.actionTokenGeneratedByAdminLifespan = actionTokenGeneratedByAdminLifespan;
+    }
+
+    public Integer getActionTokenGeneratedByUserLifespan() {
+        return actionTokenGeneratedByUserLifespan;
+    }
+
+    public void setActionTokenGeneratedByUserLifespan(Integer actionTokenGeneratedByUserLifespan) {
+        this.actionTokenGeneratedByUserLifespan = actionTokenGeneratedByUserLifespan;
+    }
+
     public List<String> getDefaultRoles() {
         return defaultRoles;
     }