import org.springframework.security.oauth2.provider.TokenRequest; //导入依赖的package包/类
@Override
public OAuth2AccessToken refreshAccessToken(String refreshTokenValue, TokenRequest tokenRequest) throws AuthenticationException {
    logger.info("refresh token:" + refreshTokenValue);
    String jti = tokenRequest.getRequestParameters().get("jti");
    try {
        if ( jti != null )
                if ( blackListService.isBlackListed(jti) ) return null;


        OAuth2AccessToken token = super.refreshAccessToken(refreshTokenValue, tokenRequest);
        blackListService.addToBlackList(jti);
        return token;
    } catch (TokenBlackListService.TokenNotFoundException e) {
        e.printStackTrace();
        return null;
    }
}
 

import org.springframework.security.oauth2.provider.TokenRequest; //导入依赖的package包/类
@BodyParser.Of(BodyParser.Json.class)
public Promise<Result> authenticateClient() {
  JsonNode json = request().body().asJson();
  String clientId = json.findPath("clientId").textValue();
  String clientSecret = json.findPath("clientSecret").textValue();

  UsernamePasswordAuthenticationToken authRequest =
      new UsernamePasswordAuthenticationToken(clientId, clientSecret);
  clientAuthenticationManager.authenticate(authRequest);

  ClientDetails clientDetails = clientDetailsService.loadClientByClientId(clientId);
  TokenRequest tokenRequest = new TokenRequest(Collections.emptyMap(), clientId,
      clientDetails.getScope(), "password");
  OAuth2AccessToken token = tokenGranter.grant("client_credentials", tokenRequest);

  ObjectNode result = Json.newObject();
  result.setAll(ImmutableMap.of(
      "accessToken", result.textNode(token.getValue()),
      "clientId", result.textNode(clientId),
      "expiration", result.numberNode(token.getExpiration().getTime())));
  return Promise.pure(ok(result));
}
 

import org.springframework.security.oauth2.provider.TokenRequest; //导入依赖的package包/类
@BodyParser.Of(BodyParser.Json.class)
@PreAuthorize("#oauth2.clientHasRole('ROLE_CLIENT') and #oauth2.hasScope('trust')")
public Promise<Result> authenticateUser() {
  JsonNode json = request().body().asJson();
  String username = json.findPath("username").textValue();
  String password = json.findPath("password").textValue();

  Authentication authentication = SecurityContextHolder.getContext().getAuthentication();
  OAuth2Request clientAuthenticationRequest =
      ((OAuth2Authentication) authentication).getOAuth2Request();
  Map<String, String> requestParameters = new HashMap<>();
  requestParameters.put("username", username);
  requestParameters.put("password", password);
  TokenRequest tokenRequest = new TokenRequest(requestParameters,
          clientAuthenticationRequest.getClientId(), clientAuthenticationRequest.getScope(),
          "password");
  OAuth2AccessToken token = tokenGranter.grant("password", tokenRequest);
  ObjectNode result = Json.newObject();
  result.setAll(ImmutableMap.of(
      "accessToken", result.textNode(token.getValue()),
      "username", result.textNode(username),
      "expiration", result.numberNode(token.getExpiration().getTime()),
      "refreshToken", result.textNode(token.getRefreshToken().getValue())));
  return Promise.pure(ok(result));
}
 

import org.springframework.security.oauth2.provider.TokenRequest; //导入依赖的package包/类
@BodyParser.Of(BodyParser.Json.class)
@PreAuthorize("#oauth2.clientHasRole('ROLE_CLIENT') and #oauth2.hasScope('trust')")
public Promise<Result> refreshUserAccessToken() {
  JsonNode body = request().body().asJson();
  String refreshToken = body.findPath("refreshToken").textValue();

