Examples with JWT com.auth0.jwt.JWT used on opensource projects

Example 56 with JWT

use of com.auth0.jwt.JWT in project spring-security by spring-projects.

the class SecurityMockServerConfigurersJwtTests method mockJwtWhenProvidingGrantedAuthoritiesThenProducesJwtAuthentication.

@Test
public void mockJwtWhenProvidingGrantedAuthoritiesThenProducesJwtAuthentication() {
    this.client.mutateWith(SecurityMockServerConfigurers.mockJwt().jwt((jwt) -> jwt.claim("scope", "ignored authorities")).authorities((jwt) -> Arrays.asList(this.authority1))).get().exchange().expectStatus().isOk();
    SecurityContext context = this.securityContextController.removeSecurityContext();
    assertThat((List<GrantedAuthority>) context.getAuthentication().getAuthorities()).containsOnly(this.authority1);
}

Example 57 with JWT

use of com.auth0.jwt.JWT in project spring-security by spring-projects.

the class OidcAuthorizationCodeAuthenticationProviderTests method setUpIdToken.

private void setUpIdToken(Map<String, Object> claims) {
    Jwt idToken = TestJwts.jwt().claims((c) -> c.putAll(claims)).build();
    JwtDecoder jwtDecoder = mock(JwtDecoder.class);
    given(jwtDecoder.decode(anyString())).willReturn(idToken);
    this.authenticationProvider.setJwtDecoderFactory((registration) -> jwtDecoder);
}

Example 58 with JWT

use of com.auth0.jwt.JWT in project spring-security by spring-projects.

the class OidcAuthorizationCodeReactiveAuthenticationManagerTests method authenticateWhenIdTokenInvalidNonceThenOAuth2AuthenticationException.

@Test
public void authenticateWhenIdTokenInvalidNonceThenOAuth2AuthenticationException() {
    // @formatter:off
    OAuth2AccessTokenResponse accessTokenResponse = OAuth2AccessTokenResponse.withToken("foo").tokenType(OAuth2AccessToken.TokenType.BEARER).additionalParameters(Collections.singletonMap(OidcParameterNames.ID_TOKEN, this.idToken.getTokenValue())).build();
    // @formatter:on
    OAuth2AuthorizationCodeAuthenticationToken authorizationCodeAuthentication = loginToken();
    Map<String, Object> claims = new HashMap<>();
    claims.put(IdTokenClaimNames.ISS, "https://issuer.example.com");
    claims.put(IdTokenClaimNames.SUB, "sub");
    claims.put(IdTokenClaimNames.AUD, Arrays.asList("client-id"));
    claims.put(IdTokenClaimNames.NONCE, "invalid-nonce-hash");
    Jwt idToken = TestJwts.jwt().claims((c) -> c.putAll(claims)).build();
    given(this.accessTokenResponseClient.getTokenResponse(any())).willReturn(Mono.just(accessTokenResponse));
    given(this.jwtDecoder.decode(any())).willReturn(Mono.just(idToken));
    this.manager.setJwtDecoderFactory((c) -> this.jwtDecoder);
    assertThatExceptionOfType(OAuth2AuthenticationException.class).isThrownBy(() -> this.manager.authenticate(authorizationCodeAuthentication).block()).withMessageContaining("[invalid_nonce]");
}

Example 59 with JWT

use of com.auth0.jwt.JWT in project spring-security by spring-projects.

the class OidcAuthorizationCodeReactiveAuthenticationManagerTests method authenticateWhenTokenSuccessResponseThenAdditionalParametersAddedToUserRequest.

// gh-5368
@Test
public void authenticateWhenTokenSuccessResponseThenAdditionalParametersAddedToUserRequest() {
    ClientRegistration clientRegistration = this.registration.build();
    Map<String, Object> additionalParameters = new HashMap<>();
    additionalParameters.put(OidcParameterNames.ID_TOKEN, this.idToken.getTokenValue());
    additionalParameters.put("param1", "value1");
    additionalParameters.put("param2", "value2");
    // @formatter:off
    OAuth2AccessTokenResponse accessTokenResponse = OAuth2AccessTokenResponse.withToken("foo").tokenType(OAuth2AccessToken.TokenType.BEARER).additionalParameters(additionalParameters).build();
    // @formatter:on
    OAuth2AuthorizationCodeAuthenticationToken authorizationCodeAuthentication = loginToken();
    Map<String, Object> claims = new HashMap<>();
    claims.put(IdTokenClaimNames.ISS, "https://issuer.example.com");
    claims.put(IdTokenClaimNames.SUB, "rob");
    claims.put(IdTokenClaimNames.AUD, Arrays.asList(clientRegistration.getClientId()));
    claims.put(IdTokenClaimNames.NONCE, this.nonceHash);
    Jwt idToken = TestJwts.jwt().claims((c) -> c.putAll(claims)).build();
    given(this.accessTokenResponseClient.getTokenResponse(any())).willReturn(Mono.just(accessTokenResponse));
    DefaultOidcUser user = new DefaultOidcUser(AuthorityUtils.createAuthorityList("ROLE_USER"), this.idToken);
    ArgumentCaptor<OidcUserRequest> userRequestArgCaptor = ArgumentCaptor.forClass(OidcUserRequest.class);
    given(this.userService.loadUser(userRequestArgCaptor.capture())).willReturn(Mono.just(user));
    given(this.jwtDecoder.decode(any())).willReturn(Mono.just(idToken));
    this.manager.setJwtDecoderFactory((c) -> this.jwtDecoder);
    this.manager.authenticate(authorizationCodeAuthentication).block();
    assertThat(userRequestArgCaptor.getValue().getAdditionalParameters()).containsAllEntriesOf(accessTokenResponse.getAdditionalParameters());
}

Example 60 with JWT

use of com.auth0.jwt.JWT in project spring-security by spring-projects.

the class OidcIdTokenValidatorTests method validateIdToken.

private Collection<OAuth2Error> validateIdToken() {
    // @formatter:off
    Jwt idToken = Jwt.withTokenValue("token").issuedAt(this.issuedAt).expiresAt(this.expiresAt).headers((h) -> h.putAll(this.headers)).claims((c) -> c.putAll(this.claims)).build();
    // @formatter:on
    OidcIdTokenValidator validator = new OidcIdTokenValidator(this.registration.build());
    validator.setClockSkew(this.clockSkew);
    return validator.validate(idToken).getErrors();
}