import com.nimbusds.oauth2.sdk.id.Issuer; //导入依赖的package包/类
@Bean
public TokenEndpoint tokenEndpoint() {
	AuthorizationCodeGrantHandler authorizationCodeGrantHandler = new AuthorizationCodeGrantHandler(
			clientRepository(), tokenService(), authorizationCodeService());
	ResourceOwnerPasswordCredentialsGrantHandler passwordCredentialsGrantHandler = new ResourceOwnerPasswordCredentialsGrantHandler(
			clientRepository(), tokenService(), scopeResolver(), authenticationHandler());
	ClientCredentialsGrantHandler clientCredentialsGrantHandler = new ClientCredentialsGrantHandler(
			clientRepository(), scopeResolver(), tokenService());
	RefreshTokenGrantHandler refreshTokenGrantHandler = new RefreshTokenGrantHandler(clientRepository(),
			tokenService(), refreshTokenStore());

	Map<Class<?>, GrantHandler> grantHandlers = new HashMap<>();
	grantHandlers.put(AuthorizationCodeGrant.class, authorizationCodeGrantHandler);
	grantHandlers.put(ResourceOwnerPasswordCredentialsGrant.class, passwordCredentialsGrantHandler);
	grantHandlers.put(ClientCredentialsGrant.class, clientCredentialsGrantHandler);
	grantHandlers.put(RefreshTokenGrant.class, refreshTokenGrantHandler);

	return new TokenEndpoint(grantHandlers, new Issuer("http://example.com"), clientRepository());
}
 

import com.nimbusds.oauth2.sdk.id.Issuer; //导入依赖的package包/类
@Override
public IDTokenClaimsSet validate(final JWT idToken, final Nonce expectedNonce) throws BadJOSEException, JOSEException {
    try {
        if (originalIssuer.contains("%7Btenantid%7D")) {
            Object tid = idToken.getJWTClaimsSet().getClaim("tid");
            if (tid == null) {
                throw new BadJWTException("ID token does not contain the 'tid' claim");
            }
            base = new IDTokenValidator(new Issuer(originalIssuer.replace("%7Btenantid%7D", tid.toString())),
                    base.getClientID(), base.getJWSKeySelector(), base.getJWEKeySelector());
            base.setMaxClockSkew(getMaxClockSkew());
        }
    } catch (ParseException e) {
        throw new BadJWTException(e.getMessage(), e);
    }
    return base.validate(idToken, expectedNonce);
}
 

import com.nimbusds.oauth2.sdk.id.Issuer; //导入依赖的package包/类
@Override
public Response handle(HTTPRequest httpRequest, OIDCResourceReference reference) throws Exception
{
    Issuer issuer = this.manager.getIssuer();
    List<SubjectType> subjectTypes = Arrays.asList(SubjectType.PUBLIC);
    URI jwkSetURI = this.manager.createEndPointURI(JWKOIDCEndpoint.HINT);

    OIDCProviderMetadata metadata = new OIDCProviderMetadata(issuer, subjectTypes, jwkSetURI);

    metadata.setAuthorizationEndpointURI(this.manager.createEndPointURI(AuthorizationOIDCEndpoint.HINT));
    metadata.setTokenEndpointURI(this.manager.createEndPointURI(TokenOIDCEndpoint.HINT));
    metadata.setUserInfoEndpointURI(this.manager.createEndPointURI(UserInfoOIDCEndpoint.HINT));

    return new ContentResponse(CommonContentTypes.APPLICATION_JSON, metadata.toJSONObject().toString(),
        HTTPResponse.SC_OK);
}
 

import com.nimbusds.oauth2.sdk.id.Issuer; //导入依赖的package包/类
@Test
public void testSuccess() throws Exception {
    final IssuerCriterion criterion = new IssuerCriterion(new Issuer(issuer));
    final OIDCProviderMetadata metadata = resolver.resolveSingle(new CriteriaSet(criterion));
    Assert.assertNotNull(metadata);
    Assert.assertEquals(metadata.getIssuer().getValue(), issuer);
}
 