  Authentication authentication = SecurityContextHolder.getContext().getAuthentication();
  OAuth2Request clientAuthenticationRequest =
      ((OAuth2Authentication) authentication).getOAuth2Request();
  TokenRequest tokenRequest =
      new TokenRequest(Collections.emptyMap(), clientAuthenticationRequest.getClientId(),
          clientAuthenticationRequest.getScope(), "refresh");
  OAuth2AccessToken token = tokenServices.refreshAccessToken(refreshToken, tokenRequest);
  ObjectNode result = Json.newObject();
  result.setAll(ImmutableMap.of(
      "accessToken", result.textNode(token.getValue()),
      "expiration", result.numberNode(token.getExpiration().getTime()),
      "refreshToken", result.textNode(token.getRefreshToken().getValue())));
  return Promise.pure(ok(result));
}
 

import org.springframework.security.oauth2.provider.TokenRequest; //导入依赖的package包/类
@Override
protected OAuth2Authentication getOAuth2Authentication(ClientDetails client, TokenRequest tokenRequest) {

	Map<String, String> parameters = tokenRequest.getRequestParameters();
	String username = parameters.get("username");
	String password = parameters.get("password");

	Authentication userAuth = new UsernamePasswordAuthenticationToken(username, password);
	try {
		userAuth = authenticationManager.authenticate(userAuth);
	}
	catch (AccountStatusException ase) {
		//covers expired, locked, disabled cases (mentioned in section 5.2, draft 31)
		throw new InvalidGrantException(ase.getMessage());
	}
	catch (BadCredentialsException e) {
		// If the username/password are wrong the spec says we should send 400/invlid grant
		throw new InvalidGrantException(e.getMessage());
	}
	if (userAuth == null || !userAuth.isAuthenticated()) {
		throw new InvalidGrantException("Could not authenticate user: " + username);
	}
	
	OAuth2Request storedOAuth2Request = getRequestFactory().createOAuth2Request(client, tokenRequest);		
	return new OAuth2Authentication(storedOAuth2Request, userAuth);
}
 

import org.springframework.security.oauth2.provider.TokenRequest; //导入依赖的package包/类
@Test
public void testNotReuseRefreshTokenMaintainsState() throws Exception {
	getTokenServices().setSupportRefreshToken(true);
	getTokenServices().setReuseRefreshToken(false);
	OAuth2AccessToken accessToken = getTokenServices().createAccessToken(
			createAuthentication());
	OAuth2RefreshToken expectedExpiringRefreshToken = accessToken
			.getRefreshToken();
	TokenRequest tokenRequest = new TokenRequest(Collections.singletonMap(
			"client_id", "id"), "id", null, null);
	OAuth2AccessToken refreshedAccessToken = getTokenServices()
			.refreshAccessToken(expectedExpiringRefreshToken.getValue(),
					tokenRequest);
	assertNotNull(refreshedAccessToken);
	assertEquals(1, getRefreshTokenCount());
}
 

import org.springframework.security.oauth2.provider.TokenRequest; //导入依赖的package包/类
@Before
public void init() throws Exception {
	client = new BaseClientDetails();
	client.setRegisteredRedirectUri(Collections.singleton("http://anywhere.com"));
	client.setAuthorizedGrantTypes(Arrays.asList("authorization_code", "implicit"));
	endpoint.setClientDetailsService(new ClientDetailsService() {
		public ClientDetails loadClientByClientId(String clientId) throws OAuth2Exception {
			return client;
		}
	});
	endpoint.setTokenGranter(new TokenGranter() {
		public OAuth2AccessToken grant(String grantType, TokenRequest tokenRequest) {
			return null;
		}
	});
	endpoint.setRedirectResolver(new DefaultRedirectResolver());
	endpoint.afterPropertiesSet();
}
 

import org.springframework.security.oauth2.provider.TokenRequest; //导入依赖的package包/类
@Test
public void testGetAccessTokenWithNoClientId() {

	HashMap<String, String> parameters = new HashMap<String, String>();
	parameters.put(OAuth2Utils.GRANT_TYPE, "authorization_code");

