|
| 1 | +package no.nav.familie.ba.skatteetaten.maskinporten |
| 2 | + |
| 3 | +import com.nimbusds.jose.JOSEException |
| 4 | +import com.nimbusds.jose.JOSEObjectType |
| 5 | +import com.nimbusds.jose.JWSAlgorithm |
| 6 | +import com.nimbusds.jose.JWSHeader |
| 7 | +import com.nimbusds.jose.JWSSigner |
| 8 | +import com.nimbusds.jose.crypto.RSASSASigner |
| 9 | +import com.nimbusds.jose.jwk.RSAKey |
| 10 | +import com.nimbusds.jwt.JWTClaimsSet |
| 11 | +import com.nimbusds.jwt.SignedJWT |
| 12 | +import org.springframework.http.HttpEntity |
| 13 | +import org.springframework.http.HttpHeaders |
| 14 | +import org.springframework.http.HttpMethod |
| 15 | +import org.springframework.http.MediaType |
| 16 | +import org.springframework.util.LinkedMultiValueMap |
| 17 | +import org.springframework.web.client.RestTemplate |
| 18 | +import java.time.Instant |
| 19 | +import java.util.Date |
| 20 | + |
| 21 | +fun main() { |
| 22 | + val jwkPrivate: String = System.getenv("MASKINPORTEN_CLIENT_JWK") |
| 23 | + assert(jwkPrivate.isNotBlank()) |
| 24 | + val clientId: String = System.getenv("MASKINPORTEN_CLIENT_ID") |
| 25 | + assert(clientId.isNotBlank()) |
| 26 | + |
| 27 | + val token = MaskinportenClient().hentToken("nav:familie/v1/kontantstotte/barnehagelister", jwkPrivate, clientId) |
| 28 | + |
| 29 | + println(token) |
| 30 | +} |
| 31 | + |
| 32 | +class MaskinportenClient { |
| 33 | + private val restTemplate = RestTemplate() |
| 34 | + |
| 35 | + private fun createSignedJWT( |
| 36 | + rsaJwk: RSAKey, |
| 37 | + claimsSet: JWTClaimsSet?, |
| 38 | + ): SignedJWT = |
| 39 | + try { |
| 40 | + val header = |
| 41 | + JWSHeader |
| 42 | + .Builder(JWSAlgorithm.RS256) |
| 43 | + .keyID(rsaJwk.keyID) |
| 44 | + .type(JOSEObjectType.JWT) |
| 45 | + val signedJWT = SignedJWT(header.build(), claimsSet) |
| 46 | + val signer: JWSSigner = RSASSASigner(rsaJwk.toPrivateKey()) |
| 47 | + signedJWT.sign(signer) |
| 48 | + signedJWT |
| 49 | + } catch (e: JOSEException) { |
| 50 | + throw RuntimeException(e) |
| 51 | + } |
| 52 | + |
| 53 | + fun hentToken( |
| 54 | + scope: String, |
| 55 | + jwkPrivate: String, |
| 56 | + clientId: String, |
| 57 | + ): String { |
| 58 | + val rsaKey = RSAKey.parse(jwkPrivate) |
| 59 | + val time = Instant.now() |
| 60 | + val jwtClaimsSet = |
| 61 | + JWTClaimsSet |
| 62 | + .Builder() |
| 63 | + .audience(AUD) |
| 64 | + .issuer(clientId) |
| 65 | + .issueTime(Date.from(time)) |
| 66 | + .expirationTime(Date.from(time.plusSeconds(120))) |
| 67 | + .claim(SCOPE, scope) |
| 68 | + .build() |
| 69 | + val signedJWT = createSignedJWT(rsaKey, jwtClaimsSet) |
| 70 | + val headers = HttpHeaders() |
| 71 | + headers.contentType = MediaType.APPLICATION_FORM_URLENCODED |
| 72 | + val requestBody = LinkedMultiValueMap<Any, Any>() |
| 73 | + requestBody.add("grant_type", GRANT_TYPE_VALUE) |
| 74 | + requestBody.add("assertion", signedJWT.serialize()) |
| 75 | + val httpEntity = HttpEntity(requestBody, headers) |
| 76 | + val json = |
| 77 | + restTemplate |
| 78 | + .exchange( |
| 79 | + TOKEN_ENDPOINT, |
| 80 | + HttpMethod.POST, |
| 81 | + httpEntity, |
| 82 | + String::class.java, |
| 83 | + ).body!! |
| 84 | + |
| 85 | + return json |
| 86 | + } |
| 87 | + |
| 88 | + companion object { |
| 89 | + private const val SCOPE = "scope" |
| 90 | + private const val GRANT_TYPE_VALUE = "urn:ietf:params:oauth:grant-type:jwt-bearer" |
| 91 | + private const val AUD = "https://test.maskinporten.no/" |
| 92 | + private const val TOKEN_ENDPOINT = "$AUD/token" |
| 93 | + } |
| 94 | +} |
0 commit comments