public String getSAML2URI(GluuAttribute attribute) {
	if (StringHelper.isNotEmpty(attribute.getSaml2Uri())) {
		return "SAML1 URI: " + attribute.getSaml2Uri();
	}
	List<String> attributeNames = new ArrayList<String>();
	attributeNames.add(attribute.getName());
	SchemaEntry schemaEntry = shemaService.getSchema();
	List<AttributeTypeDefinition> attributeTypes = shemaService.getAttributeTypeDefinitions(schemaEntry,
			attributeNames);
	String attributeName = attribute.getName();
	AttributeTypeDefinition attributeTypeDefinition = shemaService.getAttributeTypeDefinition(attributeTypes,
			attributeName);
	if (attributeTypeDefinition == null) {
		log.error("Failed to get OID for attribute name {}", attributeName);
		return null;
	}
	return "SAML2 URI: urn:oid:" + attributeTypeDefinition.getOID();
}
 

public List<DeviceRegistration> findDeviceRegistrationsByKeyHandle(String appId, String keyHandle, String ... returnAttributes) {
	if (org.gluu.util.StringHelper.isEmpty(appId) || StringHelper.isEmpty(keyHandle)) {
		return new ArrayList<DeviceRegistration>(0);
	}

	byte[] keyHandleDecoded = Base64Util.base64urldecode(keyHandle);

	String baseDn = userService.getDnForUser(null);

	Filter deviceObjectClassFilter = Filter.createEqualityFilter("objectClass", "oxDeviceRegistration");
	Filter deviceHashCodeFilter = Filter.createEqualityFilter("oxDeviceHashCode", getKeyHandleHashCode(keyHandleDecoded));
	Filter deviceKeyHandleFilter = Filter.createEqualityFilter("oxDeviceKeyHandle", keyHandle);
	Filter appIdFilter = Filter.createEqualityFilter("oxApplication", appId);

	Filter filter = Filter.createANDFilter(deviceObjectClassFilter, deviceHashCodeFilter, appIdFilter, deviceKeyHandleFilter);

	return ldapEntryManager.findEntries(baseDn, DeviceRegistration.class, filter, returnAttributes);
}
 

public String getUserInumByKeyHandle(String appId, String keyHandle) throws InvalidKeyHandleDeviceException {
    if (org.gluu.util.StringHelper.isEmpty(appId) || StringHelper.isEmpty(keyHandle)) {
        return null;
    }

    List<DeviceRegistration> deviceRegistrations = deviceRegistrationService.findDeviceRegistrationsByKeyHandle(appId, keyHandle, "oxId");
    if (deviceRegistrations.isEmpty()) {
        throw new InvalidKeyHandleDeviceException(String.format("Failed to find device by keyHandle '%s' in LDAP", keyHandle));
    }

    if (deviceRegistrations.size() != 1) {
        throw new BadInputException(String.format("There are '%d' devices with keyHandle '%s' in LDAP", deviceRegistrations.size(), keyHandle));
    }

    DeviceRegistration deviceRegistration = deviceRegistrations.get(0);

    return userService.getUserInumByDn(deviceRegistration.getDn());
}
 

public void addCustomAttribute(String inum, boolean mandatory) {
	if (StringHelper.isEmpty(inum)) {
		return;
	}

	GluuAttribute tmpAttribute = attributeInums.get(inum);
	if ((tmpAttribute == null) || containsCustomAttribute(tmpAttribute)) {
		return;
	}

	String id = this.attributeIds.get(tmpAttribute);
	this.availableAttributeIds.remove(id);

	GluuCustomAttribute tmpGluuPersonAttribute = new GluuCustomAttribute(tmpAttribute.getName(), (String) null,
			true, mandatory);
	tmpGluuPersonAttribute.setMetadata(tmpAttribute);

	this.customAttributes.add(tmpGluuPersonAttribute);
}
 

private void loadOpenIdConfiguration() throws IOException {
	String openIdProvider = appConfiguration.getOpenIdProviderUrl();
	if (StringHelper.isEmpty(openIdProvider)) {
		throw new ConfigurationException("OpenIdProvider Url is invalid");
	}

