signature:
public class AuthorizationDecisionHandler { /** * Process the end - user ' s decision . */
private Response process ( String ticket , String [ ] claimNames , String [ ] claimLocales ) { } }

implementation:
// If the end - user did not grant authorization to the client application .
if ( mSpi . isClientAuthorized ( ) == false ) { // The end - user denied the authorization request .
return fail ( ticket , Reason . DENIED ) ; } // The subject ( = unique identifier ) of the end - user .
String subject = mSpi . getUserSubject ( ) ; // If the subject of the end - user is not available .
if ( subject == null || subject . length ( ) == 0 ) { // The end - user is not authenticated .
return fail ( ticket , Reason . NOT_AUTHENTICATED ) ; } // The time when the end - user was authenticated .
long authTime = mSpi . getUserAuthenticatedAt ( ) ; // The ACR ( Authentication Context Class Reference ) of the
// end - user authentication .
String acr = mSpi . getAcr ( ) ; // Collect claim values .
Map < String , Object > claims = collectClaims ( subject , claimNames , claimLocales ) ; // Extra properties to associate with an access token and / or
// an authorization code .
Property [ ] properties = mSpi . getProperties ( ) ; // Scopes to associate with an access token and / or an authorization code .
// If a non - null value is returned from mSpi . getScopes ( ) , the scope set
// replaces the scopes that have been specified in the original
// authorization request .
String [ ] scopes = mSpi . getScopes ( ) ; // Authorize the authorization request .
return authorize ( ticket , subject , authTime , acr , claims , properties , scopes ) ;


signature:
public class AuthorizationDecisionHandler { /** * Collect claims of the end - user . */
private Map < String , Object > collectClaims ( String subject , String [ ] claimNames , String [ ] claimLocales ) { } }

implementation:
// If no claim is required .
if ( claimNames == null || claimNames . length == 0 ) { return null ; } // Drop empty and duplicate entries from claimLocales .
claimLocales = normalizeClaimLocales ( claimLocales ) ; // Claim values .
Map < String , Object > claims = new HashMap < String , Object > ( ) ; // For each requested claim .
for ( String claimName : claimNames ) { // If the claim name is empty .
if ( claimName == null || claimName . length ( ) == 0 ) { continue ; } // Split the claim name into the name part and the tag part .
String [ ] elements = claimName . split ( "#" , 2 ) ; String name = elements [ 0 ] ; String tag = ( elements . length == 2 ) ? elements [ 1 ] : null ; // If the name part is empty .
if ( name == null || name . length ( ) == 0 ) { continue ; } // Get the claim value of the claim .
Object value = getClaim ( name , tag , claimLocales ) ; // If the claim value was not obtained .
if ( value == null ) { continue ; } if ( tag == null ) { // Just for an edge case where claimName ends with " # " .
claimName = name ; } // Add the pair of the claim name and the claim value .
claims . put ( claimName , value ) ; } // If no claim value has been obtained .
if ( claims . size ( ) == 0 ) { return null ; } // Obtained claim values .
return claims ;


signature:
public class AuthorizationDecisionHandler { /** * Handle an end - user ' s decision of granting authorization to the client
 * application . This method calls Authlete ' s { @ code
 * / api / auth / authorization / issue } API .
 * < b > Note about the { @ code claims } argument : < / b >
 * A response from Authlete ' s { @ code / api / auth / authorization } API contains
 * { @ code claims } parameter which is a { @ code String } array of claim names
 * such as { @ code name } , { @ code email } and { @ code birthdate } . They are
 * claims requested by the client application . You are expected to collect
 * values of the claims and pass the collected claim key - value pairs to
 * Authlete ' s { @ code / api / auth / authorization / issue } API . The { @ code claims }
 * argument of this method is the collected claim key - value pairs .
 * Types of claim values vary depending on claim keys . Types of most
 * standard claims ( see " < a href =
 * " http : / / openid . net / specs / openid - connect - core - 1_0 . html # StandardClaims "
 * > 5.1 . Standard Claims < / a > " in < a href =
 * " http : / / openid . net / specs / openid - connect - core - 1_0 . html " > OpenID Connect
 * Core 1.0 < / a > ) are string , but types of { @ code email _ verified } claim
 * and { @ code phone _ number _ verified } claim are boolean and the type of
 * { @ code updated _ at } claim is number . In addition , the type of { @ code
 * address } claim is JSON object . The detailed format of { @ code address }
 * claim is described in < a href =
 * " http : / / openid . net / specs / openid - connect - core - 1_0 . html # AddressClaim "
 * > 5.1.1 . Address Claim < / a > . { @ link com . authlete . common . dto . Address
 * Address } class in < a href = " https : / / github . com / authlete / authlete - java - common "
 * > authlete - java - common < / a > library can be used to represent a value of
 * { @ code address } claim .
 * The following code is an example to prepare { @ code claims } argument .
 * < blockquote >
 * < pre style = " border : 1px solid gray ; padding : 0.5em ; margin : 1em ; " >
 * Map & lt ; String , Object & gt ; claims = new HashMap & lt ; String , Object & gt ; ( ) ;
 * < span style = " color : green ; " > / / Name < / span >
 * claims . put ( < span style = " color : darkred ; " > " name " < / span > , < span style = " color : darkred ; " > " Takahiko Kawasaki " < / span > ) ;
 * claims . put ( < span style = " color : darkred ; " > " given _ name " < / span > , < span style = " color : darkred ; " > " Takahiko " < / span > ) ;
 * claims . put ( < span style = " color : darkred ; " > " family _ name " < / span > , < span style = " color : darkred ; " > " Kawasaki " < / span > ) ;
 * < span style = " color : green ; " > / / Name with a language tag .
 * / / See < a href = " http : / / openid . net / specs / openid - connect - core - 1_0 . html # ClaimsLanguagesAndScripts "
 * > 5.2 . Claims Languages and Scripts < / a > for details . < / span >
 * claims . put ( < span style = " color : darkred ; " > " name # ja " < / span > , < span style = " color : darkred ; "
 * > " \ u5DDD \ u5D0E \ u8CB4 \ u5F66 " < / span > ) ; < span style = " color : green ; " > / / & # x5ddd ; & # x5D0E ; & # x8CB4 ; & # x5F66 ; < / span >
 * claims . put ( < span style = " color : darkred ; " > " given _ name # ja " < / span > , < span style = " color : darkred ; "
 * > " \ u8CB4 \ u5F66 " < / span > ) ; < span style = " color : green ; " > / / & # x8CB4 ; & # x5F66 ; < / span >
 * claims . put ( < span style = " color : darkred ; " > " family _ name # ja " < / span > , < span style = " color : darkred ; "
 * > " \ u5DDD \ u5D0E " < / span > ) ; < span style = " color : green ; " > / / & # x5ddd ; & # x5D0E ; < / span >
 * < span style = " color : green ; " > / / Postal address .
 * / / See < a href = " http : / / openid . net / specs / openid - connect - core - 1_0 . html # AddressClaim "
 * > 5.1.1 . Address Claim < / a > for details . < / span >
 * Address address = new Address ( )
 * . setCountry ( < span style = " color : darkred ; " > " JP " < / span > )
 * . setRegion ( < span style = " color : darkred ; " > " Tokyo " < / span > )
 * . setLocality ( < span style = " color : darkred ; " > " Itabashi - ku " < / span > )
 * . setFormatted ( < span style = " color : darkred ; " > " Itabashi - ku , Tokyo , Japan " < / span > ) ;
 * claims . put ( < span style = " color : darkred ; " > " address " < / span > , address ) ;
 * < span style = " color : green ; " > / / Other information . < / span >
 * claims . put ( < span style = " color : darkred ; " > " gender " < / span > , < span style = " color : darkred ; " > " male " < / span > ) ;
 * claims . put ( < span style = " color : darkred ; " > " birthdate " < / span > , < span style = " color : darkred ; " > " 1974-05-06 " < / span > ) ;
 * claims . put ( < span style = " color : darkred ; " > " zoneinfo " < / span > , < span style = " color : darkred ; " > " Asia / Tokyo " < / span > ) ;
 * claims . put ( < span style = " color : darkred ; " > " locale " < / span > , < span style = " color : darkred ; " > " ja " < / span > ) ;
 * < span style = " color : green ; " > / / FYI : Constant values in { @ link com . authlete . common . types . StandardClaims
 * StandardClaims } class can be used as keys . < / span > < / pre >
 * < / blockquote >
 * @ param ticket
 * A ticket that was issued by Authlete ' s { @ code / api / auth / authorization } API .
 * @ param subject
 * The subject ( = unique identifier ) of the end - user .
 * @ param authTime
 * The time when end - user authentication occurred . The number of
 * seconds since Unix epoch ( 1970-01-01 ) . This value is used as
 * the value of { @ code auth _ time } claim in an ID token that may
 * be issued . Pass 0 if the time is unknown .
 * @ param acr
 * The authentication context class reference that the end - user
 * authentication satisfied . This value is used as the value of
 * { @ code acr } claim in an ID token that may be issued . Pass
 * { @ code null } if ACR is unknown .
 * @ param claims
 * Pairs of claim key and claim value . The pairs are embedded
 * in an ID token that may be issued . Passing { @ code null } means
 * that values of the requested claims are not available .
 * @ param properties
 * Extra properties to associate with an access token and / or
 * an authorization code .
 * @ param scopes
 * Scopes to associate with an access token and / or an authorization
 * code . If { @ code null } is given , the scopes contained in the
 * original authorization request are used . Otherwise , including
 * the case of an empty array , the scopes given to this method
 * replace the scopes . Note that < code > " openid " < / code > scope is
 * ignored if it is not included in the original authorization
 * request .
 * @ return
 * A response that should be returned to the client application . */
private Response authorize ( String ticket , String subject , long authTime , String acr , Map < String , Object > claims , Property [ ] properties , String [ ] scopes ) { } }

implementation:
try { // Generate a redirect response containing an authorization code ,
// an access token and / or an ID token . If the original authorization
// request had response _ type = none , no tokens will be contained in
// the generated response , though .
return getApiCaller ( ) . authorizationIssue ( ticket , subject , authTime , acr , claims , properties , scopes ) ; } catch ( WebApplicationException e ) { return e . getResponse ( ) ; }


signature:
public class AuthorizationDecisionHandler { /** * Generate an error response to indicate that the authorization
 * request failed . This method calls Authlete ' s { @ code
 * / api / auth / authorization / fail } API and generates a response that
 * triggers redirection .
 * @ param ticket
 * A ticket that was issued by Authlete ' s { @ code / api / auth / authorization } API .
 * @ param reason
 * A reason of the failure of the authorization request .
 * @ return
 * A response that should be returned to the client application . */
private Response fail ( String ticket , Reason reason ) { } }

implementation:
try { // Generate an error response to indicate that
// the authorization request failed .
return getApiCaller ( ) . authorizationFail ( ticket , reason ) . getResponse ( ) ; } catch ( WebApplicationException e ) { return e . getResponse ( ) ; }


signature:
public class AccessTokenValidator { /** * Validate an access token . This method is an alias of { @ link
 * # validate ( String , String [ ] , String )
 * validate } < code > ( accessToken , null , null ) < / code > .
 * When the given access token is not valid , this method throws a
 * { @ link WebApplicationException } . The response contained in the
 * exception complies with the requirements described in < a href =
 * " http : / / tools . ietf . org / html / rfc6750 " > RFC 6750 < / a > ( The OAuth
 * 2.0 Authorization Framework : Bearer Token Usage ) .
 * @ param accessToken
 * An access token to validate .
 * @ return
 * Information about the access token .
 * @ throws WebApplicationException
 * The access token is invalid . To be concrete , the access
 * token does not exist or it has expired . */
public AccessTokenInfo validate ( String accessToken ) throws WebApplicationException { } }

implementation: return validate ( accessToken , null , null , null ) ;


