CR-5340 OPENIG-326 The OAuth2 ResourceServer scopes is now a list of
expressions.

OAuth2ResourceServerFilter.java
- Replaced 'Set<String> scopes' to 'List<Expression> scopes'.
- As the AccessToken defines scopes as Set<String>,
 added a new method to getScopes from List<Expression> to Set<String>.
- InsufficientScopeChallengeHandler is no longer a field of the
OAuth2ResourceServerFilter.
- Added realm attribute to the OAuth2ResourceServerFilter.

OAuth2ResourceServerFilterTest.java
- Fixed tests according to the above modifications.
- Added unit tests with expression evaluations.

man-OAuth2ResourceServerFilter.xml
- Modified doc according to Mark's patch.

git-svn-id: https://svn.forgerock.org/openig/trunk@732 dbb9e58e-28e6-4ce0-90e8-f11d9605b710
Modified error message from the OAuth2Utils#getScopes function as it is
only used by the Client Server and to uniformize the message with the
OAuth2ResourceFilter.

git-svn-id: https://svn.forgerock.org/openig/trunk@733 dbb9e58e-28e6-4ce0-90e8-f11d9605b710
OPENIG-326 - Revert previously introduced List as Set (no duplicate elements)

git-svn-id: https://svn.forgerock.org/openig/trunk@734 dbb9e58e-28e6-4ce0-90e8-f11d9605b710
OPENIG-368 (CR-5326) Use exchange.originalUri in OAuth2ClientFilter

The Client filter heavily use the `exchange.request.uri` property to compute URIs.

That was causing issues because, in the set of upstream filters/handlers, someone
could have rebased the request URI (usually to globally 'redirect' the message
to the protected application). That was causing wrong URI computations (like an
OAuth2 `redirect_uri` with the hostname of the protected application, instead of
the user-facing one of OpenIG).

This changes fix this behaviour with the introduction of an immutable
`exchange.originalUri` property that is the original request URI, as received by the
web container.

The Client filter is now using this instead of the mutable one (`exchange.request.uri`).

Updated the Nascar page sample of the documentation to limit copy/paste errors.

git-svn-id: https://svn.forgerock.org/openig/trunk@735 dbb9e58e-28e6-4ce0-90e8-f11d9605b710
OPENIG-359 (CR-5294) Introduce Audit Framework

The audit framework is a new OpenIG API that gives to users a deeper view (and probably
a better understanding) of what's going on in the observed OpenIG system.

This is an initial version of the audit framework that only supports `Exchange` flow
observation: Filters and Handlers will send `AuditEvent` notifications both when an
Exchange enters or exists.

An `AuditEvent` is a notification that includes meta-information about the observed
component emitter of the notification (its `Name` in particular), a timestamp, the
exchange being captured and a set of tags that helps to qualify the event.

Four tags are supported out-of-the-box: `request`, `response`, `completed` and `exception`.
The user can add as many tags as wanted as part of the decoration configuration:

    "audit": "route-#1"  // add a single tag to the decorated component
    "audit": [ "super-tag", "route-#2" ] // add all of theses tags
    "audit": boolean, object, ... // any other format will be ignored

OpenIG provides a single `audit` decorator by default.

Consumers of AuditEvent are `AuditEventListener`, they have to provide their own Heaplet
implementation that extends `ConditionalListenerHeaplet`. They'll be automatically notified
of emitted AuditEvents and can (optionally) filter the received event using the `condition`
configuration attribute (condition is expressed as an `Expression` that needs to evaluate
to a boolean).

Examples of such event-filtering conditions:

    ${true}
    ${contains(tags, 'tag#1')}
    ${source.name.leaf == 'source'}

git-svn-id: https://svn.forgerock.org/openig/trunk@736 dbb9e58e-28e6-4ce0-90e8-f11d9605b710
CR-5327 OPENIG-365 Doc how to configure multiple SAML SPs

This patch adds an appendix
that briefly describes and demonstrates
how OpenIG as a SAML 2.0 SP can support more than one application.