	final OpenIdConfigurationClient openIdConfigurationClient = new OpenIdConfigurationClient(openIdProvider);
	final OpenIdConfigurationResponse response = openIdConfigurationClient.execOpenIdConfiguration();
	if ((response == null) || (response.getStatus() != 200)) {
		throw new ConfigurationException("Failed to load oxAuth configuration");
	}

	logger.info("Successfully loaded oxAuth configuration");

	this.openIdConfiguration = response;
}
 

/**
 * Search scopes by pattern
 * 
 * @param pattern
 *            Pattern
 * @param sizeLimit
 *            Maximum count of results
 * @return List of scopes
 * @throws Exception
 */
public List<Scope> searchScopes(String pattern, int sizeLimit) {
	Filter searchFilter = null;
	if (StringHelper.isNotEmpty(pattern)) {
		String[] targetArray = new String[] { pattern };
		Filter displayNameFilter = Filter.createSubstringFilter(OxTrustConstants.displayName, null, targetArray,
				null);
		Filter descriptionFilter = Filter.createSubstringFilter(OxTrustConstants.description, null, targetArray,
				null);
		searchFilter = Filter.createORFilter(displayNameFilter, descriptionFilter);
	}
	List<Scope> result = new ArrayList<>();
	try {
		result = persistenceEntryManager.findEntries(getDnForScope(null), Scope.class, searchFilter, sizeLimit);
		return filter(result);
	} catch (Exception e) {
		e.printStackTrace();
	}
	return result;
}
 

private void initAttribute() {
	if (StringHelper.isEmpty(this.attribute.getSaml1Uri())) {
		String namespace;
		if (attribute.isCustom() || StringHelper.isEmpty(attribute.getUrn())
				&& attribute.getUrn().startsWith("urn:gluu:dir:attribute-def:")) {
			namespace = "gluu";
		} else {
			namespace = "mace";
		}
		this.attribute.setSaml1Uri(String.format("urn:%s:dir:attribute-def:%s", namespace, attribute.getName()));
	}

	if (StringHelper.isEmpty(this.attribute.getSaml2Uri())) {
		this.attribute.setSaml2Uri(attributeService.getDefaultSaml2Uri(attribute.getName()));
	}

	if (attribute.getAttributeValidation() == null) {
		attribute.setAttributeValidation(new AttributeValidation());
	} else {
		this.validationToggle = true;
	}

	if (attribute.getGluuTooltip() != null) {
		this.tooltipToggle = true;
	}
}
 

public String[] buildOrganizationCustomMessages(String[][] customMessages) {
	List<String> result = new ArrayList<String>();

	for (String[] customMessage : customMessages) {
		if (ArrayHelper.isEmpty(customMessage) || customMessage.length != 2) {
			continue;
		}
		String msgKey = customMessage[0];
		String msgValue = customMessage[1];

		if (StringHelper.isNotEmpty(msgKey) && StringHelper.isNotEmpty(msgValue)) {
			result.add(msgKey + ": " + msgValue);
		}
	}

	return result.toArray(new String[0]);
}
 

private void loadOpenIdConfiguration() throws IOException {
    String openIdProvider = appConfiguration.getOxAuthIssuer();
    if (StringHelper.isEmpty(openIdProvider)) {
        throw new ConfigurationException("OpenIdProvider Url is invalid");
    }

    openIdProvider = openIdProvider + "/.well-known/openid-configuration";

    final OpenIdConfigurationClient openIdConfigurationClient = new OpenIdConfigurationClient(openIdProvider);
    final OpenIdConfigurationResponse response = openIdConfigurationClient.execOpenIdConfiguration();
    if ((response == null) || (response.getStatus() != 200)) {
        throw new ConfigurationException("Failed to load oxAuth configuration");
    }

    log.info("Successfully loaded oxAuth configuration");

    this.openIdConfiguration = response;
}
 

public User getUser(String userId, String... returnAttributes) {
	log.debug("Getting user information from LDAP: userId = {}", userId);

	if (StringHelper.isEmpty(userId)) {
		return null;
	}

	Filter userUidFilter = Filter.createEqualityFilter(Filter.createLowercaseFilter("uid"), StringHelper.toLowerCase(userId));

