Merge pull request #146 from ihormartsekha-okta/im-OKTA-265220-error-handling-for-OIDC-sign-in

Create new AuthorizationException type for Token Validation errors

Author: FeiChen-okta

library/src/main/java/com/okta/oidc/OktaIdToken.java

@@ -90,7 +90,8 @@ public interface Clock {
     String mSignature;
 
     private static final Long MILLIS_PER_SECOND = 1000L;
-    private static final Long TEN_MINUTES_IN_SECONDS = 600L;
+    private static final int SECONDS_IN_ONE_MINUTE = 60;
+    private static final Long TEN_MINUTES_IN_SECONDS = 10L * SECONDS_IN_ONE_MINUTE;
 
     /**
      * The address in the claims section.
@@ -301,62 +302,62 @@ public void validate(TokenRequest request, Clock clock) throws AuthorizationExce
 
         if (!"RS256".equals(mHeader.alg)) {
             throw AuthorizationException.fromTemplate(ID_TOKEN_VALIDATION_ERROR,
-                    new IllegalStateException("JWT Header 'alg' of [" + mHeader.alg + "] " +
-                            "is not supported, only RSA256 signatures are supported"));
+                    AuthorizationException.TokenValidationError
+                            .createNotSupportedAlgorithmException(mHeader.alg));
         }
         if (providerConfig.issuer != null) {
             if (!mClaims.iss.equals(providerConfig.issuer)) {
                 throw AuthorizationException.fromTemplate(ID_TOKEN_VALIDATION_ERROR,
-                        new IllegalStateException("Issuer mismatch"));
+                        AuthorizationException.TokenValidationError.ISSUER_MISMATCH);
             }
 
             Uri issuerUri = Uri.parse(mClaims.iss);
             if (!issuerUri.getScheme().equals("https")) {
                 throw AuthorizationException.fromTemplate(ID_TOKEN_VALIDATION_ERROR,
-                        new IllegalStateException("Issuer must be an https URL"));
+                        AuthorizationException.TokenValidationError.ISSUER_NOT_HTTPS_URL);
             }
 
             if (TextUtils.isEmpty(issuerUri.getHost())) {
                 throw AuthorizationException.fromTemplate(ID_TOKEN_VALIDATION_ERROR,
-                        new IllegalStateException("Issuer host can not be empty"));
+                        AuthorizationException.TokenValidationError.ISSUER_HOST_EMPTY);
             }
 
             if (issuerUri.getFragment() != null || issuerUri.getQueryParameterNames().size() > 0) {
                 throw AuthorizationException.fromTemplate(ID_TOKEN_VALIDATION_ERROR,
-                        new IllegalStateException(
-                                "Issuer URL contains query parameters or fragment components"));
+                        AuthorizationException.TokenValidationError
+                                .ISSUER_URL_CONTAIN_OTHER_COMPONENTS);
             }
         }
 
         String clientId = config.getClientId();
         if (!this.mClaims.aud.contains(clientId)) {
             throw AuthorizationException.fromTemplate(ID_TOKEN_VALIDATION_ERROR,
-                    new IllegalStateException("Audience mismatch"));
+                    AuthorizationException.TokenValidationError.AUDIENCE_MISMATCH);
         }
 
         long nowInSeconds = clock.getCurrentTimeMillis() / MILLIS_PER_SECOND;
         if (nowInSeconds > mClaims.exp) {
             throw AuthorizationException.fromTemplate(ID_TOKEN_VALIDATION_ERROR,
-                    new IllegalStateException("ID Token expired"));
+                    AuthorizationException.TokenValidationError.ID_TOKEN_EXPIRED);
         }
 
         if (Math.abs(nowInSeconds - mClaims.iat) > TEN_MINUTES_IN_SECONDS) {
             throw AuthorizationException.fromTemplate(ID_TOKEN_VALIDATION_ERROR,
-                    new IllegalStateException("Issued at time is more than 10 minutes "
-                            + "before or after the current time"));
+                    AuthorizationException.TokenValidationError.createWrongTokenIssuedTime(
+                            TEN_MINUTES_IN_SECONDS.intValue() / SECONDS_IN_ONE_MINUTE));
         }
 
         if (GrantTypes.AUTHORIZATION_CODE.equals(request.getGrantType())) {
             String expectedNonce = request.getNonce();
             if (!TextUtils.equals(mClaims.nonce, expectedNonce)) {
                 throw AuthorizationException.fromTemplate(ID_TOKEN_VALIDATION_ERROR,
-                        new IllegalStateException("Nonce mismatch"));
+                        AuthorizationException.TokenValidationError.NONCE_MISMATCH);
             }
         }
 
         if (request.getMaxAge() != null && mClaims.auth_time <= 0) {
             throw AuthorizationException.fromTemplate(ID_TOKEN_VALIDATION_ERROR,
-                    new IllegalStateException("max_age provided but auth_time is missing"));
+                    AuthorizationException.TokenValidationError.AUTH_TIME_MISSING);
         }
     }
 

library/src/main/java/com/okta/oidc/util/AuthorizationException.java

@@ -129,7 +129,12 @@ public final class AuthorizationException extends Exception {
     /**
      * The error type for persistence specific errors.
      */
-    public static final int TYPE_ENCRYPTION_ERROR = 4;
+    public static final int TYPE_ENCRYPTION_ERROR = 5;
+
+    /**
+     * The error type for OAuth token validation errors.
+     */
+    public static final int TYPE_OAUTH_VALIDATION_TOKEN_ERROR = 6;
 