signature:
public class AccessTokenValidator { /** * Validate an access token . This method is an alias of { @ link
 * # validate ( String , String [ ] , String )
 * validate } < code > ( accessToken , requiredScopes , null ) < / code > .
 * When the given access token is not valid , this method throws a
 * { @ link WebApplicationException } . The response contained in the
 * exception complies with the requirements described in < a href =
 * " http : / / tools . ietf . org / html / rfc6750 " > RFC 6750 < / a > ( The OAuth
 * 2.0 Authorization Framework : Bearer Token Usage ) .
 * @ param accessToken
 * An access token to validate .
 * @ param requiredScopes
 * Scopes that must be associated with the access token .
 * { @ code null } is okay .
 * @ return
 * Information about the access token .
 * @ throws WebApplicationException
 * The access token is invalid . To be concrete , one or more of
 * the following conditions meet .
 * < ol >
 * < li > The access token does not exist .
 * < li > The access token has expired .
 * < li > The access token does not cover the required scopes .
 * < / ol > */
public AccessTokenInfo validate ( String accessToken , String [ ] requiredScopes ) throws WebApplicationException { } }

implementation: return validate ( accessToken , requiredScopes , null , null ) ;


signature:
public class AccessTokenValidator { /** * Validate an access token .
 * When the given access token is not valid , this method throws a
 * { @ link WebApplicationException } . The response contained in the
 * exception complies with the requirements described in < a href =
 * " http : / / tools . ietf . org / html / rfc6750 " > RFC 6750 < / a > ( The OAuth
 * 2.0 Authorization Framework : Bearer Token Usage ) .
 * @ param accessToken
 * An access token to validate .
 * @ param requiredScopes
 * Scopes that must be associated with the access token .
 * { @ code null } is okay .
 * @ param requiredSubject
 * Subject ( = user ' s unique identifier ) that must be associated
 * with the access token . { @ code null } is okay .
 * @ param clientCertificate
 * TLS Certificate of the client presented during a call to
 * the resource server , used with TLS - bound access tokens .
 * Can be { @ code null } if no certificate is presented .
 * @ return
 * Information about the access token .
 * @ throws WebApplicationException
 * The access token is invalid . To be concrete , one or more of
 * the following conditions meet .
 * < ol >
 * < li > The access token does not exist .
 * < li > The access token has expired .
 * < li > The access token does not cover the required scopes .
 * < li > The access token is not associated with the required subject .
 * < / ol > */
public AccessTokenInfo validate ( String accessToken , String [ ] requiredScopes , String requiredSubject , String clientCertificate ) throws WebApplicationException { } }

implementation:
if ( accessToken == null ) { // Return " 400 Bad Request " .
throw toException ( Status . BAD_REQUEST , CHALLENGE_ON_MISSING_ACCESS_TOKEN ) ; } try { return process ( accessToken , requiredScopes , requiredSubject , clientCertificate ) ; } catch ( WebApplicationException e ) { throw e ; } catch ( Throwable t ) { // Unexpected error .
throw unexpected ( "Unexpected error in AccessTokenValidator" , t ) ; }


signature:
public class BaseResourceEndpoint { /** * Extract an access token from either { @ code Authorization } header
 * or request parameters .
 * The first argument expects a value of { @ code Authorization } header
 * that complies with < a href = " http : / / tools . ietf . org / html / rfc6750"
 * > RFC 6750 < / a > ( Bearer Token Usage ) . If the argument contains an
 * access token , this method returns the access token without checking
 * the second argument .
 * The second argument expects a value of { @ code access _ token }
 * request parameter . The value of this argument is returned when
 * the first argument does not contain an access token .
 * @ param authorization
 * A value of { @ code Authorization } header whose scheme is
 * Bearer . For example , { @ code " Bearer SlAV32hkKG " } .
 * @ param accessTokenInRequestParameters
 * A value of { @ code access _ token } request parameter .
 * @ return
 * An access token . */
public String extractAccessToken ( String authorization , String accessTokenInRequestParameters ) { } }

implementation:
// Extract an access token from the value of Authorization header .
String accessToken = BearerToken . parse ( authorization ) ; // If an access token was not found in Authorization header .
if ( accessToken == null ) { // Use the value given via ' access _ token ' request parameter .
accessToken = accessTokenInRequestParameters ; } return accessToken ;


signature:
public class BaseResourceEndpoint { /** * Validate an access token . This method is an alias of { @ link
 * # validateAccessToken ( AuthleteApi , String , String [ ] , String , String )
 * validateAccessToken } < code > ( api , accessToken , null , null , null ) < / code > .
 * @ param api
 * Implementation of { @ link AuthleteApi } interface .
 * @ param accessToken
 * An access token to validate .
 * @ return
 * Information about the access token .
 * @ throws WebApplicationException
 * The access token is invalid . To be concrete , the access
 * token does not exist or it has expired . */
public AccessTokenInfo validateAccessToken ( AuthleteApi api , String accessToken ) throws WebApplicationException { } }

implementation: return validateAccessToken ( api , accessToken , null , null , null ) ;


signature:
public class BaseResourceEndpoint { /** * Validate an access token .
 * This method internally creates a { @ link AccessTokenValidator } instance and
 * calls its { @ link AccessTokenValidator # validate ( String , String [ ] , String , String )
 * validate ( ) } method . Then , this method uses the value returned from the
 * { @ code validate ( ) } method as a response from this method .
 * When { @ code AccessTokenValidator . validate ( ) } method raises a { @ link
 * WebApplicationException } , this method calls { @ link # onError ( WebApplicationException )
 * onError ( ) } method with the exception . The default implementation of { @ code onError ( ) }
 * calls { @ code printStackTrace ( ) } of the exception and does nothing else . You
 * can override the method as necessary . After calling { @ code onError ( ) } method ,
 * this method re - throws the exception . The response contained in the exception
 * complies with the requirements described in < a href =
 * " http : / / tools . ietf . org / html / rfc6750 " > RFC 6750 < / a > ( The OAuth 2.0 Authorization
 * Framework : Bearer Token Usage ) .
 * @ param api
 * Implementation of { @ link AuthleteApi } interface .
 * @ param accessToken
 * An access token to validate .
 * @ param requiredScopes
 * Scopes that must be associated with the access token .
 * { @ code null } is okay .
 * @ param requiredSubject
 * Subject ( = user ' s unique identifier ) that must be associated
 * with the access token . { @ code null } is okay .
 * @ param clientCertificate
 * TLS Certificate of the client presented during a call to
 * the resource server , used with TLS - bound access tokens .
 * Can be { @ code null } if no certificate is presented .
 * @ return
 * Information about the access token .
 * @ throws WebApplicationException
 * The access token is invalid . To be concrete , one or more of
 * the following conditions meet .
 * < ol >
 * < li > The access token does not exist .
 * < li > The access token has expired .
 * < li > The access token does not cover the required scopes .
 * < li > The access token is not associated with the required subject .
 * < / ol > */
public AccessTokenInfo validateAccessToken ( AuthleteApi api , String accessToken , String [ ] requiredScopes , String requiredSubject , String clientCertificate ) throws WebApplicationException { } }

implementation:
try { // Validate the access token and obtain the information about it .
return new AccessTokenValidator ( api ) . validate ( accessToken , requiredScopes , requiredSubject , clientCertificate ) ; } catch ( WebApplicationException e ) { // The access token is invalid . ( Or an network error , or some others . )
onError ( e ) ; throw e ; }


signature:
public class BaseAuthorizationDecisionEndpoint { /** * Handle an authorization decision request .
 * This method internally creates a { @ link AuthorizationDecisionHandler } instance and
 * calls its { @ link AuthorizationDecisionHandler # handle ( String , String [ ] , String [ ] ) }
 * method . Then , this method uses the value returned from the { @ code handle ( ) } method
 * as a response from this method .
 * When { @ code AuthorizationDecisionHandler . handle ( ) } method raises a { @ link
 * WebApplicationException } , this method calls { @ link # onError ( WebApplicationException )
 * onError ( ) } method with the exception . The default implementation of { @ code onError ( ) }
 * calls { @ code printStackTrace ( ) } of the exception and does nothing else . You
 * can override the method as necessary . After calling { @ code onError ( ) } method ,
 * this method calls { @ code getResponse ( ) } method of the exception and uses the
 * returned value as a response from this method .
 * @ param api
 * An implementation of { @ link AuthleteApi } .
 * @ param spi
 * An implementation of { @ link AuthorizationDecisionHandlerSpi } .
 * @ param ticket
 * A ticket that was issued by Authlete ' s { @ code / api / auth / authorization } API .
 * @ param claimNames
 * Names of requested claims . Use the value of the { @ code claims }
 * parameter in a response from Authlete ' s { @ code / api / auth / authorization } API .
 * @ param claimLocales
 * Requested claim locales . Use the value of the { @ code claimsLocales }
 * parameter in a response from Authlete ' s { @ code / api / auth / authorization } API .
 * @ return
 * A response that should be returned to the client application . */
public Response handle ( AuthleteApi api , AuthorizationDecisionHandlerSpi spi , String ticket , String [ ] claimNames , String [ ] claimLocales ) { } }

implementation:
try { // Create a handler .
AuthorizationDecisionHandler handler = new AuthorizationDecisionHandler ( api , spi ) ; // Delegate the task to the handler .
return handler . handle ( ticket , claimNames , claimLocales ) ; } catch ( WebApplicationException e ) { // An error occurred in the handler .
onError ( e ) ; // Convert the error to a Response .
return e . getResponse ( ) ; }


signature:
public class AuthleteApiCaller { /** * Create an { @ link InternalServerErrorException } instance to indicate
 * that an Authlete API call failed . */
private InternalServerErrorException apiFailure ( String path , AuthleteApiException e ) { } }

implementation:
// Error message .
String message = String . format ( "Authlete %s API failed: %s" , path , e . getMessage ( ) ) ; // Response body in the response from the Authlete server .
if ( e . getResponseBody ( ) != null ) { // Append the content of the response body to the error message .
message = new StringBuilder ( message ) . append ( ": " ) . append ( e . getResponseBody ( ) ) . toString ( ) ; } // 500 Internal Server Error
return internalServerError ( message , e ) ;


signature:
public class AuthleteApiCaller { /** * Create an { @ link InternalServerErrorException } instance to indicate
 * that the value of { @ code action } parameter contained in a response
 * from an Authlete API is unknown . */
public InternalServerErrorException unknownAction ( String path , Enum < ? > action ) { } }

implementation:
// Error message .
String message = String . format ( "Authlete %s API returned an unknown action: %s" , path , action ) ; // 500 Internal Server Error
return internalServerError ( message , null ) ;


signature:
public class AuthleteApiCaller { /** * Create an { @ link InternalServerErrorException } instance having
 * a response body . */
private InternalServerErrorException internalServerError ( String message , Throwable cause ) { } }

implementation: Response response = ResponseUtil . internalServerError ( message , MediaType . TEXT_PLAIN_TYPE ) ; if ( cause != null ) { return new InternalServerErrorException ( message , response , cause ) ; } else { return new InternalServerErrorException ( message , response ) ; }


signature:
public class AuthleteApiCaller { /** * Call Authlete ' s { @ code / api / auth / authorization } API . */
public AuthorizationResponse callAuthorization ( MultivaluedMap < String , String > parameters ) { } }

implementation: String params = URLCoder . formUrlEncode ( parameters ) ; return callAuthorization ( params ) ;


signature:
public class AuthleteApiCaller { /** * Call Authlete ' s { @ code / api / auth / authorization } API . */
private AuthorizationResponse callAuthorization ( String parameters ) { } }

