import java.io.*;
import java.util.concurrent.*;
import java.net.*;
import javax.servlet.*;
import javax.servlet.http.*;

import com.microsoft.aad.adal4j.*;
import com.nimbusds.oauth2.sdk.AuthorizationCode;
import com.nimbusds.openid.connect.sdk.AuthenticationErrorResponse;
import com.nimbusds.openid.connect.sdk.AuthenticationResponse;
import com.nimbusds.openid.connect.sdk.AuthenticationResponseParser;
import com.nimbusds.openid.connect.sdk.AuthenticationSuccessResponse;

public class Token extends HttpServlet {

  public void init() throws ServletException
  {
  }

  public String getCookie(String name, HttpServletRequest request) {
    Cookie[] cookies = request.getCookies();
    if (cookies != null) {
      for (int i = 0; i < cookies.length; i++) {
        if (cookies[i].getName().equals(name)) {
          return cookies[i].getValue();
        }
      }
    }
    return null;
  }

  public void doGet(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException
  {

      // move to configuration file
      String authority = "https://login.windows.net/common";
      String clientId = "36bda7c5-cc23-4618-9e09-e710b2357818";
      String clientSecret = "gol9M4EXyLk0lNJWzig2FUECrMJnh7TvEdm+KLHo7rk=";
      String redirect = "http://pelasne-java.southcentralus.cloudapp.azure.com:8080/multitenant/token";
      String resource = "https://graph.windows.net/";

      // ensure this is part of the same authorization chain
      String state_qs = request.getParameter("state");
      String state_c = getCookie("authstate", request);
      if (!state_qs.equals(state_c)) {
        response.sendError(400, "Bad Request: this does not appear to be part of the same authorization chain (" + state_qs + ", " + state_c + ").");
      } else {

        ExecutorService service = null;
        try {

          service = Executors.newFixedThreadPool(1);
          AuthenticationContext authContext = new AuthenticationContext(authority, true, service);

          Future<AuthenticationResult> promise = authContext.acquireTokenByAuthorizationCode(
            request.getParameter("code"),
            new URI(redirect),
            new ClientCredential(clientId, clientSecret),
            resource,
            null);

          AuthenticationResult result = promise.get();
          if (result == null) {
            response.sendError(401, "no auth result");
          } else {
            response.sendError(500, "success " + result.getAccessToken());
          }

        } catch (Throwable e) {
          response.sendError(500, "exception - " + e.getCause() + "; " + e.getMessage() + "; " + e.getStackTrace());
        } finally {
          service.shutdown();
        }

      }


  }

  public void destroy()
  {
      // do nothing.
  }
}

@@ -888,24 +888,982 @@
  null;%0A  %7D%0A%0A
+  public String post(String s_url, String body) throws Throwable %7B%0A    URL url = new URL(s_url);%0A    HttpURLConnection conn = (HttpURLConnection) url.openConnection();%0A    conn.setDoOutput(true);%0A    conn.setInstanceFollowRedirects(false);%0A    conn.setRequestMethod(%22POST%22);%0A    conn.setRequestProperty(%22Content-Type%22, %22application/json%22);%0A    conn.setRequestProperty(%22charset%22, %22utf-8%22);%0A    byte%5B%5D bodyBuffer = body.getBytes(%22UTF-8%22);%0A    conn.setRequestProperty(%22Content-Length%22, Integer.toString(bodyBuffer.length));%0A    conn.setUseCaches(false);%0A    try( DataOutputStream wr = new DataOutputStream(conn.getOutputStream()) ) %7B%0A      wr.write(bodyBuffer);%0A    %7D%0A    try( Reader in = new BufferedReader(new InputStreamReader(conn.getInputStream(), %22UTF-8%22)) ) %7B%0A      StringBuilder sb = new StringBuilder();%0A      for (int c; (c = in.read()) %3E= 0;) %7B%0A        sb.append((char)c);%0A      %7D%0A      String result = sb.toString();%0A      return result;%0A    %7D%0A  %7D%0A%0A
   public voi
@@ -3375,24 +3375,25 @@
    %7D else %7B%0A
+%0A
             
@@ -3396,68 +3396,367 @@
     
-response.sendError(500, %22success %22 + result.getAccessToken()
+String userId = result.getUserInfo().getDisplayableId();%0A            String domain = userId.split(%22@%22)%5B1%5D;%0A            String url = %22https://graph.windows.net/%22 + domain + %22/users/%22 + userId + %22/getMemberGroups?api-version=1.6%22;%0A            String json = post(url, %22%7B %5C%22securityEnabledOnly%5C%22: false %7D%22);%0A%0A            response.sendError(500, %22success: %22 + json
 );%0A 

add POST