full/src/main/java/de/ids_mannheim/korap/web/controller/OAuth2Controller.java - KorAP/Kustvakt - Gitiles

 package de.ids_mannheim.korap.web.controller;

 import java.time.ZonedDateTime;
 import java.util.List;

 import javax.servlet.ServletContext;
 import javax.servlet.http.HttpServletRequest;
 import javax.ws.rs.Consumes;
 import javax.ws.rs.FormParam;
 import javax.ws.rs.POST;
 import javax.ws.rs.Path;
 import javax.ws.rs.Produces;
 import javax.ws.rs.core.Context;
 import javax.ws.rs.core.MediaType;
 import javax.ws.rs.core.MultivaluedMap;
 import javax.ws.rs.core.Response;
 import javax.ws.rs.core.SecurityContext;

 import org.apache.oltu.oauth2.as.request.AbstractOAuthTokenRequest;
 import org.apache.oltu.oauth2.as.request.OAuthTokenRequest;
 import org.apache.oltu.oauth2.as.request.OAuthUnauthenticatedTokenRequest;
 import org.apache.oltu.oauth2.common.exception.OAuthProblemException;
 import org.apache.oltu.oauth2.common.exception.OAuthSystemException;
 import org.apache.oltu.oauth2.common.message.OAuthResponse;
 import org.apache.oltu.oauth2.common.message.types.GrantType;
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.stereotype.Controller;

 import com.sun.jersey.spi.container.ResourceFilters;

 import de.ids_mannheim.korap.constant.OAuth2Scope;
 import de.ids_mannheim.korap.exceptions.KustvaktException;
 import de.ids_mannheim.korap.oauth2.dto.OAuth2RefreshTokenDto;
 import de.ids_mannheim.korap.oauth2.oltu.OAuth2AuthorizationRequest;
 import de.ids_mannheim.korap.oauth2.oltu.OAuth2RevokeAllTokenSuperRequest;
 import de.ids_mannheim.korap.oauth2.oltu.OAuth2RevokeTokenRequest;
 import de.ids_mannheim.korap.oauth2.oltu.OAuth2RevokeTokenSuperRequest;
 import de.ids_mannheim.korap.oauth2.oltu.service.OltuAuthorizationService;
 import de.ids_mannheim.korap.oauth2.oltu.service.OltuTokenService;
 import de.ids_mannheim.korap.oauth2.service.OAuth2ScopeService;
 import de.ids_mannheim.korap.security.context.TokenContext;
 import de.ids_mannheim.korap.web.OAuth2ResponseHandler;
 import de.ids_mannheim.korap.web.filter.APIVersionFilter;
 import de.ids_mannheim.korap.web.filter.AuthenticationFilter;
 import de.ids_mannheim.korap.web.filter.BlockingFilter;
 import de.ids_mannheim.korap.web.utils.FormRequestWrapper;

 /**
  * OAuth2Controller describes OAuth2 web API for authorization
  * for both internal (e.g Kalamar) and external (third party) clients.
  *
  * Possible authorization scopes are listed in {@link OAuth2Scope} For
  * more information about OAuth2 authorization mechanisms, see RFC
  * 6749.
  *
  * @author margaretha
  *
  */
 @Controller
 @Path("{version}/oauth2")
 @ResourceFilters({ APIVersionFilter.class })
 public class OAuth2Controller {

     @Autowired
     private OAuth2ResponseHandler responseHandler;
     @Autowired
     private OltuTokenService tokenService;
     @Autowired
     private OltuAuthorizationService authorizationService;
     @Autowired
     private OAuth2ScopeService scopeService;