implementation:
if ( parameters == null ) { // Authlete returns different error codes for null and an empty string .
// ' null ' is regarded as a caller ' s error . An empty string is regarded
// as a client application ' s error .
parameters = "" ; } // Create a request for Authlete ' s / api / auth / authorization API .
AuthorizationRequest request = new AuthorizationRequest ( ) . setParameters ( parameters ) ; try { // Call Authlete ' s / api / auth / authorization API .
return mApi . authorization ( request ) ; } catch ( AuthleteApiException e ) { // The API call failed .
throw apiFailure ( "/api/auth/authorization" , e ) ; }


signature:
public class AuthleteApiCaller { /** * Call Authlete ' s { @ code / api / auth / authorization / fail } API . */
private AuthorizationFailResponse callAuthorizationFail ( String ticket , AuthorizationFailRequest . Reason reason ) { } }

implementation:
// Create a request for / api / auth / authorization / fail API .
AuthorizationFailRequest request = new AuthorizationFailRequest ( ) . setTicket ( ticket ) . setReason ( reason ) ; try { // Call Authlete ' s / api / auth / authorization / fail API .
return mApi . authorizationFail ( request ) ; } catch ( AuthleteApiException e ) { // The API call failed .
throw apiFailure ( "/api/auth/authorization/fail" , e ) ; }


signature:
public class AuthleteApiCaller { /** * Create a response that describes the failure . This method
 * calls Authlete ' s { @ code / api / auth / authorization / fail } API . */
private Response createAuthorizationFailResponse ( String ticket , AuthorizationFailRequest . Reason reason ) { } }

implementation:
// Call Authlete ' s / api / auth / authorization / fail API .
AuthorizationFailResponse response = callAuthorizationFail ( ticket , reason ) ; // ' action ' in the response denotes the next action which
// this service implementation should take .
AuthorizationFailResponse . Action action = response . getAction ( ) ; // The content of the response to the client application .
// The format of the content varies depending on the action .
String content = response . getResponseContent ( ) ; // Dispatch according to the action .
switch ( action ) { case INTERNAL_SERVER_ERROR : // 500 Internal Server Error
return ResponseUtil . internalServerError ( content ) ; case BAD_REQUEST : // 400 Bad Request
return ResponseUtil . badRequest ( content ) ; case LOCATION : // 302 Found
return ResponseUtil . location ( content ) ; case FORM : // 200 OK
return ResponseUtil . form ( content ) ; default : // This never happens .
throw unknownAction ( "/api/auth/authorization/fail" , action ) ; }


signature:
public class AuthleteApiCaller { /** * Create an exception that describes the failure . This method
 * calls Authlete ' s { @ code / api / auth / authorization / fail } API . */
public WebApplicationException authorizationFail ( String ticket , AuthorizationFailRequest . Reason reason ) { } }

implementation:
// Create a response to the client application with the help of
// Authlete ' s / api / auth / authorization / fail API .
Response response = createAuthorizationFailResponse ( ticket , reason ) ; // Create an exception containing the response .
return new WebApplicationException ( response ) ;


signature:
public class AuthleteApiCaller { /** * Call Authlete ' s { @ code / api / auth / authorization / issue } API . */
private AuthorizationIssueResponse callAuthorizationIssue ( String ticket , String subject , long authTime , String acr , Map < String , Object > claims , Property [ ] properties , String [ ] scopes ) { } }

implementation:
// Create a request for / api / auth / authorization / issue API .
AuthorizationIssueRequest request = new AuthorizationIssueRequest ( ) . setTicket ( ticket ) . setSubject ( subject ) . setAuthTime ( authTime ) . setAcr ( acr ) . setProperties ( properties ) . setScopes ( scopes ) ; if ( claims != null && claims . size ( ) != 0 ) { request . setClaims ( claims ) ; } try { // Call Authlete ' s / api / auth / authorization / issue API .
return mApi . authorizationIssue ( request ) ; } catch ( AuthleteApiException e ) { // The API call failed .
throw apiFailure ( "/api/auth/authorization/issue" , e ) ; }


signature:
public class AuthleteApiCaller { /** * Issue an authorization code , an ID token and / or an access token .
 * This method calls Authlete ' s { @ code / api / auth / authorization / issue } API . */
public Response authorizationIssue ( String ticket , String subject , long authTime , String acr , Map < String , Object > claims , Property [ ] properties , String [ ] scopes ) { } }

implementation:
// Call Authlete ' s / api / auth / authorization / issue API .
AuthorizationIssueResponse response = callAuthorizationIssue ( ticket , subject , authTime , acr , claims , properties , scopes ) ; // ' action ' in the response denotes the next action which
// this service implementation should take .
AuthorizationIssueResponse . Action action = response . getAction ( ) ; // The content of the response to the client application .
// The format of the content varies depending on the action .
String content = response . getResponseContent ( ) ; // Dispatch according to the action .
switch ( action ) { case INTERNAL_SERVER_ERROR : // 500 Internal Server Error
return ResponseUtil . internalServerError ( content ) ; case BAD_REQUEST : // 400 Bad Request
return ResponseUtil . badRequest ( content ) ; case LOCATION : // 302 Found
return ResponseUtil . location ( content ) ; case FORM : // 200 OK
return ResponseUtil . form ( content ) ; default : // This never happens .
throw unknownAction ( "/api/auth/authorization/issue" , action ) ; }


signature:
public class AuthleteApiCaller { /** * Call Authlete ' s { @ code / api / auth / token } API . */
public TokenResponse callToken ( MultivaluedMap < String , String > parameters , String clientId , String clientSecret , Property [ ] properties , String clientCertificate , String [ ] clientCertificatePath ) { } }

implementation: String params = URLCoder . formUrlEncode ( parameters ) ; return callToken ( params , clientId , clientSecret , properties , clientCertificate , clientCertificatePath ) ;


signature:
public class AuthleteApiCaller { /** * Call Authlete ' s { @ code / api / auth / token } API . */
private TokenResponse callToken ( String parameters , String clientId , String clientSecret , Property [ ] properties , String clientCertificate , String [ ] clientCertificatePath ) { } }

implementation:
if ( parameters == null ) { // Authlete returns different error codes for null and an empty string .
// ' null ' is regarded as a caller ' s error . An empty string is regarded
// as a client application ' s error .
parameters = "" ; } // Create a request for Authlete ' s / api / auth / token API .
TokenRequest request = new TokenRequest ( ) . setParameters ( parameters ) . setClientId ( clientId ) . setClientSecret ( clientSecret ) . setProperties ( properties ) . setClientCertificate ( clientCertificate ) . setClientCertificatePath ( clientCertificatePath ) ; try { // Call Authlete ' s / api / auth / token API .
return mApi . token ( request ) ; } catch ( AuthleteApiException e ) { // The API call failed .
throw apiFailure ( "/api/auth/token" , e ) ; }


signature:
public class AuthleteApiCaller { /** * Call Authlete ' s { @ code / api / auth / token / fail } API . */
private TokenFailResponse callTokenFail ( String ticket , TokenFailRequest . Reason reason ) { } }

implementation:
// Create a request for / api / auth / token / fail API .
TokenFailRequest request = new TokenFailRequest ( ) . setTicket ( ticket ) . setReason ( reason ) ; try { // Call Authlete ' s / api / auth / token / fail API .
return mApi . tokenFail ( request ) ; } catch ( AuthleteApiException e ) { // The API call failed .
throw apiFailure ( "/api/auth/token/fail" , e ) ; }


signature:
public class AuthleteApiCaller { /** * Create a response that describes the failure . This method
 * calls Authlete ' s { @ code / api / auth / token / fail } API . */
private Response createTokenFailResponse ( String ticket , TokenFailRequest . Reason reason ) { } }

implementation:
// Call Authlete ' s / api / auth / token / fail API .
TokenFailResponse response = callTokenFail ( ticket , reason ) ; // ' action ' in the response denotes the next action which
// this service implementation should take .
TokenFailResponse . Action action = response . getAction ( ) ; // The content of the response to the client application .
String content = response . getResponseContent ( ) ; // Dispatch according to the action .
switch ( action ) { case INTERNAL_SERVER_ERROR : // 500 Internal Server Error
return ResponseUtil . internalServerError ( content ) ; case BAD_REQUEST : // 400 Bad Request
return ResponseUtil . badRequest ( content ) ; default : // This never happens .
throw unknownAction ( "/api/auth/token/fail" , action ) ; }


signature:
public class AuthleteApiCaller { /** * Create an exception that describes the failure . This method
 * calls Authlete ' s { @ code / api / auth / token / fail } API . */
public WebApplicationException tokenFail ( String ticket , TokenFailRequest . Reason reason ) { } }

implementation:
// Create a response to the client application with the help of
// Authlete ' s / api / auth / token / fail API .
Response response = createTokenFailResponse ( ticket , reason ) ; // Create an exception containing the response .
return new WebApplicationException ( response ) ;


signature:
public class AuthleteApiCaller { /** * Call Authlete ' s { @ code / api / auth / token / issue } API . */
private TokenIssueResponse callTokenIssue ( String ticket , String subject , Property [ ] properties ) { } }

implementation:
// Create a request for Authlete ' s / api / auth / token / issue API .
TokenIssueRequest request = new TokenIssueRequest ( ) . setTicket ( ticket ) . setSubject ( subject ) . setProperties ( properties ) ; try { // Call Authlete ' s / api / auth / token / issue API .
return mApi . tokenIssue ( request ) ; } catch ( AuthleteApiException e ) { // The API call failed .
throw apiFailure ( "/api/auth/token/issue" , e ) ; }


signature:
public class AuthleteApiCaller { /** * Issue an access token and optionally an ID token .
 * This method calls Authlete ' s { @ code / api / auth / token / issue } API . */
public Response tokenIssue ( String ticket , String subject , Property [ ] properties ) { } }

implementation:
// Call Authlete ' s / api / auth / token / issue API .
TokenIssueResponse response = callTokenIssue ( ticket , subject , properties ) ; // ' action ' in the response denotes the next action which
// this service implementation should take .
TokenIssueResponse . Action action = response . getAction ( ) ; // The content of the response to the client application .
String content = response . getResponseContent ( ) ; // Dispatch according to the action .
switch ( action ) { case INTERNAL_SERVER_ERROR : // 500 Internal Server Error
return ResponseUtil . internalServerError ( content ) ; case OK : // 200 OK
return ResponseUtil . ok ( content ) ; default : // This never happens .
throw unknownAction ( "/api/auth/token/issue" , action ) ; }


signature:
public class AuthleteApiCaller { /** * Call Authlete ' s { @ code / api / service / configuration } API . */
public String callServiceConfiguration ( boolean pretty ) { } }

implementation:
try { // Call Authlete ' s / api / service / configuration API .
return mApi . getServiceConfiguration ( pretty ) ; } catch ( AuthleteApiException e ) { // The API call failed .
throw apiFailure ( "/api/service/configuration" , e ) ; }


signature:
public class AuthleteApiCaller { /** * Get the JWK Set of the service . This method calls Authlete ' s
 * { @ code / api / service / jwks / get } API . */
public Response serviceJwksGet ( boolean pretty , boolean includePrivateKeys ) throws AuthleteApiException { } }

implementation:
try { // Call Authlete ' s / api / service / jwks / get API .
String jwks = mApi . getServiceJwks ( pretty , includePrivateKeys ) ; if ( jwks == null || jwks . length ( ) == 0 ) { // 204 No Content
return ResponseUtil . noContent ( ) ; } // Response as " application / json ; charset = UTF - 8 " with 200 OK .
return ResponseUtil . ok ( jwks ) ; } catch ( AuthleteApiException e ) { // If the status code is not 302 Found .
if ( e . getStatusCode ( ) != Status . FOUND . getStatusCode ( ) ) { // The API call failed .
throw apiFailure ( "/api/service/jwks/get" , e ) ; } // The value of ' Location ' header .
String location = getFirst ( e . getResponseHeaders ( ) , "Location" ) ; // 302 Found with Location header .
return ResponseUtil . location ( location ) ; }


