@POST
@Consumes(MediaType.APPLICATION_JSON)
@Produces(MediaType.APPLICATION_JSON)
public Response login(LoginRequest request) {
  var payload = new LoginResponse();

  if (!service.verifyLogin(request)) {
    throw new NotAuthorizedException("Invalid user and/or password");
  }

  var user = PersistenceManager.getInstance().getById(User.class, request.getUsername());

  payload.setToken(service.createToken(user));

  // TODO: max age, etc.
  return Response.ok(payload).cookie(new NewCookie("authorization", payload.getToken())).build();
}
 

/**
 * Retrieve a stock for a given symbol.
 * http://localhost:8080/stockquote/IBM
 *
 * @param symbol Stock symbol will be taken from the path parameter.
 * @return Response
 */
@GET
@Path("/{symbol}")
@Produces({"application/json", "text/xml"})
@ApiOperation(
        value = "Return stock quote corresponding to the symbol",
        notes = "Returns HTTP 404 if the symbol is not found")
@ApiResponses(value = {
        @ApiResponse(code = 200, message = "Valid stock item found"),
        @ApiResponse(code = 404, message = "Stock item not found")})
public Response getQuote(@ApiParam(value = "Symbol", required = true)
                         @PathParam("symbol") String symbol) throws SymbolNotFoundException {
    Stock stock = stockQuotes.get(symbol);
    if (stock == null) {
        throw new SymbolNotFoundException("Symbol " + symbol + " not found");
    }
    return Response.ok().entity(stock).cookie(new NewCookie("symbol", symbol)).build();
}
 

NewCookie createLoginCookie(HttpServletRequest req, SSOPrincipal principal) {
  String token = principal.getTokenStr();
  // if expires is negative, it means the cookie must be transient
  int expires = (principal.getExpires() <= -1)
      ? NewCookie.DEFAULT_MAX_AGE
      : (int) ((principal.getExpires() - getTimeNow()) / 1000);
  NewCookie authCookie = new NewCookie(
      HttpUtils.getLoginCookieName(),
      token,
      "/",
      null,
      null,
      expires,
      (req.isSecure() || secureLoadBalancer)
  );
  return authCookie;
}
 

@Test
public void filterNoQueryId() throws Exception {
    EasyMock.expect(method.getMethodAnnotations()).andReturn(new Annotation[] {annotation});
    // More method calls due to logging the error about QUERY_ID threadlocal not set.
    EasyMock.expect(method.getResourceClass()).andReturn(null);
    // noinspection ConfusingArgumentToVarargsMethod
    EasyMock.expect(method.getMethod()).andReturn(getClass().getMethod("filterNoQueryId", null));
    replayAll();
    
    CreateQuerySessionIDFilter.QUERY_ID.set(null);
    filter.filter(request, response);
    
    NewCookie responseCookie = (NewCookie) response.getHeaders().getFirst("Set-Cookie");
    assertNotNull("No cookie present when we should have one.", responseCookie);
    assertEquals("query-session-id", responseCookie.getName());
    assertEquals("/test/path/", responseCookie.getPath());
    
    verifyAll();
}
 

@GET
@Path("/client-logout/{redirectUri}")
@UnitOfWork
public Response serviceLogOut(
        @Context UriInfo uriInfo,
        @CookieParam(COOKIE_NAME) String token,
        @PathParam("redirectUri") String redirectUri) {
    sessionStore.deleteSessionByToken(token);
    return Response.seeOther(URI.create(redirectUri))
            .cookie(new NewCookie(
                    COOKIE_NAME,
                    "expired",
                    "/",
                    uriInfo.getBaseUri().getHost(),
                    Cookie.DEFAULT_VERSION,
                    null,
                    (int) Duration.ofDays(7).getSeconds(),
                    new Date(0),
                    false,
                    true))
            .build();
}
 