     /**
      * Requests an authorization code.
      *
      * Kustvakt supports authorization only with Kalamar as the
      * authorization web-frontend or user interface. Thus
      * authorization code request requires user authentication
      * using authorization header.
      *
      * <br /><br />
      * RFC 6749:
      * If the client omits the scope parameter when requesting
      * authorization, the authorization server MUST either process the
      * request using a pre-defined default value or fail the request
      * indicating an invalid scope.
      *
      * @param request
      *            HttpServletRequest
      * @param form
      *            form parameters
      * @return a redirect URL
      */
     @POST
     @Path("authorize")
     @ResourceFilters({ AuthenticationFilter.class, BlockingFilter.class })
     @Consumes(MediaType.APPLICATION_FORM_URLENCODED)
     public Response requestAuthorizationCode (
             @Context HttpServletRequest request,
             @Context SecurityContext context, @FormParam("state") String state,
             MultivaluedMap<String, String> form) {

         TokenContext tokenContext = (TokenContext) context.getUserPrincipal();
         String username = tokenContext.getUsername();
         ZonedDateTime authTime = tokenContext.getAuthenticationTime();

         try {
             scopeService.verifyScope(tokenContext, OAuth2Scope.AUTHORIZE);

             HttpServletRequest requestWithForm =
                     new FormRequestWrapper(request, form);
             OAuth2AuthorizationRequest authzRequest =
                     new OAuth2AuthorizationRequest(requestWithForm);
             String uri = authorizationService.requestAuthorizationCode(
                     requestWithForm, authzRequest, username, authTime);
             return responseHandler.sendRedirect(uri);
         }
         catch (OAuthSystemException e) {
             throw responseHandler.throwit(e, state);
         }
         catch (OAuthProblemException e) {
             throw responseHandler.throwit(e, state);
         }
         catch (KustvaktException e) {
             throw responseHandler.throwit(e, state);
         }
     }

     /**
      * Grants a client an access token, namely a string used in
      * authenticated requests representing user authorization for
      * the client to access user resources. An additional refresh
      * token strictly associated to the access token is also granted.
      *
      * <br /><br />
      *
      * Clients may request refresh access token using this endpoint.
      * This request will grants a new access token. The refresh token
      * is not changed and can be used until it expires.
      *
      * <br /><br />
      *
      * Client credentials for authentication can be provided either as
      * an authorization header with Basic authentication scheme or as
      * form parameters in the request body.
      *
      * <br /><br />
      *
      * OAuth2 specification describes various ways of requesting an
      * access token. Kustvakt supports:
      * <ul>
      * <li> Authorization code grant: obtains authorization from a
      * third party application. Required parameters: grant_type,
      * code, client_id, redirect_uri (if specified in the
      * authorization request), client_secret (if the client is
      * confidential or issued a secret).
      * </li>
      * <li> Resource owner password grant: strictly for clients that
      * are parts of KorAP. Clients use user credentials, e.g. Kalamar
      * (front-end) with login form. Required parameters: grant_type,
      * username, password, client_id, client_secret (if the client is
      * confidential or issued a secret). Optional parameters: scope.
      * </li>
      * <li> Client credentials grant: strictly for clients that are
      * parts of KorAP. Clients access their own resources, not on
      * behalf of a user. Required parameters: grant_type, client_id,
      * client_secret. Optional parameters: scope.
      * </li>
      * </ul>
      *
      * RFC 6749: The value of the scope parameter is expressed as a
      * list of space-delimited, case-sensitive strings defined by the
      * authorization server.
      *
      * @param request
      *            the request
      * @param form
      *            form parameters in a map
      * @return a JSON object containing an access token, a refresh
      *         token, a token type and the token expiration in seconds
      *         if successful, an error code and an error description
      *         otherwise.
      */
     @POST
     @Path("token")
     @Consumes(MediaType.APPLICATION_FORM_URLENCODED)
     @Produces(MediaType.APPLICATION_JSON + ";charset=utf-8")
     public Response requestAccessToken (@Context HttpServletRequest request,
             @FormParam("grant_type") String grantType,
             MultivaluedMap<String, String> form) {

         try {
             boolean grantTypeExist = grantType != null && !grantType.isEmpty();
             AbstractOAuthTokenRequest oAuthRequest = null;
             if (grantTypeExist && grantType
                     .equals(GrantType.CLIENT_CREDENTIALS.toString())) {
                 oAuthRequest = new OAuthTokenRequest(
                         new FormRequestWrapper(request, form));
             }
             else {
                 oAuthRequest = new OAuthUnauthenticatedTokenRequest(
                         new FormRequestWrapper(request, form));
             }

