Eduard Lebedyuk

Thanks @Barton Pravin for clarifying scope and providing the code snippets!  If you want the claim to be part of the Token endpoint response message, you can use Do properties.ResponseProperties.SetAt(roles,"roles") 

Heres's a sample of ValidateUser customization

// Use the Cache roles for the user to setup a custom property.
Set sc=##class(Security.Roles).RecurseRoleSet(prop("Roles"),.roles)
If $$$ISERR(sc) Quit 0


Set roles=prop("Roles")
Do properties.CustomProperties.SetAt(roles,"roles") 

// SETUP CUSTOM CLAIMS HERE
Set tClaim = ##class(%OAuth2.Server.Claim).%New()
Do properties.ResponseProperties.SetAt(roles,"roles")
Do properties.IntrospectionClaims.SetAt(tClaim,"roles")
Do properties.UserinfoClaims.SetAt(tClaim,"roles")
Do properties.JWTClaims.SetAt(tClaim,"roles") 
Do properties.SetClaimValue("roles",roles)

And a sample of the REST API application

Class API.DemoBearerToken Extends %CSP.REST
{
Parameter APIHOST = "localhost";

Parameter APIPORT = 57773;

Parameter APIPATH = "/api/demobearertoken";

Parameter CHARSET = "utf-8";

Parameter CONTENTTYPE = "application/json";

Parameter OAUTH2CLIENTREDIRECTURI = "https://localhost:57773/api/demobearertoken/example";

Parameter OAUTH2APPNAME = "demobearertoken";

XData UrlMap [ XMLNamespace = "http://www.intersystems.com/urlmap" ]
{
<Routes>
<Route Url="/getToken" Method="Get" Call="GetToken"/>
</Routes>
}


Classmethod AccessCheck(Output pAuthorized As %Boolean = 0) as %Status
{

Set dayNum = $p($H,",",1)
Set timeNum = $p($H,",",2)


Set accessToken = ..GetAccessTokenFromRequest(%request) 
Set scope = "createModify openid profile publish" 
Set isValidToken=##class(%SYS.OAuth2.Validation).ValidateJWT(..#OAUTH2APPNAME,.accessToken,,,.jsonValidationObject,.securityParameters,.error)
Set ^LOG(dayNum,timeNum,$UserName,"API.DemoBearerToken",$ztimestamp,"AccessCheck")=$zdatetime(dayNum_","_timeNum,4,1,,,4)_"*"_isValidToken

Set:isValidToken=1 pAuthorized=1
Set:isValidToken=0 pAuthorized=0 
Quit $$$OK
}
ClassMethod GetToken() As %Status
{
#dim %response as %CSP.Response
Set %response.Expires = 86400
Set %response.Headers("Cache-Control") = "max-age=86400"

Set dayNum = $p($H,",",1)
Set timeNum = $p($H,",",2) 
Set ^LOG(dayNum,timeNum,$UserName,"API.DemoBearerToken",$ztimestamp,"GetToken")=$zdatetime(dayNum_","_timeNum,4,1,,,4) 
Set accessToken = ..GetAccessTokenFromRequest(%request)
Set scope = "createModify openid profile publish" 
Set valid=##class(%SYS.OAuth2.Validation).ValidateJWT(..#OAUTH2APPNAME,.accessToken,,,.jsonValidationObject,.securityParameters,.error) 

Set introspectionStatus=##class(%SYS.OAuth2.AccessToken).GetIntrospection(..#OAUTH2APPNAME,accessToken,.introspectionJSON) 
Set userInfoStatus = ##class(%SYS.OAuth2.AccessToken).GetUserinfo(..#OAUTH2APPNAME,accessToken,,.userInfoJSON) 
Set jsonResponse = {}.%Set("OAUTH2APPNAME",..#OAUTH2APPNAME)
Do jsonResponse.%Set("ValidateJWT",valid) 

Do jsonResponse.%Set("jsonValidationObject",jsonValidationObject)
Do jsonResponse.%Set("IntrospectionJSON",introspectionJSON)
Do jsonResponse.%Set("sc_userinfo",$$$ISOK(userInfoStatus)) 

If $$$ISOK(userInfoStatus) {
 Do jsonResponse.%Set("UserInfoJSON",userInfoJSON)
}

