Examples with JWT com.auth0.jwt.JWT used on opensource projects

Example 91 with JWT

use of com.auth0.jwt.JWT in project spring-security by spring-projects.

the class JwtBearerOAuth2AuthorizedClientProviderTests method authorizeWhenCustomJwtAssertionResolverSetThenUsed.

@Test
public void authorizeWhenCustomJwtAssertionResolverSetThenUsed() {
    Function<OAuth2AuthorizationContext, Jwt> jwtAssertionResolver = mock(Function.class);
    given(jwtAssertionResolver.apply(any())).willReturn(this.jwtAssertion);
    this.authorizedClientProvider.setJwtAssertionResolver(jwtAssertionResolver);
    OAuth2AccessTokenResponse accessTokenResponse = TestOAuth2AccessTokenResponses.accessTokenResponse().build();
    given(this.accessTokenResponseClient.getTokenResponse(any())).willReturn(accessTokenResponse);
    // @formatter:off
    TestingAuthenticationToken principal = new TestingAuthenticationToken("user", "password");
    OAuth2AuthorizationContext authorizationContext = OAuth2AuthorizationContext.withClientRegistration(this.clientRegistration).principal(principal).build();
    // @formatter:on
    OAuth2AuthorizedClient authorizedClient = this.authorizedClientProvider.authorize(authorizationContext);
    verify(jwtAssertionResolver).apply(any());
    assertThat(authorizedClient.getClientRegistration()).isSameAs(this.clientRegistration);
    assertThat(authorizedClient.getPrincipalName()).isEqualTo(principal.getName());
    assertThat(authorizedClient.getAccessToken()).isEqualTo(accessTokenResponse.getAccessToken());
}

Example 92 with JWT

use of com.auth0.jwt.JWT in project spring-security by spring-projects.

the class ServerOAuth2AuthorizedClientExchangeFilterFunctionTests method filterWhenJwtBearerClientNotAuthorizedThenExchangeToken.

@Test
public void filterWhenJwtBearerClientNotAuthorizedThenExchangeToken() {
    setupMocks();
    OAuth2AccessTokenResponse accessTokenResponse = OAuth2AccessTokenResponse.withToken("exchanged-token").tokenType(OAuth2AccessToken.TokenType.BEARER).expiresIn(360).build();
    given(this.jwtBearerTokenResponseClient.getTokenResponse(any())).willReturn(Mono.just(accessTokenResponse));
    // @formatter:off
    ClientRegistration registration = ClientRegistration.withRegistrationId("jwt-bearer").clientId("client-id").clientSecret("client-secret").clientAuthenticationMethod(ClientAuthenticationMethod.CLIENT_SECRET_BASIC).authorizationGrantType(AuthorizationGrantType.JWT_BEARER).scope("read", "write").tokenUri("https://example.com/oauth/token").build();
    // @formatter:on
    given(this.clientRegistrationRepository.findByRegistrationId(eq(registration.getRegistrationId()))).willReturn(Mono.just(registration));
    Jwt jwtAssertion = TestJwts.jwt().build();
    Authentication jwtAuthentication = new TestingAuthenticationToken(jwtAssertion, jwtAssertion);
    given(this.authorizedClientRepository.loadAuthorizedClient(eq(registration.getRegistrationId()), eq(jwtAuthentication), any())).willReturn(Mono.empty());
    // @formatter:off
    ClientRequest request = ClientRequest.create(HttpMethod.GET, URI.create("https://example.com")).attributes(ServerOAuth2AuthorizedClientExchangeFilterFunction.clientRegistrationId(registration.getRegistrationId())).build();
    // @formatter:on
    this.function.filter(request, this.exchange).subscriberContext(ReactiveSecurityContextHolder.withAuthentication(jwtAuthentication)).subscriberContext(serverWebExchange()).block();
    verify(this.jwtBearerTokenResponseClient).getTokenResponse(any());
    verify(this.authorizedClientRepository).loadAuthorizedClient(eq(registration.getRegistrationId()), eq(jwtAuthentication), any());
    verify(this.authorizedClientRepository).saveAuthorizedClient(any(), eq(jwtAuthentication), any());
    List<ClientRequest> requests = this.exchange.getRequests();
    assertThat(requests).hasSize(1);
    ClientRequest request1 = requests.get(0);
    assertThat(request1.headers().getFirst(HttpHeaders.AUTHORIZATION)).isEqualTo("Bearer exchanged-token");
    assertThat(request1.url().toASCIIString()).isEqualTo("https://example.com");
    assertThat(request1.method()).isEqualTo(HttpMethod.GET);
    assertThat(getBody(request1)).isEmpty();
}

Example 93 with JWT

use of com.auth0.jwt.JWT in project spring-security by spring-projects.

the class SecurityMockMvcRequestPostProcessorsJwtTests method jwtWhenProvidingScopedAuthoritiesThenProducesJwtAuthentication.

@Test
public void jwtWhenProvidingScopedAuthoritiesThenProducesJwtAuthentication() {
    jwt().jwt((jwt) -> jwt.claim("scope", "scoped authorities")).postProcessRequest(this.request);
    verify(this.repository).saveContext(this.contextCaptor.capture(), eq(this.request), any(HttpServletResponse.class));
    SecurityContext context = this.contextCaptor.getValue();
    assertThat((List<GrantedAuthority>) context.getAuthentication().getAuthorities()).containsOnly(new SimpleGrantedAuthority("SCOPE_scoped"), new SimpleGrantedAuthority("SCOPE_authorities"));
}

Example 94 with JWT

use of com.auth0.jwt.JWT in project spring-security by spring-projects.

the class SecurityMockMvcRequestPostProcessorsJwtTests method jwtWhenProvidingGrantedAuthoritiesThenProducesJwtAuthentication.

@Test
public void jwtWhenProvidingGrantedAuthoritiesThenProducesJwtAuthentication() {
    jwt().jwt((jwt) -> jwt.claim("scope", "ignored authorities")).authorities((jwt) -> Arrays.asList(this.authority1)).postProcessRequest(this.request);
    verify(this.repository).saveContext(this.contextCaptor.capture(), eq(this.request), any(HttpServletResponse.class));
    SecurityContext context = this.contextCaptor.getValue();
    assertThat((List<GrantedAuthority>) context.getAuthentication().getAuthorities()).containsOnly(this.authority1);
}

Example 95 with JWT

use of com.auth0.jwt.JWT in project spring-security by spring-projects.

the class SecurityMockMvcRequestPostProcessorsJwtTests method jwtWhenProvidingBuilderConsumerThenProducesJwtAuthentication.

@Test
public void jwtWhenProvidingBuilderConsumerThenProducesJwtAuthentication() {
    String name = new String("user");
    jwt().jwt((jwt) -> jwt.subject(name)).postProcessRequest(this.request);
    verify(this.repository).saveContext(this.contextCaptor.capture(), eq(this.request), any(HttpServletResponse.class));
    SecurityContext context = this.contextCaptor.getValue();
    assertThat(context.getAuthentication()).isInstanceOf(JwtAuthenticationToken.class);
    JwtAuthenticationToken token = (JwtAuthenticationToken) context.getAuthentication();
    assertThat(token.getToken().getSubject()).isSameAs(name);
}