StandardIdentityManager: capture scope and audience claims in AuthorizationToken

cadc-access-control-server/src/main/java/ca/nrc/cadc/ac/server/oidc/UserInfoAction.java

@@ -112,10 +112,9 @@ public void doAction() throws Exception {
         for (AuthorizationToken t : tokens) {
             log.debug("Token: " + t);
 
-            if (t.getScope() != null) {
-                String tScope = t.getScope().toString();
-                if (tScope.startsWith(OIDCUtil.ACCESS_TOKEN_SCOPE) &&
-                        tScope.length() > OIDCUtil.ACCESS_TOKEN_SCOPE.length()) {
+            for (String tScope : t.getScopes()) {
+                if (tScope.startsWith(OIDCUtil.ACCESS_TOKEN_SCOPE)
+                        && tScope.length() > OIDCUtil.ACCESS_TOKEN_SCOPE.length()) {
                     int slashIndex = tScope.lastIndexOf("/");
                     if (slashIndex == OIDCUtil.ACCESS_TOKEN_SCOPE.length()) {
                         clientID = tScope.substring(slashIndex + 1);

cadc-gms/build.gradle

@@ -15,13 +15,13 @@ sourceCompatibility = 11
 
 group = 'org.opencadc'
 
-version = '1.0.19'
+version = '1.0.20'
 
 description = 'OpenCADC GMS API library'
 def git_url = 'https://github.com/opencadc/ac'
 
 dependencies {
-    implementation 'org.opencadc:cadc-util:[1.11.3,2.0)'
+    implementation 'org.opencadc:cadc-util:[1.13.0,2.0)'
     implementation 'org.opencadc:cadc-registry:[1.7.7,2.0)'
     implementation 'org.opencadc:cadc-cdp:[1.3,2.0)'
     implementation 'org.bitbucket.b_c:jose4j:[0.9.6,)'

cadc-gms/src/intTest/java/org/opencadc/auth/StandardIdentityManagerTest.java

@@ -68,6 +68,7 @@
 package org.opencadc.auth;
 
 import ca.nrc.cadc.auth.AuthenticationUtil;
+import ca.nrc.cadc.auth.AuthorizationToken;
 import ca.nrc.cadc.auth.AuthorizationTokenPrincipal;
 import ca.nrc.cadc.auth.HttpPrincipal;
 import ca.nrc.cadc.auth.IdentityManager;
@@ -86,6 +87,7 @@
 import java.security.PrivilegedExceptionAction;
 import java.util.Base64;
 import java.util.HashSet;
+import java.util.Iterator;
 import java.util.Set;
 import javax.security.auth.Subject;
 import javax.security.auth.x500.X500Principal;
@@ -168,9 +170,23 @@ public void testAccessToken() {
             Subject validated = AuthenticationUtil.getSubject(new DummyPrincipalExtractor(false, true), false);
             final StandardIdentityManager im = new StandardIdentityManager();
             log.info("validated: " + validated);
+            // token captured
+            Set<AuthorizationToken> ats = validated.getPublicCredentials(AuthorizationToken.class);
+            Assert.assertNotNull(ats);
+            Assert.assertFalse(ats.isEmpty());
+            Iterator<AuthorizationToken> ai = ats.iterator();
+            AuthorizationToken atok = ai.next();
+            Assert.assertFalse(ai.hasNext());
+            for (String s : atok.getScopes()) {
+                log.info("scope: " + s);
+            }
+            for (String a : atok.getAudience()) {
+                log.info("audience: " + a);
+            }
             Assert.assertFalse("oidc iss/sub", validated.getPrincipals(OpenIdPrincipal.class).isEmpty());
+            // this is present for user tokens with the right scope
             Assert.assertFalse("oidc username", validated.getPrincipals(HttpPrincipal.class).isEmpty());
-
+            
             Subject augmented = im.augment(validated);
             log.info("augmented: " + augmented);
             Assert.assertFalse("oidc iss/sub", validated.getPrincipals(OpenIdPrincipal.class).isEmpty());

cadc-gms/src/main/java/org/opencadc/auth/StandardIdentityManager.java

@@ -393,7 +393,7 @@ private void validateToken(Subject s, AuthorizationTokenPrincipal raw) {
         } catch (MalformedClaimException | InvalidJwtException | MalformedURLException e) {
             log.debug("Cannot determine issuer from token", e);
         }
-        List<Principal> validatedPrincipals = null;
+        Validated validatedPrincipals = null;
         if (jwtIssuer != null) {
             try {
                 validatedPrincipals = validateWithPubKey(jwtIssuer, challengeType, credentials);
@@ -421,16 +421,23 @@ private void validateToken(Subject s, AuthorizationTokenPrincipal raw) {
         }
 
         s.getPrincipals().remove(raw);
-        for (Principal p : validatedPrincipals) {
+        for (Principal p : validatedPrincipals.principals) {
             s.getPrincipals().add(p);
         }
 