import com.nimbusds.oauth2.sdk.id.Issuer; //导入依赖的package包/类
@Test
public void testDynamic() throws Exception {
    final IssuerCriterion criterion = new IssuerCriterion(new Issuer(issuer));
    OIDCProviderMetadata metadata = resolver.resolveSingle(new CriteriaSet(criterion));
    Assert.assertNotNull(metadata);
    Assert.assertEquals(metadata.getIssuer().getValue(), issuer);
    ((DynamicFilesystemProviderMetadataResolver)resolver).refresh();
    metadata = resolver.resolveSingle(new CriteriaSet(criterion));
    Assert.assertNotNull(metadata.getCustomParameter(name));
    Assert.assertEquals(metadata.getCustomParameter(name), value);
}
 

import com.nimbusds.oauth2.sdk.id.Issuer; //导入依赖的package包/类
@Test
public void testSetters() throws URISyntaxException, ParseException {
    ctx.setAcr("acrValue");
    ctx.setAuthTime(1);
    ctx.setExp(2);
    Issuer issuer = new Issuer("iss");
    Subject sub = new Subject("sub");
    List<Audience> aud = new ArrayList<Audience>();
    aud.add(new Audience("aud"));
    IDTokenClaimsSet token = new IDTokenClaimsSet(issuer, sub, aud, new Date(), new Date());
    ctx.setIDToken(token);
    NameID id = new MockNameID();
    ctx.setNameId(id);
    URI uri = new URI("https://example.org");
    ctx.setRedirectURI(uri);
    ctx.setRequestedSubject("sub");
    Scope scope = new Scope();
    ctx.setScope(scope);
    JWSHeader header = new JWSHeader(JWSAlgorithm.ES256);
    SignedJWT sJWT = new SignedJWT(header, token.toJWTClaimsSet());
    ctx.setSignedIDToken(sJWT);
    Assert.assertEquals(ctx.getAcr().toString(), "acrValue");
    ctx.setAcr(null);
    Assert.assertNull(ctx.getAcr());
    Assert.assertEquals(ctx.getAuthTime(), new Date(1));
    Assert.assertEquals(ctx.getExp(), new Date(2));
    Assert.assertEquals(ctx.getIDToken(), token);
    Assert.assertEquals(ctx.getNameId(), id);
    Assert.assertEquals(ctx.getSignedIDToken(), sJWT);
    Assert.assertEquals(ctx.getRedirectURI(), uri);
    Assert.assertEquals(ctx.getRequestedSubject(), "sub");
    Assert.assertEquals(ctx.getScope(), scope);
}
 

import com.nimbusds.oauth2.sdk.id.Issuer; //导入依赖的package包/类
public DefaultTokenService(Issuer issuer, JwkSetLoader jwkSetLoader, ClaimSource claimSource,
		RefreshTokenStore refreshTokenStore) {
	Objects.requireNonNull(issuer, "issuer must not be null");
	Objects.requireNonNull(jwkSetLoader, "jwkSetLoader must not be null");
	Objects.requireNonNull(claimSource, "claimSource must not be null");
	Objects.requireNonNull(refreshTokenStore, "refreshTokenStore must not be null");
	this.issuer = issuer;
	this.jwkSetLoader = jwkSetLoader;
	this.claimSource = claimSource;
	this.refreshTokenStore = refreshTokenStore;
}
 

import com.nimbusds.oauth2.sdk.id.Issuer; //导入依赖的package包/类
public TokenRevocationEndpoint(Issuer issuer, ClientRepository clientRepository,
		RefreshTokenStore refreshTokenStore) {
	Objects.requireNonNull(issuer, "issuer must not be null");
	Objects.requireNonNull(clientRepository, "clientRepository must not be null");
	Objects.requireNonNull(refreshTokenStore, "refreshTokenStore must not be null");
	this.refreshTokenStore = refreshTokenStore;
	this.clientRequestValidator = new ClientRequestValidator(issuer, clientRepository);
}
 

