Skip to content

Commit 458e613

Browse files
hzalazhzalaz
committed
Rework /oauth/token methods
1 parent 3a0a54d commit 458e613

5 files changed

Lines changed: 108 additions & 68 deletions

File tree

‎auth0/src/main/java/com/auth0/authentication/AuthenticationAPIClient.java‎

Lines changed: 48 additions & 64 deletions
Original file line numberDiff line numberDiff line change
@@ -46,6 +46,10 @@
4646
/**
4747
* API client for Auth0 Authentication API.
4848
*
49+
* <pre><code>
50+
* Auth0 auth0 = new Auth0("your_client_id", "your_domain");
51+
* AuthenticationAPIClient client = new AuthenticationAPIClient(auth0);
52+
* </code></pre>
4953
* @see <a href="https://auth0.com/docs/auth-api">Auth API docs</a>
5054
*/
5155
public class AuthenticationAPIClient {
@@ -72,8 +76,6 @@ public class AuthenticationAPIClient {
7276
private static final String RESOURCE_OWNER_PATH = "ro";
7377
private static final String TOKEN_INFO_PATH = "tokeninfo";
7478
private static final String OAUTH_CODE_KEY = "code";
75-
private static final String OAUTH_CODE_VERIFIER_KEY = "code_verifier";
76-
private static final String OAUTH_CLIENT_SECRET_KEY = "client_secret";
7779
private static final String REDIRECT_URI_KEY = "redirect_uri";
7880

7981
private final Auth0 auth0;
@@ -681,56 +683,40 @@ public ProfileRequest getProfileAfter(AuthenticationRequest authenticationReques
681683
return new ProfileRequest(authenticationRequest, profileRequest);
682684
}
683685

684-
private AuthenticationRequest loginWithResourceOwner(Map<String, Object> parameters) {
685-
HttpUrl url = HttpUrl.parse(auth0.getDomainUrl()).newBuilder()
686-
.addPathSegment(OAUTH_PATH)
687-
.addPathSegment(RESOURCE_OWNER_PATH)
688-
.build();
689-
690-
final Map<String, Object> requestParameters = ParameterBuilder.newBuilder()
691-
.setClientId(getClientId())
692-
.setConnection(defaultDatabaseConnection)
693-
.addAll(parameters)
694-
.asDictionary();
695-
return factory.authenticationPOST(url, client, gson)
696-
.addAuthenticationParameters(requestParameters);
697-
}
698-
699-
private ParameterizableRequest<UserProfile> profileRequest() {
700-
HttpUrl url = HttpUrl.parse(auth0.getDomainUrl()).newBuilder()
701-
.addPathSegment(TOKEN_INFO_PATH)
702-
.build();
703-
704-
return factory.POST(url, client, gson, UserProfile.class);
705-
}
706-
707-
/**
708-
* For backwards compatibility only
709-
*
710-
* @param authorizationCode
711-
* @param codeVerifier
712-
* @param redirectUri
713-
* @return
714-
*/
715-
@Deprecated
716-
public AuthenticationRequest token(String authorizationCode, String codeVerifier, String redirectUri) {
717-
return tokenUsingCodeVerifier(authorizationCode, codeVerifier, redirectUri);
718-
}
719-
720686
/**
721687
* Fetch the token information from Auth0, using the authorization_code grant type
722688
*
689+
* For Public Client, e.g. Android apps ,you need to provide the code_verifier
690+
* used to generate the challenge sent to Auth0 {@literal /authorize} method like:
691+
*
692+
* <pre>{@code
693+
* AuthenticationAPIClient client = new AuthenticationAPIClient(new Auth0("clientId", "domain"));
694+
* client
695+
* .token("code", "redirect_uri")
696+
* .setCodeVerifier("code_verifier")
697+
* .start(new Callback<Credentials> {...});
698+
* }</pre>
699+
*
700+
* For the rest of clients, clients who can safely keep a {@literal client_secret}, you need to provide it instead like:
701+
*
702+
* <pre>{@code
703+
* AuthenticationAPIClient client = new AuthenticationAPIClient(new Auth0("clientId", "domain"));
704+
* client
705+
* .token("code", "redirect_uri")
706+
* .setClientSecret("client_secret")
707+
* .start(new Callback<Credentials> {...});
708+
* }</pre>
709+
*
723710
* @param authorizationCode the authorization code received from the /authorize call.
724-
* @param codeVerifier the code verifier used when requesting a code to /authorize.
725-
* @param redirectUri the uri to redirect after a successful request.
726-
* @return a request to configure and start
711+
* @param redirectUri the uri sent to /authorize as the 'redirect_uri'.
712+
* @return a request to obtain access_token by exchanging a authorization code.
727713
*/
728-
public AuthenticationRequest tokenUsingCodeVerifier(String authorizationCode, String codeVerifier, String redirectUri) {
714+
@SuppressWarnings("WeakerAccess")
715+
public TokenRequest token(String authorizationCode, String redirectUri) {
729716
Map<String, Object> parameters = ParameterBuilder.newBuilder()
730717
.setClientId(getClientId())
731718
.setGrantType(GRANT_TYPE_AUTHORIZATION_CODE)
732719
.set(OAUTH_CODE_KEY, authorizationCode)
733-
.set(OAUTH_CODE_VERIFIER_KEY, codeVerifier)
734720
.set(REDIRECT_URI_KEY, redirectUri)
735721
.asDictionary();
736722

