return Response.status(302).location(redirectUri.build()).build();
}
protected SkeletonKeyToken createToken(String scopeParam, Realm realm, User client, User user)
{
SkeletonKeyToken token = null;
if (scopeParam != null)
{
token = new SkeletonKeyToken();
token.id(generateId());
token.principal(user.getUsername());
token.audience(realm.getName());
if (realm.getTokenLifespan() > 0)
{
token.expiration((System.currentTimeMillis() / 1000) + realm.getTokenLifespan());
}
SkeletonKeyScope scope = null;
byte[] bytes = Base64Url.decode(scopeParam);
try
{
scope = JsonSerialization.fromBytes(SkeletonKeyScope.class, bytes);
}
catch (IOException e)
{
throw new RuntimeException(e);
}
for (String res : scope.keySet())
{
Resource resource = identityManager.getResource(realm, res);
ScopeMapping scopeMapping = identityManager.getScopeMapping(realm, resource, client);
RoleMapping roleMapping = identityManager.getRoleMapping(realm, resource, user);
SkeletonKeyToken.Access access = token.addAccess(resource.getName());
for (String role : scope.get(res))
{
if (!scopeMapping.getRoles().contains(role))
{
throw new ForbiddenException(Response.status(403).entity("<h1>Security Alert</h1><p>Known client not authorized for the requested scope.</p>").type("text/html").build());