oauth2.mapper.xxxx.username=%{claim:firstName} %{claim.lastName}
oauth2.mapper.xxxx.salary=%{script}salary(); function salary() {var json = JSON.from(context.jo.toJSONString()); return (json.monthlySalary * 12) + json.yearlyBonus;}
oauth2.mapper.xxxx.valuesAreFrom=Some Custom Provider

<group name="OpenID_Connect" description="OpenID Connect related settings">
  <property name="openid.scopes" value="openid,email,profile,address,phone" description="The list of configured openid scopes" />
  <property name="openid.scope.openid.userinfo" value="sub=userid" description="Attributes to include in userinfo for openid scope"/>
  <property name="openid.scope.openid.accesstoken" value="sub=userid" description="Attributes to include in access token for openid scope"/>
  <property name="openid.scope.openid.idtoken" value="sub=userid" description="Attributes to include in id token for openid scope"/>
  <property name="openid.scope.openid.description" value="Essential information" description="Description of openid scope"/>
  <property name="openid.scope.email.userinfo" value="email=email1;email_verified=null" description="Attributes to include in userinfo for email scope"/>
  <property name="openid.scope.email.idtoken" value="" description="Attributes to include in userinfo for email scope"/>
  <property name="openid.scope.email.accesstoken" value="" description="Attributes to include in access token for email scope"/>
  <property name="openid.scope.email.description" value="Email address" description="Description of email scope"/>
  <property name="openid.scope.profile.userinfo" value="name=username;family_name=null;given_name=null;middle_name=null;nickname=null;preferred_username=null;profile=null;picture=null;website=null;gender=gender;birthdate=birthdate;zoneinfo=null;locale=null;updated_at=null" description="Attributes to include in userinfo for email scope"/>
  <property name="openid.scope.profile.idtoken" value="" description="Attributes to include in userinfo for email scope"/>
  <property name="openid.scope.profile.accesstoken" value="" description="Attributes to include in access token for email scope"/>
  <property name="openid.scope.profile.description" value="Email address" description="Description of email scope"/>
  <property name="openid.scope.address.userinfo" value="address=address" description="Attributes to include in userinfo for email scope"/>
  <property name="openid.scope.address.idtoken" value="" description="Attributes to include in userinfo for email scope"/>
  <property name="openid.scope.address.accesstoken" value="" description="Attributes to include in access token for email scope"/>
  <property name="openid.scope.address.description" value="Your address" description="Description of email scope"/>
  <property name="openid.scope.phone.userinfo" value="phone=mobilephone;phone=phone;phone_verified=null" description="Attributes to include in userinfo for email scope"/>
  <property name="openid.scope.phone.idtoken" value="" description="Attributes to include in userinfo for email scope"/>
  <property name="openid.scope.phone.accesstoken" value="" description="Attributes to include in access token for email scope"/>
  <property name="openid.scope.phone.description" value="Your phone number" description="Description of email scope"/>
  <property name="openid.fields" value="address" description="List of custom fields for which sub attributes exists"/>
  <property name="openid.field.address" value="street_address=address1;locality=city;region=state;postal_code=postal;country=country" description="Specifies which fields are included within the address JSON object"/>
</group>
<group name="Oauth2" description="Oauth2 related settings">
  <property name="oauth2.clients" value="sample" description="List of Oauth2 token names"/>
  <property name="oauth2.client.sample.accesstokentype" value="JWT" description="Type of access token to generate for use in bearer token - either JWT or UUID"/>
  <property name="oauth2.client.sample.clientid" value="https://www.example.com/" description="Client ID"/>
  <property name="oauth2.client.sample.secret" value="secret" description="Client Secret"/>
  <property name="oauth2.client.sample.allowedscopes" value="openid;profile;email" description="Allowed scopes"/>
  <property name="oauth2.client.sample.allowedredirecturis" value="https://www.example.com/oauth2" description="Allowed redirectURIs"/>
  <property name="oauth2.client.sample.validgranttypes" value="authorization_code,implicit,hybrid" description="Valid oauth2 grant types"/>
  <property name="oauth2.client.sample.accesstokenvalidityseconds" value="3600" description="Number of seconds an issued access token is valid for"/>
  <property name="oauth2.client.sample.maximumexpirationminutes" value="120" description="Maximum number of minutes an expiration time can be set in the future, 0 or -1 for no expiration"/>
  <property name="oauth2.client.sample.refreshtokenvalidityseconds" value="-1" description="Number of seconds a refresh token is valid for - 0 or -1 to disable"/>
  <property name="oauth2.client.sample.tokenname" value="sample" description="Which oauth2 token name to use for this client"/>
</group>
<group name="Oauth2_JWT" description="Oauth2 JWT related settings">
  <property name="oauth2.datastoreclass" value="dk.itp.security.authentication.oauth.data.properties.Oauth2DataStoreProperties" description="Java class to handle reading Oauth2 datastore"/>
  <property name="oauth2.defaulttoken" value="sample" description="Name of the default token to use if nothing else is requested"/>
  <property name="oauth2.tokens" value="sample;sample2" description="List of Oauth2 JWT tokens names"/>
  <property name="oauth2.tokens.jwks" value="sample" description="List of Oauth2 JWT tokens names which are included in the JWK key list"/>
  