	List<User> entries = persistenceEntryManager.findEntries(getPeopleBaseDn(), User.class, userUidFilter, returnAttributes);
	log.debug("Found {} entries for user id = {}", entries.size(), userId);

	if (entries.size() > 0) {
		return entries.get(0);
	} else {
		return null;
	}
}
 

public String search() {
	if (StringHelper.isNotEmpty(this.oldSearchPattern) && Util.equals(this.oldSearchPattern, this.searchPattern)) {
		return OxTrustConstants.RESULT_SUCCESS;
	}
	try {
	    if (StringHelper.isEmpty(this.searchPattern)) {
            this.attributes = attributeService.getAllAttributes();
	    } else {
	        this.attributes = attributeService.searchAttributes(this.searchPattern, OxTrustConstants.searchPersonsSizeLimit);
	    }
           for (GluuAttribute selectedAttribute : selectedAttributes) {
               if (!attributes.contains(selectedAttribute)) {
                   attributes.add(selectedAttribute);
               }
           }
		this.oldSearchPattern = this.searchPattern;
	} catch (Exception ex) {
		log.error("Failed to find attributes", ex);
		return OxTrustConstants.RESULT_FAILURE;
	}

	return OxTrustConstants.RESULT_SUCCESS;
}
 

public boolean generateSp() throws IOException {
	FacesContext facesContext = FacesContext.getCurrentInstance();
	try {
		this.trustRelationship.setInum(trustService.generateInumForNewTrustRelationship());
		String cert = getCertForGeneratedSP();
		String spMetadataFileName = this.trustRelationship.getSpMetaDataFN();
		if (StringHelper.isEmpty(spMetadataFileName)) {
			spMetadataFileName = shibboleth3ConfService.getSpNewMetadataFileName(trustRelationship);
			trustRelationship.setSpMetaDataFN(spMetadataFileName);
		}
		String spMetadataFileContent = shibboleth3ConfService.generateSpMetadataFileContent(trustRelationship,
				cert);
		HttpServletResponse response = (HttpServletResponse) externalContext.getResponse();
		response.setContentType("application/xml");
		response.setHeader("Content-Disposition", "attachment;filename=" + spMetadataFileName);
		ServletOutputStream os = response.getOutputStream();
		os.write(spMetadataFileContent.getBytes());
		os.flush();
		os.close();
		facesContext.responseComplete();
	} catch (IOException e) {
		e.printStackTrace();
	}
	facesContext.responseComplete();
	return true;
}
 

private Pair<SessionId, AuthorizationGrant> getPair(String idTokenHint, String sessionId, HttpServletRequest httpRequest) {
    AuthorizationGrant authorizationGrant = authorizationGrantList.getAuthorizationGrantByIdToken(idTokenHint);
    if (authorizationGrant == null) {
        Boolean endSessionWithAccessToken = appConfiguration.getEndSessionWithAccessToken();
        if ((endSessionWithAccessToken != null) && endSessionWithAccessToken) {
            authorizationGrant = authorizationGrantList.getAuthorizationGrantByAccessToken(idTokenHint);
        }
    }

    SessionId ldapSessionId = null;

    try {
        String id = sessionId;
        if (StringHelper.isEmpty(id)) {
            id = cookieService.getSessionIdFromCookie(httpRequest);
        }
        if (StringHelper.isNotEmpty(id)) {
            ldapSessionId = sessionIdService.getSessionId(id);
        }
    } catch (Exception e) {
        log.error("Failed to current session id.", e);
    }
    return new Pair<>(ldapSessionId, authorizationGrant);
}
 

public User getUserByAttribute(String attributeName, String attributeValue) {
    log.debug("Getting user information from LDAP: attributeName = '{}', attributeValue = '{}'", attributeName, attributeValue);
    
    if (StringHelper.isEmpty(attributeName) || StringHelper.isEmpty(attributeValue)) {
    	return null;
    }

    User user = new User();
    user.setDn(getPeopleBaseDn());

    List<CustomAttribute> customAttributes =  new ArrayList<CustomAttribute>();
    customAttributes.add(new CustomAttribute(attributeName, attributeValue));

    user.setCustomAttributes(customAttributes);

    List<User> entries = persistenceEntryManager.findEntries(user, 1);
    log.debug("Found '{}' entries", entries.size());

    if (entries.size() > 0) {
        return entries.get(0);
    } else {
        return null;
    }
}
 

