Examples with ECKeyGenerator com.nimbusds.jose.jwk.gen.ECKeyGenerator used on opensource projects

Example 21 with ECKeyGenerator

use of com.nimbusds.jose.jwk.gen.ECKeyGenerator in project di-authentication-api by alphagov.

the class AuthoriseAccessTokenHandlerTest method createSignedExpiredAccessToken.

private SignedJWT createSignedExpiredAccessToken(List<String> scopes) throws JOSEException {
    Date expiryDate = NowHelper.nowMinus(2, ChronoUnit.MINUTES);
    ECKey ecJWK = new ECKeyGenerator(Curve.P_256).keyID(KEY_ID).generate();
    JWSSigner signer = new ECDSASigner(ecJWK);
    return TokenGeneratorHelper.generateSignedToken(CLIENT_ID, "http://example.com", scopes, signer, SUBJECT, "14342354354353", expiryDate);
}

Example 22 with ECKeyGenerator

use of com.nimbusds.jose.jwk.gen.ECKeyGenerator in project di-authentication-api by alphagov.

the class AuthoriseAccessTokenHandlerTest method createSignedAccessToken.

private SignedJWT createSignedAccessToken(List<String> scopes) throws JOSEException {
    ECKey ecJWK = new ECKeyGenerator(Curve.P_256).keyID(KEY_ID).generate();
    JWSSigner signer = new ECDSASigner(ecJWK);
    return TokenGeneratorHelper.generateSignedToken(CLIENT_ID, "http://example.com", scopes, signer, SUBJECT, "14342354354353");
}

Example 23 with ECKeyGenerator

use of com.nimbusds.jose.jwk.gen.ECKeyGenerator in project di-authentication-api by alphagov.

the class LogoutHandlerTest method shouldRedirectToDefaultLogoutUriWithErrorMessageWhenSignaturenIdTokenIsInvalid.

@Test
public void shouldRedirectToDefaultLogoutUriWithErrorMessageWhenSignaturenIdTokenIsInvalid() throws URISyntaxException, JOSEException {
    ECKey ecSigningKey = new ECKeyGenerator(Curve.P_256).algorithm(JWSAlgorithm.ES256).generate();
    SignedJWT signedJWT = TokenGeneratorHelper.generateIDToken("invalid-client-id", new Subject(), "http://localhost-rp", ecSigningKey);
    when(tokenValidationService.isTokenSignatureValid(signedJWT.serialize())).thenReturn(false);
    APIGatewayProxyRequestEvent event = generateRequestEvent(Map.of("id_token_hint", signedJWT.serialize(), "post_logout_redirect_uri", CLIENT_LOGOUT_URI.toString()));
    session.getClientSessions().add(CLIENT_SESSION_ID);
    generateSessionFromCookie(session);
    setupClientSessionToken(signedJWT);
    APIGatewayProxyResponseEvent response = handler.handleRequest(event, context);
    assertThat(response, hasStatus(302));
    ErrorObject errorObject = new ErrorObject(OAuth2Error.INVALID_REQUEST_CODE, "unable to validate id_token_hint");
    URIBuilder uriBuilder = new URIBuilder(DEFAULT_LOGOUT_URI);
    uriBuilder.addParameter("error_code", errorObject.getCode());
    uriBuilder.addParameter("error_description", errorObject.getDescription());
    URI expectedUri = uriBuilder.build();
    assertThat(response.getHeaders().get(ResponseHeaders.LOCATION), equalTo(expectedUri.toString()));
    verify(auditService).submitAuditEvent(OidcAuditableEvent.LOG_OUT_SUCCESS, "aws-session-id", SESSION_ID, AuditService.UNKNOWN, AuditService.UNKNOWN, AuditService.UNKNOWN, "123.123.123.123", AuditService.UNKNOWN, PERSISTENT_SESSION_ID);
}

Example 24 with ECKeyGenerator

use of com.nimbusds.jose.jwk.gen.ECKeyGenerator in project di-authentication-api by alphagov.

the class LogoutHandlerTest method setUp.

@BeforeEach
public void setUp() throws JOSEException {
    handler = new LogoutHandler(configurationService, sessionService, dynamoClientService, clientSessionService, tokenValidationService, auditService, backChannelLogoutService);
    when(configurationService.getDefaultLogoutURI()).thenReturn(DEFAULT_LOGOUT_URI);
    ECKey ecSigningKey = new ECKeyGenerator(Curve.P_256).algorithm(JWSAlgorithm.ES256).generate();
    signedIDToken = TokenGeneratorHelper.generateIDToken("client-id", SUBJECT, "http://localhost-rp", ecSigningKey);
    session = generateSession().setEmailAddress(EMAIL);
    when(context.getAwsRequestId()).thenReturn("aws-session-id");
}

Example 25 with ECKeyGenerator

use of com.nimbusds.jose.jwk.gen.ECKeyGenerator in project di-authentication-api by alphagov.

the class LogoutHandlerTest method shouldRedirectToDefaultLogoutUriWithErrorMessageWhenClientIsNotFoundInClientRegistry.

@Test
public void shouldRedirectToDefaultLogoutUriWithErrorMessageWhenClientIsNotFoundInClientRegistry() throws JOSEException, URISyntaxException {
    ECKey ecSigningKey = new ECKeyGenerator(Curve.P_256).algorithm(JWSAlgorithm.ES256).generate();
    SignedJWT signedJWT = TokenGeneratorHelper.generateIDToken("invalid-client-id", SUBJECT, "http://localhost-rp", ecSigningKey);
    when(tokenValidationService.isTokenSignatureValid(signedJWT.serialize())).thenReturn(true);
    APIGatewayProxyRequestEvent event = generateRequestEvent(Map.of("id_token_hint", signedJWT.serialize(), "post_logout_redirect_uri", CLIENT_LOGOUT_URI.toString(), "state", STATE.toString()));
    session.getClientSessions().add(CLIENT_SESSION_ID);
    generateSessionFromCookie(session);
    setupClientSessionToken(signedJWT);
    APIGatewayProxyResponseEvent response = handler.handleRequest(event, context);
    assertThat(response, hasStatus(302));
    ErrorObject errorObject = new ErrorObject(OAuth2Error.UNAUTHORIZED_CLIENT_CODE, "client not found");
    URIBuilder uriBuilder = new URIBuilder(DEFAULT_LOGOUT_URI);
    uriBuilder.addParameter("state", STATE.getValue());
    uriBuilder.addParameter("error_code", errorObject.getCode());
    uriBuilder.addParameter("error_description", errorObject.getDescription());
    URI expectedUri = uriBuilder.build();
    assertThat(response.getHeaders().get(ResponseHeaders.LOCATION), equalTo(expectedUri.toString()));
    verify(auditService).submitAuditEvent(OidcAuditableEvent.LOG_OUT_SUCCESS, "aws-session-id", SESSION_ID, "invalid-client-id", AuditService.UNKNOWN, AuditService.UNKNOWN, "123.123.123.123", AuditService.UNKNOWN, PERSISTENT_SESSION_ID);
}