import com.nimbusds.oauth2.sdk.id.Issuer; //导入依赖的package包/类
public TokenEndpoint(Map<Class<?>, GrantHandler> grantHandlers, Issuer issuer, ClientRepository clientRepository) {
	Objects.requireNonNull(grantHandlers, "grantHandlers must not be null");
	Objects.requireNonNull(issuer, "issuer must not be null");
	Objects.requireNonNull(clientRepository, "clientRepository must not be null");
	if (grantHandlers.isEmpty()) {
		throw new IllegalArgumentException("grantHandlers must not be empty");
	}
	this.grantHandlers = grantHandlers;
	this.clientRequestValidator = new ClientRequestValidator(issuer, clientRepository);
}
 

import com.nimbusds.oauth2.sdk.id.Issuer; //导入依赖的package包/类
protected Issuer getMetadataIssuer() {
	Issuer issuer;
	if (params.getBool(FORCE_HONEST_DISCOVERY_ISS)) {
		issuer = getHonestIssuer();
	} else {
		issuer = supplyHonestOrEvil(this::getHonestIssuer, this::getEvilIssuer);
	}
	return issuer;
}
 

import com.nimbusds.oauth2.sdk.id.Issuer; //导入依赖的package包/类
protected Issuer getTokenIssuer() {
	Issuer issuer;
	if (params.getBool(FORCE_HONEST_TOKEN_ISS)) {
		issuer = getHonestIssuer();
	} else {
		issuer = supplyHonestOrEvil(this::getHonestIssuer, this::getEvilIssuer);
	}
	return issuer;
}
 

import com.nimbusds.oauth2.sdk.id.Issuer; //导入依赖的package包/类
protected OIDCProviderMetadata getDefaultOPMetadata() throws ParseException {
	Issuer issuer = getMetadataIssuer();
	List<SubjectType> subjectTypes = Arrays.asList(SubjectType.PUBLIC);
	URI jwksUri = UriBuilder.fromUri(baseUri).path(JWKS_PATH).build();
	OIDCProviderMetadata md = new OIDCProviderMetadata(issuer, subjectTypes, jwksUri);
	md.applyDefaults();

	// endpoints
	URI authzEndpt = getMetadataAuthorizationEndpoint();
	URI tokenEndpt = getMetadataTokenEndpoint();
	URI userInfoEndpt = getMetadataUserinfoEndpoint();
	URI registrationEndpt = getMetadataRegistrationEndpoint();
	md.setAuthorizationEndpointURI(authzEndpt);
	md.setTokenEndpointURI(tokenEndpt);
	md.setUserInfoEndpointURI(userInfoEndpt);
	md.setRegistrationEndpointURI(registrationEndpt);

	// , ResponseType.parse("id_token"), ResponseType.parse("token id_token"));
	Scope scopes = new Scope("openid");
	List<ResponseType> responseTypes = Arrays.asList(ResponseType.parse("code"), ResponseType.parse("id_token"),
			ResponseType.parse("token id_token"));
	List<ResponseMode> responseModes = Arrays.asList(ResponseMode.QUERY, ResponseMode.FRAGMENT, ResponseMode.FORM_POST);
	List<GrantType> grantTypes = Arrays.asList(GrantType.AUTHORIZATION_CODE, GrantType.IMPLICIT);
	md.setScopes(scopes);
	md.setResponseTypes(responseTypes);
	md.setResponseModes(responseModes);
	md.setGrantTypes(grantTypes);

	// algorithms
	List<JWSAlgorithm> jwsAlgs = Arrays.asList(JWSAlgorithm.RS256, JWSAlgorithm.parse("none"));
	md.setIDTokenJWSAlgs(jwsAlgs);

	List<ClientAuthenticationMethod> authMethods = Arrays.asList(ClientAuthenticationMethod.CLIENT_SECRET_BASIC);
	md.setTokenEndpointAuthMethods(authMethods);

