6 Creating Custom HTTP Processors

Example 6-4 weblogic-application.xml

<?xml version="1.0" encoding="UTF-8"?>
<weblogic-application
 xmlns="http://xmlns.oracle.com/weblogic/weblogic-application"
 xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
 xsi:schemaLocation="http://xmlns.oracle.com/weblogic/weblogic-application http://xmlns.oracle.com/weblogic/weblogic-application/1.4/weblogic-application.xsd">
   <listener>
     <listener-class>
       oracle.ocsg.security.ProcessorLifecycleListener
     </listener-class>
   </listener>
</weblogic-application>

Example 6-5 ProcessorLifecycleListener

/**
* Listener class for HTTP processor to register.
*/
public class ProcessorLifecycleListener extends ApplicationLifecycleListener {
  List<Class<? extends HttpProcessor>> processorClasses;
 
  public ProcessorLifecycleListener() {
    processorClasses = new ArrayList<>();
    processorClasses.add(JsonTokenProcessor.class);
  }
 
  /**
  * Register the Processor(s)
  */
  public void preStart(ApplicationLifecycleEvent evt) {
    registerProcessors(processorClasses);
  }
 
  /**
  * Unregister the Processor(s)
  */
  public void postStop(ApplicationLifecycleEvent evt) {
    deRegisterProcessors(processorClasses);
  }
 
  void registerProcessors(List<Class<? extends HttpProcessor>> processorClasses) {
    List<Class<? extends HttpProcessor>> registeredProcessors = new
      ArrayList<Class<? extends HttpProcessor>>();
    for (Class<? extends HttpProcessor> processorClass : processorClasses) {
      try {
        CustomHttpProcessorsRepository.INSTANCE.registerProcessor(processorClass);
        registeredProcessors.add(processorClass);
 
      } catch (Exception e) {
        // If we have exception, let's rollback all processors we already
                // registered before throwing exception. 
        deRegisterProcessors(registeredProcessors);
        throw new RuntimeException(e);
      }
    }
  }
 
  void deRegisterProcessors(List<Class<? extends HttpProcessor>> processorClasses)
  {
    for (Class<? extends HttpProcessor> registeredProcessor : processorClasses) {
      try {
        CustomHttpProcessorsRepository.INSTANCE.deRegisterProcessor
                                             (registeredProcessor.getName());
      } catch (Exception ex) {
        ex.printStackTrace();
        //keep going
      }
    }
  }
}

Example 6-6 Processor Configuration REST PUT Payload

{ 
 "SubscribeProcessorsRequest":{ 
   "processors":[ 
     { 
      "name":"JsonTokenProcessor",
      "configuration":"{\"key\":\"1y7M3cO(86m0R5FwC>(N61lRwiTQYu\",\"header\":
        \"x-json-token\"}"
    }
   ]
 }
}

Example 6-7 JsonTokenProcessorConfig

public class JsonTokenProcessorConfig implements HttpProcessorConfig {
  private String key;
  private String header;
 
  public String getKey() {
    return key;
  }
 
  public void setKey(String key) {
    this.key = key;
  }
 
  public String getHeader() {
    return header;
  }
 
  public void setHeader(String header) {
    this.header = header;
  }
}

Example 6-8 JsonTokenProcessor

@HttpProcessorAnnotation(name = "JsonTokenProcessor", configBean =
    JsonTokenProcessorConfig.class)
  public class JsonTokenProcessor extends
     AbstractHttpProcessor<JsonTokenProcessorConfig> {
    private JsonTokenProcessorConfig configuration;
 
    @Override
    public Set<Principal> process(HttpServletRequest httpServletRequest) throws
          HttpProcessorExecutionException {
      String clearTextToken = getTokenFromRequest(httpServletRequest);
      JsonReader reader = Json.createReader(new StringReader(clearTextToken));
      JsonObject token = reader.readObject();
      Set<Principal> principals =
             assertApplication(token.getString("application"));
      if (!principals.isEmpty()) {
        //We have found an application, let's add scope to application principle
        for (Principal principal: principals) {
          if (principal instanceof ApplicationInstance) {
            principals.remove(principal);
            principal = new JsonTokenApplication((ApplicationInstance)principal,
                token.getString("scope"));
            principals.add(principal);
            break;
        }
      }
    }
    return principals;
  }
  private String getTokenFromRequest (HttpServletRequest httpServletRequest) {
    return AES.getInstance(getConfiguration().getKey()).
      decrypt(httpServletRequest.getHeader(getConfiguration().getHeader()));
  }
  @Override
  public JsonTokenProcessorConfig getConfiguration() {
    return configuration;
  }
 
  @Override
  public void init(JsonTokenProcessorConfig configuration) throws
      HttpProcessorConfigException {
    this.configuration = configuration;
  }
}