For future consideration I have also opened some issues
that might make this easier:
OPENIG-397, but also OPENIG-399, OPENIG-400.

git-svn-id: https://svn.forgerock.org/openig/trunk@737 dbb9e58e-28e6-4ce0-90e8-f11d9605b710
CR-5343 OPENIG-381 Update doc for change to global decorator config

git-svn-id: https://svn.forgerock.org/openig/trunk@738 dbb9e58e-28e6-4ce0-90e8-f11d9605b710
Remove LogTimer on the GatewayServlet

Timer values should always be obtained through `timer` decorations.

git-svn-id: https://svn.forgerock.org/openig/trunk@739 dbb9e58e-28e6-4ce0-90e8-f11d9605b710
OPENIG-379 CR-5353 Improve logging when JWT sessions are using random keys and ensure that invalid JWT sessions are expired


git-svn-id: https://svn.forgerock.org/openig/trunk@740 dbb9e58e-28e6-4ce0-90e8-f11d9605b710
Placate checkstyle

git-svn-id: https://svn.forgerock.org/openig/trunk@741 dbb9e58e-28e6-4ce0-90e8-f11d9605b710
CR-5379 OPENIG-387 Document removal of "objects" layer from heap

git-svn-id: https://svn.forgerock.org/openig/trunk@742 dbb9e58e-28e6-4ce0-90e8-f11d9605b710
OPENIG-269 (CR-5396) Fix erroneous OAuth 2.0 error codes

Issues an `invalid_request` when there are multiple `Authorization` headers.
Issues an `invalid_token` when there is no bearer token and when the token
can't be resolved (for any reason: expiration, revocation, plain wrong token, ...)

git-svn-id: https://svn.forgerock.org/openig/trunk@743 dbb9e58e-28e6-4ce0-90e8-f11d9605b710
Code simplification

git-svn-id: https://svn.forgerock.org/openig/trunk@744 dbb9e58e-28e6-4ce0-90e8-f11d9605b710
CR-5398 OPENIG-388 Document that empty heap is optional

git-svn-id: https://svn.forgerock.org/openig/trunk@745 dbb9e58e-28e6-4ce0-90e8-f11d9605b710
Reformat XML without material changes to content

git-svn-id: https://svn.forgerock.org/openig/trunk@746 dbb9e58e-28e6-4ce0-90e8-f11d9605b710
CR-5423 OPENIG-392 Document exchange.originalUri

git-svn-id: https://svn.forgerock.org/openig/trunk@747 dbb9e58e-28e6-4ce0-90e8-f11d9605b710
CR-5424 OPENIG-396 Correct doc for logSink used by a TimerDecorator

git-svn-id: https://svn.forgerock.org/openig/trunk@748 dbb9e58e-28e6-4ce0-90e8-f11d9605b710
CR-5426 OPENIG-402 Update DESKEY gen steps for OpenAM 12

This patch anticipates the release of OpenAM 12.
I'm hoping that
http://sources.forgerock.org/browse/openam/trunk/openam/pom.xml?hb=true#to123
does not change before release. 


git-svn-id: https://svn.forgerock.org/openig/trunk@749 dbb9e58e-28e6-4ce0-90e8-f11d9605b710
CR-5444 OPENIG-403 Doc use of unique session field names for SAML SPs

A SamlFederationHandler maps data from the assertion
into the exchange.session object.

With multiple SP configurations, it is important to use unique field names
for mapped data to avoid one handler from overwriting another's session data.

This patch fixes the doc to account for that requirement.

git-svn-id: https://svn.forgerock.org/openig/trunk@750 dbb9e58e-28e6-4ce0-90e8-f11d9605b710
CR-5446 OPENIG-390 Move DumpExchange.groovy out of docs

Now that we have a CaptureDecorator to capture the exchange,
we do not need to document a script for doing the same thing.

In working on this issue, it also became apparent
that these examples did not call for dumping the exchange anyway.


git-svn-id: https://svn.forgerock.org/openig/trunk@751 dbb9e58e-28e6-4ce0-90e8-f11d9605b710