             OAuthResponse oAuthResponse =
                     tokenService.requestAccessToken(oAuthRequest);

             return responseHandler.createResponse(oAuthResponse);
         }
         catch (KustvaktException e) {
             throw responseHandler.throwit(e);
         }
         catch (OAuthProblemException e) {
             throw responseHandler.throwit(e);
         }
         catch (OAuthSystemException e) {
             throw responseHandler.throwit(e);
         }
     }

     /**
      * Revokes either an access token or a refresh token. Revoking a
      * refresh token also revokes all access token associated with the
      * refresh token.
      *
      * RFC 7009
      * Client authentication for confidential client
      *
      * @param request
      * @param form
      *            containing
      *            client_id,
      *            client_secret (required for confidential clients),
      *            token,
      *            token_type (optional)
      * @return 200 if token invalidation is successful or the given
      *         token is invalid
      */
     @POST
     @Path("revoke")
     @Consumes(MediaType.APPLICATION_FORM_URLENCODED)
     public Response revokeAccessToken (@Context HttpServletRequest request,
             MultivaluedMap<String, String> form) {

         try {
             OAuth2RevokeTokenRequest revokeTokenRequest =
                     new OAuth2RevokeTokenRequest(
                             new FormRequestWrapper(request, form));
             tokenService.revokeToken(revokeTokenRequest);
             return Response.ok("SUCCESS").build();
         }
         catch (OAuthProblemException e) {
             throw responseHandler.throwit(e);
         }
         catch (OAuthSystemException e) {
             throw responseHandler.throwit(e);
         }
         catch (KustvaktException e) {
             throw responseHandler.throwit(e);
         }
     }


     @POST
     @Path("revoke/super")
     @ResourceFilters({ AuthenticationFilter.class, BlockingFilter.class })
     @Consumes(MediaType.APPLICATION_FORM_URLENCODED)
     public Response revokeTokenViaSuperClient (@Context SecurityContext context,
             @Context HttpServletRequest request,
             MultivaluedMap<String, String> form) {

         TokenContext tokenContext = (TokenContext) context.getUserPrincipal();
         String username = tokenContext.getUsername();

         try {
             OAuth2RevokeTokenSuperRequest revokeTokenRequest =
                     new OAuth2RevokeTokenSuperRequest(
                             new FormRequestWrapper(request, form));
             tokenService.revokeTokensViaSuperClient(username,
                     revokeTokenRequest);
             return Response.ok("SUCCESS").build();
         }
         catch (OAuthSystemException e) {
             throw responseHandler.throwit(e);
         }
         catch (OAuthProblemException e) {
             throw responseHandler.throwit(e);
         }
         catch (KustvaktException e) {
             throw responseHandler.throwit(e);
         }
     }

     /**
      * Revokes all tokens of a client for the authenticated user from
      * a super client. This service is not part of the OAUTH2
      * specification. It requires user authentication via
      * authorization header, and super client
      * via URL-encoded form parameters.
      *
      * @param request
      * @param form
      *            containing client_id, super_client_id,
      *            super_client_secret
      * @return 200 if token invalidation is successful or the given
      *         token is invalid
      */
     @POST
     @Path("revoke/super/all")
     @ResourceFilters({ AuthenticationFilter.class, BlockingFilter.class })
     @Consumes(MediaType.APPLICATION_FORM_URLENCODED)
     public Response revokeAllClientTokensViaSuperClient (
             @Context SecurityContext context,
             @Context HttpServletRequest request,
             MultivaluedMap<String, String> form) {