@POST
@Path("/sessionLogin")
@Consumes("application/json")
public Response createSessionCookie(LoginRequest request) {
  // Get the ID token sent by the client
  String idToken = request.getIdToken();
  // Set session expiration to 5 days.
  long expiresIn = TimeUnit.DAYS.toMillis(5);
  SessionCookieOptions options = SessionCookieOptions.builder()
      .setExpiresIn(expiresIn)
      .build();
  try {
    // Create the session cookie. This will also verify the ID token in the process.
    // The session cookie will have the same claims as the ID token.
    String sessionCookie = FirebaseAuth.getInstance().createSessionCookie(idToken, options);
    // Set cookie policy parameters as required.
    NewCookie cookie = new NewCookie("session", sessionCookie /* ... other parameters */);
    return Response.ok().cookie(cookie).build();
  } catch (FirebaseAuthException e) {
    return Response.status(Status.UNAUTHORIZED).entity("Failed to create a session cookie")
        .build();
  }
}
 

public Response checkAuthTime(String idToken) throws FirebaseAuthException {
  // [START check_auth_time]
  // To ensure that cookies are set only on recently signed in users, check auth_time in
  // ID token before creating a cookie.
  FirebaseToken decodedToken = FirebaseAuth.getInstance().verifyIdToken(idToken);
  long authTimeMillis = TimeUnit.SECONDS.toMillis(
      (long) decodedToken.getClaims().get("auth_time"));

  // Only process if the user signed in within the last 5 minutes.
  if (System.currentTimeMillis() - authTimeMillis < TimeUnit.MINUTES.toMillis(5)) {
    long expiresIn = TimeUnit.DAYS.toMillis(5);
    SessionCookieOptions options = SessionCookieOptions.builder()
        .setExpiresIn(expiresIn)
        .build();
    String sessionCookie = FirebaseAuth.getInstance().createSessionCookie(idToken, options);
    // Set cookie policy parameters as required.
    NewCookie cookie = new NewCookie("session", sessionCookie);
    return Response.ok().cookie(cookie).build();
  }
  // User did not sign in recently. To guard against ID token theft, require
  // re-authentication.
  return Response.status(Status.UNAUTHORIZED).entity("Recent sign in required").build();
  // [END check_auth_time]
}
 

@Path("/login")
@POST
public Response login(LoginAJAXRequest loginAJAXRequest) throws IOException {
    captchaCode.validate(loginAJAXRequest.captchaCode);

    LoginRequest authenticationRequest = new LoginRequest();
    authenticationRequest.username = loginAJAXRequest.username;
    authenticationRequest.password = loginAJAXRequest.password;
    authenticationRequest.autoLogin = loginAJAXRequest.autoLogin;

    LoginResponse authenticationResponse = userWebService.login(authenticationRequest);
    UserResponse user = authenticationResponse.user;
    sessionInfo.put(UserInfoContextProvider.SESSION_USER_ID, user.id);

    if (Boolean.TRUE.equals(loginAJAXRequest.autoLogin)) {
        return Response.ok().entity(loginAJAXResponse(user.id))
            .cookie(new NewCookie(userWebOptions.autoLoginCookie, authenticationResponse.autoLoginToken, "/", null, null, userWebOptions.autoLoginMaxAge, false))
            .cookie(Cookies.removeCookie(COOKIE_FROM_URL)).build();
    } else {
        return Response.ok(loginAJAXResponse(user.id)).cookie(Cookies.removeCookie(COOKIE_FROM_URL)).build();
    }
}
 

@POST
@Consumes(MediaType.APPLICATION_JSON)
@Produces(MediaType.APPLICATION_JSON)
public Response create(@NotNull @Valid final AcquisitionRequest request,
    @Context final HttpServletRequest httpRequest) {

    final AcquisitionFlow acquisitionFlow = credentials.acquire(connectorId, apiBase(httpRequest),
        absoluteTo(httpRequest, request.getReturnUrl()));

    final CredentialFlowState flowState = acquisitionFlow.state().get();
    final NewCookie cookie = state.persist(flowState.persistenceKey(), "/", flowState);

    final AcquisitionResponse acquisitionResponse = AcquisitionResponse.Builder.from(acquisitionFlow)
        .state(State.Builder.cookie(cookie.toString())).build();

    return Response.accepted().entity(acquisitionResponse).build();
}
 

@Test
public void shouldPersistAsInRfcErrata() {
    final ClientSideState clientSideState = new ClientSideState(RFC_EDITION, ClientSideStateTest::rfcTime, ClientSideStateTest::rfcIV,
        ClientSideStateTest::serialize, ClientSideStateTest::deserialize, ClientSideState.DEFAULT_TIMEOUT);