     @VisibleForTesting
     static final String KEY_TYPE = "type";
@@ -524,6 +529,63 @@ public static AuthorizationException byEncryptionException(EncryptionException e
         }
     }
 
+    /**
+     * Error codes related to failed during token validation.
+     */
+    public static final class TokenValidationError {
+        public static final int NOT_SUPPORTED_ALGORITHM_ERROR = 6000;
+        public static final int ISSUER_MISMATCH_ERROR = 6001;
+        public static final int ISSUER_NOT_HTTPS_URL_ERROR = 6002;
+        public static final int ISSUER_HOST_EMPTY_ERROR = 6003;
+        public static final int ISSUER_URL_CONTAIN_OTHER_COMPONENTS_ERROR = 6004;
+        public static final int AUDIENCE_MISMATCH_ERROR = 6005;
+        public static final int ID_TOKEN_EXPIRED_ERROR = 6006;
+        public static final int ID_TOKEN_WRONG_ISSUED_TIME_ERROR = 6007;
+        public static final int NONCE_MISMATCH_ERROR = 6008;
+        public static final int AUTH_TIME_MISSING_ERROR = 6009;
+
+        public static AuthorizationException createNotSupportedAlgorithmException(String alg) {
+            return tokenValidationEx(NOT_SUPPORTED_ALGORITHM_ERROR,
+                    "JWT Header 'alg' of [" + alg + "] " +
+                    "is not supported, only RSA256 signatures are supported");
+        }
+
+        public static final AuthorizationException ISSUER_MISMATCH =
+                tokenValidationEx(ISSUER_MISMATCH_ERROR, "Issuer mismatch");
+
+        public static final AuthorizationException ISSUER_NOT_HTTPS_URL =
+                tokenValidationEx(ISSUER_NOT_HTTPS_URL_ERROR,
+                        "Issuer must be an https URL");
+
+        public static final AuthorizationException ISSUER_HOST_EMPTY =
+                tokenValidationEx(ISSUER_HOST_EMPTY_ERROR,
+                        "Issuer host can not be empty");
+
+        public static final AuthorizationException ISSUER_URL_CONTAIN_OTHER_COMPONENTS =
+                tokenValidationEx(ISSUER_URL_CONTAIN_OTHER_COMPONENTS_ERROR,
+                        "Issuer URL contains query parameters or fragment components");
+
+        public static final AuthorizationException AUDIENCE_MISMATCH =
+                tokenValidationEx(AUDIENCE_MISMATCH_ERROR, "Audience mismatch");
+
+        public static final AuthorizationException ID_TOKEN_EXPIRED =
+                tokenValidationEx(ID_TOKEN_EXPIRED_ERROR, "ID Token expired");
+
+        public static AuthorizationException createWrongTokenIssuedTime(int minutes) {
+            return tokenValidationEx(ID_TOKEN_WRONG_ISSUED_TIME_ERROR,
+                    "Issued at time is more than "
+                            + minutes + " minutes before or after the current time");
+        }
+
+        public static final AuthorizationException NONCE_MISMATCH =
+                tokenValidationEx(NONCE_MISMATCH_ERROR, "Nonce mismatch");
+
+        public static final AuthorizationException AUTH_TIME_MISSING =
+                tokenValidationEx(AUTH_TIME_MISSING_ERROR,
+                        "max_age provided but auth_time is missing");
+
+    }
+
     private static AuthorizationException generalEx(int code, @Nullable String errorDescription) {
         return new AuthorizationException(
                 TYPE_GENERAL_ERROR, code, null, errorDescription, null, null);
@@ -544,6 +606,11 @@ private static AuthorizationException registrationEx(int code, @Nullable String
                 TYPE_OAUTH_REGISTRATION_ERROR, code, error, null, null, null);
     }
 
+    private static AuthorizationException tokenValidationEx(int code, @Nullable String error) {
+        return new AuthorizationException(
+                TYPE_OAUTH_VALIDATION_TOKEN_ERROR, code, null, error, null, null);
+    }
+
     /**
      * Creates an exception based on one of the existing values defined in
      * {@link GeneralErrors}, {@link AuthorizationRequestErrors} or {@link TokenRequestErrors},