signature:
public class AuthleteApiCaller { /** * Call Authlete ' s { @ code / api / auth / revocation } API . */
public RevocationResponse callRevocation ( MultivaluedMap < String , String > parameters , String clientId , String clientSecret ) { } }

implementation: String params = URLCoder . formUrlEncode ( parameters ) ; return callRevocation ( params , clientId , clientSecret ) ;


signature:
public class AuthleteApiCaller { /** * Call Authlete ' s { @ code / api / auth / revocation } API . */
private RevocationResponse callRevocation ( String parameters , String clientId , String clientSecret ) { } }

implementation:
if ( parameters == null ) { // Authlete returns different error codes for null and an empty string .
// ' null ' is regarded as a caller ' s error . An empty string is regarded
// as a client application ' s error .
parameters = "" ; } // Create a request for Authlete ' s / api / auth / revocation API .
RevocationRequest request = new RevocationRequest ( ) . setParameters ( parameters ) . setClientId ( clientId ) . setClientSecret ( clientSecret ) ; try { // Call Authlete ' s / api / auth / revocation API .
return mApi . revocation ( request ) ; } catch ( AuthleteApiException e ) { // The API call failed .
throw apiFailure ( "/api/auth/revocation" , e ) ; }


signature:
public class AuthleteApiCaller { /** * Call Authlete ' s { @ code / api / auth / userinfo } API . */
public UserInfoResponse callUserInfo ( String accessToken ) { } }

implementation:
// Create a request for Authlete ' s / api / auth / userinfo API .
UserInfoRequest request = new UserInfoRequest ( ) . setToken ( accessToken ) ; try { // Call Authlete ' s / api / auth / userinfo API .
return mApi . userinfo ( request ) ; } catch ( AuthleteApiException e ) { // The API call failed .
throw apiFailure ( "/api/auth/userinfo" , e ) ; }


signature:
public class AuthleteApiCaller { /** * Call Authlete ' s { @ code / api / auth / userinfo / issue } API . */
private UserInfoIssueResponse callUserInfoIssue ( String accessToken , Map < String , Object > claims ) { } }

implementation:
// Create a request for / api / auth / userinfo / issue API .
UserInfoIssueRequest request = new UserInfoIssueRequest ( ) . setToken ( accessToken ) ; if ( claims != null && claims . size ( ) != 0 ) { request . setClaims ( claims ) ; } try { // Call Authlete ' s / api / auth / userinfo / issue API .
return mApi . userinfoIssue ( request ) ; } catch ( AuthleteApiException e ) { // The API call failed .
throw apiFailure ( "/api/auth/userinfo/issue" , e ) ; }


signature:
public class AuthleteApiCaller { /** * Issue a JSON or a JWT containing user information . */
public Response userInfoIssue ( String accessToken , Map < String , Object > claims ) { } }

implementation:
// Call Authlete ' s / api / auth / userinfo / issue API .
UserInfoIssueResponse response = callUserInfoIssue ( accessToken , claims ) ; // ' action ' in the response denotes the next action which
// this service implementation should take .
UserInfoIssueResponse . Action action = response . getAction ( ) ; // The content of the response to the client application .
// The format of the content varies depending on the action .
String content = response . getResponseContent ( ) ; // Dispatch according to the action .
switch ( action ) { case INTERNAL_SERVER_ERROR : // 500 Internal Server Error
return ResponseUtil . bearerError ( Status . INTERNAL_SERVER_ERROR , content ) ; case BAD_REQUEST : // 400 Bad Request
return ResponseUtil . bearerError ( Status . BAD_REQUEST , content ) ; case UNAUTHORIZED : // 401 Unauthorized
return ResponseUtil . bearerError ( Status . UNAUTHORIZED , content ) ; case FORBIDDEN : // 403 Forbidden
return ResponseUtil . bearerError ( Status . FORBIDDEN , content ) ; case JSON : // 200 OK , application / json ; charset = UTF - 8
return ResponseUtil . ok ( content ) ; case JWT : // 200 OK , application / jwt
return ResponseUtil . ok ( content , ResponseUtil . MEDIA_TYPE_JWT ) ; default : // This never happens .
throw unknownAction ( "/api/auth/userinfo/issue" , action ) ; }


signature:
public class AuthleteApiCaller { /** * Call Authlete ' s { @ code / api / auth / introspection } API . */
public IntrospectionResponse callIntrospection ( String accessToken , String [ ] scopes , String subject , String clientCertificate ) { } }

implementation:
// Create a request for / api / auth / introspection API .
IntrospectionRequest request = new IntrospectionRequest ( ) . setToken ( accessToken ) . setScopes ( scopes ) . setSubject ( subject ) . setClientCertificate ( clientCertificate ) ; try { // Call Authlete ' s / api / auth / introspection API .
return mApi . introspection ( request ) ; } catch ( AuthleteApiException e ) { // The API call failed .
throw apiFailure ( "/api/auth/introspection" , e ) ; }


signature:
public class AuthleteApiCaller { /** * Call Authlete ' s { @ code / api / auth / introspection / standard } API . */
public StandardIntrospectionResponse callStandardIntrospection ( MultivaluedMap < String , String > parameters ) { } }

implementation: String params = URLCoder . formUrlEncode ( parameters ) ; return callStandardIntrospection ( params ) ;


signature:
public class AuthleteApiCaller { /** * Call Authlete ' s { @ code / api / auth / introspection / standard } API . */
private StandardIntrospectionResponse callStandardIntrospection ( String parameters ) { } }

implementation:
if ( parameters == null ) { // Authlete returns different error codes for null and an empty string .
// ' null ' is regarded as a caller ' s error . An empty string is regarded
// as a client application ' s error .
parameters = "" ; } // Create a request for Authlete ' s / api / auth / introspection / standard API .
StandardIntrospectionRequest request = new StandardIntrospectionRequest ( ) . setParameters ( parameters ) ; try { // Call Authlete ' s / api / auth / introspection / standard API .
return mApi . standardIntrospection ( request ) ; } catch ( AuthleteApiException e ) { // The API call failed .
throw apiFailure ( "/api/auth/introspection/standard" , e ) ; }


signature:
public class AuthleteApiCaller { /** * Call Authlete ' s { @ code / api / backchannel / authentication } API . */
public BackchannelAuthenticationResponse callBackchannelAuthentication ( MultivaluedMap < String , String > parameters , String clientId , String clientSecret , String clientCertificate , String [ ] clientCertificatePath ) { } }

implementation: String params = URLCoder . formUrlEncode ( parameters ) ; return callBackchannelAuthentication ( params , clientId , clientSecret , clientCertificate , clientCertificatePath ) ;


signature:
public class AuthleteApiCaller { /** * Call Authlete ' s { @ code / api / backchannel / authentication } API . */
private BackchannelAuthenticationResponse callBackchannelAuthentication ( String parameters , String clientId , String clientSecret , String clientCertificate , String [ ] clientCertificatePath ) { } }

implementation:
if ( parameters == null ) { // Authlete returns different error codes for null and an empty string .
// ' null ' is regarded as a caller ' s error . An empty string is regarded
// as a client application ' s error .
parameters = "" ; } // Create a request for Authlete ' s / api / backchannel / authentication API .
BackchannelAuthenticationRequest request = new BackchannelAuthenticationRequest ( ) . setParameters ( parameters ) . setClientId ( clientId ) . setClientSecret ( clientSecret ) . setClientCertificate ( clientCertificate ) . setClientCertificatePath ( clientCertificatePath ) ; try { // Call Authlete ' s / api / backchannel / authentication API .
return mApi . backchannelAuthentication ( request ) ; } catch ( AuthleteApiException e ) { // The API call failed .
throw apiFailure ( "/api/backchannel/authentication" , e ) ; }


signature:
public class AuthleteApiCaller { /** * Call Authlete ' s { @ code / api / backchannel / authentication / fail } API . */
private BackchannelAuthenticationFailResponse callBackchannelAuthenticationFail ( String ticket , BackchannelAuthenticationFailRequest . Reason reason ) { } }

implementation:
// Create a request for / api / backchannel / authentication / fail API .
BackchannelAuthenticationFailRequest request = new BackchannelAuthenticationFailRequest ( ) . setTicket ( ticket ) . setReason ( reason ) ; try { // Call Authlete ' s / api / backchannel / authentication / fail API .
return mApi . backchannelAuthenticationFail ( request ) ; } catch ( AuthleteApiException e ) { // The API call failed .
throw apiFailure ( "/api/backchannel/authentication/fail" , e ) ; }


signature:
public class AuthleteApiCaller { /** * Create a response that describes the failure . This method
 * calls Authlete ' s { @ code / api / backchannel / authentication / fail } API . */
private Response createBackchannelAuthenticationFailResponse ( String ticket , BackchannelAuthenticationFailRequest . Reason reason ) { } }

implementation:
// Call Authlete ' s / api / backchannel / authentication / fail API .
BackchannelAuthenticationFailResponse response = callBackchannelAuthenticationFail ( ticket , reason ) ; // ' action ' in the response denotes the next action which
// this service implementation should take .
BackchannelAuthenticationFailResponse . Action action = response . getAction ( ) ; // The content of the response to the client application .
// The format of the content varies depending on the action .
String content = response . getResponseContent ( ) ; // Dispatch according to the action .
switch ( action ) { case INTERNAL_SERVER_ERROR : // 500 Internal Server Error
return ResponseUtil . internalServerError ( content ) ; case FORBIDDEN : // 403 Forbidden .
return ResponseUtil . forbidden ( content ) ; case BAD_REQUEST : // 400 Bad Request
return ResponseUtil . badRequest ( content ) ; default : // This never happens .
throw unknownAction ( "/api/backchannel/authentication/fail" , action ) ; }


signature:
public class AuthleteApiCaller { /** * Create an exception that describes the failure . This method
 * calls Authlete ' s { @ code / api / backchannel / authentication / fail } API . */
public WebApplicationException backchannelAuthenticationFail ( String ticket , BackchannelAuthenticationFailRequest . Reason reason ) { } }

implementation:
// Create a response to the client application with the help of
// Authlete ' s / api / backchannel / authentication / fail API .
Response response = createBackchannelAuthenticationFailResponse ( ticket , reason ) ; // Create an exception containing the response .
return new WebApplicationException ( response ) ;


signature:
public class AuthleteApiCaller { /** * Call Authlete ' s { @ code / api / backchannel / authentication / issue } API . */
public BackchannelAuthenticationIssueResponse callBackchannelAuthenticationIssue ( String ticket ) { } }

implementation:
// Create a request for / api / backchannel / authentication / issue API .
BackchannelAuthenticationIssueRequest request = new BackchannelAuthenticationIssueRequest ( ) . setTicket ( ticket ) ; try { // Call Authlete ' s / api / backchannel / authentication / issue API .
return mApi . backchannelAuthenticationIssue ( request ) ; } catch ( AuthleteApiException e ) { // The API call failed .
throw apiFailure ( "/api/backchannel/authentication/issue" , e ) ; }


signature:
public class AuthleteApiCaller { /** * Call Authlete ' s { @ code / api / backchannel / authentication / complete } API . */
public BackchannelAuthenticationCompleteResponse callBackchannelAuthenticationComplete ( String ticket , String subject , Result result , long authTime , String acr , Map < String , Object > claims , Property [ ] properties , String [ ] scopes , String errorDescription , URI errorUri ) { } }

implementation:
// Create a request for / api / backchannel / authentication / complete API .
BackchannelAuthenticationCompleteRequest request = new BackchannelAuthenticationCompleteRequest ( ) . setTicket ( ticket ) . setSubject ( subject ) . setResult ( result ) . setAuthTime ( authTime ) . setAcr ( acr ) . setProperties ( properties ) . setScopes ( scopes ) . setErrorDescription ( errorDescription ) . setErrorUri ( errorUri ) ; if ( claims != null && claims . size ( ) != 0 ) { request . setClaims ( claims ) ; } try { // Call Authlete ' s / api / backchannel / authentication / complete API .
return mApi . backchannelAuthenticationComplete ( request ) ; } catch ( AuthleteApiException e ) { // The API call failed .
throw apiFailure ( "/api/backchannel/authentication/complete" , e ) ; }