	OAuth2AccessToken expectedToken = new DefaultOAuth2AccessToken("FOO");
	when(tokenGranter.grant(Mockito.eq("authorization_code"), Mockito.any(TokenRequest.class))).thenReturn(
			expectedToken);
	@SuppressWarnings("unchecked")
	Map<String, String> anyMap = Mockito.any(Map.class);
	when(authorizationRequestFactory.createTokenRequest(anyMap, Mockito.any(ClientDetails.class))).thenReturn(
			createFromParameters(parameters));

	clientAuthentication = new UsernamePasswordAuthenticationToken(null, null,
			Collections.singleton(new SimpleGrantedAuthority("ROLE_CLIENT")));
	ResponseEntity<OAuth2AccessToken> response = endpoint.getAccessToken(clientAuthentication, parameters);

	assertNotNull(response);
	assertEquals(HttpStatus.OK, response.getStatusCode());
	OAuth2AccessToken body = response.getBody();
	assertEquals(body, expectedToken);
	assertTrue("Wrong body: " + body, body.getTokenType() != null);
}
 

import org.springframework.security.oauth2.provider.TokenRequest; //导入依赖的package包/类
@Override
protected OAuth2Authentication getOAuth2Authentication(ClientDetails client, TokenRequest tokenRequest) {

    Map<String, String> parameters = tokenRequest.getRequestParameters();
    String authorizationCode = parameters.get("code");
    String redirectUri = parameters.get(OAuth2Utils.REDIRECT_URI);
    String codeVerifier = parameters.get("code_verifier");

    if (authorizationCode == null) {
        throw new InvalidRequestException("An authorization code must be supplied.");
    }

    OAuth2Authentication storedAuth = authorizationCodeServices.consumeAuthorizationCode(authorizationCode);
    if (storedAuth == null) {
        throw new InvalidGrantException("Invalid authorization code: " + authorizationCode);
    }

    OAuth2Request pendingOAuth2Request = storedAuth.getOAuth2Request();




    // Validates code verifier
    Map<String, String> pendingOauth2RequestParams = pendingOAuth2Request.getRequestParameters();
    String codeChallenge = pendingOauth2RequestParams.get("code_challenge");
    String codeChallengeMethod = pendingOauth2RequestParams.get("code_challenge_method");

    if (codeVerifier == null && codeChallenge != null) {
        // client is using PKCE but did not send the codeVerifier
        throw new InvalidRequestException(
                "Invalid authorization code for current token request.");
    }

    if (codeVerifier != null && codeChallenge != null) {
        String hashed = codeVerifier;
        if ("S256".equals(codeChallengeMethod)) {
            hashed = DigestUtils.sha256Hex(codeVerifier);
        }

        if (!hashed.equalsIgnoreCase(codeChallenge)) {
            throw new InvalidRequestException(
                    "Invalid authorization code for current token request.");
        }
    }



    // https://jira.springsource.org/browse/SECOAUTH-333
    // This might be null, if the authorization was done without the redirect_uri parameter
    String redirectUriApprovalParameter = pendingOAuth2Request.getRequestParameters().get(
            OAuth2Utils.REDIRECT_URI);

    if ((redirectUri != null || redirectUriApprovalParameter != null)
            && !pendingOAuth2Request.getRedirectUri().equals(redirectUri)) {
        throw new RedirectMismatchException("Redirect URI mismatch.");
    }

    String pendingClientId = pendingOAuth2Request.getClientId();
    String clientId = tokenRequest.getClientId();
    if (clientId != null && !clientId.equals(pendingClientId)) {
        // just a sanity check.
        throw new InvalidClientException("Client ID mismatch");
    }

    // Secret is not required in the authorization request, so it won't be available
    // in the pendingAuthorizationRequest. We do want to check that a secret is provided
    // in the token request, but that happens elsewhere.

    Map<String, String> combinedParameters = new HashMap<String, String>(pendingOAuth2Request
            .getRequestParameters());
    // Combine the parameters adding the new ones last so they override if there are any clashes
    combinedParameters.putAll(parameters);

    // Make a new stored request with the combined parameters
    OAuth2Request finalStoredOAuth2Request = pendingOAuth2Request.createOAuth2Request(combinedParameters);

    Authentication userAuth = storedAuth.getUserAuthentication();

    return new OAuth2Authentication(finalStoredOAuth2Request, userAuth);

}
 

import org.springframework.security.oauth2.provider.TokenRequest; //导入依赖的package包/类
@Override
public OAuth2AccessToken refreshAccessToken(String refreshTokenValue, TokenRequest tokenRequest)
        throws AuthenticationException {