Write jsonResponse.%ToJSON()

Quit $$$OK 
}

}

And the Postman response for GET https://{{SERVER}}:{{SSLPORT}}/api/demobearertoken/getToken

{

"OAUTH2APPNAME": "demobearertoken",

"ValidateJWT": 1,

"jsonValidationObject": {

"jti": "https://localhost:57773/oauth2.mxn0URwYVkmaX9BSKHGIzISi-cI",

"iss": "https://localhost:57773/oauth2",

"sub": "test1",

"exp": 1565708268,

"aud": "xxxxxxxxxxxxxxxxxxxxx",

"roles": "%DB_CODE,%Manager,createModify,publish"

},

"IntrospectionJSON": {

"active": true,

"scope": "createModify openid profile publish",

"client_id": "xxxxxxxxxxxxxxxxxxxxxxxxxxx",

"username": "test1",

"token_type": "bearer",

"exp": 1565708268,

"sub": "test1",

"aud": "xxxxxxxxxxxxxxxxxxxxxxx",

"iss": "https://localhost:57773/oauth2",

"roles": "%DB_CODE,%Manager,createModify,publish"

},

"sc_userinfo": 1,

"UserInfoJSON": {

"sub": "test1",

"roles": "%DB_CODE,%Manager,createModify,publish"

}

You can see 'roles' has been added to JWT, Introspection and UserInfo claim types. In my real-world application it's probably sufficient to add it to the JWT. 

Also @Eduard Lebedyuk  suggested using the AccessCheck method to verify the token in the post From Cache how to Retrieve and Use/Reuse a Bearer Token to authenticate and send data to REST web service?  AccessCheck is called before anything else so if the token is invalid or has expired a 401 Unauthorized HTTP Response is returned. A web application consuming this REST API can then process this unauthorized status and return them to the login screen. 

@Eduard Lebedyuk, the code you provided is correct, but it does not do a 24-hour calculation from the moment the purge task is started. Instead, it does a midnight-to-midnight calculation in UTC time.

@Eduard Lebedyuk , I am running into an issue when attempting to run the commands in the Cache Terminal.

When typing "S sc=##class(isc.rabbitmq.API).sendMessage()

I get "<METHOD DOES NOT EXIST> *sendMessage,isc.rabbitmq.API"

Also when I created the Java Gateway I got this error

"

Thank you @Eduard Lebedyuk ,  @Bernd Mueller for the tips - yes, it works with a 32-bit Apache server.  For some reason even though CSPGateway-2018.1.1.643.0-win_x64 is the one installed (it's the only one downloaded), the CSPa24.dll is 32-bit according to the above test.

Regards,

Olga

Yes @Eduard Lebedyuk  XML is part of URL,

Sample screen shot of Request from Document:

@Eduard Lebedyuk I have tried changing the file to a txt file and the file is being created with nothing in it

@Eduard Lebedyuk Looked at the class this classEnsLib.RecordMap.Service.BatchFileService and the EnsLib.RecordMap.Service.BatchStandard class apparently these are fine  but for some reason the custom class acts as if it goes into a loop.I have put some traces in my code and tried to capture the status and change  it to fail if a certain validation fails but that makes the whole service to log an error after successfully delivering the first message .