signature:
public class ConfigurationRequestHandler { /** * Handle a request to an OpenID Provider configuration endpoint . This
 * method internally calls Authlete ' s { @ code / api / service / configuration }
 * API .
 * @ param pretty
 * { @ code true } to return the output JSON in pretty format .
 * @ return
 * A response that should be returned from the endpoint to
 * the client application .
 * @ throws WebApplicationException
 * An error occurred . */
public Response handle ( boolean pretty ) throws WebApplicationException { } }

implementation:
try { // Call Authlete ' s / api / service / configuration API .
// The API returns a JSON that complies with
// OpenID Connect Discovery 1.0.
String json = getApiCaller ( ) . callServiceConfiguration ( pretty ) ; // Response as " application / json ; charset = UTF - 8 " with 200 OK .
return ResponseUtil . ok ( json ) ; } catch ( WebApplicationException e ) { // The API call raised an exception .
throw e ; } catch ( Throwable t ) { // Unexpected error .
throw unexpected ( "Unexpected error in ConfigurationRequestHandler" , t ) ; }


signature:
public class BackchannelAuthenticationCompleteRequestHandler { /** * Call Authlete ' s { @ code / api / backchannel / authentication / complete } API with an unsuccessful
 * result .
 * @ param ticket
 * A ticket that was issued by Authlete ' s { @ code / api / backchannel / authentication }
 * API .
 * @ param subject
 * The subject of the authenticated user .
 * @ param result
 * The result of end - user authentication and authorization .
 * @ param errorDescription
 * The description of the error .
 * @ param errorUri
 * The URI of a document which describes the error in detail .
 * @ return
 * A response from Authlete ' s { @ code / api / backchannel / authentication / complete }
 * API . */
private BackchannelAuthenticationCompleteResponse fail ( String ticket , String subject , Result result , String errorDescription , URI errorUri ) { } }

implementation: return callBackchannelAuthenticationComplete ( ticket , subject , result , 0 , null , null , null , null , errorDescription , errorUri ) ;


signature:
public class BackchannelAuthenticationCompleteRequestHandler { /** * Call Authlete ' s { @ code / api / backchannel / authentication / complete } API with
 * successful authorization .
 * @ param ticket
 * A ticket that was issued by Authlete ' s { @ code / api / backchannel / authentication }
 * API .
 * @ param subject
 * The subject ( = unique identifier ) of the end - user .
 * @ param authTime
 * The time when end - user authentication occurred . The number of
 * seconds since Unix epoch ( 1970-01-01 ) . This value is used as
 * the value of { @ code auth _ time } claim in an ID token that may
 * be issued . Pass 0 if the time is unknown .
 * @ param acr
 * The authentication context class reference that the end - user
 * authentication satisfied . This value is used as the value of
 * { @ code acr } claim in an ID token that may be issued . Pass
 * { @ code null } if ACR is unknown .
 * @ param claims
 * Pairs of claim key and claim value . The pairs are embedded
 * in an ID token that may be issued . Passing { @ code null } means
 * that values of the requested claims are not available .
 * @ param properties
 * Extra properties to associate with an access token .
 * @ param scopes
 * Scopes to associate with an access token . If { @ code null } is given ,
 * the scopes contained in the original backchannel authentication
 * request are used . Otherwise , the scopes given to this method replace
 * the scopes .
 * @ return
 * A response from Authlete ' s { @ code / api / backchannel / authentication / complete }
 * API . */
private BackchannelAuthenticationCompleteResponse authorize ( String ticket , String subject , long authTime , String acr , Map < String , Object > claims , Property [ ] properties , String [ ] scopes ) { } }

implementation: return callBackchannelAuthenticationComplete ( ticket , subject , Result . AUTHORIZED , authTime , acr , claims , properties , scopes , null , null ) ;


signature:
public class AuthorizationPageModel { /** * Compute the initial value for the login ID field in the
 * authorization page . */
private static String computeLoginId ( AuthorizationResponse info ) { } }

implementation: if ( info . getSubject ( ) != null ) { return info . getSubject ( ) ; } return info . getLoginHint ( ) ;


signature:
public class BaseJwksEndpoint { /** * Handle a request for a JWK Set document .
 * This method internally creates a { @ link JwksRequestHandler } instance and
 * calls its { @ link JwksRequestHandler # handle ( ) } method . Then , this method
 * uses the value returned from the { @ code handle ( ) } method as a response
 * from this method .
 * When { @ code JwksRequestHandler . handle ( ) } method raises a { @ link
 * WebApplicationException } , this method calls { @ link # onError ( WebApplicationException )
 * onError ( ) } method with the exception . The default implementation of { @ code onError ( ) }
 * calls { @ code printStackTrace ( ) } of the exception and does nothing else . You
 * can override the method as necessary . After calling { @ code onError ( ) } method ,
 * this method calls { @ code getResponse ( ) } method of the exception and uses the
 * returned value as a response from this method .
 * @ param api
 * An implementation of { @ link AuthleteApi } .
 * @ return
 * A response that should be returned to the client application . */
public Response handle ( AuthleteApi api ) { } }

implementation:
try { // Create a handler .
JwksRequestHandler handler = new JwksRequestHandler ( api ) ; // Delegate the task to the handler .
return handler . handle ( ) ; } catch ( WebApplicationException e ) { // An error occurred in the handler .
onError ( e ) ; // Convert the error to a Response .
return e . getResponse ( ) ; }


signature:
public class BaseTokenEndpoint { /** * Handle a token request .
 * This method is an alias of the { @ link # handle ( AuthleteApi ,
 * TokenRequestHandlerSpi , MultivaluedMap , String , String [ ] ) handle ( ) }
 * method that accepts 5 arguments .
 * @ param api
 * An implementation of { @ link AuthleteApi } .
 * @ param spi
 * An implementation of { @ link TokenRequestHandlerSpi } .
 * @ param parameters
 * Request parameters of the token request .
 * @ param authorization
 * The value of { @ code Authorization } header of the token request .
 * @ return
 * A response that should be returned to the client application . */
public Response handle ( AuthleteApi api , TokenRequestHandlerSpi spi , MultivaluedMap < String , String > parameters , String authorization ) { } }

implementation: return handle ( api , spi , parameters , authorization , null ) ;


signature:
public class BaseTokenEndpoint { /** * Handle a token request .
 * This method internally creates a { @ link TokenRequestHandler } instance and
 * calls its { @ link TokenRequestHandler # handle ( MultivaluedMap , String ) } method .
 * Then , this method uses the value returned from the { @ code handle ( ) } method
 * as a response from this method .
 * When { @ code TokenRequestHandler . handle ( ) } method raises a { @ link
 * WebApplicationException } , this method calls { @ link # onError ( WebApplicationException )
 * onError ( ) } method with the exception . The default implementation of { @ code onError ( ) }
 * does nothing . You can override the method as necessary . After calling
 * { @ code onError ( ) } method , this method calls { @ code getResponse ( ) } method of
 * the exception and uses the returned value as a response from this method .
 * @ param api
 * An implementation of { @ link AuthleteApi } .
 * @ param spi
 * An implementation of { @ link TokenRequestHandlerSpi } .
 * @ param parameters
 * Request parameters of the token request .
 * @ param authorization
 * The value of { @ code Authorization } header of the token request .
 * @ param clientCertificatePath
 * The certificate path used in mutual TLS authentication , in PEM format . The
 * client ' s own certificate is the first in this array . Can be { @ code null } .
 * @ return
 * A response that should be returned to the client application .
 * @ since 2.8 */
public Response handle ( AuthleteApi api , TokenRequestHandlerSpi spi , MultivaluedMap < String , String > parameters , String authorization , String [ ] clientCertificatePath ) { } }

implementation:
try { // Create a handler .
TokenRequestHandler handler = new TokenRequestHandler ( api , spi ) ; // Delegate the task to the handler .
return handler . handle ( parameters , authorization , clientCertificatePath ) ; } catch ( WebApplicationException e ) { // An error occurred in the handler .
onError ( e ) ; // Convert the error to a Response .
return e . getResponse ( ) ; }


signature:
public class BaseIntrospectionEndpoint { /** * Handle an introspection request .
 * This method internally creates an { @ link IntrospectionRequestHandler }
 * instance and calls its { @ link IntrospectionRequestHandler # handle ( MultivaluedMap )
 * handle ( ) } method with the { @ code parameters } argument . Then , this
 * method uses the value returned from the { @ code handle ( ) } method as a
 * response from this method .
 * When { @ code IntrospectionRequestHandler . handle ( ) } method raises a
 * { @ link WebApplicationException } , this method calls { @ link
 * # onError ( WebApplicationException ) onError ( ) } method with the exception .
 * The default implementation of { @ code onError ( ) } calls { @ code
 * printStackTrace ( ) } of the exception and does nothing else . You can
 * override the method as necessary . After calling { @ code onError ( ) }
 * method , this method calls { @ code getResponse ( ) } method of the
 * exception and uses the returned value as a response from this method .
 * @ param api
 * An implementation of { @ link AuthleteApi } .
 * @ param parameters
 * Request parameters of an introspection request .
 * @ return
 * A response that should be returned to the client application . */
public Response handle ( AuthleteApi api , MultivaluedMap < String , String > parameters ) { } }

implementation:
try { // Create a handler .
IntrospectionRequestHandler handler = new IntrospectionRequestHandler ( api ) ; // Delegate the task to the handler .
return handler . handle ( parameters ) ; } catch ( WebApplicationException e ) { // An error occurred in the handler .
onError ( e ) ; // Convert the error to a Response .
return e . getResponse ( ) ; }


signature:
public class ResponseUtil { /** * Create a response of { @ code " 200 OK " } with the given entity
 * with the given media format . */
public static Response ok ( String entity , MediaType mediaType ) { } }

implementation: return builder ( Status . OK , entity , mediaType ) . build ( ) ;


signature:
public class ResponseUtil { /** * Create a response of { @ code " 200 OK " }
 * with the given entity formatted in
 * { @ code " text / html ; charset = UTF - 8 " } . */
public static Response form ( String entity ) { } }

implementation: return builder ( Status . OK , entity , MEDIA_TYPE_HTML ) . build ( ) ;


signature:
public class ResponseUtil { /** * Create a response of { @ code " 200 OK " }
 * with the given entity formatted in
 * { @ code " application / javascript ; charset = UTF - 8 " } . */
public static Response javaScript ( String entity ) { } }

implementation: return builder ( Status . OK , entity , MEDIA_TYPE_JAVASCRIPT ) . build ( ) ;


signature:
public class ResponseUtil { /** * Create a response of { @ code " 302 Found " }
 * with { @ code Location } header having the given location . */
public static Response location ( String location ) { } }

implementation: return builder ( Status . FOUND ) . header ( HttpHeaders . LOCATION , location ) . build ( ) ;


signature:
public class ResponseUtil { /** * Create a response of { @ code " 400 Bad Request " }
 * with the given entity formatted in
 * { @ code " application / json ; charset = UTF - 8 " } . */
public static Response badRequest ( String entity ) { } }

implementation: return builder ( Status . BAD_REQUEST , entity , MEDIA_TYPE_JSON ) . build ( ) ;


signature:
public class ResponseUtil { /** * Create a response of { @ code " 401 Unauthorized " }
 * with the given entity formatted in
 * { @ code " application / json ; charset = UTF - 8 " } and
 * with { @ code WWW - Authenticate } header having the
 * value specified by { @ code challenge } . */
public static Response unauthorized ( String entity , String challenge ) { } }