	List<Display> displays = Arrays.asList(Display.PAGE);
	md.setDisplays(displays);

	return md;
}
 

import com.nimbusds.oauth2.sdk.id.Issuer; //导入依赖的package包/类
public OIDCIdentityProvider(IdentityProvider provider, Issuer issuer, URI authURI, URI tokenURI, URI userInfoURI, IDTokenValidator rsaValidator, IDTokenValidator hmacValidator) {
	this.clientId = new ClientID(provider.getClientId());
	this.clientSecret = provider.getClientSecret();
	this.responseType = provider.getResponseType();
	this.scope = provider.getScope();
	this.clockSkew = provider.getClockSkew();
	this.checkNonce = provider.isCheckNonce();
	this.claims = parseClaimsRequest(provider.getClaims());
	this.issuer = issuer;
	this.authURI = authURI;
	this.tokenURI = tokenURI;
	this.userInfoURI = userInfoURI;
	this.rsaValidator = rsaValidator;
	this.hmacValidator = hmacValidator;
}
 

import com.nimbusds.oauth2.sdk.id.Issuer; //导入依赖的package包/类
private IDTokenClaimsSet validateToken(OAuthProvider provider, OAuthLoginRequestDTO oAuthLoginRequestDTO) throws MalformedURLException, ParseException, BadJOSEException, JOSEException {
    Issuer iss = new Issuer(provider.getIssuer());
    ClientID clientID = new ClientID(provider.getClientID());
    Nonce nonce = new Nonce(oAuthLoginRequestDTO.getNonce());
    URL jwkSetURL = new URL(provider.getJwkSetURL());
    JWSAlgorithm jwsAlg = JWSAlgorithm.parse(provider.getJwsAlgorithm());
    IDTokenValidator validator = new IDTokenValidator(iss, clientID, jwsAlg, jwkSetURL);
    JWT idToken = JWTParser.parse(oAuthLoginRequestDTO.getIdToken());
    return validator.validate(idToken, nonce);
}
 

import com.nimbusds.oauth2.sdk.id.Issuer; //导入依赖的package包/类
/**
 * @return the issuer
 * @throws MalformedURLException when failing to create the issuer
 */
public Issuer getIssuer() throws MalformedURLException
{
    XWikiContext xcontext = this.xcontextProvider.get();

    XWikiURLFactory urlFactory = xcontext.getURLFactory();

    return new Issuer(urlFactory.getServerURL(xcontext).toString());
}
 

import com.nimbusds.oauth2.sdk.id.Issuer; //导入依赖的package包/类
/**
 * Generate an OIDC ID Token.
 * 
 * @param clientID the client id
 * @param userReference the reference of the user
 * @param nonce the nonce
 * @param claims the custom fields to return
 * @return the id token
 * @throws ParseException when failing to create the id token
 * @throws MalformedURLException when failing to get issuer
 * @since 1.3
 */
public JWT createdIdToken(ClientID clientID, DocumentReference userReference, Nonce nonce, ClaimsRequest claims)
    throws ParseException, MalformedURLException
{
    Issuer issuer = getIssuer();
    Subject subject = getSubject(userReference);
    List<Audience> audiences =
        clientID != null ? Arrays.asList(new Audience(clientID)) : Collections.<Audience>emptyList();

    LocalDateTime now = LocalDateTime.now();
    LocalDateTime now1year = now.plusYears(1);

    IDTokenClaimsSet idTokenClaimSet =
        new IDTokenClaimsSet(issuer, subject, audiences, now1year.toDate(), now.toDate());

    idTokenClaimSet.setNonce(nonce);

    // Add custom claims
    if (claims != null) {
        for (Entry claim : claims.getIDTokenClaims()) {
            switch (claim.getClaimName()) {
                case OIDCIdToken.CLAIM_XWIKI_INSTANCE_ID:
                    idTokenClaimSet.setClaim(OIDCIdToken.CLAIM_XWIKI_INSTANCE_ID, this.instance.getInstanceId());
                    break;

                default:
                    break;
            }
        }
    }

    // Convert to JWT
    return new PlainJWT(idTokenClaimSet.toJWTClaimsSet());
}
 

import com.nimbusds.oauth2.sdk.id.Issuer; //导入依赖的package包/类
/** {@inheritDoc} */
@Override
protected void doExecute(@Nonnull final ProfileRequestContext profileRequestContext) {

