com.sap.cloud.security.token

Class XsuaaToken

java.lang.Object

com.sap.cloud.security.token.AbstractToken

com.sap.cloud.security.token.XsuaaToken

All Implemented Interfaces:

AccessToken, Token

public class XsuaaToken
extends AbstractToken
implements AccessToken

Decodes and parses encoded access token (JWT) for the Xsuaa identity service and provides access to token header parameters and claims.

Field Summary

Fields inherited from class com.sap.cloud.security.token.AbstractToken

tokenBody, tokenHeader

Constructor Summary

Constructors

Constructor and Description
XsuaaToken(DecodedJwt decodedJwt) Creates an instance.
XsuaaToken(String accessToken) Creates an instance.

Method Summary

Modifier and Type	Method and Description
GrantType	getGrantType()
Principal	getPrincipal()
Set<String>	getScopes()
Service	getService()
String	getSubaccountId() Returns subaccount identifier which is in most cases same like the identity zone.
String	getSubdomain() Returns the value of the subdomain (zdn) from the external attribute ext_attr (ext_attr) claim.
String	getZoneId()
boolean	hasLocalScope(String scope) Check if a local scope is available in the authentication token.
boolean	hasScope(String scope)
XsuaaToken	withScopeConverter(ScopeConverter converter) Configures a scope converter, e.g.

Methods inherited from class com.sap.cloud.security.token.AbstractToken

createPrincipalByName, equals, getAudiences, getClaimAsJsonObject, getClaimAsString, getClaimAsStringList, getExpiration, getHeaderParameterAsString, getNotBefore, getTokenValue, hasClaim, hashCode, hasHeaderParameter, isExpired, toString

Methods inherited from class java.lang.Object

clone, finalize, getClass, notify, notifyAll, wait, wait, wait

Methods inherited from interface com.sap.cloud.security.token.AccessToken

getAttributeFromClaimAsString, getAttributeFromClaimAsStringList

Methods inherited from interface com.sap.cloud.security.token.Token

getAudiences, getClaimAsJsonObject, getClaimAsString, getClaimAsStringList, getExpiration, getHeaderParameterAsString, getNotBefore, getTokenValue, hasClaim, hasHeaderParameter, isExpired

Constructor Detail

XsuaaToken

public XsuaaToken(@Nonnull
                  DecodedJwt decodedJwt)

Creates an instance.

Parameters:

decodedJwt - the decoded jwt

XsuaaToken

public XsuaaToken(@Nonnull
                  String accessToken)

Creates an instance.

Parameters:

accessToken - the encoded access token, e.g. from the Authorization header.

Method Detail

withScopeConverter

public XsuaaToken withScopeConverter(@Nullable
                                     ScopeConverter converter)

Configures a scope converter, e.g. required for the hasLocalScope(String)

Parameters:

converter - the scope converter, e.g. XsuaaScopeConverter

Returns:

the token itself

getScopes

public Set<String> getScopes()

Specified by:

getScopes in interface AccessToken

getPrincipal

public Principal getPrincipal()

Specified by:

getPrincipal in interface Token

getService

public Service getService()

Specified by:

getService in interface Token

hasScope

public boolean hasScope(String scope)

Specified by:

hasScope in interface AccessToken

hasLocalScope

public boolean hasLocalScope(@Nonnull
                             String scope)

Check if a local scope is available in the authentication token.
Requires a ScopeConverter to be configured with withScopeConverter(ScopeConverter).

Specified by:

hasLocalScope in interface AccessToken

Parameters:

scope - name of local scope (without the appId)

Returns:

true if local scope is available

getGrantType

public GrantType getGrantType()

Specified by:

getGrantType in interface AccessToken

getSubdomain

@Nullable
public String getSubdomain()

Returns the value of the subdomain (zdn) from the external attribute ext_attr (ext_attr) claim. If the external attribute or the subdomain is missing, it returns null.

Returns:

the subdomain or null

getSubaccountId

@Nullable
public String getSubaccountId()

Returns subaccount identifier which is in most cases same like the identity zone. DO only use this for metering purposes. DO NOT longer use this method to get the unique tenant id! For that use getZoneId().

Returns:

subaccount identifier or null

getZoneId

public String getZoneId()

Specified by:

getZoneId in interface Token

Overrides:

getZoneId in class AbstractToken