implementation: return builder ( Status . UNAUTHORIZED , entity , MEDIA_TYPE_JSON ) . header ( HttpHeaders . WWW_AUTHENTICATE , challenge ) . build ( ) ;


signature:
public class ResponseUtil { /** * Create a response of { @ code " 403 Forbidden " }
 * with the given entity formatted in
 * { @ code " application / json ; charset = UTF - 8 " } . */
public static Response forbidden ( String entity ) { } }

implementation: return builder ( Status . FORBIDDEN , entity , MEDIA_TYPE_JSON ) . build ( ) ;


signature:
public class ResponseUtil { /** * Create a response of { @ code " 404 Not Found " }
 * with the given entity formatted in
 * { @ code " application / json ; charset = UTF - 8 " } . */
public static Response notFound ( String entity ) { } }

implementation: return builder ( Status . NOT_FOUND , entity , MEDIA_TYPE_JSON ) . build ( ) ;


signature:
public class ResponseUtil { /** * Create a response of { @ code " 500 Internal Server Error " }
 * with the given entity . */
public static Response internalServerError ( String entity , MediaType mediaType ) { } }

implementation: return builder ( Status . INTERNAL_SERVER_ERROR , entity , mediaType ) . build ( ) ;


signature:
public class ResponseUtil { /** * Create a { @ link ResponseBuilder } with the specified status ,
 * { @ code Cache - Control } header and { @ code Pragma } header . */
private static ResponseBuilder builder ( Status status ) { } }

implementation: return Response . status ( status ) . cacheControl ( CACHE_CONTROL ) . header ( "Pragma" , "no-cache" ) ;


signature:
public class ResponseUtil { /** * Create a { @ link ResponseBuilder } . */
private static ResponseBuilder builder ( Status status , String entity , MediaType type ) { } }

implementation: return builder ( status ) . entity ( entity ) . type ( type ) ;


signature:
public class ResponseUtil { /** * Create a response with the given status and { @ code WWW - Authenticate }
 * header having the given challenge as its value . */
public static Response bearerError ( Status status , String challenge ) { } }

implementation: return builder ( status ) . header ( "WWW-Authenticate" , challenge ) . build ( ) ;


signature:
public class AuthleteApiImpl { /** * Create an authorization header for the service owner . */
private String createServiceOwnerCredentials ( AuthleteConfiguration configuration ) { } }

implementation: if ( configuration . getServiceOwnerAccessToken ( ) != null ) { return "Bearer " + configuration . getServiceOwnerAccessToken ( ) ; } else { String key = configuration . getServiceOwnerApiKey ( ) ; String secret = configuration . getServiceOwnerApiSecret ( ) ; return new BasicCredentials ( key , secret ) . format ( ) ; }


signature:
public class AuthleteApiImpl { /** * Create an authorization header for the service . */
private String createServiceCredentials ( AuthleteConfiguration configuration ) { } }

implementation: if ( configuration . getServiceAccessToken ( ) != null ) { return "Bearer " + configuration . getServiceAccessToken ( ) ; } else { String key = configuration . getServiceApiKey ( ) ; String secret = configuration . getServiceApiSecret ( ) ; return new BasicCredentials ( key , secret ) . format ( ) ; }


signature:
public class AuthleteApiImpl { /** * Get an instance of JAX - RS client . */
private javax . ws . rs . client . Client getJaxRsClient ( ) { } }

implementation:
// If a JAX - RS client has not been created yet .
if ( mJaxRsClient == null ) { // Create a JAX - RS client .
javax . ws . rs . client . Client client = createJaxRsClient ( ) ; synchronized ( this ) { if ( mJaxRsClient == null ) { mJaxRsClient = client ; } } } // Set a connection timeout .
setConnectionTimeout ( mJaxRsClient ) ; // Set a read timeout .
setReadTimeout ( mJaxRsClient ) ; return mJaxRsClient ;


signature:
public class AuthleteApiImpl { /** * Create an instance of JAX - RS client . */
private javax . ws . rs . client . Client createJaxRsClient ( ) { } }

implementation:
if ( getJaxRsClientBuilder ( ) != null ) { // if we have a builder configured , use it
return getJaxRsClientBuilder ( ) . build ( ) ; } else { // otherwise just use the system discovered default
return ClientBuilder . newClient ( ) ; }


signature:
public class AuthleteApiImpl { /** * Set a connection timeout . */
private void setConnectionTimeout ( javax . ws . rs . client . Client client ) { } }

implementation:
// The timeout value .
int timeout = mSettings . getConnectionTimeout ( ) ; synchronized ( mConnectionTimeoutLock ) { if ( mCurrentConnectionTimeout == timeout ) { // The given value is the same as the current one .
// Let ' s skip calling property ( ) method .
return ; } // The given value is different from the current value .
// Let ' s update the configuration .
mCurrentConnectionTimeout = timeout ; } // Note that there was no standardized way to set the connection timeout
// before JAX - RS API 2.1 ( Java EE 8 ) ( cf . ClientBuilder . connectTimeout ) .
// Convert int to Integer before calling property ( ) method multiple times
// in order to reduce the number of object creation by autoboxing .
Integer value = Integer . valueOf ( timeout ) ; // For Jersey
client . property ( "jersey.config.client.connectTimeout" , value ) ; // For Apache CXF
client . property ( "http.connection.timeout" , value ) ; // For WebSphere ( 8.5.5.7 + )
client . property ( "com.ibm.ws.jaxrs.client.connection.timeout" , value ) ;


signature:
public class AuthleteApiImpl { /** * Set a read timeout . */
private void setReadTimeout ( javax . ws . rs . client . Client client ) { } }

implementation:
// The timeout value .
int timeout = mSettings . getReadTimeout ( ) ; synchronized ( mReadTimeoutLock ) { if ( mCurrentReadTimeout == timeout ) { // The given value is the same as the current one .
// Let ' s skip calling property ( ) method .
return ; } // The given value is different from the current value .
// Let ' s update the configuration .
mCurrentReadTimeout = timeout ; } // Note that there was no standardized way to set the read timeout
// before JAX - RS API 2.1 ( Java EE 8 ) ( cf . ClientBuilder . readTimeout ) .
// Convert int to Integer before calling property ( ) method multiple times
// in order to reduce the number of object creation by autoboxing .
Integer value = Integer . valueOf ( timeout ) ; // For Jersey
client . property ( "jersey.config.client.readTimeout" , value ) ; // For Apache CXF
client . property ( "http.receive.timeout" , value ) ; // For WebSphere ( 8.5.5.7 + )
client . property ( "com.ibm.ws.jaxrs.client.receive.timeout" , value ) ;


signature:
public class AuthleteApiImpl { /** * Execute an Authlete API call . */
private < TResponse > TResponse executeApiCall ( AuthleteApiCall < TResponse > apiCall ) throws AuthleteApiException { } }

implementation:
try { // Call the Authlete API .
return apiCall . call ( ) ; } catch ( WebApplicationException e ) { // Throw an exception with HTTP response information .
throw createApiException ( e , e . getResponse ( ) ) ; } catch ( ResponseProcessingException e ) { // Throw an exception with HTTP response information .
throw createApiException ( e , e . getResponse ( ) ) ; } catch ( Throwable t ) { // Throw an exception without HTTP response information .
throw createApiException ( t , null ) ; }


signature:
public class AuthleteApiImpl { /** * Create an { @ link AuthleteApiException } instance . */
private AuthleteApiException createApiException ( Throwable cause , Response response ) { } }

implementation:
// Error message .
String message = cause . getMessage ( ) ; if ( response == null ) { // Create an exception without HTTP response information .
return new AuthleteApiException ( message , cause ) ; } // Status code and status message .
int statusCode = 0 ; String statusMessage = null ; // Get the status information .
StatusType type = response . getStatusInfo ( ) ; if ( type != null ) { statusCode = type . getStatusCode ( ) ; statusMessage = type . getReasonPhrase ( ) ; } // Response body .
String responseBody = null ; // If the response has response body .
if ( hasEntity ( response ) ) { // Get the response body .
responseBody = extractResponseBody ( response ) ; } // Response headers .
Map < String , List < String > > headers = response . getStringHeaders ( ) ; // Create an exception with HTTP response information .
return new AuthleteApiException ( message , cause , statusCode , statusMessage , responseBody , headers ) ;


signature:
public class AuthleteApiImpl { /** * Call { @ code / api / auth / authorization } API . */
@ Override public AuthorizationResponse authorization ( AuthorizationRequest request ) throws AuthleteApiException { } }

implementation: return executeApiCall ( new ServicePostApiCaller < AuthorizationResponse > ( AuthorizationResponse . class , request , AUTH_AUTHORIZATION_API_PATH ) ) ;


signature:
public class AuthleteApiImpl { /** * Call { @ code / api / auth / authorization / fail } API . */
@ Override public AuthorizationFailResponse authorizationFail ( AuthorizationFailRequest request ) throws AuthleteApiException { } }

implementation: return executeApiCall ( new ServicePostApiCaller < AuthorizationFailResponse > ( AuthorizationFailResponse . class , request , AUTH_AUTHORIZATION_FAIL_API_PATH ) ) ;


signature:
public class AuthleteApiImpl { /** * Call { @ code / api / auth / authorization / issue } API . */
@ Override public AuthorizationIssueResponse authorizationIssue ( AuthorizationIssueRequest request ) throws AuthleteApiException { } }

implementation: return executeApiCall ( new ServicePostApiCaller < AuthorizationIssueResponse > ( AuthorizationIssueResponse . class , request , AUTH_AUTHORIZATION_ISSUE_API_PATH ) ) ;


signature:
public class AuthleteApiImpl { /** * Call { @ code / api / auth / token } API . */
@ Override public TokenResponse token ( TokenRequest request ) throws AuthleteApiException { } }

implementation: return executeApiCall ( new ServicePostApiCaller < TokenResponse > ( TokenResponse . class , request , AUTH_TOKEN_API_PATH ) ) ;


signature:
public class AuthleteApiImpl { /** * Call { @ code / api / auth / token / create } API . */
@ Override public TokenCreateResponse tokenCreate ( TokenCreateRequest request ) throws AuthleteApiException { } }

implementation: return executeApiCall ( new ServicePostApiCaller < TokenCreateResponse > ( TokenCreateResponse . class , request , AUTH_TOKEN_CREATE_API_PATH ) ) ;


signature:
public class AuthleteApiImpl { /** * Call { @ code / api / auth / token / fail } API . */
@ Override public TokenFailResponse tokenFail ( TokenFailRequest request ) throws AuthleteApiException { } }

implementation: return executeApiCall ( new ServicePostApiCaller < TokenFailResponse > ( TokenFailResponse . class , request , AUTH_TOKEN_FAIL_API_PATH ) ) ;


signature:
public class AuthleteApiImpl { /** * Call { @ code / api / auth / token / issue } API . */
@ Override public TokenIssueResponse tokenIssue ( TokenIssueRequest request ) throws AuthleteApiException { } }

implementation: return executeApiCall ( new ServicePostApiCaller < TokenIssueResponse > ( TokenIssueResponse . class , request , AUTH_TOKEN_ISSUE_API_PATH ) ) ;


signature:
public class AuthleteApiImpl { /** * Call { @ code / api / auth / token / update } API . */
@ Override public TokenUpdateResponse tokenUpdate ( TokenUpdateRequest request ) throws AuthleteApiException { } }

implementation: return executeApiCall ( new ServicePostApiCaller < TokenUpdateResponse > ( TokenUpdateResponse . class , request , AUTH_TOKEN_UPDATE_API_PATH ) ) ;


signature:
public class AuthleteApiImpl { /** * Call { @ code / api / auth / revocation } API . */
@ Override public RevocationResponse revocation ( RevocationRequest request ) throws AuthleteApiException { } }

implementation: return executeApiCall ( new ServicePostApiCaller < RevocationResponse > ( RevocationResponse . class , request , AUTH_REVOCATION_API_PATH ) ) ;