         TokenContext tokenContext = (TokenContext) context.getUserPrincipal();
         String username = tokenContext.getUsername();

         try {
             OAuth2RevokeAllTokenSuperRequest revokeTokenRequest =
                     new OAuth2RevokeAllTokenSuperRequest(
                             new FormRequestWrapper(request, form));
             tokenService.revokeAllClientTokensViaSuperClient(username,
                     revokeTokenRequest);
             return Response.ok("SUCCESS").build();
         }
         catch (OAuthSystemException e) {
             throw responseHandler.throwit(e);
         }
         catch (OAuthProblemException e) {
             throw responseHandler.throwit(e);
         }
         catch (KustvaktException e) {
             throw responseHandler.throwit(e);
         }
     }

     @POST
     @Path("token/list")
     @ResourceFilters({ AuthenticationFilter.class, BlockingFilter.class })
     @Consumes(MediaType.APPLICATION_FORM_URLENCODED)
     @Produces(MediaType.APPLICATION_JSON + ";charset=utf-8")
     public List<OAuth2RefreshTokenDto> listUserRefreshToken (
             @Context SecurityContext context,
             @FormParam("client_id") String clientId,
             @FormParam("client_secret") String clientSecret) {

         TokenContext tokenContext = (TokenContext) context.getUserPrincipal();
         String username = tokenContext.getUsername();

         try {
             return tokenService.listUserRefreshToken(username, clientId,
                     clientSecret);
         }
         catch (KustvaktException e) {
             throw responseHandler.throwit(e);
         }

     }

     @POST
     @Consumes(MediaType.APPLICATION_FORM_URLENCODED)
     @Path("token/clear")
     public Response clearAccessTokenCache (
             @FormParam("token") String adminToken,
             @FormParam("access_token") String accessToken,
             @Context ServletContext context) {
         try {
             String response = tokenService.clearAccessTokenCache(adminToken, accessToken,
                     context);
             return Response.ok(response).build();
         }
         catch (KustvaktException e) {
             throw responseHandler.throwit(e);
         }
     }
 }
	package de.ids_mannheim.korap.web.controller;

	import java.time.ZonedDateTime;
	import java.util.List;

	import javax.servlet.ServletContext;
	import javax.servlet.http.HttpServletRequest;
	import javax.ws.rs.Consumes;
	import javax.ws.rs.FormParam;
	import javax.ws.rs.POST;
	import javax.ws.rs.Path;
	import javax.ws.rs.Produces;
	import javax.ws.rs.core.Context;
	import javax.ws.rs.core.MediaType;
	import javax.ws.rs.core.MultivaluedMap;
	import javax.ws.rs.core.Response;
	import javax.ws.rs.core.SecurityContext;

	import org.apache.oltu.oauth2.as.request.AbstractOAuthTokenRequest;
	import org.apache.oltu.oauth2.as.request.OAuthTokenRequest;
	import org.apache.oltu.oauth2.as.request.OAuthUnauthenticatedTokenRequest;
	import org.apache.oltu.oauth2.common.exception.OAuthProblemException;
	import org.apache.oltu.oauth2.common.exception.OAuthSystemException;
	import org.apache.oltu.oauth2.common.message.OAuthResponse;
	import org.apache.oltu.oauth2.common.message.types.GrantType;
	import org.springframework.beans.factory.annotation.Autowired;
	import org.springframework.stereotype.Controller;

	import com.sun.jersey.spi.container.ResourceFilters;