here are the changes made thanks for your help

ClassMethod GetBatchHeader(pIOStream As %IO.DeviceStream, pTimeout As %Numeric = -1, Output pBatch As EnsLib.RecordMap.SimpleBatch, ByRef pLookAhead As %String) As %Status
{
    $$$TRACE("Begin")
 Try {
  #dim cpStatus as %Status=$$$OK
    Set tStatus = $$$OK
    Set pBatch = ""
    Set tTerm = ..GetHeaderTerm()
    //Set tFullHeader = 63 _ tTerm
    Set tHeaderLen =63+$length(tTerm)
    set stage=""
    If tHeaderLen
       {
       Set tFound = 0
       $$$TRACE("0")
       Set tLeadingJunk = ""
       Set pLookAhead = $get(pLookAhead)
       Set tTimeout = pTimeout
       Set tEndTime = $zhorolog + pTimeout
      // While ('tFound) && ('pIOStream.AtEnd)
        //  {
          Set tReadLen = tHeaderLen - $length(pLookAhead)
          If tReadLen > 0
             {
             Set tData = pLookAhead _ pIOStream.Read(tReadLen, .tTimeout, .tStatus)
             $$$TRACE("1")
             If $$$ISERR(tStatus) Quit
             If tTimeout
                {
                Set tStatus = $$$ERROR($$$EnsErrTCPReadTimeoutExpired, pTimeout, tReadLen)
                Quit
                }
                  Set pLookAhead = ""
             }
             Else
             {
             $$$TRACE("Else treadlen less than 0-[2]")
             Set tData = $extract(pLookAhead, 1, tHeaderLen)
             Set pLookAhead = $extract(pLookAhead, tHeaderLen + 1, *)
             }
             If ($extract(tData,1,3) = "001" )
                 {
                Set pBatch = ..%New()
                set pBatch.BatchHeader = tData
                Set tFound = 1
                $$$TRACE("Foundlee[3]"_tFound)
                Quit
                 }
                 Else
                 {
                $$$TRACE("else $extract(tData1,3)Failed[3]")
                Set pLookAhead = pLookAhead _ tData
                 #; Check if we should start discarding leading data
                If ($length(pLookAhead) >= tHeaderLen)
                   {
                   If ($length(tLeadingJunk) < 400)
                      {
                     Set tLeadingJunk = tLeadingJunk _ $extract(pLookAhead,1)
                      }
                      Set pLookAhead = $extract(pLookAhead,2,*)
                   }
                   set cpStatus=0
                   set stage="Extractfailed" //check here
                  // Quit
                  //Continue
     
                 }
                 If (pTimeout = -1)
                    {
                    Set tTimeout = -1
                    }
                    Else
                    {
                     $$$TRACE("time out ok [4]")
                    Set tCurrTime = $zhorolog
                    If (tCurrTime > tEndTime)
                       {
                      Set tStatus = $$$ERROR($$$EnsErrTCPReadTimeoutExpired, pTimeout, tReadLen)
                      Quit
                       }
                       Set tTimeout = tEndTime - tCurrTime
                   }
                   If $$$ISERR(tStatus) Quit
         // } //while
         
          $$$TRACE("while end"_tFound)
         
          If $$$ISERR(tStatus) Quit
          #; Clear the lookahead buffer if we didn't find the batch header
          $$$TRACE("###Status###[5]"_tStatus)
          If (('tFound) && ($length(tLeadingJunk) < 400)&&('pLookAhead="")&&($$$ISERR(cpStatus)))
             {
             Set tLeadingJunk = tLeadingJunk _ $get(pLookAhead)
             Set pLookAhead = ""
             $$$TRACE("###Not Found###[6]"_tFound)
             }
            If (tLeadingJunk '= "") && ('..#IgnoreLeadingData)
               {
               #; Use JS escaping to handle control characters
               Set tLoggedJunk = $zconvert($extract(tLeadingJunk,1,400),"O","JS") _ $select($length(tLeadingJunk) > 400: "...", 1: "")
               $$$LOGWARNING($$$FormatText($$$Text("[]Discarding unexpected leading data: '%1'","Ensemble"),tLoggedJunk))
               }
               If (('tFound)&&($$$ISERR(cpStatus)))
                  {
                 Set pBatch = ""
                 $$$TRACE("Not Found[8]")
                 //Set tStatus = $$$ERROR($$$EnsRecordMapErrBatchHeaderNotFound,$classname($this))
                 if (stage="Extractfailed" &&($$$ISERR(cpStatus)))
                          {
                          
                        
                         set tStatus=cpStatus
                        
                         $$$LOGWARNING($classname($this)_":: Empty Batch Discarded")
                        
                          set tStatus=$$$OK
                          }
                          else
                          {
                            // Set tStatus = $$$EnsSystemError
                            Set tStatus = $$$ERROR($$$EnsRecordMapErrBatchHeaderNotFound,$classname($this))
                             }
                
                 Quit
                  }
     }
     Else
     {
   Set pBatch = ..%New()
   Set pLookAhead = $get(pLookAhead)
   Quit
     }
     }
 Catch ex
    {
      $$$TRACE("in catch]")
    Set tStatus = $$$EnsSystemError
      quit
      }
      