@@ -739,33 +725,31 @@ public AuthenticationRequest tokenUsingCodeVerifier(String authorizationCode, St
739725
.addPathSegment(TOKEN_PATH)
740726
.build();
741727

742-
return factory.authenticationPOST(url, client, gson)
743-
.addAuthenticationParameters(parameters);
728+
ParameterizableRequest<Credentials> request = factory.POST(url, client, gson, Credentials.class).addParameters(parameters);
729+
return new TokenRequest(request);
744730
}
745731

746-
/**
747-
* Fetch the token information from Auth0, using the authorization_code grant type
748-
*
749-
* @param authorizationCode the authorization code received from the /authorize call.
750-
* @param clientSecret the client secret used when requesting a code to /authorize.
751-
* @param redirectUri the uri to redirect after a successful request.
752-
* @return a request to configure and start
753-
*/
754-
public AuthenticationRequest tokenUsingClientSecret(final String authorizationCode, final String clientSecret, final String redirectUri) {
755-
final Map<String, Object> parameters = ParameterBuilder.newBuilder()
732+
private AuthenticationRequest loginWithResourceOwner(Map<String, Object> parameters) {
733+
HttpUrl url = HttpUrl.parse(auth0.getDomainUrl()).newBuilder()
734+
.addPathSegment(OAUTH_PATH)
735+
.addPathSegment(RESOURCE_OWNER_PATH)
736+
.build();
737+
738+
final Map<String, Object> requestParameters = ParameterBuilder.newBuilder()
756739
.setClientId(getClientId())
757-
.setGrantType(GRANT_TYPE_AUTHORIZATION_CODE)
758-
.set(OAUTH_CODE_KEY, authorizationCode)
759-
.set(OAUTH_CLIENT_SECRET_KEY, clientSecret)
760-
.set(REDIRECT_URI_KEY, redirectUri)
740+
.setConnection(defaultDatabaseConnection)
741+
.addAll(parameters)
761742
.asDictionary();
743+
return factory.authenticationPOST(url, client, gson)
744+
.addAuthenticationParameters(requestParameters);
745+
}
762746

763-
final HttpUrl url = HttpUrl.parse(auth0.getDomainUrl()).newBuilder()
764-
.addPathSegment(OAUTH_PATH)
765-
.addPathSegment(TOKEN_PATH)
747+
private ParameterizableRequest<UserProfile> profileRequest() {
748+
HttpUrl url = HttpUrl.parse(auth0.getDomainUrl()).newBuilder()
749+
.addPathSegment(TOKEN_INFO_PATH)
766750
.build();
767751

768-
return factory.authenticationPOST(url, client, gson)
769-
.addAuthenticationParameters(parameters);
752+
return factory.POST(url, client, gson, UserProfile.class);
770753
}
754+
771755
}