signature:
public class AuthleteApiImpl { /** * Call { @ code / api / auth / userinfo } API . */
@ Override public UserInfoResponse userinfo ( UserInfoRequest request ) throws AuthleteApiException { } }

implementation: return executeApiCall ( new ServicePostApiCaller < UserInfoResponse > ( UserInfoResponse . class , request , AUTH_USERINFO_API_PATH ) ) ;


signature:
public class AuthleteApiImpl { /** * Call { @ code / api / auth / userinfo / issue } API . */
@ Override public UserInfoIssueResponse userinfoIssue ( UserInfoIssueRequest request ) throws AuthleteApiException { } }

implementation: return executeApiCall ( new ServicePostApiCaller < UserInfoIssueResponse > ( UserInfoIssueResponse . class , request , AUTH_USERINFO_ISSUE_API_PATH ) ) ;


signature:
public class AuthleteApiImpl { /** * Call { @ code / api / auth / introspection } API . */
@ Override public IntrospectionResponse introspection ( IntrospectionRequest request ) throws AuthleteApiException { } }

implementation: return executeApiCall ( new ServicePostApiCaller < IntrospectionResponse > ( IntrospectionResponse . class , request , AUTH_INTROSPECTION_API_PATH ) ) ;


signature:
public class AuthleteApiImpl { /** * Call { @ code / api / auth / introspection / standard } API . */
@ Override public StandardIntrospectionResponse standardIntrospection ( StandardIntrospectionRequest request ) throws AuthleteApiException { } }

implementation: return executeApiCall ( new ServicePostApiCaller < StandardIntrospectionResponse > ( StandardIntrospectionResponse . class , request , AUTH_INTROSPECTION_STANDARD_API_PATH ) ) ;


signature:
public class AuthleteApiImpl { /** * Call { @ code / api / service / create } API . */
@ Override public Service createService ( Service service ) throws AuthleteApiException { } }

implementation: return executeApiCall ( new ServiceOwnerPostApiCaller < Service > ( Service . class , service , SERVICE_CREATE_API_PATH ) ) ;


signature:
public class AuthleteApiImpl { /** * Call < code > / api / service / get / < i > { serviceApiKey } < / i > < / code > API . */
@ Override public Service getService ( long apiKey ) throws AuthleteApiException { } }

implementation: return executeApiCall ( new ServiceOwnerGetApiCaller < Service > ( Service . class , SERVICE_GET_API_PATH , apiKey ) ) ;


signature:
public class AuthleteApiImpl { /** * Call < code > / service / get / list < / code > . */
private ServiceListResponse callGetServiceList ( int start , int end , boolean rangeGiven ) { } }

implementation: WebTarget target = getTarget ( ) . path ( SERVICE_GET_LIST_API_PATH ) ; if ( rangeGiven ) { target = target . queryParam ( "start" , start ) . queryParam ( "end" , end ) ; } return target . request ( APPLICATION_JSON_TYPE ) . header ( AUTHORIZATION , mServiceOwnerAuth ) . get ( ServiceListResponse . class ) ;


signature:
public class AuthleteApiImpl { /** * Call < code > / api / service / update / < i > { serviceApiKey } < / i > < / code > API . */
@ Override public Service updateService ( final Service service ) throws AuthleteApiException { } }

implementation: return executeApiCall ( new ServiceOwnerPostApiCaller < Service > ( Service . class , service , SERVICE_UPDATE_API_PATH , service . getApiKey ( ) ) ) ;


signature:
public class AuthleteApiImpl { /** * Call { @ code / api / service / jwks / get } API */
@ Override public String getServiceJwks ( boolean pretty , boolean includePrivateKeys ) throws AuthleteApiException { } }

implementation: return executeApiCall ( new ServiceGetApiCaller < String > ( String . class , SERVICE_JWKS_GET_API_PATH ) . addParam ( "pretty" , pretty ) . addParam ( "includePrivateKeys" , includePrivateKeys ) ) ;


signature:
public class AuthleteApiImpl { /** * Call { @ code / api / service / configuration } API */
@ Override public String getServiceConfiguration ( boolean pretty ) throws AuthleteApiException { } }

implementation: return executeApiCall ( new ServiceGetApiCaller < String > ( String . class , SERVICE_CONFIGURATION_API_PATH ) . addParam ( "pretty" , pretty ) ) ;


signature:
public class AuthleteApiImpl { /** * Call { @ code / api / client / create } API . */
@ Override public Client createClient ( Client client ) throws AuthleteApiException { } }

implementation: return executeApiCall ( new ServicePostApiCaller < Client > ( Client . class , client , CLIENT_CREATE_API_PATH ) ) ;


signature:
public class AuthleteApiImpl { /** * Call { @ code / api / client / register } API . */
@ Override public ClientRegistrationResponse registerClient ( ClientRegistrationRequest request ) throws AuthleteApiException { } }

implementation: return executeApiCall ( new ServicePostApiCaller < ClientRegistrationResponse > ( ClientRegistrationResponse . class , request , CLIENT_REGISTER_API_PATH ) ) ;


signature:
public class AuthleteApiImpl { /** * Call < code > / api / client / get / < i > { clientId } < / i > < / code > API . */
@ Override public Client getClient ( final long clientId ) throws AuthleteApiException { } }

implementation: return executeApiCall ( new ServiceGetApiCaller < Client > ( Client . class , CLIENT_GET_API_PATH , clientId ) ) ;


signature:
public class AuthleteApiImpl { /** * Call < code > / api / client / update / < i > { clientId } < / i > < / code > API . */
@ Override public Client updateClient ( Client client ) throws AuthleteApiException { } }

implementation: return executeApiCall ( new ServicePostApiCaller < Client > ( Client . class , client , CLIENT_UPDATE_API_PATH , client . getClientId ( ) ) ) ;


signature:
public class AuthleteApiImpl { /** * Call < code > / api / client / extension / requestable _ scopes / get / < i > { clientId } < / i > < / code > API . */
@ Override public String [ ] getRequestableScopes ( long clientId ) throws AuthleteApiException { } }

implementation:
// Call the API .
RequestableScopes response = executeApiCall ( new ServiceGetApiCaller < RequestableScopes > ( RequestableScopes . class , REQUESTABLE_SCOPES_GET_API_PATH , clientId ) ) ; if ( response != null ) { // Extract ' requestableScopes ' from the response .
return response . getRequestableScopes ( ) ; } else { return null ; }


signature:
public class AuthleteApiImpl { /** * Call { @ code / api / jose / verify } API . */
@ Override public JoseVerifyResponse verifyJose ( JoseVerifyRequest request ) throws AuthleteApiException { } }

implementation: return executeApiCall ( new ServicePostApiCaller < JoseVerifyResponse > ( JoseVerifyResponse . class , request , JOSE_VERIFY_API_PATH ) ) ;


signature:
public class AuthleteApiImpl { /** * Call { @ code / api / backchannel / authentication } API . */
@ Override public BackchannelAuthenticationResponse backchannelAuthentication ( BackchannelAuthenticationRequest request ) throws AuthleteApiException { } }

implementation: return executeApiCall ( new ServicePostApiCaller < BackchannelAuthenticationResponse > ( BackchannelAuthenticationResponse . class , request , BACKCHANNEL_AUTHENTICATION_API_PATH ) ) ;


signature:
public class AuthleteApiImpl { /** * Call { @ code / api / backchannel / authentication / issue } API . */
@ Override public BackchannelAuthenticationIssueResponse backchannelAuthenticationIssue ( BackchannelAuthenticationIssueRequest request ) throws AuthleteApiException { } }

implementation: return executeApiCall ( new ServicePostApiCaller < BackchannelAuthenticationIssueResponse > ( BackchannelAuthenticationIssueResponse . class , request , BACKCHANNEL_AUTHENTICATION_ISSUE_API_PATH ) ) ;


signature:
public class AuthleteApiImpl { /** * Call { @ code / api / backchannel / authentication / fail } API . */
@ Override public BackchannelAuthenticationFailResponse backchannelAuthenticationFail ( BackchannelAuthenticationFailRequest request ) throws AuthleteApiException { } }

implementation: return executeApiCall ( new ServicePostApiCaller < BackchannelAuthenticationFailResponse > ( BackchannelAuthenticationFailResponse . class , request , BACKCHANNEL_AUTHENTICATION_FAIL_API_PATH ) ) ;


signature:
public class AuthleteApiImpl { /** * Call { @ code / api / backchannel / authentication / complete } API . */
@ Override public BackchannelAuthenticationCompleteResponse backchannelAuthenticationComplete ( BackchannelAuthenticationCompleteRequest request ) throws AuthleteApiException { } }

implementation: return executeApiCall ( new ServicePostApiCaller < BackchannelAuthenticationCompleteResponse > ( BackchannelAuthenticationCompleteResponse . class , request , BACKCHANNEL_AUTHENTICATION_COMPLETE_API_PATH ) ) ;


signature:
public class BaseAuthorizationEndpoint { /** * Handle an authorization request .
 * This method internally creates a { @ link AuthorizationRequestHandler } instance and
 * calls its { @ link AuthorizationRequestHandler # handle ( MultivaluedMap ) } method .
 * Then , this method uses the value returned from the { @ code handle ( ) } method
 * as a response from this method .
 * When { @ code AuthorizationRequestHandler . handle ( ) } method raises a { @ link
 * WebApplicationException } , this method calls { @ link # onError ( WebApplicationException )
 * onError ( ) } method with the exception . The default implementation of { @ code onError ( ) }
 * calls { @ code printStackTrace ( ) } of the exception and does nothing else . You
 * can override the method as necessary . After calling { @ code onError ( ) } method ,
 * this method calls { @ code getResponse ( ) } method of the exception and uses the
 * returned value as a response from this method .
 * @ param api
 * An implementation of { @ link AuthleteApi } .
 * @ param spi
 * An implementation of { @ link AuthorizationRequestHandlerSpi } .
 * @ param parameters
 * Request parameters of the authorization request .
 * @ return
 * A response that should be returned to the client application . */
public Response handle ( AuthleteApi api , AuthorizationRequestHandlerSpi spi , MultivaluedMap < String , String > parameters ) { } }

implementation:
try { // Create a handler .
AuthorizationRequestHandler handler = new AuthorizationRequestHandler ( api , spi ) ; // Delegate the task to the handler .
return handler . handle ( parameters ) ; } catch ( WebApplicationException e ) { // An error occurred in the handler .
onError ( e ) ; // Convert the error to a Response .
return e . getResponse ( ) ; }


signature:
public class IntrospectionRequestHandler { /** * Process the parameters of the introspection request . */
private Response process ( MultivaluedMap < String , String > parameters ) { } }

implementation:
// Call Authlete ' s / api / auth / introspection / standard API .
StandardIntrospectionResponse response = getApiCaller ( ) . callStandardIntrospection ( parameters ) ; // ' action ' in the response denotes the next action which
// this service implementation should take .
Action action = response . getAction ( ) ; // The content of the response to the client application .
String content = response . getResponseContent ( ) ; // Dispatch according to the action .
switch ( action ) { case INTERNAL_SERVER_ERROR : // 500 Internal Server Error
return ResponseUtil . internalServerError ( content ) ; case BAD_REQUEST : // 400 Bad Request
return ResponseUtil . badRequest ( content ) ; case OK : // 200 OK
return ResponseUtil . ok ( content ) ; default : // This never happens .
throw getApiCaller ( ) . unknownAction ( "/api/auth/introspection/standard" , action ) ; }


signature:
public class UserInfoRequestHandler { /** * Handle a userinfo request to a < a href =
 * " http : / / openid . net / specs / openid - connect - core - 1_0 . html # UserInfo "
 * > UserInfo Endpoint < / a > defined in < a href =
 * " http : / / openid . net / specs / openid - connect - core - 1_0 . html " > OpenID Connect
 * Core 1 & # x002E ; 0 < / a > .
 * @ param accessToken
 * An access token .
 * @ return
 * A response that should be returned from the endpoint to the
 * client application .
 * @ throws WebApplicationException
 * An error occurred . */
public Response handle ( String accessToken ) throws WebApplicationException { } }