 Quit tStatus
}

Since this is made up of three classes how do I control the status to send the call with within the block have a look at where  I have newStatus and I would like to quit and pass new status

@Eduard Lebedyuk

yes that the expected results even if you can not move the last two elements to be last just making something similar might help

Thanks for the advice have changed my code but come to a problem while reading my stream as there seems to an error with the XSLT XML Transformer Error: SAXParseException  I do not seems to see what the problem is as I tested my XLT with the XLT Transform Wizard and it all worked fine could you please have a look at the xml and the XLT and see if you can spot where I am going wrong thanks in advance

XML

<Message><Header><Code>HOT</Code><Date>2017-12-08 11:22:34.658</Date></Header><Body><Code>HOT</Code><Name>SIDE</Name><Type>AADULT</Type><Sec>MSec</Sec><ardge>Adult</ardge><Nder>F</Nder><TBC>21</TBC><BO>14</BO><DBOC>0</DBOC><LBC>5</LBC><AB>2</AB></Body><Body><Code>HOT</Code><Name>DARS</Name><Type>AADULT</Type><Sec>MSec</Sec><ardge>OADULT</ardge><Nder>U</Nder><TBC>20</TBC><BO>16</BO><DBOC>0</DBOC><LBC>2</LBC><AB>2</AB></Body><Body><Code>HOT</Code><Name>ENTLE</Name><Type>AADULT</Type><Sec>MSec</Sec><ardge>Adult</ardge><Nder>M</Nder><TBC>22</TBC><BO>18</BO><DBOC>0</DBOC><LBC>3</LBC><AB>1</AB></Body><Body><Code>HOT</Code><Name>ROOXED</Name><Type>AADULT</Type><Sec>MSec</Sec><ardge>OADULT</ardge><Nder>U</Nder><TBC>17</TBC><BO>7</BO><DBOC>0</DBOC><LBC/><AB>9</AB></Body><Body><Code>HOT</Code><Name>DUK</Name><Type>AADULT</Type><Sec>MSec</Sec><ardge>Adult</ardge><Nder>F</Nder><TBC>20</TBC><BO>17</BO><DBOC>0</DBOC><LBC>1</LBC><AB>2</AB></Body><Body><Code>HOT</Code><Name>DALE</Name><Type>AADULT</Type><Sec>MSec</Sec><ardge>Adult</ardge><Nder>M</Nder><TBC>18</TBC><BO>15</BO><DBOC>0</DBOC><LBC>2</LBC><AB/></Body><Body><Code>HOT</Code><Name>DAN</Name><Type>AADULT</Type><Sec>MSec</Sec><ardge>OADULT</ardge><Nder>U</Nder><TBC>16</TBC><BO>8</BO><DBOC>0</DBOC><LBC/><AB>8</AB></Body><Body><Code>HOT</Code><Name>DUN</Name><Type>AADULT</Type><Sec>MSec</Sec><ardge>Adult</ardge><Nder>U</Nder><TBC>2</TBC><BO>0</BO><DBOC>0</DBOC><LBC>1</LBC><AB>1</AB></Body><Body><Code>HOT</Code><Name>DUW</Name><Type>AADULT</Type><Sec>MSec</Sec><ardge>Adult</ardge><Nder>U</Nder><TBC>3</TBC><BO>2</BO><DBOC>0</DBOC><LBC>1</LBC><AB/></Body><Body><Code>HOT</Code><Name>DUM</Name><Type>AADULT</Type><Sec>MSec</Sec><ardge>OADULT</ardge><Nder>U</Nder><TBC>22</TBC><BO>18</BO><DBOC>0</DBOC><LBC>2</LBC><AB>2</AB></Body><Body><Code>HOT</Code><Name>DUR</Name><Type>AADULT</Type><Sec>MSec</Sec><ardge>Adult</ardge><Nder>U</Nder><TBC>16</TBC><BO>13</BO><DBOC>0</DBOC><LBC>2</LBC><AB/></Body></Message>