	import de.ids_mannheim.korap.constant.OAuth2Scope;
	import de.ids_mannheim.korap.exceptions.KustvaktException;
	import de.ids_mannheim.korap.oauth2.dto.OAuth2RefreshTokenDto;
	import de.ids_mannheim.korap.oauth2.oltu.OAuth2AuthorizationRequest;
	import de.ids_mannheim.korap.oauth2.oltu.OAuth2RevokeAllTokenSuperRequest;
	import de.ids_mannheim.korap.oauth2.oltu.OAuth2RevokeTokenRequest;
	import de.ids_mannheim.korap.oauth2.oltu.OAuth2RevokeTokenSuperRequest;
	import de.ids_mannheim.korap.oauth2.oltu.service.OltuAuthorizationService;
	import de.ids_mannheim.korap.oauth2.oltu.service.OltuTokenService;
	import de.ids_mannheim.korap.oauth2.service.OAuth2ScopeService;
	import de.ids_mannheim.korap.security.context.TokenContext;
	import de.ids_mannheim.korap.web.OAuth2ResponseHandler;
	import de.ids_mannheim.korap.web.filter.APIVersionFilter;
	import de.ids_mannheim.korap.web.filter.AuthenticationFilter;
	import de.ids_mannheim.korap.web.filter.BlockingFilter;
	import de.ids_mannheim.korap.web.utils.FormRequestWrapper;

	/**
	* OAuth2Controller describes OAuth2 web API for authorization
	* for both internal (e.g Kalamar) and external (third party) clients.
	*
	* Possible authorization scopes are listed in {@link OAuth2Scope} For
	* more information about OAuth2 authorization mechanisms, see RFC
	* 6749.
	*
	* @author margaretha
	*
	*/
	@Controller
	@Path("{version}/oauth2")
	@ResourceFilters({ APIVersionFilter.class })
	public class OAuth2Controller {

	@Autowired
	private OAuth2ResponseHandler responseHandler;
	@Autowired
	private OltuTokenService tokenService;
	@Autowired
	private OltuAuthorizationService authorizationService;
	@Autowired
	private OAuth2ScopeService scopeService;

	/**
	* Requests an authorization code.
	*
	* Kustvakt supports authorization only with Kalamar as the
	* authorization web-frontend or user interface. Thus
	* authorization code request requires user authentication
	* using authorization header.
	*
	* <br /><br />
	* RFC 6749:
	* If the client omits the scope parameter when requesting
	* authorization, the authorization server MUST either process the
	* request using a pre-defined default value or fail the request
	* indicating an invalid scope.
	*
	* @param request
	* HttpServletRequest
	* @param form
	* form parameters
	* @return a redirect URL
	*/
	@POST
	@Path("authorize")
	@ResourceFilters({ AuthenticationFilter.class, BlockingFilter.class })
	@Consumes(MediaType.APPLICATION_FORM_URLENCODED)
	public Response requestAuthorizationCode (
	@Context HttpServletRequest request,
	@Context SecurityContext context, @FormParam("state") String state,
	MultivaluedMap<String, String> form) {

	TokenContext tokenContext = (TokenContext) context.getUserPrincipal();
	String username = tokenContext.getUsername();
	ZonedDateTime authTime = tokenContext.getAuthenticationTime();

	try {
	scopeService.verifyScope(tokenContext, OAuth2Scope.AUTHORIZE);

	HttpServletRequest requestWithForm =
	new FormRequestWrapper(request, form);
	OAuth2AuthorizationRequest authzRequest =
	new OAuth2AuthorizationRequest(requestWithForm);
	String uri = authorizationService.requestAuthorizationCode(
	requestWithForm, authzRequest, username, authTime);
	return responseHandler.sendRedirect(uri);
	}
	catch (OAuthSystemException e) {
	throw responseHandler.throwit(e, state);
	}
	catch (OAuthProblemException e) {
	throw responseHandler.throwit(e, state);
	}
	catch (KustvaktException e) {
	throw responseHandler.throwit(e, state);
	}
	}