-        // TODO - oidcScope not assigned yet
-        AuthorizationToken authToken = new AuthorizationToken(challengeType, credentials, oidcDomains, oidcScope);
+        AuthorizationToken authToken = new AuthorizationToken(challengeType, credentials, oidcDomains);
+        authToken.getScopes().addAll(validatedPrincipals.scopes);
+        authToken.getAudience().addAll(validatedPrincipals.audiences);
         s.getPublicCredentials().add(authToken);
     }
+
+    private class Validated {
+        List<Principal> principals = new ArrayList<>();
+        List<String> scopes = new ArrayList<>();
+        List<String> audiences = Collections.EMPTY_LIST;
+    }
 
-    private List<Principal> validateWithPubKey(URI jwtIssuer, String challengeType, String credentials)
+    private Validated validateWithPubKey(URI jwtIssuer, String challengeType, String credentials)
             throws MalformedURLException, InvalidJwtException, MalformedClaimException {
         VerificationKeyResolver httpsJwksKeyResolver = getHttpsJwksVerificationKeyResolver(jwtIssuer, challengeType);
         JwtConsumer jwtConsumer = new JwtConsumerBuilder()
@@ -446,18 +453,30 @@ private List<Principal> validateWithPubKey(URI jwtIssuer, String challengeType,
 
         String sub = jwtClaims.getClaimValue("sub", String.class);
 
-        List<Principal> result = new ArrayList<>();
+        Validated ret = new Validated();
         OpenIdPrincipal oip = new OpenIdPrincipal(jwtIssuer.toURL(), sub);
-        result.add(oip);
+        ret.principals.add(oip);
 
         if (jwtClaims.getClaimValueAsString("preferred_username") != null) {
-            result.add(new HttpPrincipal(jwtClaims.getClaimValueAsString("preferred_username")));
+            ret.principals.add(new HttpPrincipal(jwtClaims.getClaimValueAsString("preferred_username")));
+        }
+
+        // scopes
+        String raw = jwtClaims.getClaimValue("scope", String.class);
+        log.debug("raw scopes: " + raw);
+        String[] scopes = raw.split("\\s+");
+        for (String s : scopes) {
+            ret.scopes.add(s);
         }
+
+        // audience
+        ret.audiences = jwtClaims.getAudience();
+
         log.debug("Validated user via issuer pub key: " + oip);
-        return result;
+        return ret;
     }
 
-    private static List<Principal> validateWithUserInfo(AuthorizationTokenPrincipal raw, URL issuerURL)
+    private Validated validateWithUserInfo(AuthorizationTokenPrincipal raw, URL issuerURL)
             throws ResourceAlreadyExistsException, ResourceNotFoundException, IOException, InterruptedException {
         HttpGet get = new HttpGet(issuerURL, true);
         get.setRequestProperty("authorization", raw.getHeaderValue());
@@ -477,15 +496,17 @@ private static List<Principal> validateWithUserInfo(AuthorizationTokenPrincipal
         } else {
             log.debug("No username provided for OpenID identity issuer(" + issuerURL + "), sub(" + sub + ")");
         }
+
 
-        List<Principal> result = new ArrayList<>();
+        Validated ret = new Validated();
         OpenIdPrincipal oip = new OpenIdPrincipal(issuerURL, sub);
-        result.add(oip);
+        ret.principals.add(oip);
         if (username != null) {
-            result.add(new HttpPrincipal(username));
+            ret.principals.add(new HttpPrincipal(username));
         }
+
         log.debug("Validated user via user info endpoint: " + oip);
-        return result;
+        return ret;
     }
 
     private VerificationKeyResolver getHttpsJwksVerificationKeyResolver(URI jwtIssuer, String challengeType) throws