@PreDestroy
  public void sessionDestroyed() {
  	OauthData oauthData = identity.getOauthData();
  	if ((oauthData == null) || StringHelper.isEmpty(oauthData.getSessionState())) {
  		return;
  	}

  	String userUid = oauthData.getUserUid();
  	log.debug("Calling oxAuth logout method at the end of HTTP session. User: '{}'", userUid);
  	try {
          String endSessionState = UUID.randomUUID().toString();

          EndSessionRequest endSessionRequest = new EndSessionRequest(oauthData.getIdToken(), appConfiguration.getLogoutRedirectUrl(), endSessionState);
          endSessionRequest.setSessionId(oauthData.getSessionState());

          EndSessionClient endSessionClient = new EndSessionClient(openIdService.getOpenIdConfiguration().getEndSessionEndpoint());
          endSessionClient.setRequest(endSessionRequest);
          EndSessionResponse endSessionResponse = endSessionClient.exec();
 
          if ((endSessionResponse == null) || (endSessionResponse.getStatus() != 302)) {
  	    	log.error("Invalid response code at oxAuth logout. User: '{}'", userUid);
          }
} catch (Exception ex) {
   	log.error("Exception happened at oxAuth logout. User: '{}'", userUid, ex);
}
  }
 

private boolean initActions() {
	initAttributes(this.trustRelationship);
	String resultInitContacts = trustContactsAction.initContacts(this.trustRelationship);
	if (!StringHelper.equalsIgnoreCase(OxTrustConstants.RESULT_SUCCESS, resultInitContacts)) {
		return false;
	}
	String resultInitMetadataFilters = metadataFiltersAction.initMetadataFilters(this.trustRelationship);
	if (!StringHelper.equalsIgnoreCase(OxTrustConstants.RESULT_SUCCESS, resultInitMetadataFilters)) {
		return false;
	}
	String resultInitProfileConfigurations = relyingPartyAction.initProfileConfigurations();
	if (!StringHelper.equalsIgnoreCase(OxTrustConstants.RESULT_SUCCESS, resultInitProfileConfigurations)) {
		return false;
	}
	String resultInitFederationDeconstructions = federationDeconstructionAction
			.initFederationDeconstructions(this.trustRelationship);
	if (!StringHelper.equalsIgnoreCase(OxTrustConstants.RESULT_SUCCESS, resultInitFederationDeconstructions)) {
		return false;
	}
	initFederatedSites(this.trustRelationship);
	return true;
}
 

public User getAuthenticatedUser() {
	if (identity.getUser() != null) {
		return identity.getUser();
	} else {
		SessionId sessionId = sessionIdService.getSessionId();
		if (sessionId != null) {
			Map<String, String> sessionIdAttributes = sessionId.getSessionAttributes();
			String userId = sessionIdAttributes.get(Constants.AUTHENTICATED_USER);
			if (StringHelper.isNotEmpty(userId)) {
				User user = userService.getUser(userId);
				identity.setUser(user);

				return user;
			}
		}
	}

	return null;
}
 

private AuthorizationGrant validateAuthorization(String authorization, UmaScopeType umaScopeType) {
    log.trace("Validate authorization: {}", authorization);
    if (StringHelper.isEmpty(authorization)) {
        throw errorResponseFactory.createWebApplicationException(UNAUTHORIZED, UNAUTHORIZED_CLIENT, "Authorization header is blank.");
    }

    String token = tokenService.getToken(authorization);
    if (StringHelper.isEmpty(token)) {
        log.debug("Token is invalid.");
        throw errorResponseFactory.createWebApplicationException(UNAUTHORIZED, UNAUTHORIZED_CLIENT, "Token is invalid.");
    }

    AuthorizationGrant authorizationGrant = authorizationGrantList.getAuthorizationGrantByAccessToken(token);
    if (authorizationGrant == null) {
        throw errorResponseFactory.createWebApplicationException(UNAUTHORIZED, ACCESS_DENIED, "Unable to find authorization grant by token.");
    }

    Set<String> scopes = authorizationGrant.getScopes();
    if (!scopes.contains(umaScopeType.getValue())) {
        throw errorResponseFactory.createWebApplicationException(Response.Status.NOT_ACCEPTABLE, INVALID_CLIENT_SCOPE, "Client does not have scope: " + umaScopeType.getValue());
    }
    return authorizationGrant;
}
 