    final NewCookie cookie = clientSideState.persist("id", "/path", "a state string");

    assertThat(cookie).isNotNull();
    assertThat(cookie.getName()).isEqualTo("id");

    assertThat(cookie.getValue())
        .isEqualTo("pzSOjcNui9-HWS_Qk1Pwpg|MTM0NzI2NTk1NQ|dGlk|tL3lJPf2nUSFMN6dtVXJTw|uea1fgC67RmOxfpNz8gMbnPWfDA");
    assertThat(cookie.getPath()).isEqualTo("/path");
    assertThat(cookie.isHttpOnly()).isFalse();
    assertThat(cookie.isSecure()).isTrue();
}
 

/**
 * used to create new session with grafana (login with grafana)
 * 
 * @param userName
 * @param password
 * @return
 * @throws InsightsCustomException
 */
private static List<NewCookie> getValidGrafanaSession(String userName, String password)
		throws InsightsCustomException {
	log.debug("Inside getValidGrafanaSession method call");
	JsonObject loginRequestParams = new JsonObject();
	loginRequestParams.addProperty("user", userName);
	loginRequestParams.addProperty("password", password);
	String loginApiUrl = ApplicationConfigProvider.getInstance().getGrafana().getGrafanaEndpoint() + "/login";
	ClientResponse grafanaLoginResponse = RestHandler.doPost(loginApiUrl, loginRequestParams, null);
	log.debug("GrafanaUserDetailsUtil ==== status code {} loginApiUrl {} Grafana responce {} ",
			grafanaLoginResponse.getStatus(), loginApiUrl, grafanaLoginResponse.getEntity(String.class));
	if (grafanaLoginResponse.getStatus() != 200) {
		String response = grafanaLoginResponse.getEntity(String.class);
		log.error("GrafanaUserDetailsUtil ==== unable to getValidGrafanaSession ==== {} response {}",
				grafanaLoginResponse.getStatus(), response);
		throw new InsightsCustomException(" user or password is incorrect ==== ");
	}
	return grafanaLoginResponse.getCookies();
}
 

@Test
public void getCurrentUserTest() throws Exception {
    Response response = target().path("session").request().get();
    assertEquals(response.getStatus(), 200);
    verify(tokenManager).getTokenString(any(ContainerRequestContext.class));
    verify(tokenManager).verifyToken(TOKEN_STRING);
    verify(tokenManager, never()).generateUnauthToken();
    Map<String, NewCookie> cookies = response.getCookies();
    assertEquals(0, cookies.size());
    try {
        JSONObject result = JSONObject.fromObject(response.readEntity(String.class));
        assertEquals(removeWhitespace(VALID_USER), removeWhitespace(result.toString()));
    } catch (Exception e) {
        fail("Expected no exception, but got: " + e.getMessage());
    }
}
 

@Test
public void testCreateHeaderProvider() throws Exception {
    assertSame(MediaTypeHeaderProvider.class,
               new RuntimeDelegateImpl().
                   createHeaderDelegate(MediaType.class).getClass());
    assertSame(EntityTagHeaderProvider.class,
               new RuntimeDelegateImpl().
                   createHeaderDelegate(EntityTag.class).getClass());
    assertSame(CacheControlHeaderProvider.class,
               new RuntimeDelegateImpl().
                   createHeaderDelegate(CacheControl.class).getClass());
    assertSame(CookieHeaderProvider.class,
               new RuntimeDelegateImpl().
                   createHeaderDelegate(Cookie.class).getClass());
    assertSame(NewCookieHeaderProvider.class,
               new RuntimeDelegateImpl().
                   createHeaderDelegate(NewCookie.class).getClass());
}
 

@Test
public void loginAuthValidNoPrincipalsTest() throws Exception {
    // Setup:
    String authorization = USERNAME + ":" + PASSWORD;
    when(RestSecurityUtils.authenticateUser(eq("mobi"), any(Subject.class), eq(USERNAME), eq(PASSWORD), eq(mobiConfiguration))).thenReturn(true);

