|
@@ -2,6 +2,7 @@ package com.aip.gateway.api.aip;
|
|
|
|
|
|
import com.aip.gateway.api.aip.model.AipConfig;
|
|
|
import com.aip.gateway.api.aip.utils.MemoryTokenCacheWithEviction;
|
|
|
+import com.aip.gateway.api.utils.TimeUtils;
|
|
|
import com.microsoft.aad.msal4j.*;
|
|
|
import com.microsoft.informationprotection.IAuthDelegate;
|
|
|
import com.microsoft.informationprotection.Identity;
|
|
@@ -33,15 +34,7 @@ public class AuthDelegateImpl implements IAuthDelegate {
|
|
|
private Date expiredDate = new Date();
|
|
|
private String accessToken = "x";
|
|
|
|
|
|
- private final String instance = "https://login.microsoftonline.com/";
|
|
|
- private final String authority = "https://login.windows.net/";
|
|
|
- private final String scope = "https://graph.microsoft.com/.default";
|
|
|
-
|
|
|
- private static int LOGIN_TYPE = 0;
|
|
|
- private static String CLIENT_ID = "";
|
|
|
- private static String TENANT_ID = "";
|
|
|
- private static String AUTHORITY = "";
|
|
|
- private static Set<String> SCOPE = Collections.singleton("");
|
|
|
+ private final String AUTHORITY = "https://login.microsoftonline.com/"; // https://login.microsoftonline.com/{tenant}
|
|
|
|
|
|
public AuthDelegateImpl(AipConfig aipConfig) throws Exception {
|
|
|
this.aipConfig = aipConfig;
|
|
@@ -49,89 +42,88 @@ public class AuthDelegateImpl implements IAuthDelegate {
|
|
|
|
|
|
String cacheKey = aipConfig.getClientId() + "_" + aipConfig.getTenantId() + "_AppTokenCache";
|
|
|
MemoryTokenCacheWithEviction memoryTokenCacheWithEviction = new MemoryTokenCacheWithEviction(cacheKey);
|
|
|
- //TokenCacheAspect tokenCacheAspect = new TokenCacheAspect("token_cache.json");
|
|
|
|
|
|
- CLIENT_ID = aipConfig.getClientId();
|
|
|
- TENANT_ID = aipConfig.getTenantId();
|
|
|
if (aipConfig.getLoginType() == AipConfig.authLoginPassword) {
|
|
|
- LOGIN_TYPE = 0;
|
|
|
- confidentialApp = ConfidentialClientApplication.builder(
|
|
|
- aipConfig.getClientId(),
|
|
|
- ClientCredentialFactory.createFromSecret(aipConfig.getSecretValue()))
|
|
|
- .authority(instance + aipConfig.getTenantId())
|
|
|
+ IClientCredential credential = ClientCredentialFactory.createFromSecret(aipConfig.getSecretValue());
|
|
|
+ confidentialApp = ConfidentialClientApplication
|
|
|
+ .builder(aipConfig.getClientId(), credential)
|
|
|
+ .authority(AUTHORITY + aipConfig.getTenantId())
|
|
|
.setTokenCacheAccessAspect(memoryTokenCacheWithEviction)
|
|
|
.build();
|
|
|
}
|
|
|
else if (aipConfig.getLoginType() == AipConfig.authLoginCert) {
|
|
|
- LOGIN_TYPE = 1;
|
|
|
InputStream certStream = new ByteArrayInputStream(Files.readAllBytes(Paths.get(aipConfig.getCertThumbPrint())));
|
|
|
-
|
|
|
String password = "hanteinfo1234!";
|
|
|
- confidentialApp = ConfidentialClientApplication.builder(
|
|
|
- aipConfig.getClientId(),
|
|
|
+ confidentialApp = ConfidentialClientApplication
|
|
|
+ .builder(aipConfig.getClientId(),
|
|
|
ClientCredentialFactory.createFromCertificate(certStream, password))
|
|
|
- .authority(authority+aipConfig.getTenantId())
|
|
|
+ .authority(AUTHORITY +aipConfig.getTenantId())
|
|
|
.setTokenCacheAccessAspect(memoryTokenCacheWithEviction)
|
|
|
.build();
|
|
|
}
|
|
|
- else {
|
|
|
- throw new Exception("지원하지 않는 AIP 인증 방법 입니다.");
|
|
|
- }
|
|
|
- if (confidentialApp != null) {
|
|
|
- log.info("AuthDelegateImpl: Refresh token provider setting.");
|
|
|
- //confidentialApp.appTokenProvider();
|
|
|
- }
|
|
|
+ else throw new Exception("지원하지 않는 AIP 인증 방법 입니다.");
|
|
|
}
|
|
|
@Override
|
|
|
public String acquireToken(Identity identity, String authority, String resource, String claim) {
|
|
|
- if (authenticationResult != null) {
|
|
|
- if (authenticationResult.expiresOnDate().before(new Date())) {
|
|
|
- log.error("Access token expired #################################################################################################");
|
|
|
- }
|
|
|
+ Set<String> scope;
|
|
|
+ if (resource.endsWith("/")){
|
|
|
+ scope = Collections.singleton(resource + ".default");
|
|
|
}
|
|
|
- return AcquireTokenByCertificate(identity, authority, resource, claim);
|
|
|
- }
|
|
|
- private static IAuthenticationResult acquireTokenInteractive() throws Exception {
|
|
|
-
|
|
|
- // Load token cache from file and initialize token cache aspect. The token cache will have
|
|
|
- // dummy data, so the acquireTokenSilently call will fail.
