Examples with AuthCryptoProvider io.jans.as.model.crypto.AuthCryptoProvider used on opensource projects

Example 66 with AuthCryptoProvider

use of io.jans.as.model.crypto.AuthCryptoProvider in project jans by JanssenProject.

the class AuthorizationResponseModeJwtResponseTypeCodeSignedEncryptedHttpTest method ensureRequestObjectWithBadAudFails.

@Parameters({ "redirectUri", "redirectUris", "clientJwksUri", "RSA_OAEP_keyId", "PS256_keyId", "dnName", "keyStoreFile", "keyStoreSecret", "sectorIdentifierUri" })
// Enable FAPI to run this test!
@Test(enabled = false)
public void ensureRequestObjectWithBadAudFails(final String redirectUri, final String redirectUris, final String clientJwksUri, final String encryptionKeyId, final String signingKeyId, final String dnName, final String keyStoreFile, final String keyStoreSecret, final String sectorIdentifierUri) throws Exception {
    showTitle("ensureRequestObjectWithBadAudFails");
    List<ResponseType> responseTypes = Arrays.asList(ResponseType.CODE);
    // 1. Dynamic Client Registration
    RegisterResponse registerResponse = registerClient(redirectUris, responseTypes, sectorIdentifierUri, clientJwksUri, SignatureAlgorithm.PS256, KeyEncryptionAlgorithm.RSA_OAEP, BlockEncryptionAlgorithm.A256GCM);
    String clientId = registerResponse.getClientId();
    // 2. Request authorization
    List<String> scope = Arrays.asList("openid", "profile", "address", "email");
    String state = UUID.randomUUID().toString();
    String nonce = UUID.randomUUID().toString();
    AuthorizationRequest authorizationRequest = new AuthorizationRequest(responseTypes, clientId, scope, redirectUri, null);
    AuthCryptoProvider cryptoProvider1 = new AuthCryptoProvider(keyStoreFile, keyStoreSecret, dnName);
    JwtAuthorizationRequest jwsAuthorizationRequest = new JwtAuthorizationRequest(authorizationRequest, SignatureAlgorithm.PS256, cryptoProvider1);
    jwsAuthorizationRequest.setKeyId(signingKeyId);
    // Added bad aud to request object claims
    jwsAuthorizationRequest.setAud("https://www.other1.example.com/");
    jwsAuthorizationRequest.setRedirectUri(redirectUri);
    jwsAuthorizationRequest.setResponseMode(ResponseMode.JWT);
    jwsAuthorizationRequest.setState(state);
    // FAPI: nonce param is required
    jwsAuthorizationRequest.setNonce(nonce);
    // FAPI: require the request object to contain an exp claim that has a lifetime of no longer than 60 minutes after the nbf claim
    jwsAuthorizationRequest.setNbf((int) Instant.now().getEpochSecond());
    // FAPI: require the request object to contain an exp claim that has a lifetime of no longer than 60 minutes after the nbf claim
    jwsAuthorizationRequest.setExp(jwsAuthorizationRequest.getNbf() + 3600);
    Jwt authJws = Jwt.parse(jwsAuthorizationRequest.getEncodedJwt());
    JwkClient jwkClient = new JwkClient(jwksUri);
    JwkResponse jwkResponse = jwkClient.exec();
    String serverKeyId = jwkResponse.getKeyId(Algorithm.RSA_OAEP);
    assertNotNull(serverKeyId);
    JSONObject jwks = JwtUtil.getJSONWebKeys(jwksUri);
    AuthCryptoProvider cryptoProvider2 = new AuthCryptoProvider(keyStoreFile, keyStoreSecret, dnName);
    privateKey = cryptoProvider2.getPrivateKey(encryptionKeyId);
    JwtAuthorizationRequest jweAuthorizationRequest = new JwtAuthorizationRequest(authorizationRequest, KeyEncryptionAlgorithm.RSA_OAEP, BlockEncryptionAlgorithm.A256GCM, cryptoProvider2);
    jweAuthorizationRequest.setKeyId(serverKeyId);
    jweAuthorizationRequest.setNestedPayload(authJws);
    String authJwe = jweAuthorizationRequest.getEncodedJwt(jwks);
    authorizationRequest.setRequest(authJwe);
    AuthorizeClient authorizeClient = new AuthorizeClient(authorizationEndpoint);
    authorizeClient.setRequest(authorizationRequest);
    AuthorizationResponse authorizationResponse = authorizeClient.exec();
    showClient(authorizeClient);
    assertNotNull(authorizationResponse.getResponse());
    Jwe response = Jwe.parse(authorizationResponse.getResponse(), privateKey, null);
    assertJweResponse(response);
    assertEquals(response.getClaims().getClaimAsString("error"), "invalid_request_object");
    // Clear private key to do not affect to other tests
    privateKey = null;
}

Example 67 with AuthCryptoProvider

use of io.jans.as.model.crypto.AuthCryptoProvider in project jans by JanssenProject.

the class AuthorizationResponseModeJwtResponseTypeCodeSignedEncryptedHttpTest method ensureRequestObjectWithNoneSigningAlgorithmFails.