    /**
     * aud REQUIRED. Audience(s) that this ID Token is intended for. It MUST contain
     * the OAuth 2.0 client_id of the Relying Party as an audience value. It MAY
     * also contain identifiers for other audiences. In the general case, the aud
     * value is an array of case sensitive strings. In the common special case when
     * there is one audience, the aud value MAY be a single case sensitive string.
     * 
     * NOTE. TODO. We allow only single value in this first version.
     */
    List<Audience> aud = new ArrayList<Audience>();
    aud.add(new Audience(rpCtx.getRelyingPartyId()));
    /**
     * exp REQUIRED. Expiration time on or after which the ID Token MUST NOT be
     * accepted for processing. The processing of this parameter requires that the
     * current date/time MUST be before the expiration date/time listed in the
     * value. Implementers MAY provide for some small leeway, usually no more than a
     * few minutes, to account for clock skew. Its value is a JSON number
     * representing the number of seconds from 1970-01-01T0:0:0Z as measured in UTC
     * until the date/time. See RFC 3339 [RFC3339] for details regarding date/times
     * in general and UTC in particular.
     * 
     * NOTE. We set here exp to +180s unless set in response context.
     */

    // NOTE: There is no control for id token exp, always +180s
    // TODO: The purpose and mechanism how to control id token exp
    Date exp = getOidcResponseContext().getExp();
    if (exp == null) {
        Calendar calExp = Calendar.getInstance();
        calExp.add(Calendar.SECOND, 180);
        exp = calExp.getTime();
    }

    /**
     * iss REQUIRED. Issuer Identifier for the Issuer of the response. The iss value
     * is a case sensitive URL using the https scheme that contains scheme, host,
     * and optionally, port number and path components and no query or fragment
     * components.
     * 
     */

    /**
     * sub REQUIRED. Subject Identifier. A locally unique and never reassigned
     * identifier within the Issuer for the End-User, which is intended to be
     * consumed by the Client, e.g., 24400320 or
     * AItOawmwtWwcT0k51BayewNvutrJUqsvl6qs7A4. It MUST NOT exceed 255 ASCII
     * characters in length. The sub value is a case sensitive string.
     * 
     * 
     * Note. We use Name ID based value as the sub.
     * 
     */

    /**
     * iat REQUIRED. Time at which the JWT was issued. Its value is a JSON number
     * representing the number of seconds from 1970-01-01T0:0:0Z as measured in UTC
     * until the date/time.
     * 
     * Note. We consider time of idtoken shell generation as iat.
     */
    IDTokenClaimsSet idToken = new IDTokenClaimsSet(new Issuer(issuerId),
            new Subject(getOidcResponseContext().getNameId().getValue()), aud, exp, new Date());
    log.debug("{} Setting id token shell to response context {}", getLogPrefix(),
            idToken.toJSONObject().toJSONString());
    getOidcResponseContext().setIDToken(idToken);
}
 

import com.nimbusds.oauth2.sdk.id.Issuer; //导入依赖的package包/类
/** {@inheritDoc} */
@Override
protected Issuer getKey(OIDCProviderMetadata value) {
    return value.getIssuer();
}
 

import com.nimbusds.oauth2.sdk.id.Issuer; //导入依赖的package包/类
protected void setIdTokenToResponseContext(String iss, String sub, String aud, Date exp, Date iat) {
    List<Audience> audience = new ArrayList<Audience>();
    audience.add(new Audience(aud));
    IDTokenClaimsSet idToken = new IDTokenClaimsSet(new Issuer(iss), new Subject(sub), audience, exp, iat);
    respCtx.setIDToken(idToken);
}
 

import com.nimbusds.oauth2.sdk.id.Issuer; //导入依赖的package包/类
@Test
public void testNotFound() throws Exception {
    final IssuerCriterion criterion = new IssuerCriterion(new Issuer("not_found"));
    final OIDCProviderMetadata metadata = resolver.resolveSingle(new CriteriaSet(criterion));
    Assert.assertNull(metadata);
}