|
|
|
- //TokenCacheAspect tokenCacheAspect = new TokenCacheAspect("sample_cache.json");
|
|
|
- String cacheKey = CLIENT_ID + "_" + TENANT_ID + "_AppTokenCache";
|
|
|
- MemoryTokenCacheWithEviction memoryTokenCacheWithEviction = new MemoryTokenCacheWithEviction(cacheKey);
|
|
|
-
|
|
|
- ConfidentialClientApplication pca = ConfidentialClientApplication.builder(
|
|
|
- CLIENT_ID,
|
|
|
- ClientCredentialFactory.createFromSecret("CvW8Q~0iANtLN1Y2EXR_nVyYb_tQTDwjW-Z7Ndg3"))
|
|
|
- .authority("https://login.microsoftonline.com/" + TENANT_ID)
|
|
|
- .setTokenCacheAccessAspect(memoryTokenCacheWithEviction)
|
|
|
- .build();
|
|
|
-
|
|
|
- Set<IAccount> accountsInCache = pca.getAccounts().join();
|
|
|
- // Take first account in the cache. In a production application, you would filter
|
|
|
- // accountsInCache to get the right account for the user authenticating.
|
|
|
- IAccount account = accountsInCache.iterator().next();
|
|
|
+ else {
|
|
|
+ scope = Collections.singleton(resource + "/.default");
|
|
|
+ }
|
|
|
+ // authority scope
|
|
|
+ // https://login.windows.net/common https://syncservice.o365syncservice.com/.default
|
|
|
+ // https://login.windows.net/common https://syncservice.o365syncservice.com/.default
|
|
|
+ // https://login.windows.net/common https://syncservice.o365syncservice.com/.default
|
|
|
+ // https://login.windows.net/common https://aadrm.com/.default
|
|
|
+ // https://login.windows.net/common https://aadrm.com/.default
|
|
|
+ // https://login.windows.net/common https://aadrm.com/.default
|
|
|
+ // Wed Jun 05 10:41:59 KST 2024
|
|
|
+ // https://login.windows.net/2e58414a-c6ae-43ff-aaf5-45ab8b78a404 https://aadrm.com/.default
|
|
|
|
|
|
- IAuthenticationResult result;
|
|
|
+ //log.info("{}, acquireToken: identity = {}, authority = {}, scope = {}", Thread.currentThread(), identity.getEmail(), authority, scope);
|
|
|
try {
|
|
|
- SilentParameters silentParameters =
|
|
|
- SilentParameters
|
|
|
- .builder(SCOPE, account)
|
|
|
- .build();
|
|
|
-
|
|
|
- // try to acquire token silently. This call will fail since the token cache
|
|
|
- // does not have any data for the user you are trying to acquire a token for
|
|
|
- result = pca.acquireTokenSilently(silentParameters).join();
|
|
|
- } catch (Exception ex) {
|
|
|
+ SilentParameters silentParameters = SilentParameters.builder(scope).build();
|
|
|
+ authenticationResult = confidentialApp.acquireTokenSilently(silentParameters).join();
|
|
|
+ }
|
|
|
+ catch (Exception ex) {
|
|
|
if (ex.getCause() instanceof MsalException) {
|
|
|
+ try {
|
|
|
+ log.info("********************************************* Refresh Access Token Required.");
|
|
|
+ ClientCredentialParameters parameters = ClientCredentialParameters.builder(scope).build();
|
|
|
+ authenticationResult = confidentialApp.acquireToken(parameters).join();
|
|
|
+ }
|
|
|
+ catch (Exception ex2) {
|
|
|
+ setError(1, "AuthDelegateImpl:acquireToken Failed.", ex2.getMessage());
|
|
|
+ return "";
|
|
|
+ }
|
|
|
+ }
|
|
|
+ else {
|
|
|
+ setError(2, "AuthDelegateImpl:acquireTokenSilently Failed.", ex.getMessage());
|
|
|
+ return "";
|
|
|
+ }
|
|
|
+ }
|
|
|
|
|
|
