<group name="ltpa" description="LTPA Tokens">
	<property name="ltpa.token.liberty1.authenticate" value="true" description="If true, allow authentication using tokens signed by these keys"/>
	<property name="ltpa.token.liberty1.create.script" value="%{script}" description="Script called when creating token - allows adding additional attributes to the generated token"/>
	<property name="ltpa.token.liberty1.create.userid" value="user:BasicRegistry/%{userid}" description="Macro/script for specifying userid inside LTPA token"/>
	<property name="ltpa.token.liberty1.expiration.minutes" value="30" description="Expiration time in minutes, when creating new tokens"/>
	<property name="ltpa.token.liberty1.filename" value="${portalprotect.home}/config/ltpa.keys" description="Name of file that keys are stored within - created if it does not exist upon startup"/>
	<property name="ltpa.token.liberty1.parse.script" value="%{script}context.session.userid = context.token.getAttributes('u')[0];" description="Script used when parsing token - used to parse token content into session"/>
	<property name="ltpa.token.liberty1.password" value="changeit" description="Password that keys are encrypted with"/>
	<property name="ltpa.token.liberty1.properties" value="" description="If set, used instead of filename - can contain the LTPA keys file contents"/>
	<property name="ltpa.tokens" value="liberty1" description="List of LTPA tokens"/>
</group>

package dk.itp.security.authentication.ltpa;

import dk.itp.security.authentication.ltpa.token.Token;
import dk.itp.security.passticket.User;
import portalprotect.org.json.JSONObject;

public class LTPAState {
	/** Contains input from the caller - e.g. the gateway */
	public JSONObject jo;
	/** The session being updated or used to create the token */
	public User session;
	/** LTPA Token configuration - contains the values from the configuration */
	public LTPATokenConfig cfg;
	/** The token used as input when authenticating or newly created when creating a token */
	public Token token;
}

// Copy the userid directly from the token to the user
// Most LTPA tokens only contain this and no other attributes.
context.session.userid = context.token.getAttributes('u')[0];

// Add the username
context.token.addAttribute("name", context.session.username);
// Add each group - will end up as an array of string in the token.
if (context.session.userGroups != null) {
  for(int i = 0; i < context.session.userGroups.length; i++) {
	context.token.addAttribute("group", context.session.userGroups[i]);
  }
}

JSONObject json = new JSONObject();
json.put("tokenname", "liberty1");
json.put("additionalattribute", "available to the create script");

String result = Agent.getInstance().newToken(sessionId, json.toString()); // result is now a JSON string with two attributes; token and expiration

JSONObject resultObject = new JSONObject(result);
String generatedToken = resultObject.get("token");
long expiresAt = resultObject.get("expiration"); // Time this expires at, in milliseconds since 1/1 1970, GMT.

// Use JSON input - allows you to specify additional attributes that are available to the scripts
JSONObject json = new JSONObject();
json.put("tokenname", "liberty1");
json.put("token", myLTPAToken);
json.put("myadditionalattribute", "myvalue");
Agent.getInstance().login(sessionId, AuthTypes.AUTHTYPE_LTPA, "ltpa", json.toString());


// Alternatively - Use the token directly, no JSON
Agent.getInstance().login(sessionId, AuthTypes.AUTHTYPE_LTPA, "liberty1", myLTPAToken);