Catch oauth2 exceptions. Fixes #339 and #338

Author: phavekes

oidc/src/main/java/oidc/endpoints/UserInfoEndpoint.java

@@ -11,7 +11,10 @@
 import oidc.model.AccessToken;
 import oidc.model.User;
 import oidc.repository.AccessTokenRepository;
+import oidc.saml.AuthnRequestContextConsumer;
 import oidc.secure.TokenGenerator;
+import org.apache.commons.logging.Log;
+import org.apache.commons.logging.LogFactory;
 import org.springframework.http.HttpStatus;
 import org.springframework.http.MediaType;
 import org.springframework.http.ResponseEntity;
@@ -30,19 +33,45 @@ public class UserInfoEndpoint {
     private final AccessTokenRepository accessTokenRepository;
     private final TokenGenerator tokenGenerator;
 
+    private static final Log LOG = LogFactory.getLog(AuthnRequestContextConsumer.class);
+
     public UserInfoEndpoint(AccessTokenRepository accessTokenRepository, TokenGenerator tokenGenerator) {
         this.accessTokenRepository = accessTokenRepository;
         this.tokenGenerator = tokenGenerator;
     }
 
     @GetMapping("oidc/userinfo")
-    public ResponseEntity<Map<String, Object>> getUserInfo(HttpServletRequest request) throws IOException, ParseException, java.text.ParseException {
-        return userInfo(request);
+    public ResponseEntity<Map<String, Object>> getUserInfo(HttpServletRequest request)
+        throws IOException, java.text.ParseException {
+        try {
+            return userInfo(request);
+        } catch (com.nimbusds.oauth2.sdk.ParseException e) {
+            return handleMissingToken(e, request);
+        }
     }
 
     @PostMapping(value = {"oidc/userinfo"}, consumes = {MediaType.APPLICATION_FORM_URLENCODED_VALUE})
-    public ResponseEntity<Map<String, Object>> postUserInfo(HttpServletRequest request) throws ParseException, IOException, java.text.ParseException {
-        return userInfo(request);
+    public ResponseEntity<Map<String, Object>> postUserInfo(HttpServletRequest request)
+        throws IOException, java.text.ParseException {
+        try {
+            return userInfo(request);
+        } catch (com.nimbusds.oauth2.sdk.ParseException e) {
+            return handleMissingToken(e, request);
+        }
+    }
+
+    private ResponseEntity<Map<String, Object>> handleMissingToken(com.nimbusds.oauth2.sdk.ParseException e, HttpServletRequest request) {
+        LOG.warn(String.format("UserInfo request failed: %s | Path: %s | IP: %s",
+            e.getMessage(), request.getRequestURI(), request.getRemoteAddr()));
+
+        Map<String, Object> body = new HashMap<>();
+        body.put("error", "invalid_request");
+        body.put("error_description", e.getMessage());
+
+        return ResponseEntity
+            .status(HttpStatus.UNAUTHORIZED)
+            .header("WWW-Authenticate", "Bearer error=\"invalid_request\", error_description=\"Missing access token\"")
+            .body(body);
     }
 
     private ResponseEntity<Map<String, Object>> userInfo(HttpServletRequest request) throws ParseException, IOException, java.text.ParseException {