implementation:
// If an access token is not available .
if ( accessToken == null ) { // Return " 400 Bad Request " .
return ResponseUtil . bearerError ( Status . BAD_REQUEST , CHALLENGE_ON_MISSING_ACCESS_TOKEN ) ; } try { // Process the userinfo request with the access token .
return process ( accessToken ) ; } catch ( WebApplicationException e ) { throw e ; } catch ( Throwable t ) { // Unexpected error .
throw unexpected ( "Unexpected error in UserInfoRequestHandler" , t ) ; }


signature:
public class UserInfoRequestHandler { /** * Process the userinfo request with the access token . */
private Response process ( String accessToken ) { } }

implementation:
// Call Authlete ' s / api / auth / userinfo API .
UserInfoResponse response = getApiCaller ( ) . callUserInfo ( accessToken ) ; // ' action ' in the response denotes the next action which
// this service implementation should take .
Action action = response . getAction ( ) ; // The content of the response to the client application .
String content = response . getResponseContent ( ) ; // Dispatch according to the action .
switch ( action ) { case INTERNAL_SERVER_ERROR : // 500 Internal Server Error
return ResponseUtil . bearerError ( Status . INTERNAL_SERVER_ERROR , content ) ; case BAD_REQUEST : // 400 Bad Request
return ResponseUtil . bearerError ( Status . BAD_REQUEST , content ) ; case UNAUTHORIZED : // 401 Unauthorized
return ResponseUtil . bearerError ( Status . UNAUTHORIZED , content ) ; case FORBIDDEN : // 403 Forbidden
return ResponseUtil . bearerError ( Status . FORBIDDEN , content ) ; case OK : // Return the user information .
return getUserInfo ( response ) ; default : // This never happens .
throw getApiCaller ( ) . unknownAction ( "/api/auth/userinfo" , action ) ; }


signature:
public class UserInfoRequestHandler { /** * Generate a JSON or a JWT containing user information by calling
 * Authlete ' s { @ code / api / auth / userinfo / issue } API . */
private Response getUserInfo ( UserInfoResponse response ) { } }

implementation:
// Collect claim values of the user .
Map < String , Object > claims = collectClaims ( response . getSubject ( ) , response . getClaims ( ) ) ; try { // Generate a JSON or a JWT containing user information
// by calling Authlete ' s / api / auth / userinfo / issue API .
return getApiCaller ( ) . userInfoIssue ( response . getToken ( ) , claims ) ; } catch ( WebApplicationException e ) { return e . getResponse ( ) ; }


signature:
public class BaseUserInfoEndpoint { /** * Handle a userinfo request .
 * This method internally creates a { @ link UserInfoRequestHandler } instance
 * and calls its { @ link UserInfoRequestHandler # handle ( String ) } method .
 * Then , this method uses the value returned from the { @ code handle ( ) } method
 * as a response from this method .
 * When { @ code UserInfoRequestHandler . handle ( ) } method raises a { @ link
 * WebApplicationException } , this method calls { @ link # onError ( WebApplicationException )
 * onError ( ) } method with the exception . The default implementation of { @ code onError ( ) }
 * calls { @ code printStackTrace ( ) } of the exception and does nothing else . You
 * can override the method as necessary . After calling { @ code onError ( ) } method ,
 * this method calls { @ code getResponse ( ) } method of the exception and uses the
 * returned value as a response from this method .
 * @ param api
 * An implementation of { @ link AuthleteApi } .
 * @ param spi
 * An implementation of { @ link UserInfoRequestHandlerSpi } .
 * @ param accessToken
 * An access token .
 * @ return
 * A response that should be returned to the client application . */
public Response handle ( AuthleteApi api , UserInfoRequestHandlerSpi spi , String accessToken ) { } }

implementation:
try { // Create a handler .
UserInfoRequestHandler handler = new UserInfoRequestHandler ( api , spi ) ; // Delegate the task to the handler .
return handler . handle ( accessToken ) ; } catch ( WebApplicationException e ) { // An error occurred in the handler .
onError ( e ) ; // Convert the error to a Response .
return e . getResponse ( ) ; }


signature:
public class AuthorizationRequestHandler { /** * Handle an authorization request to a < a href =
 * " https : / / tools . ietf . org / html / rfc6749 # section - 3.1 " > authorization endpoint < / a >
 * of OAuth 2.0 ( < a href = " https : / / tools . ietf . org / html / rfc6749 " > RFC 6749 < / a > ) .
 * @ param parameters
 * Request parameters of an authorization request .
 * @ return
 * A response that should be returned from the endpoint to the
 * client application .
 * @ throws WebApplicationException
 * An error occurred . */
public Response handle ( MultivaluedMap < String , String > parameters ) throws WebApplicationException { } }

implementation:
try { // Process the given parameters .
return process ( parameters ) ; } catch ( WebApplicationException e ) { throw e ; } catch ( Throwable t ) { // Unexpected error .
throw unexpected ( "Unexpected error in AuthorizationRequestHandler" , t ) ; }


signature:
public class AuthorizationRequestHandler { /** * Process the authorization request . */
private Response process ( MultivaluedMap < String , String > parameters ) { } }

implementation:
// Call Authlete ' s / api / auth / authorization API .
AuthorizationResponse response = getApiCaller ( ) . callAuthorization ( parameters ) ; // ' action ' in the response denotes the next action which
// this service implementation should take .
AuthorizationResponse . Action action = response . getAction ( ) ; // The content of the response to the client application .
// The format of the content varies depending on the action .
String content = response . getResponseContent ( ) ; // Dispatch according to the action .
switch ( action ) { case INTERNAL_SERVER_ERROR : // 500 Internal Server Error
return ResponseUtil . internalServerError ( content ) ; case BAD_REQUEST : // 400 Bad Request
return ResponseUtil . badRequest ( content ) ; case LOCATION : // 302 Found
return ResponseUtil . location ( content ) ; case FORM : // 200 OK
return ResponseUtil . form ( content ) ; case INTERACTION : // Process the authorization request with user interaction .
return handleInteraction ( response ) ; case NO_INTERACTION : // Process the authorization request without user interaction .
// The flow reaches here only when the authorization request
// contained prompt = none .
return handleNoInteraction ( response ) ; default : // This never happens .
throw getApiCaller ( ) . unknownAction ( "/api/auth/authorization" , action ) ; }


signature:
public class AuthorizationRequestHandler { /** * Handle the case where { @ code action } parameter in a response from
 * Authlete ' s { @ code / api / auth / authorization } API is { @ code NO _ INTERACTION } . */
private Response handleNoInteraction ( AuthorizationResponse response ) { } }

implementation:
// Check 1 . End - User Authentication
noInteractionCheckAuthentication ( response ) ; // Get the time when the user was authenticated .
long authTime = mSpi . getUserAuthenticatedAt ( ) ; // Check 2 . Max Age
noInteractionCheckMaxAge ( response , authTime ) ; // The current subject , i . e . the unique ID assigned by
// the service to the current user .
String subject = mSpi . getUserSubject ( ) ; // Check 3 . Subject
noInteractionCheckSubject ( response , subject ) ; // Get the ACR that was satisfied when the current user
// was authenticated .
String acr = mSpi . getAcr ( ) ; // Check 4 . ACR
noInteractionCheckAcr ( response , acr ) ; // Extra properties to associate with an access token and / or
// an authorization code .
Property [ ] properties = mSpi . getProperties ( ) ; // Scopes to associate with an access token and / or an authorization code .
// If a non - null value is returned from mSpi . getScopes ( ) , the scope set
// replaces the scopes that have been specified in the original
// authorization request .
String [ ] scopes = mSpi . getScopes ( ) ; // Issue
return noInteractionIssue ( response , authTime , subject , acr , properties , scopes ) ;


signature:
public class AuthorizationRequestHandler { /** * Check whether an end - user has already logged in or not . */
private void noInteractionCheckAuthentication ( AuthorizationResponse response ) { } }

implementation:
// If the current user has already been authenticated .
if ( mSpi . isUserAuthenticated ( ) ) { // OK .
return ; } // A user must have logged in .
throw getApiCaller ( ) . authorizationFail ( response . getTicket ( ) , Reason . NOT_LOGGED_IN ) ;


signature:
public class RevocationRequestHandler { /** * Process the parameters of the revocation request . */
private Response process ( MultivaluedMap < String , String > parameters , String clientId , String clientSecret ) { } }

implementation:
// Call Authlete ' s / api / auth / revocation API .
RevocationResponse response = getApiCaller ( ) . callRevocation ( parameters , clientId , clientSecret ) ; // ' action ' in the response denotes the next action which
// this service implementation should take .
Action action = response . getAction ( ) ; // The content of the response to the client application .
String content = response . getResponseContent ( ) ; // Dispatch according to the action .
switch ( action ) { case INVALID_CLIENT : // 401 Unauthorized
return ResponseUtil . unauthorized ( content , CHALLENGE ) ; case INTERNAL_SERVER_ERROR : // 500 Internal Server Error
return ResponseUtil . internalServerError ( content ) ; case BAD_REQUEST : // 400 Bad Request
return ResponseUtil . badRequest ( content ) ; case OK : // 200 OK
return ResponseUtil . javaScript ( content ) ; default : // This never happens .
throw getApiCaller ( ) . unknownAction ( "/api/auth/revocation" , action ) ; }


signature:
public class BaseEndpoint { /** * Utility method for extracting a single client certificate from the default
 * certificate extractors . First checks the request itself for an attached
 * certificate using { @ link javax . servlet . request . X509Certificate } , then
 * checks the incoming request headers for reverse - proxied certificates
 * using default headers .
 * @ see ClientCertificateExtractor
 * @ param request
 * The incoming HTTP request to search for the client ' s certificate .
 * @ return
 * The client ' s mutual TLS certificate .
 * @ since 2.8 */
protected String [ ] extractClientCertificateChain ( HttpServletRequest request ) { } }

implementation: for ( ClientCertificateExtractor extractor : clientCertificateExtractors ) { String [ ] chain = extractor . extractClientCertificateChain ( request ) ; if ( chain != null && chain . length > 0 ) { return chain ; } } return null ;


signature:
public class BaseEndpoint { /** * Utility method for extracting a single client certificate from the default
 * certificate extractors . Calls extractClientCertificateChain and returns the
 * first entry in the array , if any , null otherwise .
 * @ param request
 * The incoming HTTP request to search for the client ' s certificate .
 * @ return
 * The client ' s mutual TLS certificate .
 * @ since 2.8 */
protected String extractClientCertificate ( HttpServletRequest request ) { } }

implementation: String [ ] certs = extractClientCertificateChain ( request ) ; if ( certs != null && certs . length > 0 ) { return certs [ 0 ] ; } else { return null ; }


signature:
public class JwksRequestHandler { /** * Handle a request to a JWK Set endpoint . This method internally calls
 * Authlete ' s { @ code / api / service / jwks / get } API .
 * @ param pretty
 * { @ code true } to return the output JSON in pretty format .
 * @ return
 * A response that should be returned from the endpoint to
 * the client application .
 * @ throws WebApplicationException
 * An error occurred . */
public Response handle ( boolean pretty ) throws WebApplicationException { } }

implementation:
try { // Call Authlete ' s / api / service / jwks / get API . It returns the JWK Set
// of the service . Of course , private keys are not included .
return getApiCaller ( ) . serviceJwksGet ( pretty , false ) ; } catch ( WebApplicationException e ) { // The API call raised an exception .
throw e ; } catch ( Throwable t ) { // Unexpected error .
throw unexpected ( "Unexpected error in JwksRequestHandler" , t ) ; }