XSLT

<?xml version="1.0"?>
<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform">
    <xsl:output method="text" indent="yes"/>
    <xsl:template match="/*[node()]">
        <xsl:text>{</xsl:text><xsl:text>&#xa;</xsl:text>
        <xsl:apply-templates select="." mode="detect" />
  <xsl:text>&#xa;</xsl:text>
        <xsl:text>}</xsl:text>
    </xsl:template>
    <xsl:template match="*" mode="detect">
        <xsl:choose>
            <xsl:when test="name(preceding-sibling::*[1]) = name(current()) and name(following-sibling::*[1]) != name(current())">
                    <xsl:apply-templates select="." mode="obj-content" />
     <xsl:text>&#xa;</xsl:text>
                <xsl:text>]</xsl:text>
                <xsl:if test="count(following-sibling::*[name() != name(current())]) &gt; 0">, </xsl:if>
            </xsl:when>
            <xsl:when test="name(preceding-sibling::*[1]) = name(current())">
                    <xsl:apply-templates select="." mode="obj-content" />
                    <xsl:if test="name(following-sibling::*) = name(current())">, </xsl:if>
            </xsl:when>
            <xsl:when test="following-sibling::*[1][name() = name(current())]">
                <xsl:text>"</xsl:text><xsl:value-of select="name()"/><xsl:text>" : [</xsl:text>
        <xsl:text>&#xa;</xsl:text>
                    <xsl:apply-templates select="." mode="obj-content" /><xsl:text>, </xsl:text>
     <xsl:text>&#xa;</xsl:text>
            </xsl:when>
            <xsl:when test="count(./child::*) > 0 or count(@*) > 0">
                <xsl:text>"</xsl:text><xsl:value-of select="name()"/>" : <xsl:apply-templates select="." mode="obj-content" />
                <xsl:if test="count(following-sibling::*) &gt; 0">, </xsl:if>
            </xsl:when>
            <xsl:when test="count(./child::*) = 0">
                <xsl:text>"</xsl:text><xsl:value-of select="name()"/>" : "<xsl:apply-templates select="."/><xsl:text>"</xsl:text>
                <xsl:if test="count(following-sibling::*) &gt; 0">, </xsl:if>
    <xsl:text>&#xa;</xsl:text>
            </xsl:when>
        </xsl:choose>
    </xsl:template>
    <xsl:template match="*" mode="obj-content">
     <xsl:text>&#xa;</xsl:text>
        <xsl:text>{</xsl:text>
  <xsl:text>&#xa;</xsl:text>
            <xsl:apply-templates select="@*" mode="attr" />
            <xsl:if test="count(@*) &gt; 0 and (count(child::*) &gt; 0 or text())">, </xsl:if>
            <xsl:apply-templates select="./*" mode="detect" />
            <xsl:if test="count(child::*) = 0 and text() and not(@*)">
                <xsl:text>"</xsl:text><xsl:value-of select="name()"/>" : "<xsl:value-of select="text()"/><xsl:text>"</xsl:text>
            </xsl:if>
            <xsl:if test="count(child::*) = 0 and text() and @*">
                <xsl:text>"text" : "</xsl:text><xsl:value-of select="text()"/><xsl:text>"</xsl:text>
            </xsl:if>
        <xsl:text>}</xsl:text>
        <xsl:if test="position() &lt; last()">, </xsl:if>
    </xsl:template>
    <xsl:template match="@*" mode="attr">
        <xsl:text>"</xsl:text><xsl:value-of select="name()"/>" : "<xsl:value-of select="."/><xsl:text>"</xsl:text>
        <xsl:if test="position() &lt; last()">,</xsl:if>
    </xsl:template>
    <xsl:template match="node/@TEXT | text()" name="removeBreaks">
        <xsl:param name="pText" select="normalize-space(.)"/>
        <xsl:choose>
            <xsl:when test="not(contains($pText, '&#xA;'))"><xsl:copy-of select="$pText"/></xsl:when>
            <xsl:otherwise>
                <xsl:value-of select="concat(substring-before($pText, '&#xD;&#xA;'), ' ')"/>
                <xsl:call-template name="removeBreaks">
                    <xsl:with-param name="pText" select="substring-after($pText, '&#xD;&#xA;')"/>
                </xsl:call-template>
            </xsl:otherwise>
        </xsl:choose>
    </xsl:template>
</xsl:stylesheet>