  <property name="oauth2.token.sample.validaudiences" value="https://www.example.com/" description="List of valid audiences, used when validating JWT token"/>
  <property name="oauth2.token.sample.issuer" value="https://www.portalprotect.dk" description="OAUth2 Issuer"/>
  <property name="oauth2.token.sample.algorithm" value="RS256" description="Algorithm to use for JWT token"/>
  <property name="oauth2.token.sample.expirationminutes" value="10" description="Token Expiration in minutes"/>
  <property name="oauth2.token.sample.notBeforeMinutesInPast" value="2" description="Number of minutes in past to set in token"/>
  <property name="oauth2.token.sample.keyid" value="k1" description="Key ID for this token"/>
  <property name="oauth2.token.sample.claims" value="sub=userid;groups=groups;name=username" description="Claims to add to token"/>
  <property name="oauth2.token.sample.usernameAttributeName" value="name" description="Name of attribute to contain the username"/>
  <property name="oauth2.token.sample.roleAttributeName" value="groups" description="Name of attribute roles/groups are stored in"/>
  <property name="oauth2.token.sample.rolePattern" value="^admin*" description="Only groups matching this pattern are set"/>
  <property name="oauth2.token.sample.relaxKeyChecks" value="true" description="True to not perform key strength checks"/>
  <property name="oauth2.token.sample.openidconnect" value="true" description="True to create openid connect compatible token"/>
  <property name="oauth2.token.sample.attributesToStoreInSession" value="*" description="Attributes from ID token to store in session"/>
  <property name="oauth2.token.sample.signerCertificates" value="" description="List of valid signer certificates when receiving JWT token"/>
  <property name="oauth2.token.sample.jceprovider" value="BC" description="Name of JCE provider to use for creating/validating tokens"/>
  <property name="oauth2.token.sample.keystore.type" value="PKCS12" description="Keystore to load private key/certificate from"/>
  <property name="oauth2.token.sample.keystore.file" value="${portalprotect.home}/config/x509/nemid/kr.pfx" description=""/>
  <property name="oauth2.token.sample.keystore.password" value="Zaq12wsx" description=""/>
  <property name="oauth2.token.sample.keystore.provider" value="BC" description=""/>
  <property name="oauth2.token.sample.keystore.privalias" value="" description=""/>
  <property name="oauth2.token.sample.keystore.certalias" value="" description=""/>
  