- ClientCredentialParameters clientCredentialParam = ClientCredentialParameters.builder(SCOPE).build();
|
|
|
- result = pca.acquireToken(clientCredentialParam).get();
|
|
|
- } else {
|
|
|
- // Handle other exceptions accordingly
|
|
|
- throw ex;
|
|
|
+ if (!expiredDate.equals(authenticationResult.expiresOnDate())) {
|
|
|
+ log.error("acquireToken: expiredDate: {}", TimeUtils.dateToString2(expiredDate));
|
|
|
+ log.error("acquireToken: expiresOnDate: {}", TimeUtils.dateToString2(authenticationResult.expiresOnDate()));
|
|
|
+ expiredDate = authenticationResult.expiresOnDate();
|
|
|
+ }
|
|
|
+ if (!accessToken.equals(authenticationResult.accessToken())) {
|
|
|
+ log.error("acquireToken:accessTokenOLD: = {}", accessToken);
|
|
|
+ log.error("acquireToken:accessTokenNEW: = {}", authenticationResult.accessToken());
|
|
|
+ accessToken = authenticationResult.accessToken();
|
|
|
+ }
|
|
|
+ return authenticationResult.accessToken();
|
|
|
+ }
|
|
|
+ public String acquireToken2(Identity identity, String authority, String resource, String claim) {
|
|
|
+ if (authenticationResult != null) {
|
|
|
+ if (authenticationResult.expiresOnDate().before(new Date())) {
|
|
|
+ log.error("Access token expired #################################################################################################");
|
|
|
}
|
|
|
}
|
|
|
- return result;
|
|
|
+ return AcquireTokenByCertificate(identity, authority, resource, claim);
|
|
|
}
|
|
|
|
|
|
private String AcquireTokenByCertificate(Identity identity, String authority, String resource, String claims)
|
|
@@ -159,12 +151,13 @@ public class AuthDelegateImpl implements IAuthDelegate {
|
|
|
CompletableFuture<IAuthenticationResult> future = confidentialApp.acquireToken(clientCredentialParam);
|
|
|
authenticationResult = future.get();
|
|
|
if (!expiredDate.equals(authenticationResult.expiresOnDate())) {
|
|
|
- log.info("acquireToken: expiredDate = {}, expiresOnDate = {}", expiredDate, authenticationResult.expiresOnDate());
|
|
|
+ log.error("AcquireTokenByCertificate: expiredDate: {}", TimeUtils.dateToString2(expiredDate));
|
|
|
+ log.error("AcquireTokenByCertificate: expiresOnDate: {}", TimeUtils.dateToString2(authenticationResult.expiresOnDate()));
|
|
|
expiredDate = authenticationResult.expiresOnDate();
|
|
|
}
|
|
|
if (!accessToken.equals(authenticationResult.accessToken())) {
|
|
|
- log.info("acquireToken: accessToken: OLD = {}", accessToken);
|
|
|
- log.info("acquireToken: accessToken: NEW = {}", authenticationResult.accessToken());
|
|
|
+ log.error("AcquireTokenByCertificate:accessTokenOLD: = {}", accessToken);
|
|
|
+ log.error("AcquireTokenByCertificate:accessTokenNEW: = {}", authenticationResult.accessToken());
|
|
|
accessToken = authenticationResult.accessToken();
|
|
|
}
|
|
|
return authenticationResult.accessToken();
|
|
@@ -173,6 +166,7 @@ public class AuthDelegateImpl implements IAuthDelegate {
|
|
|
if (ex.getCause() instanceof MsalException) {
|
|
|
setError(1, "AuthDelegateImpl:acquireToken, Scope provided is not supported.", ex.getMessage());
|
|
|
} else {
|
|
|
+ log.error(ex.getMessage());
|
|
|
setError(1, "AuthDelegateImpl:acquireToken Failed.", ex.getMessage());
|
|
|
}
|
|
|
}
|