@Produces
@ApplicationScoped
public StringEncrypter getStringEncrypter() throws OxIntializationException {
	String encodeSalt = configurationFactory.getCryptoConfigurationSalt();

	if (StringHelper.isEmpty(encodeSalt)) {
		throw new OxIntializationException("Encode salt isn't defined");
	}

	try {
		StringEncrypter stringEncrypter = StringEncrypter.instance(encodeSalt);

		return stringEncrypter;
	} catch (EncryptionException ex) {
		throw new OxIntializationException("Failed to create StringEncrypter instance");
	}
}
 

private GluuAttribute createAttributeFromConfig(String prefix) {
	String attributeName = importConfiguration.getString(prefix + ATTRIBUTE_LDAP_NAME_SUFFIX, null);
	String displayName = importConfiguration.getString(prefix + ATTRIBUTE_DISPLAY_NAME_SUFFIX, null);
	String dataType = importConfiguration.getString(prefix + ATTRIBUTE_DATA_TYPE_SUFFIX, null);
	boolean required = importConfiguration.getBoolean(prefix + ATTRIBUTE_DATA_REQUIRED_SUFFIX, false);

	if (StringHelper.isNotEmpty(attributeName) && StringHelper.isNotEmpty(displayName) && StringHelper.isNotEmpty(dataType)) {
		AttributeDataType attributeDataType = AttributeDataType.getByValue(dataType);
		if (attributeDataType != null) {
			GluuAttribute attr = new GluuAttribute();
			attr.setName(attributeName);
			attr.setDisplayName(displayName);
			attr.setDataType(attributeDataType);
			attr.setRequred(required);

			return attr;
		}
	}

	return null;
}
 

private GluuAttribute createAttributeFromConfig(ImportPerson importPerson) {
	String attributeName = importPerson.getLdapName();
	String displayName = importPerson.getDisplayName();
	String dataType = importPerson.getDataType();
	boolean required = importPerson.getRequired();

	if (StringHelper.isNotEmpty(attributeName) && StringHelper.isNotEmpty(displayName) && StringHelper.isNotEmpty(dataType)) {
		AttributeDataType attributeDataType = AttributeDataType.getByValue(dataType);
		if (attributeDataType != null) {
			GluuAttribute attr = new GluuAttribute();
			attr.setName(attributeName);
			attr.setDisplayName(displayName);
			attr.setDataType(attributeDataType);
			attr.setRequred(required);

			return attr;
		}
	}

	return null;
}
 

public void initTimer() {
	log.info("Initializing Cache Refresh Timer");
	this.isActive = new AtomicBoolean(false);

	// Clean up previous Inum cache
	CacheRefreshConfiguration cacheRefreshConfiguration = configurationFactory.getCacheRefreshConfiguration();
	if (cacheRefreshConfiguration != null) {
		String snapshotFolder = cacheRefreshConfiguration.getSnapshotFolder();
		if (StringHelper.isNotEmpty(snapshotFolder)) {
			String inumCachePath = getInumCachePath(cacheRefreshConfiguration);
			objectSerializationService.cleanup(inumCachePath);
		}
	}

	// Schedule to start cache refresh every 1 minute
	timerEvent.fire(new TimerEvent(new TimerSchedule(DEFAULT_INTERVAL, DEFAULT_INTERVAL), new CacheRefreshEvent(),
			Scheduled.Literal.INSTANCE));

	this.lastFinishedTime = System.currentTimeMillis();
}
 

public boolean verifyGoogleRecaptchaFromServletContext(String secretKey) {
	HttpServletRequest httpServletRequest = (HttpServletRequest) externalContext.getRequest();
	String gRecaptchaResponse = httpServletRequest.getParameter("g-recaptcha-response");
	if (StringHelper.isNotEmpty(gRecaptchaResponse)) {
		return verifyGoogleRecaptcha(gRecaptchaResponse, secretKey);
	}

	return false;
}
 

private void updateLoginURIs() {
    if (this.loginUris == null || this.loginUris.size() == 0) {
        this.client.setOxAuthRedirectURIs(null);
        return;
    }
    List<String> tmpUris = new ArrayList<String>();
    for (String uri : this.loginUris) {
        tmpUris.add(StringHelper.trimAll(uri));
    }
    this.client.setOxAuthRedirectURIs(tmpUris);
}
 

protected CommonProfile retrieveUserProfileFromUserInfoResponse(final WebContext context, final Jwt jwt, final UserInfoResponse userInfoResponse) {
	final CommonProfile profile = new CommonProfile();