  <property name="oauth2.token.sample2.issuer" value="https://www.portalprotect.dk" description="OAUth2 Issuer"/>
  <property name="oauth2.token.sample2.algorithm" value="HS256" description="Algorithm to use for JWT token"/>
  <property name="oauth2.token.sample2.expirationminutes" value="10" description="Token Expiration in minutes"/>
  <property name="oauth2.token.sample2.notBeforeMinutesInPast" value="2" description="Number of minutes in past to set in token"/>
  <property name="oauth2.token.sample2.claims" value="sub=userid;groups=groups;name=username" description="Claims to add to token"/>
  <property name="oauth2.token.sample2.usernameAttributeName" value="name" description="Name of attribute to contain the username"/>
  <property name="oauth2.token.sample2.roleAttributeName" value="groups" description="Name of attribute roles/groups are stored in"/>
  <property name="oauth2.token.sample2.rolePattern" value="^admin*" description="Only groups matching this pattern are set"/>
  <property name="oauth2.token.sample2.relaxKeyChecks" value="false" description="True to not perform key strength checks"/>
  <property name="oauth2.token.sample2.openidconnect" value="true" description="True to create openid connect compatible token"/>
  <property name="oauth2.token.sample2.attributesToStoreInSession" value="*" description="Attributes from ID token to store in session"/>
  <property name="oauth2.token.sample2.jceprovider" value="BC" description="Name of JCE provider to use for creating/validating tokens"/>
  <property name="oauth2.token.sample2.secretkey" value="secret" description="Secret key"/>
  <property name="openid.identityproviders" value="google" description="OpenID Connect identity providers, where we can exchange an authorization code for an id/access token"/>
  <property name="openid.idp.google.clientid" value="371213948273-79eceu24cm64ft69pln0hk2lfapok1bq.apps.googleusercontent.com" description="Client ID"/>
  <property name="openid.idp.google.secret" value="{encoded}806F9FE0C7CBC28D5777D6DE91772DA4961482568956695A" description="Client Secret"/>
  <property name="openid.idp.google.tokenurl" value="https://accounts.google.com/o/oauth2/token" description="URL to use when exchanging authorization code for a token"/>
</group>

<property name="openid.identityproviders" value="microsoft" description="OpenID Connect identity providers, where we can exchange an authorization code for an id/access token"/>


<property name="openid.idp.microsoft.clientid" value="xxxxx - your client ID xxxxx" description="Client ID"/>
<property name="openid.idp.microsoft.secret" value="xxxx your client secret ----" description=""/>
<property name="openid.idp.microsoft.tokenurl" value="https://login.microsoftonline.com/common/oauth2/v2.0/token" description="URL to use when exchanging authorization code for a token"/>

<property name="oauth2.tokens" value="sample;sample2;google;microsoft" description="List of OAuth2 JWT tokens names"/>

<property name="oauth2.token.microsoft.attributesToStoreInSession" value="*" description=""/>
<property name="oauth2.token.microsoft.issuer" value="https://login.microsoftonline.com/9188040d-6c67-4c5b-b112-36a304b66dad/v2.0" description=""/>
<property name="oauth2.token.microsoft.jceprovider" value="BC" description=""/>
<property name="oauth2.token.microsoft.openidconnect" value="true" description=""/>
<property name="oauth2.token.microsoft.signerCertificates" value="" description=""/>
<property name="oauth2.token.microsoft.signerCertificatesURL" value="https://login.microsoftonline.com/common/discovery/v2.0/keys" description=""/>
<property name="oauth2.token.microsoft.useridAttributeName" value="preferred_username" description="Name of attribute to contain the userid, if not sub"/>
<property name="oauth2.token.microsoft.usernameAttributeName" value="name" description="Name of attribute to contain the username"/>
<property name="oauth2.token.microsoft.validaudiences" value="xxxxx your client ID xxxxx" description="We need to specify which audience is valid for the token"/>

<property name="openid.idp.facebook.clientid" value="xxxx your client ID xxxxx" description="Client ID"/>
<property name="openid.idp.facebook.secret" value="xxxx your client secret xxxx" description=""/>
<property name="openid.idp.facebook.facebook" value="true" description="Use facebook connect, since facebook does not support OpenID Connect - it prefers its own broken variation"/>
<property name="openid.idp.facebook.facebookfields" value="id,cover,name,first_name,last_name,age_range,link,gender,locale,picture,timezone,updated_time,verified,email" description=""/>
<property name="openid.idp.facebook.facebookurl" value="https://graph.facebook.com/me" description=""/>
<property name="openid.idp.facebook.tokenurl" value="https://graph.facebook.com/oauth/access_token" description="URL to use when exchanging authorization code for a token"/>