    OAuth2AccessToken token = super.refreshAccessToken(refreshTokenValue, tokenRequest);
    return token;
}
 

import org.springframework.security.oauth2.provider.TokenRequest; //导入依赖的package包/类
@Override
public TokenRequest createTokenRequest(Map<String, String> requestParameters, ClientDetails authenticatedClient) {
    TokenRequest tokenRequest = super.createTokenRequest(requestParameters, authenticatedClient);

    Map<String, String> enhancedRequestParameters = new HashMap<>(tokenRequest.getRequestParameters());
    enhancedRequestParameters.put(OAuth2Utils.CLIENT_ID, authenticatedClient.getClientId());
    tokenRequest.setRequestParameters(enhancedRequestParameters);

    return tokenRequest;
}
 

import org.springframework.security.oauth2.provider.TokenRequest; //导入依赖的package包/类
private OAuth2AccessToken getAccessTokenForImplicitGrant(TokenRequest tokenRequest, OAuth2Request storedOAuth2Request) {
    OAuth2AccessToken accessToken;
    // These 1 method calls have to be atomic, otherwise the ImplicitGrantService can have a race condition where
    // one thread removes the token request before another has a chance to redeem it.
    synchronized (this.implicitLock) {
        accessToken = tokenGranter.grant("implicit",
            new ImplicitTokenRequest(tokenRequest, storedOAuth2Request));
    }
    return accessToken;
}
 

import org.springframework.security.oauth2.provider.TokenRequest; //导入依赖的package包/类
private String getImplicitGrantResponse(AuthorizationRequest authorizationRequest) {
    try {
        TokenRequest tokenRequest = requestFactory.createTokenRequest(authorizationRequest, "implicit");
        OAuth2Request storedOAuth2Request = requestFactory.createOAuth2Request(authorizationRequest);
        OAuth2AccessToken accessToken = getAccessTokenForImplicitGrant(tokenRequest, storedOAuth2Request);
        if (isNull(accessToken)) {
            throw new UnsupportedResponseTypeException("Unsupported response type: token");
        }
        return appendAccessToken(authorizationRequest, accessToken);
    } catch (OAuth2Exception e) {
        return getUnsuccessfulRedirect(authorizationRequest, e, true);
    }
}
 

import org.springframework.security.oauth2.provider.TokenRequest; //导入依赖的package包/类
void authenticate(String... authorities) {
    StringBuilder authoritiesBuilder = new StringBuilder();
    for (String authority : authorities) {
        authoritiesBuilder.append(",").append(authority);
    }
    ClientDetails client = new BaseClientDetails("clientId", null, "read", "client_credentials", authoritiesBuilder.substring(1));
    OAuth2Authentication authentication = new OAuth2Authentication(new TokenRequest(null, "clientId", null, "client_credentials").createOAuth2Request(client), null);

    SecurityContext context = SecurityContextHolder.createEmptyContext();
    context.setAuthentication(authentication);
    SecurityContextHolder.setContext(context);
}
 

import org.springframework.security.oauth2.provider.TokenRequest; //导入依赖的package包/类
public OAuth2AccessToken refreshAccessToken(String refreshTokenValue, TokenRequest request)
		throws AuthenticationException {

	if (!supportRefreshToken) {
		throw new InvalidGrantException("Invalid refresh token: " + refreshTokenValue);
	}

	OAuth2Authentication authentication = loadAuthentication(refreshTokenValue);
	String clientId = authentication.getOAuth2Request().getClientId();
	if (clientId == null || !clientId.equals(request.getClientId())) {
		throw new InvalidGrantException("Wrong client for this refresh token: " + refreshTokenValue);
	}

	OAuth2AccessToken refreshTokenData = readAccessToken(refreshTokenValue);
	if (isExpired(refreshTokenData)) {
		throw new InvalidTokenException("Invalid refresh token (expired): " + refreshTokenValue);
	}

	authentication = createRefreshedAuthentication(authentication, request.getScope());

