The client makes a request to the token endpoint by sending the following parameters using the * "application/x-www-form-urlencoded" format per Appendix B with a character encoding of UTF-8 in * the HTTP request entity-body: * *
grant_type REQUIRED. Value MUST be set to "authorization_code". * *
code REQUIRED. The authorization code received from the authorization server. * *
redirect_uri REQUIRED, if the "redirect_uri" parameter was included in the authorization * request as described in Section 4.1.1, and their values MUST be identical. * *
client_id REQUIRED, if the client is not authenticating with the authorization server as * described in Section 3.2.1. * *
If the client type is confidential or the client was issued client credentials (or assigned * other authentication requirements), the client MUST authenticate with the authorization server as * described in Section 3.2.1. * *
For example, the client makes the following HTTP request using TLS (with extra line breaks for * display purposes only): * *
POST /token HTTP/1.1 Host: server.example.com Authorization: Basic * czZCaGRSa3F0MzpnWDFmQmF0M2JW Content-Type: application/x-www-form-urlencoded * *
grant_type=authorization_code&code=SplxlOBeZQQYbYS6WxSbIA * &redirect_uri=https%3A%2F%2Fclient%2Eexample%2Ecom%2Fcb * *
The authorization server MUST: * *
o require client authentication for confidential clients or for any client that was issued * client credentials (or with other authentication requirements), * *
o authenticate the client if client authentication is included, * *
o ensure that the authorization code was issued to the authenticated confidential client, or * if the client is public, ensure that the code was issued to "client_id" in the request, * *
o verify that the authorization code is valid, and * *
o ensure that the "redirect_uri" parameter is present if the "redirect_uri" parameter was * included in the initial authorization request as described in Section 4.1.1, and if included * ensure that their values are identical. * * @see 4.1.3. Access Token * Request */ public class AuthorizationCodeGrantService implements OAuthTokenCreationService, RefreshTokenCreatable, CNonceCreatable { AuthorizationRequestRepository authorizationRequestRepository; OAuthTokenCommandRepository oAuthTokenCommandRepository; AuthorizationCodeGrantRepository authorizationCodeGrantRepository; AuthorizationCodeGrantVerifier verifier; IdTokenCreator idTokenCreator; AccessTokenCreator accessTokenCreator; public AuthorizationCodeGrantService( AuthorizationRequestRepository authorizationRequestRepository, OAuthTokenCommandRepository oAuthTokenCommandRepository, AuthorizationCodeGrantRepository authorizationCodeGrantRepository) { this.authorizationRequestRepository = authorizationRequestRepository; this.oAuthTokenCommandRepository = oAuthTokenCommandRepository; this.authorizationCodeGrantRepository = authorizationCodeGrantRepository; this.verifier = new AuthorizationCodeGrantVerifier(); this.idTokenCreator = IdTokenCreator.getInstance(); this.accessTokenCreator = AccessTokenCreator.getInstance(); } @Override public GrantType grantType() { return GrantType.authorization_code; } @Override public OAuthToken create( TokenRequestContext tokenRequestContext, ClientCredentials clientCredentials) { TokenRequestCodeGrantValidator validator = new TokenRequestCodeGrantValidator(tokenRequestContext); validator.validate(); Tenant tenant = tokenRequestContext.tenant(); AuthorizationCode code = tokenRequestContext.code(); AuthorizationCodeGrant authorizationCodeGrant = authorizationCodeGrantRepository.find(tenant, code); if (!authorizationCodeGrant.exists()) { throw new TokenBadRequestException("invalid_grant", "not found authorization code."); } AuthorizationRequest authorizationRequest = authorizationRequestRepository.find( tenant, authorizationCodeGrant.authorizationRequestIdentifier()); verifier.verify( tokenRequestContext, authorizationRequest, authorizationCodeGrant, clientCredentials); AuthorizationServerConfiguration authorizationServerConfiguration = tokenRequestContext.serverConfiguration(); ClientConfiguration clientConfiguration = tokenRequestContext.clientConfiguration(); AuthorizationGrant authorizationGrant = authorizationCodeGrant.authorizationGrant(); AccessToken accessToken = accessTokenCreator.create( authorizationGrant, authorizationServerConfiguration, clientConfiguration, clientCredentials); RefreshToken refreshToken = createRefreshToken(authorizationServerConfiguration, clientConfiguration); OAuthTokenBuilder oAuthTokenBuilder = new OAuthTokenBuilder(new OAuthTokenIdentifier(UUID.randomUUID().toString())) .add(accessToken) .add(refreshToken); if (authorizationRequest.isOidcProfile()) { IdTokenCustomClaimsBuilder idTokenCustomClaimsBuilder = new IdTokenCustomClaimsBuilder() .add(authorizationCodeGrant.authorizationCode()) .add(accessToken.accessTokenEntity()) .add(authorizationRequest.nonce()) .add(authorizationRequest.state()); // Add sid for OIDC Session Management if present in custom properties if (authorizationGrant.hasCustomProperties() && authorizationGrant.customProperties().contains("sid")) { String sidValue = authorizationGrant.customProperties().getValueAsStringOrEmpty("sid"); if (!sidValue.isEmpty()) { idTokenCustomClaimsBuilder.add(new ClientSessionIdentifier(sidValue)); } } IdTokenCustomClaims idTokenCustomClaims = idTokenCustomClaimsBuilder.build(); IdToken idToken = idTokenCreator.createIdToken( authorizationGrant.user(), authorizationCodeGrant.authentication(), authorizationGrant, idTokenCustomClaims, authorizationRequest.requestedClaimsPayload(), authorizationServerConfiguration, clientConfiguration); oAuthTokenBuilder.add(idToken); } if (authorizationRequest.isVerifiableCredentialRequest()) { CNonce cNonce = createCNonce(); CNonceExpiresIn cNonceExpiresIn = new CNonceExpiresIn(3600L); oAuthTokenBuilder.add(cNonce); oAuthTokenBuilder.add(cNonceExpiresIn); } OAuthToken oAuthToken = oAuthTokenBuilder.build(); oAuthTokenCommandRepository.register(tenant, oAuthToken); authorizationCodeGrantRepository.delete(tokenRequestContext.tenant(), authorizationCodeGrant); authorizationRequestRepository.delete( tokenRequestContext.tenant(), authorizationCodeGrant.authorizationRequestIdentifier()); return oAuthToken; } }