<property name="openid.idp.linkedin.clientid" value="xxxx your client ID xxxx" description=""/>
<property name="openid.idp.linkedin.secret" value="xxxx your client secret xxxx" description=""/>
<property name="openid.idp.linkedin.tokenurl" value="https://www.linkedin.com/oauth/v2/accessToken" description=""/>
<property name="openid.idp.linkedin.linkedin" value="true" description=""/>
<property name="openid.idp.linkedin.linkedinurl" value="https://api.linkedin.com/v1/people/~" description=""/>
<property name="openid.idp.linkedin.linkedinfields" value="id,firstName,lastName,headline,num-connections,picture-url,formatted-name,summary,location,public-profile-url" description=""/>

{
  "content.preload": false,
  "name": "OpenID Connect LinkedIn",
  "description": "OpenID Connect authorization code flow example using LinkedIn",
  "conditions": [{
    "values": [
      "/openid/linkedin",
      "/openid/linkedin/"
    ],
    "type": "path"
  }],
  "authentication": {
    "plugins": ["io.ceptor.authentication.AuthenticatorOpenIDConnect"],
    "openidconnect": {
      "identityprovider.name": "linkedin",
      "authenticationplugin": 48,
      "redirecturl": "https://%{HTTP_HOST}/openid/linkedin",
      "response.name": "Redirect to page after login",
      "scope": "r_basicprofile",
      "authorize.url": "https://www.linkedin.com/oauth/v2/authorization",
      "client.id": "xxxx your client ID xxxx"
    }
  }
}

package dk.itp.security.authentication.oauth.data;

/**
 * Interface to OAuth2 data store - implementers retrieve client ID information, 
 */
public interface IOAuthDataStore {
	/**
	 * Gives the datastore its configuration
	 * @param config Configuration
	 */
	public void setConfiguration(Properties config);
	
	/**
	 * Return a list of known client IDs
	 * @return List of known client IDs
	 */
	public Collection<String> getKnownClientIDs();
	
	/**
	 * Returns known ClientData from a clientID
	 * 
	 * @param clientID Client ID
	 * @return Client Data - includes secret, valid scopes, valid redirect URIs etc.
	 */
	public ClientData getClientData(String clientID);
}

package dk.itp.security.authentication.oauth.data;

/**
 * Contains known data about an OAuth2 Client.
 * A client is not PortalProtect as a client to someone else, but a client towards PortalProtect where we are the server
 */
public class ClientData {
	public enum AccessTokenType {
		JWT, UUID
	}
	
	/** Client ID */
	public String clientID;
	/** Client secret */
	public String clientSecret;
	/** Valid OAuth2 grant type; implicit, authorization_code */
	public Collection<String> validGrantTypes;
	/** Valid scopes, e.g. email, profile, name, photo */
	public Collection<String> allowedScopes;
	/** Allowed redirect URIs */
	public Collection<String> allowedUris;
	/** Allowed logout URIs */
	public Collection<String> allowedLogoutUris;
	/** Number of seconds the access token is valid for */
	public int accessTokenValiditySeconds;
	/** Number of seconds the refresh token is valid for */
	public int refreshTokenValiditySeconds;
	
	/** The maximum expiration time in minutes allowed */
	public int maximumIdTokenExpirationMinutes;
	/** Name of token configuration to use with this client */
	public String tokenname;
	/** Type of access token to generate */
	public AccessTokenType accessTokenType;

	/** If true, client is confidential and must always authenticate itself */
	public boolean isConfidential;
	/** If true, new refresh token is issued when previous refresh token is used */
	public boolean issueNewRefreshTokensWhenUsed;
	/** If true, refresh token is invalidate on use */
	public boolean invalidateRefreshTokenOnUse;

	/** A list of roles for this client - could be roles for an API partner */
	public List<String> roles;
	
	public Map<String, Object> properties = new LinkedHashMap<>();
}

package dk.itp.security.authentication.oauth.data;

/**
 * Interface which must be implemented by data-stores which handle access tokens and authorization codes
 */
public interface IAccessTokenDataStore {
	/**
	 * Lookup a previously stored set of information for a particular client ID and access token
	 * 
	 * @param clientId Client ID - might be null if session is created from a ticket/bearer token
	 * @param refreshToken Refresh Token
	 * @return RefreshTokenInfo loaded from datastore.
	 */
	public AccessTokenInfo lookupToken(String clientId, String accessToken);
	