	/**
	* Grants a client an access token, namely a string used in
	* authenticated requests representing user authorization for
	* the client to access user resources. An additional refresh
	* token strictly associated to the access token is also granted.
	*
	* <br /><br />
	*
	* Clients may request refresh access token using this endpoint.
	* This request will grants a new access token. The refresh token
	* is not changed and can be used until it expires.
	*
	* <br /><br />
	*
	* Client credentials for authentication can be provided either as
	* an authorization header with Basic authentication scheme or as
	* form parameters in the request body.
	*
	* <br /><br />
	*
	* OAuth2 specification describes various ways of requesting an
	* access token. Kustvakt supports:
	* <ul>
	* <li> Authorization code grant: obtains authorization from a
	* third party application. Required parameters: grant_type,
	* code, client_id, redirect_uri (if specified in the
	* authorization request), client_secret (if the client is
	* confidential or issued a secret).
	* </li>
	* <li> Resource owner password grant: strictly for clients that
	* are parts of KorAP. Clients use user credentials, e.g. Kalamar
	* (front-end) with login form. Required parameters: grant_type,
	* username, password, client_id, client_secret (if the client is
	* confidential or issued a secret). Optional parameters: scope.
	* </li>
	* <li> Client credentials grant: strictly for clients that are
	* parts of KorAP. Clients access their own resources, not on
	* behalf of a user. Required parameters: grant_type, client_id,
	* client_secret. Optional parameters: scope.
	* </li>
	* </ul>
	*
	* RFC 6749: The value of the scope parameter is expressed as a
	* list of space-delimited, case-sensitive strings defined by the
	* authorization server.
	*
	* @param request
	* the request
	* @param form
	* form parameters in a map
	* @return a JSON object containing an access token, a refresh
	* token, a token type and the token expiration in seconds
	* if successful, an error code and an error description
	* otherwise.
	*/
	@POST
	@Path("token")
	@Consumes(MediaType.APPLICATION_FORM_URLENCODED)
	@Produces(MediaType.APPLICATION_JSON + ";charset=utf-8")
	public Response requestAccessToken (@Context HttpServletRequest request,
	@FormParam("grant_type") String grantType,
	MultivaluedMap<String, String> form) {

	try {
	boolean grantTypeExist = grantType != null && !grantType.isEmpty();
	AbstractOAuthTokenRequest oAuthRequest = null;
	if (grantTypeExist && grantType
	.equals(GrantType.CLIENT_CREDENTIALS.toString())) {
	oAuthRequest = new OAuthTokenRequest(
	new FormRequestWrapper(request, form));
	}
	else {
	oAuthRequest = new OAuthUnauthenticatedTokenRequest(
	new FormRequestWrapper(request, form));
	}

	OAuthResponse oAuthResponse =
	tokenService.requestAccessToken(oAuthRequest);

	return responseHandler.createResponse(oAuthResponse);
	}
	catch (KustvaktException e) {
	throw responseHandler.throwit(e);
	}
	catch (OAuthProblemException e) {
	throw responseHandler.throwit(e);
	}
	catch (OAuthSystemException e) {
	throw responseHandler.throwit(e);
	}
	}

	/**
	* Revokes either an access token or a refresh token. Revoking a
	* refresh token also revokes all access token associated with the
	* refresh token.
	*
	* RFC 7009
	* Client authentication for confidential client
	*
	* @param request
	* @param form
	* containing
	* client_id,
	* client_secret (required for confidential clients),
	* token,
	* token_type (optional)
	* @return 200 if token invalidation is successful or the given
	* token is invalid
	*/
	@POST
	@Path("revoke")
	@Consumes(MediaType.APPLICATION_FORM_URLENCODED)
	public Response revokeAccessToken (@Context HttpServletRequest request,
	MultivaluedMap<String, String> form) {

	try {
	OAuth2RevokeTokenRequest revokeTokenRequest =
	new OAuth2RevokeTokenRequest(
	new FormRequestWrapper(request, form));
	tokenService.revokeToken(revokeTokenRequest);
	return Response.ok("SUCCESS").build();
	}
	catch (OAuthProblemException e) {
	throw responseHandler.throwit(e);
	}
	catch (OAuthSystemException e) {
	throw responseHandler.throwit(e);
	}
	catch (KustvaktException e) {
	throw responseHandler.throwit(e);
	}
	}


