Package org.codelibs.fess.sso.aad

Class AzureAdAuthenticator

java.lang.Object
org.codelibs.fess.sso.aad.AzureAdAuthenticator
All Implemented Interfaces:
SsoAuthenticator
public class AzureAdAuthenticator extends Object implements SsoAuthenticator
Azure Active Directory (Azure AD) SSO authenticator implementation. Handles OAuth2/OpenID Connect authentication flow with Azure AD.

  • Field Details

    • AZUREAD_STATE_TTL

      protected static final String AZUREAD_STATE_TTL
      Configuration key for Azure AD state time-to-live.
      See Also:

    • AZUREAD_AUTHORITY

      protected static final String AZUREAD_AUTHORITY
      Configuration key for Azure AD authority URL.
      See Also:

    • AZUREAD_TENANT

      protected static final String AZUREAD_TENANT
      Configuration key for Azure AD tenant ID.
      See Also:

    • AZUREAD_CLIENT_SECRET

      protected static final String AZUREAD_CLIENT_SECRET
      Configuration key for Azure AD client secret.
      See Also:

    • AZUREAD_CLIENT_ID

      protected static final String AZUREAD_CLIENT_ID
      Configuration key for Azure AD client ID.
      See Also:

    • AZUREAD_REPLY_URL

      protected static final String AZUREAD_REPLY_URL
      Configuration key for Azure AD reply URL.
      See Also:

    • STATES

      protected static final String STATES
      Session attribute key for storing Azure AD states.
      See Also:

    • STATE

      protected static final String STATE
      OAuth2 state parameter name.
      See Also:

    • ERROR

      protected static final String ERROR
      OAuth2 error parameter name.
      See Also:

    • ERROR_DESCRIPTION

      protected static final String ERROR_DESCRIPTION
      OAuth2 error description parameter name.
      See Also:

    • ERROR_URI

      protected static final String ERROR_URI
      OAuth2 error URI parameter name.
      See Also:

    • ID_TOKEN

      protected static final String ID_TOKEN
      OpenID Connect ID token parameter name.
      See Also:

    • CODE

      protected static final String CODE
      OAuth2 authorization code parameter name.
      See Also:

    • acquisitionTimeout

      protected long acquisitionTimeout
      Timeout for token acquisition in milliseconds.

    • groupCache

      protected com.google.common.cache.Cache<String,org.codelibs.core.misc.Pair<String[],String[]>> groupCache
      Cache for storing group information to reduce API calls.

    • groupCacheExpiry

      protected long groupCacheExpiry
      Group cache expiry time in seconds.

  • Constructor Details

    • AzureAdAuthenticator

      public AzureAdAuthenticator()
      Default constructor for AzureAdAuthenticator.

  • Method Details

    • init

      @PostConstruct public void init()
      Initializes the Azure AD authenticator. Registers this authenticator with the SSO manager and sets up group cache.

    • getLoginCredential

      public org.lastaflute.web.login.credential.LoginCredential getLoginCredential()
      Description copied from interface: SsoAuthenticator
      Gets the login credential for SSO authentication.
      Specified by:
      getLoginCredential in interface SsoAuthenticator
      Returns:
      The login credential.

    • getAuthUrl

      protected String getAuthUrl(jakarta.servlet.http.HttpServletRequest request)
      Generates the Azure AD authorization URL for the authentication request.
      Parameters:
      request - The HTTP servlet request.
      Returns:
      The authorization URL to redirect the user to.

    • storeStateInSession

      protected void storeStateInSession(jakarta.servlet.http.HttpSession session, String state, String nonce)
      Stores state and nonce information in the HTTP session.
      Parameters:
      session - The HTTP session.
      state - The OAuth2 state parameter.
      nonce - The OpenID Connect nonce parameter.

    • processAuthenticationData

      protected org.lastaflute.web.login.credential.LoginCredential processAuthenticationData(jakarta.servlet.http.HttpServletRequest request)
      Processes authentication data from the OAuth2 callback.
      Parameters:
      request - The HTTP servlet request containing authentication data.
      Returns:
      The login credential or null if processing fails.

    • parseAuthenticationResponse

      protected com.nimbusds.openid.connect.sdk.AuthenticationResponse parseAuthenticationResponse(String url, Map<String,List<String>> params)
      Parses the authentication response from Azure AD.
      Parameters:
      url - The response URL.
      params - The response parameters.
      Returns:
      The parsed authentication response.

    • validateNonce

      protected void validateNonce(AzureAdAuthenticator.StateData stateData, com.microsoft.aad.adal4j.AuthenticationResult authData)
      Validates the nonce in the authentication result.
      Parameters:
      stateData - The stored state data containing the expected nonce.
      authData - The authentication result containing the actual nonce.

    • getAccessToken

      public com.microsoft.aad.adal4j.AuthenticationResult getAccessToken(String refreshToken)
      Obtains an access token using a refresh token.
      Parameters:
      refreshToken - The refresh token to use for token acquisition.
      Returns:
      The authentication result containing the access token.

    • getAccessToken

      protected com.microsoft.aad.adal4j.AuthenticationResult getAccessToken(com.nimbusds.oauth2.sdk.AuthorizationCode authorizationCode, String currentUri)
      Obtains an access token using an authorization code.
      Parameters:
      authorizationCode - The authorization code received from Azure AD.
      currentUri - The current URI for the redirect.
      Returns:
      The authentication result containing the access token.