    Response response = target().path("session").request()
            .header("Authorization", "Basic " + Base64.encode(authorization.getBytes())).post(Entity.json(""));
    assertEquals(response.getStatus(), 401);
    verifyStatic();
    RestSecurityUtils.authenticateUser(eq("mobi"), any(Subject.class), eq(USERNAME), eq(PASSWORD), eq(mobiConfiguration));
    verify(tokenManager, never()).generateAuthToken(anyString());
    verify(engineManager, times(0)).getUserRoles(anyString());
    Map<String, NewCookie> cookies = response.getCookies();
    assertEquals(0, cookies.size());
}
 

@Test
public void loginAuthValidTest() throws Exception {
    // Setup:
    String authorization = USERNAME + ":" + PASSWORD;

    Response response = target().path("session").request()
            .header("Authorization", "Basic " + Base64.encode(authorization.getBytes())).post(Entity.json(""));
    assertEquals(response.getStatus(), 200);
    verifyStatic();
    RestSecurityUtils.authenticateUser(eq("mobi"), any(Subject.class), eq(USERNAME), eq(PASSWORD), eq(mobiConfiguration));
    verify(tokenManager).generateAuthToken(USERNAME);
    verify(engineManager).getUserRoles(USERNAME);
    Map<String, NewCookie> cookies = response.getCookies();
    assertTrue(cookies.containsKey(TOKEN_NAME));
    assertEquals(USERNAME, cookies.get(TOKEN_NAME).getValue());
    try {
        JSONObject result = JSONObject.fromObject(response.readEntity(String.class));
        assertEquals(removeWhitespace(VALID_USER), removeWhitespace(result.toString()));
    } catch (Exception e) {
        fail("Expected no exception, but got: " + e.getMessage());
    }
}
 

public Response redirect(UriInfo uriInfo, String redirectUri) {
    String state = getStateCode();
    String scopeParam = TokenUtil.attachOIDCScope(scope);

    UriBuilder uriBuilder = UriBuilder.fromUri(authUrl)
            .queryParam(OAuth2Constants.CLIENT_ID, clientId)
            .queryParam(OAuth2Constants.REDIRECT_URI, redirectUri)
            .queryParam(OAuth2Constants.STATE, state)
            .queryParam(OAuth2Constants.RESPONSE_TYPE, OAuth2Constants.CODE)
            .queryParam(OAuth2Constants.SCOPE, scopeParam);

    URI url = uriBuilder.build();

    NewCookie cookie = new NewCookie(getStateCookieName(), state, getStateCookiePath(uriInfo), null, null, -1, isSecure, true);
    logger.debug("NewCookie: " + cookie.toString());
    logger.debug("Oauth Redirect to: " + url);
    return Response.status(302)
            .location(url)
            .cookie(cookie).build();
}
 

@Test
public void loginCredValidTest() throws Exception {
    Response response = target().path("session").queryParam("username", USERNAME).queryParam("password", PASSWORD).request().post(Entity.json(""));
    assertEquals(response.getStatus(), 200);
    verifyStatic();
    RestSecurityUtils.authenticateUser(eq("mobi"), any(Subject.class), eq(USERNAME), eq(PASSWORD), eq(mobiConfiguration));
    verify(tokenManager).generateAuthToken(USERNAME);
    verify(engineManager).getUserRoles(USERNAME);
    Map<String, NewCookie> cookies = response.getCookies();
    assertTrue(cookies.containsKey(TOKEN_NAME));
    assertEquals(USERNAME, cookies.get(TOKEN_NAME).getValue());
    try {
        JSONObject result = JSONObject.fromObject(response.readEntity(String.class));
        assertEquals(removeWhitespace(VALID_USER), removeWhitespace(result.toString()));
    } catch (Exception e) {
        fail("Expected no exception, but got: " + e.getMessage());
    }
}
 

@GET
@Path("callback")
public Response callback(@QueryParam("code") String code) {
  var token = retrieveAccessToken(code);

  var user = token.decode(this.engine.getOAuthJwtSecret(), this.engine.getoAuthJwtIssuer());

  if (user == null) {
    // redirect back to the beginning
    return buildRedirect();
  }

  LOGGER.info("Decoded access token as user {}", user.getUsername());