	/**
	 * Lookup a previously stored set of information for a particular client ID and authorization code
	 * An access token can only be looked up once - after that, it is marked as being used and cannot be reused.
	 * 
	 * @param clientId Client ID
	 * @param refreshToken Refresh Token
	 * @return RefreshTokenInfo loaded from datastore.
	 */
	public AccessTokenInfo lookupTokenFromCode(String clientId, String authorizationCode);
	
	/**
	 * Store the info in the data store.
	 * 
	 * @param info Access Token to store
	 */
	public void storeAccesToken(AccessTokenInfo info);
	
	/**
	 * Revoke an existing access token
	 * 
	 * @param info Access Token to revoke
	 */
	public void revokeAccessToken(AccessTokenInfo info);
	
	/**
	 * Called to initialize this datastore, after configuration has been set
	 * @param sessioncontroller
	 */
	public void start(PTSServer sessioncontroller);
	
	/**
	 * Gives this datastore a chance to stop and release any resources it might have
	 */
	public void stop();
	
	/**
	 * Gives the datastore its configuration
	 * @param config Configuration
	 */
	public void setConfiguration(Properties config);
}

package dk.itp.security.authentication.oauth.data;

/**
 * Contains information about a refresh token
 */
public class AccessTokenInfo implements Serializable {
	private static final long serialVersionUID = 1L;
	
	/** The access token */
	public String access_token;
	/** An ID token that might have be generated along with the access token */
	public String id_token;
	/** Client ID */
	public String clientid;
	/** Redirect URL */
	public String redirectUri;
	/** Userinfo generated from the session */
	public String userinfo;
	/** Refresh token, if any */
	public String refreshToken;
	/** Expiration time in seconds of the access token*/
	public int accessTokenExpireSeconds;
	/** Authorization code which can be used to obtain this access token */
	public String authorizationCode;

	// --- Information needed for introspection ---
	/** The requested scope */
	public String scope;
	/** Expires at (seconds) */
	public long expiresAt;
	/** Issued at */
	public long issuedAt;
	/** Subject */
	public String sub;
	/** Username */
	public String username;
	/** Audience */
	public String audience;
	/** Issuer */
	public String issuer;
	/** Token ID */
	public String jti;
}

package dk.itp.security.authentication.oauth.data;

/**
 * Interface which must be implemented by data-stores which handle refresh tokens
 */
public interface IRefreshTokenDataStore {
	/**
	 * Lookup a previously stored set of session data for a particular client ID and refreshToken
	 * 
	 * @param clientId Client ID
	 * @param refreshToken Refresh Token
	 * @return RefreshTokenInfo loaded from datastore.
	 */
	public RefreshTokenInfo lookupToken(String clientId, String refreshToken);
	
	/**
	 * Store the info in the data store.
	 * 
	 * @param info Refresh Token to store
	 */
	public void storeRefreshToken(RefreshTokenInfo info);
	
	/**
	 * Revoke an existing refresh token
	 * 
	 * @param info Refresh token to revoke
	 */
	public void revokeRefreshToken(RefreshTokenInfo info);
	
	/**
	 * Gives the datastore its configuration
	 * @param config Configuration
	 */
	public void setConfiguration(Properties config);
	
	/**
	 * Called to initialize this datastore, after configuration has been set
	 * @param sessioncontroller
	 */
	public void start(PTSServer sessioncontroller);
	
	/**
	 * Gives this datastore a chance to stop and release any resources it might have
	 */
	public void stop();
}

package dk.itp.security.authentication.oauth.data;

/**
 * Contains information about a refresh token
 */
public class RefreshTokenInfo implements Serializable {
	private static final long serialVersionUID = 1L;
	
	/** The refresh token */
	public String refreshToken;
	/** The client ID this token is valid for */
	public String clientID;
	/** Expire time in msecs */
	public long expiresAt;
	/** Created at in msecs */
	public long createdAt;
	
	public byte[] persistedSession;
}