	OAuth2AccessToken accessToken = createAccessToken(authentication);
	if (!reuseRefreshToken) {
		OAuth2RefreshToken refreshToken = createRefreshToken(authentication);
		DefaultOAuth2AccessToken result = new DefaultOAuth2AccessToken(accessToken);
		result.setRefreshToken(refreshToken);
	}

	return accessToken;
}
 

import org.springframework.security.oauth2.provider.TokenRequest; //导入依赖的package包/类
@Override
public OAuth2AccessToken grant(String grantType, TokenRequest tokenRequest) {
	OAuth2AccessToken token = super.grant(grantType, tokenRequest);
	if (token != null) {
		DefaultOAuth2AccessToken norefresh = new DefaultOAuth2AccessToken(token);
		// The spec says that client credentials should not be allowed to get a refresh token
		if (!allowRefresh) {
			norefresh.setRefreshToken(null);
		}
		token = norefresh;
	}
	return token;
}
 

import org.springframework.security.oauth2.provider.TokenRequest; //导入依赖的package包/类
private ModelAndView getImplicitGrantResponse(AuthorizationRequest authorizationRequest) {
	try {
		TokenRequest tokenRequest = getOAuth2RequestFactory().createTokenRequest(authorizationRequest, "implicit");
		OAuth2Request storedOAuth2Request = getOAuth2RequestFactory().createOAuth2Request(authorizationRequest);
		implicitGrantService.store(storedOAuth2Request, tokenRequest);
		OAuth2AccessToken accessToken = getTokenGranter().grant("implicit", tokenRequest);
		if (accessToken == null) {
			throw new UnsupportedResponseTypeException("Unsupported response type: token");
		}
		return new ModelAndView(new RedirectView(appendAccessToken(authorizationRequest, accessToken), false, true, false));
	}
	catch (OAuth2Exception e) {
		return new ModelAndView(new RedirectView(getUnsuccessfulRedirect(authorizationRequest, e, true), false, true, false));
	}
}
 

import org.springframework.security.oauth2.provider.TokenRequest; //导入依赖的package包/类
@Test
public void testRefreshedTokenHasScopes() throws Exception {
	ExpiringOAuth2RefreshToken expectedExpiringRefreshToken = new DefaultExpiringOAuth2RefreshToken(
			"testToken", new Date(System.currentTimeMillis() + 100000));
	tokenStore.storeRefreshToken(expectedExpiringRefreshToken,
			createAuthentication());
	TokenRequest tokenRequest = new TokenRequest(Collections.singletonMap(
			"client_id", "id"), "id", null, null);
	OAuth2AccessToken refreshedAccessToken = getTokenServices()
			.refreshAccessToken(expectedExpiringRefreshToken.getValue(),
					tokenRequest);
	assertEquals("[read, write]", refreshedAccessToken.getScope().toString());
}
 

import org.springframework.security.oauth2.provider.TokenRequest; //导入依赖的package包/类
@Test
public void testRefreshedTokenHasNarrowedScopes() throws Exception {
	ExpiringOAuth2RefreshToken expectedExpiringRefreshToken = new DefaultExpiringOAuth2RefreshToken(
			"testToken", new Date(System.currentTimeMillis() + 100000));
	tokenStore.storeRefreshToken(expectedExpiringRefreshToken,
			createAuthentication());
	TokenRequest tokenRequest = new TokenRequest(Collections.singletonMap(
			"client_id", "id"), "id", Collections.singleton("read"), null);
	OAuth2AccessToken refreshedAccessToken = getTokenServices()
			.refreshAccessToken(expectedExpiringRefreshToken.getValue(),
					tokenRequest);
	assertEquals("[read]", refreshedAccessToken.getScope().toString());
}
 

import org.springframework.security.oauth2.provider.TokenRequest; //导入依赖的package包/类
@Test(expected = InvalidGrantException.class)
public void testRefreshedTokenInvalidWithWrongClient() throws Exception {
	ExpiringOAuth2RefreshToken expectedExpiringRefreshToken = new DefaultExpiringOAuth2RefreshToken(
			"testToken", new Date(System.currentTimeMillis() + 100000));
	tokenStore.storeRefreshToken(expectedExpiringRefreshToken,
			createAuthentication());
	TokenRequest tokenRequest = new TokenRequest(Collections.singletonMap(
			"client_id", "wrong"), "wrong", null, null);
	OAuth2AccessToken refreshedAccessToken = getTokenServices()
			.refreshAccessToken(expectedExpiringRefreshToken.getValue(),
					tokenRequest);
	assertEquals("[read]", refreshedAccessToken.getScope().toString());
}