    • validateAuthRespMatchesCodeFlow

      protected void validateAuthRespMatchesCodeFlow(com.nimbusds.openid.connect.sdk.AuthenticationSuccessResponse oidcResponse)
      Validates that the authentication response matches the authorization code flow.
      Parameters:
      oidcResponse - The OpenID Connect authentication success response.

    • validateState

      protected AzureAdAuthenticator.StateData validateState(jakarta.servlet.http.HttpSession session, String state)
      Validates the OAuth2 state parameter.
      Parameters:
      session - The HTTP session containing stored state data.
      state - The state parameter to validate.
      Returns:
      The validated state data.

    • removeStateFromSession

      protected AzureAdAuthenticator.StateData removeStateFromSession(jakarta.servlet.http.HttpSession session, String state)
      Removes and returns state data from the HTTP session.
      Parameters:
      session - The HTTP session.
      state - The state parameter to remove.
      Returns:
      The removed state data or null if not found.

    • containsAuthenticationData

      protected boolean containsAuthenticationData(jakarta.servlet.http.HttpServletRequest request)
      Checks if the request contains authentication data from Azure AD.
      Parameters:
      request - The HTTP servlet request to check.
      Returns:
      True if authentication data is present, false otherwise.

    • updateMemberOf

      public void updateMemberOf(AzureAdCredential.AzureAdUser user)
      Updates the user's group and role membership information.
      Parameters:
      user - The Azure AD user to update.

    • processMemberOf

      protected void processMemberOf(AzureAdCredential.AzureAdUser user, List<String> groupList, List<String> roleList, String url)
      Processes member-of information from Microsoft Graph API.
      Parameters:
      user - The Azure AD user.
      groupList - The list to add group names to.
      roleList - The list to add role names to.
      url - The Microsoft Graph API URL.

    • addGroupOrRoleName

      protected void addGroupOrRoleName(List<String> list, String value, boolean useDomainServices)
      Adds a group or role name to the specified list.
      Parameters:
      list - The list to add the group or role name to.
      value - The group or role name value.
      useDomainServices - Whether to use domain services for group resolution.

    • processParentGroup

      protected void processParentGroup(AzureAdCredential.AzureAdUser user, List<String> groupList, List<String> roleList, String id)
      Processes parent group information for nested groups.
      Parameters:
      user - The Azure AD user.
      groupList - The list to add group names to.
      roleList - The list to add role names to.
      id - The group ID to process.

    • getParentGroup

      protected org.codelibs.core.misc.Pair<String[],String[]> getParentGroup(AzureAdCredential.AzureAdUser user, String id)
      Retrieves parent group information for the specified group ID.
      Parameters:
      user - The Azure AD user.
      id - The group ID to get parent information for.
      Returns:
      A pair containing group names and role names.

    • processGroup

      protected void processGroup(AzureAdCredential.AzureAdUser user, List<String> groupList, List<String> roleList, String id)
      Processes individual group information.
      Parameters:
      user - The Azure AD user.
      groupList - The list to add group names to.
      roleList - The list to add role names to.
      id - The group ID to process.

    • getDefaultGroupList

      protected List<String> getDefaultGroupList()
      Gets the default group list for users.
      Returns:
      The default group list.

    • getDefaultRoleList

      protected List<String> getDefaultRoleList()
      Gets the default role list for users.
      Returns:
      The default role list.

    • getClientId

      protected String getClientId()
      Gets the Azure AD client ID from configuration.
      Returns:
      The client ID.

    • getClientSecret

      protected String getClientSecret()
      Gets the Azure AD client secret from configuration.
      Returns:
      The client secret.

    • getTenant

      protected String getTenant()
      Gets the Azure AD tenant ID from configuration.
      Returns:
      The tenant ID.

    • getAuthority

      protected String getAuthority()
      Gets the Azure AD authority URL from configuration.
      Returns:
      The authority URL.

    • getStateTtl

      protected long getStateTtl()
      Gets the state time-to-live from configuration.
      Returns:
      The state TTL in milliseconds.

    • getReplyUrl

      protected String getReplyUrl(jakarta.servlet.http.HttpServletRequest request)
      Gets the reply URL for Azure AD authentication.
      Parameters:
      request - The HTTP servlet request.
      Returns:
      The reply URL.

    • resolveCredential

      public void resolveCredential(FessLoginAssist.LoginCredentialResolver resolver)
      Description copied from interface: SsoAuthenticator
      Resolves credential using the provided resolver.
      Specified by:
      resolveCredential in interface SsoAuthenticator
      Parameters:
      resolver - The login credential resolver.

    • setAcquisitionTimeout

      public void setAcquisitionTimeout(long acquisitionTimeout)
      Sets the token acquisition timeout.
      Parameters:
      acquisitionTimeout - The timeout in milliseconds.

    • setGroupCacheExpiry

      public void setGroupCacheExpiry(long groupCacheExpiry)
      Sets the group cache expiry time.
      Parameters:
      groupCacheExpiry - The cache expiry time in seconds.

    • getResponse

      public org.lastaflute.web.response.ActionResponse getResponse(SsoResponseType responseType)
      Description copied from interface: SsoAuthenticator
      Gets the action response for the specified SSO response type.
      Specified by:
      getResponse in interface SsoAuthenticator
      Parameters:
      responseType - The type of SSO response required.
      Returns:
      The action response.

    • logout

      public String logout(org.codelibs.fess.mylasta.action.FessUserBean user)
      Description copied from interface: SsoAuthenticator
      Performs logout for the specified user.
      Specified by:
      logout in interface SsoAuthenticator
      Parameters:
      user - The user to logout.
      Returns:
      The logout URL or null if not applicable.