‎auth0/src/main/java/com/auth0/authentication/TokenRequest.java‎

Lines changed: 55 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,55 @@
1+
package com.auth0.authentication;
2+
3+
import com.auth0.Auth0Exception;
4+
import com.auth0.authentication.result.Credentials;
5+
import com.auth0.callback.BaseCallback;
6+
import com.auth0.request.ParameterizableRequest;
7+
import com.auth0.request.Request;
8+
9+
/**
10+
* Auth Request to obtain tokens using OAuth2 {@literal /oauth/token} method
11+
*/
12+
@SuppressWarnings("WeakerAccess")
13+
public class TokenRequest implements Request<Credentials> {
14+
15+
private static final String OAUTH_CODE_VERIFIER_KEY = "code_verifier";
16+
private static final String OAUTH_CLIENT_SECRET_KEY = "client_secret";
17+
18+
private final ParameterizableRequest<Credentials> request;
19+
20+
TokenRequest(ParameterizableRequest<Credentials> request) {
21+
this.request = request;
22+
}
23+
24+
/**
25+
* Adds the code verifier to the request (Public Clients)
26+
* @param codeVerifier the code verifier used to generate the challenge sent to /authorize.
27+
* @return itself
28+
*/
29+
@SuppressWarnings("WeakerAccess")
30+
public TokenRequest setCodeVerifier(String codeVerifier) {
31+
this.request.addParameter(OAUTH_CODE_VERIFIER_KEY, codeVerifier);
32+
return this;
33+
}
34+
35+
/**
36+
* Adds the client secret to the request (Private Clients)
37+
* @param clientSecret the secret of the client used when making a request to /authorize
38+
* @return iself
39+
*/
40+
@SuppressWarnings("WeakerAccess")
41+
public TokenRequest setClientSecret(String clientSecret) {
42+
this.request.addParameter(OAUTH_CLIENT_SECRET_KEY, clientSecret);
43+
return this;
44+
}
45+
46+
@Override
47+
public void start(BaseCallback<Credentials> callback) {
48+
request.start(callback);
49+
}
50+
51+
@Override
52+
public Credentials execute() throws Auth0Exception {
53+
return request.execute();
54+
}
55+
}

‎auth0/src/main/java/com/auth0/authentication/UserProfileDeserializer.java‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,6 @@
44
import com.auth0.authentication.result.UserProfile;
55
import com.google.gson.*;
66
import com.google.gson.reflect.TypeToken;
7-
import com.sun.org.apache.xpath.internal.operations.Bool;
87

98
import java.lang.reflect.Type;
109
import java.util.Date;

‎auth0/src/test/java/com/auth0/authentication/AuthenticationAPIClientTest.java‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1221,7 +1221,8 @@ public void shouldGetOAuthTokensUsingCodeVerifier() throws Exception {
12211221
.willReturnTokenInfo();
12221222

12231223
final MockBaseCallback<Credentials> callback = new MockBaseCallback<>();
1224-
client.tokenUsingCodeVerifier("code", "codeVerifier", "http://redirect.uri")
1224+
client.token("code", "http://redirect.uri")
1225+
.setCodeVerifier("codeVerifier")
12251226
.start(callback);
12261227

12271228
final RecordedRequest request = mockAPI.takeRequest();
@@ -1244,7 +1245,8 @@ public void shouldGetOAuthTokensUsingClientSecret() throws Exception {
12441245
.willReturnTokenInfo();
12451246

12461247
final MockBaseCallback<Credentials> callback = new MockBaseCallback<>();
1247-
client.tokenUsingClientSecret("code", "clientSecret", "http://redirect.uri")
1248+
client.token("code", "http://redirect.uri")
1249+
.setClientSecret("clientSecret")
12481250
.start(callback);
12491251

12501252
final RecordedRequest request = mockAPI.takeRequest();

‎auth0/src/test/java/com/auth0/util/UserProfileMatcher.java‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -38,6 +38,6 @@ public void describeTo(Description description) {
3838
}
3939

4040
public static Matcher<UserProfile> isNormalizedProfile(String id, String name, String nickname) {
41-
return new UserProfileMatcher(equalTo(id), equalTo(name), equalTo(nickname), not(isEmptyOrNullString()));
41+
return new UserProfileMatcher(equalTo(id), equalTo(name), equalTo(nickname), not(emptyOrNullString()));
4242
}
4343
}

0 commit comments

Comments
 (0)