  // try to find the user
  var ref = PersistenceManager.getInstance().getById(User.class, user.getId());

  if (ref == null) {
    service.createUser(user);
  }

  // issue token for our API
  var payload = new LoginResponse();

  payload.setToken(service.createToken(user));

  // TODO: max age, etc.
  /* angular is particular about the hash! it needs to be included.
  we cannot use UriBuilder, since it will remove the hash */
  var uri = URI.create("/#?token=" + payload.getToken());

  return Response.temporaryRedirect(uri)
      .cookie(new NewCookie("authorization", payload.getToken()))
      .build();
}
 

public Builder<T> cookies(ArrayList<NewCookie> newCookies) {
  if (cookies == null) {
    cookies = new ArrayList<>();
  }
  cookies.addAll(newCookies);
  return this;
}
 

protected void addCookie(final HttpServletResponse resp, final Map.Entry<String, NewCookie> cookie) {
    final NewCookie nc = cookie.getValue();
    final Cookie servletCookie = new Cookie(cookie.getKey(), nc.getValue());
    servletCookie.setComment(nc.getComment());
    if (nc.getDomain() != null) {
        servletCookie.setDomain(nc.getDomain());
    }
    servletCookie.setHttpOnly(nc.isHttpOnly());
    servletCookie.setSecure(nc.isSecure());
    servletCookie.setMaxAge(nc.getMaxAge());
    servletCookie.setPath(nc.getPath());
    servletCookie.setVersion(nc.getVersion());
    resp.addCookie(servletCookie);
}
 

@ResourceSecurity(WEB_UI)
@POST
@Path(UI_LOGIN)
public Response login(
        @FormParam("username") String username,
        @FormParam("password") String password,
        @FormParam("redirectPath") String redirectPath,
        @Context SecurityContext securityContext)
{
    username = emptyToNull(username);
    password = emptyToNull(password);
    redirectPath = emptyToNull(redirectPath);

    if (!formWebUiAuthenticationManager.isAuthenticationEnabled(securityContext.isSecure())) {
        return Response.seeOther(DISABLED_LOCATION_URI).build();
    }

    Optional<NewCookie> authenticationCookie = formWebUiAuthenticationManager.checkLoginCredentials(username, password, securityContext.isSecure());
    if (!authenticationCookie.isPresent()) {
        // authentication failed, redirect back to the login page
        return Response.seeOther(LOGIN_FORM_URI).build();
    }

    return redirectFromSuccessfulLoginResponse(redirectPath)
            .cookie(authenticationCookie.get())
            .build();
}
 

public Optional<NewCookie> checkLoginCredentials(String username, String password, boolean secure)
{
    if (formAuthenticator.isValidCredential(username, password, secure)) {
        return Optional.of(createAuthenticationCookie(username, secure));
    }
    return Optional.empty();
}
 

public static NewCookie getDeleteCookie(boolean secure)
{
    return new NewCookie(
            PRESTO_UI_COOKIE,
            "delete",
            "/ui",
            null,
            Cookie.DEFAULT_VERSION,
            null,
            0,
            null,
            secure,
            true);
}
 

@Override
public Response uploadCertificate(CertificateRequest certificateRequest) {

    if (StringUtils.equals(getTenantDomainFromContext(), MultitenantConstants.SUPER_TENANT_DOMAIN_NAME)) {
        return Response.status(Response.Status.METHOD_NOT_ALLOWED).build();
    }
    URI certResource = keyStoreService.uploadCertificate(certificateRequest.getAlias(),
            certificateRequest.getCertificate());
    NewCookie resourceCookie = new NewCookie("Location", certResource.toString());
    return Response.created(certResource).cookie(resourceCookie).build();
}
 

@Test
public void filterClientError() throws Exception {
    response.setStatusInfo(Response.Status.BAD_REQUEST);
    EasyMock.expect(method.getMethodAnnotations()).andReturn(new Annotation[] {annotation});
    replayAll();
    
    CreateQuerySessionIDFilter.QUERY_ID.set("1234");
    filter.filter(request, response);
    