	@POST
	@Path("revoke/super")
	@ResourceFilters({ AuthenticationFilter.class, BlockingFilter.class })
	@Consumes(MediaType.APPLICATION_FORM_URLENCODED)
	public Response revokeTokenViaSuperClient (@Context SecurityContext context,
	@Context HttpServletRequest request,
	MultivaluedMap<String, String> form) {

	TokenContext tokenContext = (TokenContext) context.getUserPrincipal();
	String username = tokenContext.getUsername();

	try {
	OAuth2RevokeTokenSuperRequest revokeTokenRequest =
	new OAuth2RevokeTokenSuperRequest(
	new FormRequestWrapper(request, form));
	tokenService.revokeTokensViaSuperClient(username,
	revokeTokenRequest);
	return Response.ok("SUCCESS").build();
	}
	catch (OAuthSystemException e) {
	throw responseHandler.throwit(e);
	}
	catch (OAuthProblemException e) {
	throw responseHandler.throwit(e);
	}
	catch (KustvaktException e) {
	throw responseHandler.throwit(e);
	}
	}

	/**
	* Revokes all tokens of a client for the authenticated user from
	* a super client. This service is not part of the OAUTH2
	* specification. It requires user authentication via
	* authorization header, and super client
	* via URL-encoded form parameters.
	*
	* @param request
	* @param form
	* containing client_id, super_client_id,
	* super_client_secret
	* @return 200 if token invalidation is successful or the given
	* token is invalid
	*/
	@POST
	@Path("revoke/super/all")
	@ResourceFilters({ AuthenticationFilter.class, BlockingFilter.class })
	@Consumes(MediaType.APPLICATION_FORM_URLENCODED)
	public Response revokeAllClientTokensViaSuperClient (
	@Context SecurityContext context,
	@Context HttpServletRequest request,
	MultivaluedMap<String, String> form) {

	TokenContext tokenContext = (TokenContext) context.getUserPrincipal();
	String username = tokenContext.getUsername();

	try {
	OAuth2RevokeAllTokenSuperRequest revokeTokenRequest =
	new OAuth2RevokeAllTokenSuperRequest(
	new FormRequestWrapper(request, form));
	tokenService.revokeAllClientTokensViaSuperClient(username,
	revokeTokenRequest);
	return Response.ok("SUCCESS").build();
	}
	catch (OAuthSystemException e) {
	throw responseHandler.throwit(e);
	}
	catch (OAuthProblemException e) {
	throw responseHandler.throwit(e);
	}
	catch (KustvaktException e) {
	throw responseHandler.throwit(e);
	}
	}

	@POST
	@Path("token/list")
	@ResourceFilters({ AuthenticationFilter.class, BlockingFilter.class })
	@Consumes(MediaType.APPLICATION_FORM_URLENCODED)
	@Produces(MediaType.APPLICATION_JSON + ";charset=utf-8")
	public List<OAuth2RefreshTokenDto> listUserRefreshToken (
	@Context SecurityContext context,
	@FormParam("client_id") String clientId,
	@FormParam("client_secret") String clientSecret) {

	TokenContext tokenContext = (TokenContext) context.getUserPrincipal();
	String username = tokenContext.getUsername();

	try {
	return tokenService.listUserRefreshToken(username, clientId,
	clientSecret);
	}
	catch (KustvaktException e) {
	throw responseHandler.throwit(e);
	}

	}

	@POST
	@Consumes(MediaType.APPLICATION_FORM_URLENCODED)
	@Path("token/clear")
	public Response clearAccessTokenCache (
	@FormParam("token") String adminToken,
	@FormParam("access_token") String accessToken,
	@Context ServletContext context) {
	try {
	String response = tokenService.clearAccessTokenCache(adminToken, accessToken,
	context);
	return Response.ok(response).build();
	}
	catch (KustvaktException e) {
	throw responseHandler.throwit(e);
	}
	}
	}