	String nonceResponse = (String) jwt.getClaims().getClaim(JwtClaimName.NONCE);
       final String nonceSession = (String) context.getSessionAttribute(getName() + SESSION_NONCE_PARAMETER);
       logger.debug("Session nonce: '{}'", nonceSession);
       if (!StringHelper.equals(nonceSession, nonceResponse)) {
           logger.error("User info response:  nonce is not matching.");
           throw new CommunicationException("Nonce is not match" + nonceResponse + " : " + nonceSession);
       }

	String id = getFirstClaim(userInfoResponse, JwtClaimName.USER_NAME);
	if (StringHelper.isEmpty(id)) {
		id = getFirstClaim(userInfoResponse, JwtClaimName.SUBJECT_IDENTIFIER);
	}
	profile.setId(id);

	List<ClaimToAttributeMapping> claimMappings = this.appConfiguration.getOpenIdClaimMapping();
	if ((claimMappings == null) || (claimMappings.size() == 0)) {
		logger.info("Using default claims to attributes mapping");
		profile.setUserName(id);
		profile.setEmail(getFirstClaim(userInfoResponse, JwtClaimName.EMAIL));

		profile.setDisplayName(getFirstClaim(userInfoResponse, JwtClaimName.NAME));
		profile.setFirstName(getFirstClaim(userInfoResponse, JwtClaimName.GIVEN_NAME));
		profile.setFamilyName(getFirstClaim(userInfoResponse, JwtClaimName.FAMILY_NAME));
		profile.setZone(getFirstClaim(userInfoResponse, JwtClaimName.ZONEINFO));
		profile.setLocale(getFirstClaim(userInfoResponse, JwtClaimName.LOCALE));
	} else {
		for (ClaimToAttributeMapping mapping : claimMappings) {
			String attribute = mapping.getAttribute();
			String value = getFirstClaim(userInfoResponse, mapping.getClaim());
			profile.addAttribute(attribute, value);
			logger.trace("Adding attribute '{}' with value '{}'", attribute, value);
		}
	}

	return profile;
}
 

public String[] getAttributes(String attributeName) {
	if (StringHelper.isEmpty(attributeName)) {
		return null;
	}

	String[] values = null;
	for (GluuCustomAttribute attribute : getCustomAttributes()) {
		if (StringHelper.equalsIgnoreCase(attribute.getName(), attributeName)) {
			values = attribute.getValues();
			break;
		}
	}
	return values;
}
 

public static String escapeString(String value) {
	if (StringHelper.isEmpty(value)) {
		return "";
	}

	return escapeComma(StringEscapeUtils.escapeJava(value));
}
 

private void updateClientLogoutURIs() {
    if (this.clientlogoutUris == null || this.clientlogoutUris.size() == 0) {
        this.client.setLogoutUri(null);
        return;
    }
    List<String> tmpUris = new ArrayList<String>();
    for (String uri : this.clientlogoutUris) {
        tmpUris.add(StringHelper.trimAll(uri));
    }
    this.client.setLogoutUri(tmpUris);
}
 

public String getDnForOneStepU2fDevice(String deviceRegistrationId) {
	final String u2fBaseDn = staticConfiguration.getBaseDn().getU2fBase(); // ou=registered_devices,ou=u2f,o=gluu
	if (StringHelper.isEmpty(deviceRegistrationId)) {
		return String.format("ou=registered_devices,%s", u2fBaseDn);
	}

	return String.format("oxid=%s,ou=registered_devices,%s", deviceRegistrationId, u2fBaseDn);
}
 

public String getUmaConfigurationEndpoint() {
	String umaIssuer = appConfiguration.getUmaIssuer();
	if (StringHelper.isEmpty(umaIssuer)) {
		log.trace("oxAuth UMA issuer isn't specified");
		return null;
	}

	String umaConfigurationEndpoint = umaIssuer;
	if (!umaConfigurationEndpoint.endsWith("uma2-configuration")) {
		umaConfigurationEndpoint += "/.well-known/uma2-configuration";
	}

	return umaConfigurationEndpoint;
}