    NewCookie responseCookie = (NewCookie) response.getHeaders().getFirst("Set-Cookie");
    assertNull("Cookie present when we shouldn't have one.", responseCookie);
    
    verifyAll();
}
 

@GET
@Path("/client-login/{authCode}/{redirectUri}")
@UnitOfWork
public Response serviceLogIn(
        @Context UriInfo uriInfo,
        @PathParam("authCode") String authCode,
        @PathParam("redirectUri") String redirectUri) {

    Optional<Session> session = Optional.empty();

    // Hack: wait until the auth code actually got written to db
    for (int i = 0; i < 3; i++) {
        session = sessionStore.getSessionByAuthCode(authCode);
        if (session.isPresent()) {
            break;
        }
        Uninterruptibles.sleepUninterruptibly(500, TimeUnit.MILLISECONDS);
    }
    if (!session.isPresent()) {
        throw new IllegalArgumentException();
    }

    sessionStore.deleteAuthCode(authCode);

    return Response.seeOther(URI.create(redirectUri))
            .cookie(new NewCookie(
                    COOKIE_NAME,
                    session.get().getToken(),
                    "/",
                    uriInfo.getBaseUri().getHost(),
                    null,
                    (int) Duration.ofDays(7).getSeconds(),
                    false,
                    true))
            .build();
}
 

private ClientResponse uploadTagsWithCookie(ServiceTags serviceTags) {
	if (LOG.isDebugEnabled()) {
		LOG.debug("==> uploadTagsWithCookie");
	}

	ClientResponse response = null;
	try {
		response = tagRESTClient.put(REST_URL_IMPORT_SERVICETAGS_RESOURCE, serviceTags, sessionId);
	} catch (Exception e) {
		LOG.error("Failed to get response, Error is : "+e.getMessage());
	}
	if (response != null) {
		if (!(response.toString().contains(REST_URL_IMPORT_SERVICETAGS_RESOURCE))) {
			response.setStatus(HttpServletResponse.SC_NOT_FOUND);
			sessionId = null;
			isValidRangerCookie = false;
		} else if (response.getStatus() == HttpServletResponse.SC_UNAUTHORIZED) {
			sessionId = null;
			isValidRangerCookie = false;
		} else if (response.getStatus() == HttpServletResponse.SC_NO_CONTENT
				|| response.getStatus() == HttpServletResponse.SC_OK) {
			List<NewCookie> respCookieList = response.getCookies();
			for (NewCookie respCookie : respCookieList) {
				if (respCookie.getName().equalsIgnoreCase(rangerAdminCookieName)) {
					if (!(sessionId.getValue().equalsIgnoreCase(respCookie.toCookie().getValue()))) {
						sessionId = respCookie.toCookie();
					}
					isValidRangerCookie = true;
					break;
				}
			}
		}

	}

	if (LOG.isDebugEnabled()) {
		LOG.debug("<== uploadTagsWithCookie");
	}
	return response;
}
 

@Test public void doesNothingWhenResponseSetsSessionCookie() throws Exception {
  ImmutableMap<String, NewCookie> immutableResponseCookies =
      ImmutableMap.of(SESSION_COOKIE, NewCookie.valueOf(cookie.getValue()));
  when(response.getCookies()).thenReturn(immutableResponseCookies);

  filter.filter(request, response);

  assertThat(response.getCookies()).isSameAs(immutableResponseCookies);
  assertThat(response.getHeaders()).doesNotContainKey(SET_COOKIE);
}
 

@POST
@Path("/sessionLogout")
public Response clearSessionCookie(@CookieParam("session") Cookie cookie) {
  final int maxAge = 0;
  NewCookie newCookie = new NewCookie(cookie, null, maxAge, true);
  return Response.temporaryRedirect(URI.create("/login")).cookie(newCookie).build();
}
 

@Test
public void testFromStringWithSpaces() {
    NewCookie c = NewCookie.valueOf(
                  "foo=bar; Comment=comment; Path=path; Max-Age=10; Domain=domain; Secure; Version=1");
    assertTrue("bar".equals(c.getValue())
               && "foo".equals(c.getName())
               && 1 == c.getVersion()
               && "path".equals(c.getPath())
               && "domain".equals(c.getDomain())
               && "comment".equals(c.getComment())
               && 10 == c.getMaxAge());
}