@Parameters({ "redirectUri", "redirectUris", "clientJwksUri", "RSA_OAEP_keyId", "PS256_keyId", "dnName", "keyStoreFile", "keyStoreSecret", "sectorIdentifierUri" })
// Enable FAPI to run this test!
@Test(enabled = false)
public void ensureRequestObjectWithNoneSigningAlgorithmFails(final String redirectUri, final String redirectUris, final String clientJwksUri, final String encryptionKeyId, final String signingKeyId, final String dnName, final String keyStoreFile, final String keyStoreSecret, final String sectorIdentifierUri) throws Exception {
    showTitle("ensureRequestObjectWithNoneSigningAlgorithmFails");
    List<ResponseType> responseTypes = Arrays.asList(ResponseType.CODE);
    List<GrantType> GrantTypes = Arrays.asList(GrantType.AUTHORIZATION_CODE);
    // 1. Dynamic Client Registration
    RegisterResponse registerResponse = registerClient(redirectUris, responseTypes, GrantTypes, sectorIdentifierUri, clientJwksUri, SignatureAlgorithm.PS256, KeyEncryptionAlgorithm.RSA_OAEP, BlockEncryptionAlgorithm.A256GCM);
    String clientId = registerResponse.getClientId();
    // 2. Request authorization
    List<String> scope = Arrays.asList("openid", "profile", "address", "email");
    String state = UUID.randomUUID().toString();
    String nonce = UUID.randomUUID().toString();
    AuthorizationRequest authorizationRequest = new AuthorizationRequest(responseTypes, clientId, scope, redirectUri, null);
    AuthCryptoProvider cryptoProvider1 = new AuthCryptoProvider(keyStoreFile, keyStoreSecret, dnName);
    JwtAuthorizationRequest jwsAuthorizationRequest = new JwtAuthorizationRequest(authorizationRequest, SignatureAlgorithm.PS256, cryptoProvider1);
    jwsAuthorizationRequest.setKeyId(signingKeyId);
    // Added bad aud to request object claims
    jwsAuthorizationRequest.setAud("https://www.other1.example.com/");
    jwsAuthorizationRequest.setRedirectUri(redirectUri);
    jwsAuthorizationRequest.setResponseMode(ResponseMode.JWT);
    jwsAuthorizationRequest.setState(state);
    // FAPI: nonce param is required
    jwsAuthorizationRequest.setNonce(nonce);
    // FAPI: require the request object to
    jwsAuthorizationRequest.setNbf((int) Instant.now().getEpochSecond());
    // contain an exp claim that has a
    // lifetime of no longer than 60 minutes
    // after the nbf claim
    // FAPI: require the request object to
    jwsAuthorizationRequest.setExp(jwsAuthorizationRequest.getNbf() + 3600);
    // contain an exp claim that has a
    // lifetime of no longer than 60
    // minutes after the nbf claim
    Jwt authJws = Jwt.parse(jwsAuthorizationRequest.getEncodedJwt());
    JwkClient jwkClient = new JwkClient(jwksUri);
    JwkResponse jwkResponse = jwkClient.exec();
    String serverKeyId = jwkResponse.getKeyId(Algorithm.RSA_OAEP);
    assertNotNull(serverKeyId);
    JSONObject jwks = JwtUtil.getJSONWebKeys(jwksUri);
    AuthCryptoProvider cryptoProvider2 = new AuthCryptoProvider(keyStoreFile, keyStoreSecret, dnName);
    privateKey = cryptoProvider2.getPrivateKey(encryptionKeyId);
    JwtAuthorizationRequest jweAuthorizationRequest = new JwtAuthorizationRequest(authorizationRequest, SignatureAlgorithm.NONE, cryptoProvider2);
    jweAuthorizationRequest.setKeyId(serverKeyId);
    jweAuthorizationRequest.setNestedPayload(authJws);
    jweAuthorizationRequest.setKeyId(signingKeyId);
    jweAuthorizationRequest.setResponseMode(ResponseMode.JWT);
    jweAuthorizationRequest.setState(state);
    jweAuthorizationRequest.setScopes(scope);
    jweAuthorizationRequest.setResponseTypes(responseTypes);
    jweAuthorizationRequest.setRedirectUri(redirectUri);
    // FAPI: nonce param is required
    jweAuthorizationRequest.setNonce(nonce);
    // FAPI: require the request object to
    jweAuthorizationRequest.setNbf((int) