use of io.jans.as.client.model.authorize.JwtAuthorizationRequest in project jans by JanssenProject.
the class OpenIDRequestObjectHttpTest method requestParameterMethodPS384.
@Parameters({ "userId", "userSecret", "redirectUri", "redirectUris", "clientJwksUri", "PS384_keyId", "dnName", "keyStoreFile", "keyStoreSecret", "sectorIdentifierUri" })
@Test
public void requestParameterMethodPS384(final String userId, final String userSecret, final String redirectUri, final String redirectUris, final String jwksUri, final String keyId, final String dnName, final String keyStoreFile, final String keyStoreSecret, final String sectorIdentifierUri) throws Exception {
showTitle("requestParameterMethodPS384");
List<ResponseType> responseTypes = Arrays.asList(ResponseType.TOKEN, ResponseType.ID_TOKEN);
// 1. Dynamic Client Registration
RegisterRequest registerRequest = new RegisterRequest(ApplicationType.WEB, "jans test app", StringUtils.spaceSeparatedToList(redirectUris));
registerRequest.setResponseTypes(responseTypes);
registerRequest.setJwksUri(jwksUri);
registerRequest.setRequestObjectSigningAlg(SignatureAlgorithm.PS384);
registerRequest.addCustomAttribute("jansTrustedClnt", "true");
registerRequest.setSectorIdentifierUri(sectorIdentifierUri);
RegisterClient registerClient = new RegisterClient(registrationEndpoint);
registerClient.setRequest(registerRequest);
RegisterResponse response = registerClient.exec();
showClient(registerClient);
assertRegisterResponseOk(response, 201, true);
String clientId = response.getClientId();
// 2. Request authorization
AuthCryptoProvider cryptoProvider = new AuthCryptoProvider(keyStoreFile, keyStoreSecret, dnName);
List<String> scopes = Arrays.asList("openid", "profile", "address", "email");
String nonce = UUID.randomUUID().toString();
String state = UUID.randomUUID().toString();
AuthorizationRequest request = new AuthorizationRequest(responseTypes, clientId, scopes, redirectUri, nonce);
request.setState(state);
request.setAuthUsername(userId);
request.setAuthPassword(userSecret);
request.getPrompts().add(Prompt.NONE);
JwtAuthorizationRequest jwtAuthorizationRequest = new JwtAuthorizationRequest(request, SignatureAlgorithm.PS384, cryptoProvider);
jwtAuthorizationRequest.setKeyId(keyId);
jwtAuthorizationRequest.addUserInfoClaim(new Claim(JwtClaimName.NAME, ClaimValue.createNull()));
jwtAuthorizationRequest.addUserInfoClaim(new Claim(JwtClaimName.NICKNAME, ClaimValue.createEssential(false)));
jwtAuthorizationRequest.addUserInfoClaim(new Claim(JwtClaimName.EMAIL, ClaimValue.createNull()));
jwtAuthorizationRequest.addUserInfoClaim(new Claim(JwtClaimName.EMAIL_VERIFIED, ClaimValue.createNull()));
jwtAuthorizationRequest.addUserInfoClaim(new Claim(JwtClaimName.PICTURE, ClaimValue.createEssential(false)));
jwtAuthorizationRequest.addIdTokenClaim(new Claim(JwtClaimName.AUTHENTICATION_TIME, ClaimValue.createNull()));
jwtAuthorizationRequest.addIdTokenClaim(new Claim(JwtClaimName.AUTHENTICATION_CONTEXT_CLASS_REFERENCE, ClaimValue.createValueList(new String[] { ACR_VALUE })));
jwtAuthorizationRequest.getIdTokenMember().setMaxAge(86400);
String authJwt = jwtAuthorizationRequest.getEncodedJwt();
request.setRequest(authJwt);
AuthorizeClient authorizeClient = new AuthorizeClient(authorizationEndpoint);
authorizeClient.setRequest(request);
AuthorizationResponse response1 = authorizeClient.exec();
showClient(authorizeClient);
assertEquals(response1.getStatus(), 302, "Unexpected response code: " + response1.getStatus());
assertNotNull(response1.getLocation(), "The location is null");
assertNotNull(response1.getAccessToken(), "The accessToken is null");
assertNotNull(response1.getTokenType(), "The tokenType is null");
assertNotNull(response1.getIdToken(), "The idToken is null");
assertNotNull(response1.getState(), "The state is null");
String accessToken = response1.getAccessToken();
// 3. Request user info
UserInfoClient userInfoClient = new UserInfoClient(userInfoEndpoint);
UserInfoResponse response3 = userInfoClient.execUserInfo(accessToken);
showClient(userInfoClient);
assertUserInfoBasicMinimumResponseOk(response3, 200);
assertUserInfoPersonalDataNotNull(response3);
}
use of io.jans.as.client.model.authorize.JwtAuthorizationRequest in project jans by JanssenProject.
the class OpenIDRequestObjectHttpTest method requestParameterMethodES384X509Cert.
@Parameters({ "userId", "userSecret", "redirectUri", "redirectUris", "clientJwksUri", "ES384_keyId", "dnName", "keyStoreFile", "keyStoreSecret", "sectorIdentifierUri" })
@Test
public void requestParameterMethodES384X509Cert(final String userId, final String userSecret, final String redirectUri, final String redirectUris, final String jwksUri, final String keyId, final String dnName, final String keyStoreFile, final String keyStoreSecret, final String sectorIdentifierUri) throws Exception {
showTitle("requestParameterMethodES384X509Cert");
List<ResponseType> responseTypes = Arrays.asList(ResponseType.TOKEN, ResponseType.ID_TOKEN);
// 1. Dynamic Client Registration
RegisterRequest registerRequest = new RegisterRequest(ApplicationType.WEB, "jans test app", StringUtils.spaceSeparatedToList(redirectUris));
registerRequest.setResponseTypes(responseTypes);
registerRequest.setJwksUri(jwksUri);
registerRequest.setRequestObjectSigningAlg(SignatureAlgorithm.ES384);
registerRequest.addCustomAttribute("jansTrustedClnt", "true");
registerRequest.setSectorIdentifierUri(sectorIdentifierUri);
RegisterClient registerClient = new RegisterClient(registrationEndpoint);
registerClient.setRequest(registerRequest);
RegisterResponse response = registerClient.exec();
showClient(registerClient);
assertRegisterResponseOk(response, 201, true);
String clientId = response.getClientId();
// 2. Request authorization
AuthCryptoProvider cryptoProvider = new AuthCryptoProvider(keyStoreFile, keyStoreSecret, dnName);
List<String> scopes = Arrays.asList("openid", "profile", "address", "email");
String nonce = UUID.randomUUID().toString();
String state = UUID.randomUUID().toString();
AuthorizationRequest request = new AuthorizationRequest(responseTypes, clientId, scopes, redirectUri, nonce);
request.setState(state);
request.setAuthUsername(userId);
request.setAuthPassword(userSecret);
request.getPrompts().add(Prompt.NONE);
JwtAuthorizationRequest jwtAuthorizationRequest = new JwtAuthorizationRequest(request, SignatureAlgorithm.ES384, cryptoProvider);
jwtAuthorizationRequest.setKeyId(keyId);
jwtAuthorizationRequest.addUserInfoClaim(new Claim(JwtClaimName.NAME, ClaimValue.createNull()));
jwtAuthorizationRequest.addUserInfoClaim(new Claim(JwtClaimName.NICKNAME, ClaimValue.createEssential(false)));
jwtAuthorizationRequest.addUserInfoClaim(new Claim(JwtClaimName.EMAIL, ClaimValue.createNull()));
jwtAuthorizationRequest.addUserInfoClaim(new Claim(JwtClaimName.EMAIL_VERIFIED, ClaimValue.createNull()));
jwtAuthorizationRequest.addUserInfoClaim(new Claim(JwtClaimName.PICTURE, ClaimValue.createEssential(false)));
jwtAuthorizationRequest.addIdTokenClaim(new Claim(JwtClaimName.AUTHENTICATION_TIME, ClaimValue.createNull()));
jwtAuthorizationRequest.addIdTokenClaim(new Claim(JwtClaimName.AUTHENTICATION_CONTEXT_CLASS_REFERENCE, ClaimValue.createValueList(new String[] { ACR_VALUE })));
jwtAuthorizationRequest.getIdTokenMember().setMaxAge(86400);
String authJwt = jwtAuthorizationRequest.getEncodedJwt();
request.setRequest(authJwt);
AuthorizeClient authorizeClient = new AuthorizeClient(authorizationEndpoint);
authorizeClient.setRequest(request);
AuthorizationResponse response1 = authorizeClient.exec();
showClient(authorizeClient);
assertEquals(response1.getStatus(), 302, "Unexpected response code: " + response1.getStatus());
assertNotNull(response1.getLocation(), "The location is null");
assertNotNull(response1.getAccessToken(), "The accessToken is null");
assertNotNull(response1.getTokenType(), "The tokenType is null");
assertNotNull(response1.getIdToken(), "The idToken is null");
assertNotNull(response1.getState(), "The state is null");
String accessToken = response1.getAccessToken();
// 3. Request user info
UserInfoClient userInfoClient = new UserInfoClient(userInfoEndpoint);
UserInfoResponse response3 = userInfoClient.execUserInfo(accessToken);
showClient(userInfoClient);
assertUserInfoBasicMinimumResponseOk(response3, 200);
assertUserInfoPersonalDataNotNull(response3);
assertNotNull(response3.getClaim(JwtClaimName.ADDRESS));
}
use of io.jans.as.client.model.authorize.JwtAuthorizationRequest in project jans by JanssenProject.
the class AuthorizationResponseModeJwtResponseTypeCodeSignedEncryptedHttpTest method ensureRequestObjectWithoutRedirectUriFails.
@Parameters({ "redirectUri", "redirectUris", "clientJwksUri", "RSA_OAEP_keyId", "PS256_keyId", "dnName", "keyStoreFile", "keyStoreSecret", "sectorIdentifierUri" })
// Enable FAPI to run this test!
@Test(enabled = false)
public void ensureRequestObjectWithoutRedirectUriFails(final String redirectUri, final String redirectUris, final String clientJwksUri, final String encryptionKeyId, final String signingKeyId, final String dnName, final String keyStoreFile, final String keyStoreSecret, final String sectorIdentifierUri) throws Exception {
showTitle("ensureRequestObjectWithoutRedirectUriFails");
List<ResponseType> responseTypes = Arrays.asList(ResponseType.CODE);
// 1. Dynamic Client Registration
RegisterResponse registerResponse = registerClient(redirectUris, responseTypes, sectorIdentifierUri, clientJwksUri, SignatureAlgorithm.PS256, KeyEncryptionAlgorithm.RSA_OAEP, BlockEncryptionAlgorithm.A256GCM);
String clientId = registerResponse.getClientId();
// 2. Request authorization
List<String> scope = Arrays.asList("openid", "profile", "address", "email");
String state = UUID.randomUUID().toString();
String nonce = UUID.randomUUID().toString();
AuthorizationRequest authorizationRequest = new AuthorizationRequest(responseTypes, clientId, scope, redirectUri, null);
AuthCryptoProvider cryptoProvider1 = new AuthCryptoProvider(keyStoreFile, keyStoreSecret, dnName);
JwtAuthorizationRequest jwsAuthorizationRequest = new JwtAuthorizationRequest(authorizationRequest, SignatureAlgorithm.PS256, cryptoProvider1);
jwsAuthorizationRequest.setKeyId(signingKeyId);
jwsAuthorizationRequest.setRedirectUri(null);
jwsAuthorizationRequest.setResponseMode(ResponseMode.JWT);
jwsAuthorizationRequest.setState(state);
// FAPI: nonce param is required
jwsAuthorizationRequest.setNonce(nonce);
// FAPI: require the request object to contain an exp claim that has a lifetime of no longer than 60 minutes after the nbf claim
jwsAuthorizationRequest.setNbf((int) Instant.now().getEpochSecond());
// FAPI: require the request object to contain an exp claim that has a lifetime of no longer than 60 minutes after the nbf claim
jwsAuthorizationRequest.setExp(jwsAuthorizationRequest.getNbf() + 3600);
Jwt authJws = Jwt.parse(jwsAuthorizationRequest.getEncodedJwt());
JwkClient jwkClient = new JwkClient(jwksUri);
JwkResponse jwkResponse = jwkClient.exec();
String serverKeyId = jwkResponse.getKeyId(Algorithm.RSA_OAEP);
assertNotNull(serverKeyId);
JSONObject jwks = JwtUtil.getJSONWebKeys(jwksUri);
AuthCryptoProvider cryptoProvider2 = new AuthCryptoProvider(keyStoreFile, keyStoreSecret, dnName);
privateKey = cryptoProvider2.getPrivateKey(encryptionKeyId);
JwtAuthorizationRequest jweAuthorizationRequest = new JwtAuthorizationRequest(authorizationRequest, KeyEncryptionAlgorithm.RSA_OAEP, BlockEncryptionAlgorithm.A256GCM, cryptoProvider2);
jweAuthorizationRequest.setKeyId(serverKeyId);
jweAuthorizationRequest.setNestedPayload(authJws);
String authJwe = jweAuthorizationRequest.getEncodedJwt(jwks);
authorizationRequest.setRequest(authJwe);
AuthorizeClient authorizeClient = new AuthorizeClient(authorizationEndpoint);
authorizeClient.setRequest(authorizationRequest);
AuthorizationResponse authorizationResponse = authorizeClient.exec();
showClient(authorizeClient);
assertNotNull(authorizationResponse.getResponse());
Jwe response = Jwe.parse(authorizationResponse.getResponse(), privateKey, null);
assertJweResponse(response);
assertTrue(Arrays.asList("invalid_request", "invalid_request_object").contains(response.getClaims().getClaimAsString("error")));
// Clear private key to do not affect to other tests
privateKey = null;
}
use of io.jans.as.client.model.authorize.JwtAuthorizationRequest in project jans by JanssenProject.
the class AuthorizationResponseModeJwtResponseTypeCodeSignedEncryptedHttpTest method ensureRequestObjectWithoutScopeFails.
@Parameters({ "redirectUri", "redirectUris", "clientJwksUri", "RSA_OAEP_keyId", "PS256_keyId", "dnName", "keyStoreFile", "keyStoreSecret", "sectorIdentifierUri" })
// Enable FAPI to run this test!
@Test(enabled = false)
public void ensureRequestObjectWithoutScopeFails(final String redirectUri, final String redirectUris, final String clientJwksUri, final String encryptionKeyId, final String signingKeyId, final String dnName, final String keyStoreFile, final String keyStoreSecret, final String sectorIdentifierUri) throws Exception {
showTitle("ensureRequestObjectWithoutScopeFails");
List<ResponseType> responseTypes = Arrays.asList(ResponseType.CODE);
// 1. Dynamic Client Registration
RegisterResponse registerResponse = registerClient(redirectUris, responseTypes, sectorIdentifierUri, clientJwksUri, SignatureAlgorithm.PS256, KeyEncryptionAlgorithm.RSA_OAEP, BlockEncryptionAlgorithm.A256GCM);
String clientId = registerResponse.getClientId();
// 2. Request authorization
List<String> scope = Arrays.asList("openid", "profile", "address", "email");
String state = UUID.randomUUID().toString();
String nonce = UUID.randomUUID().toString();
AuthorizationRequest authorizationRequest = new AuthorizationRequest(responseTypes, clientId, scope, redirectUri, null);
AuthCryptoProvider cryptoProvider1 = new AuthCryptoProvider(keyStoreFile, keyStoreSecret, dnName);
JwtAuthorizationRequest jwsAuthorizationRequest = new JwtAuthorizationRequest(authorizationRequest, SignatureAlgorithm.PS256, cryptoProvider1);
jwsAuthorizationRequest.setKeyId(signingKeyId);
jwsAuthorizationRequest.setRedirectUri(redirectUri);
jwsAuthorizationRequest.setResponseMode(ResponseMode.JWT);
jwsAuthorizationRequest.setState(state);
// FAPI: nonce param is required
jwsAuthorizationRequest.setNonce(nonce);
// FAPI: scope param is required
jwsAuthorizationRequest.setScopes(null);
// FAPI: require the request object to contain an exp claim that has a lifetime of no longer than 60 minutes after the nbf claim
jwsAuthorizationRequest.setNbf((int) Instant.now().getEpochSecond());
// FAPI: require the request object to contain an exp claim that has a lifetime of no longer than 60 minutes after the nbf claim
jwsAuthorizationRequest.setExp(jwsAuthorizationRequest.getNbf() + 3600);
Jwt authJws = Jwt.parse(jwsAuthorizationRequest.getEncodedJwt());
JwkClient jwkClient = new JwkClient(jwksUri);
JwkResponse jwkResponse = jwkClient.exec();
String serverKeyId = jwkResponse.getKeyId(Algorithm.RSA_OAEP);
assertNotNull(serverKeyId);
JSONObject jwks = JwtUtil.getJSONWebKeys(jwksUri);
AuthCryptoProvider cryptoProvider2 = new AuthCryptoProvider(keyStoreFile, keyStoreSecret, dnName);
privateKey = cryptoProvider2.getPrivateKey(encryptionKeyId);
JwtAuthorizationRequest jweAuthorizationRequest = new JwtAuthorizationRequest(authorizationRequest, KeyEncryptionAlgorithm.RSA_OAEP, BlockEncryptionAlgorithm.A256GCM, cryptoProvider2);
jweAuthorizationRequest.setKeyId(serverKeyId);
jweAuthorizationRequest.setNestedPayload(authJws);
String authJwe = jweAuthorizationRequest.getEncodedJwt(jwks);
authorizationRequest.setRequest(authJwe);
AuthorizeClient authorizeClient = new AuthorizeClient(authorizationEndpoint);
authorizeClient.setRequest(authorizationRequest);
AuthorizationResponse authorizationResponse = authorizeClient.exec();
showClient(authorizeClient);
assertNotNull(authorizationResponse.getResponse());
Jwe response = Jwe.parse(authorizationResponse.getResponse(), privateKey, null);
assertJweResponse(response);
assertTrue(Arrays.asList("invalid_request", "invalid_request_object", "invalid_request_uri", "access_denied").contains(response.getClaims().getClaimAsString("error")));
// Clear private key to do not affect to other tests
privateKey = null;
}
use of io.jans.as.client.model.authorize.JwtAuthorizationRequest in project jans by JanssenProject.
the class AuthorizationResponseModeJwtResponseTypeCodeSignedEncryptedHttpTest method ensureRequestObjectSignedbyRS256AlgorithmFails.
@Parameters({ "redirectUri", "redirectUris", "clientJwksUri", "RSA_OAEP_keyId", "RS256_keyId", "dnName", "keyStoreFile", "keyStoreSecret", "sectorIdentifierUri" })
// Enable FAPI to run this test!
@Test(enabled = false)
public void ensureRequestObjectSignedbyRS256AlgorithmFails(final String redirectUri, final String redirectUris, final String clientJwksUri, final String encryptionKeyId, final String signingKeyId, final String dnName, final String keyStoreFile, final String keyStoreSecret, final String sectorIdentifierUri) throws Exception {
showTitle("ensureRequestObjectSignedbyRS256AlgorithmFails");
List<ResponseType> responseTypes = Arrays.asList(ResponseType.CODE);
List<GrantType> GrantTypes = Arrays.asList(GrantType.AUTHORIZATION_CODE);
// 1. Dynamic Client Registration
RegisterResponse registerResponse = registerClient(redirectUris, responseTypes, GrantTypes, sectorIdentifierUri, clientJwksUri, SignatureAlgorithm.RS256, KeyEncryptionAlgorithm.RSA_OAEP, BlockEncryptionAlgorithm.A256GCM);
String clientId = registerResponse.getClientId();
// 2. Request authorization
List<String> scope = Arrays.asList("openid", "profile", "address", "email");
String state = UUID.randomUUID().toString();
String nonce = UUID.randomUUID().toString();
AuthorizationRequest authorizationRequest = new AuthorizationRequest(responseTypes, clientId, scope, redirectUri, null);
AuthCryptoProvider cryptoProvider1 = new AuthCryptoProvider(keyStoreFile, keyStoreSecret, dnName);
JwtAuthorizationRequest jwsAuthorizationRequest = new JwtAuthorizationRequest(authorizationRequest, SignatureAlgorithm.RS256, cryptoProvider1);
jwsAuthorizationRequest.setKeyId(signingKeyId);
// Added bad aud to request object claims
jwsAuthorizationRequest.setAud("https://www.other1.example.com/");
jwsAuthorizationRequest.setRedirectUri(redirectUri);
jwsAuthorizationRequest.setResponseMode(ResponseMode.JWT);
jwsAuthorizationRequest.setState(state);
// FAPI: nonce param is required
jwsAuthorizationRequest.setNonce(nonce);
// FAPI: require the request object to
jwsAuthorizationRequest.setNbf((int) Instant.now().getEpochSecond());
// contain an exp claim that has a
// lifetime of no longer than 60 minutes
// after the nbf claim
// FAPI: require the request object to
jwsAuthorizationRequest.setExp(jwsAuthorizationRequest.getNbf() + 3600);
// contain an exp claim that has a
// lifetime of no longer than 60
// minutes after the nbf claim
Jwt authJws = Jwt.parse(jwsAuthorizationRequest.getEncodedJwt());
JwkClient jwkClient = new JwkClient(jwksUri);
JwkResponse jwkResponse = jwkClient.exec();
String serverKeyId = jwkResponse.getKeyId(Algorithm.RSA_OAEP);
assertNotNull(serverKeyId);
JSONObject jwks = JwtUtil.getJSONWebKeys(jwksUri);
AuthCryptoProvider cryptoProvider2 = new AuthCryptoProvider(keyStoreFile, keyStoreSecret, dnName);
privateKey = cryptoProvider2.getPrivateKey(encryptionKeyId);
JwtAuthorizationRequest jweAuthorizationRequest = new JwtAuthorizationRequest(authorizationRequest, SignatureAlgorithm.RS256, cryptoProvider2);
jweAuthorizationRequest.setKeyId(serverKeyId);
jweAuthorizationRequest.setNestedPayload(authJws);
jweAuthorizationRequest.setKeyId(signingKeyId);
jweAuthorizationRequest.setResponseMode(ResponseMode.JWT);
jweAuthorizationRequest.setState(state);
jweAuthorizationRequest.setScopes(scope);
jweAuthorizationRequest.setResponseTypes(responseTypes);
jweAuthorizationRequest.setRedirectUri(redirectUri);
// FAPI: nonce param is required
jweAuthorizationRequest.setNonce(nonce);
// FAPI: require the request object to
jweAuthorizationRequest.setNbf((int) Instant.now().getEpochSecond());
// contain an exp claim that has a
// lifetime of no longer than 60 minutes
// after the nbf claim
// Added invalid exp value to request
jweAuthorizationRequest.setExp(jwsAuthorizationRequest.getNbf() + 3600);
// object which is 70 minutes in the
// future
String authJwe = jweAuthorizationRequest.getEncodedJwt(jwks);
authorizationRequest.setRequest(authJwe);
AuthorizeClient authorizeClient = new AuthorizeClient(authorizationEndpoint);
authorizeClient.setRequest(authorizationRequest);
AuthorizationResponse authorizationResponse = authorizeClient.exec();
showClient(authorizeClient);
assertNotNull(authorizationResponse.getResponse());
Jwe response = Jwe.parse(authorizationResponse.getResponse(), privateKey, null);
assertJweResponse(response);
assertEquals(response.getClaims().getClaimAsString("error"), "invalid_request_object");
// Clear private key to do not affect to other tests
privateKey = null;
}
Aggregations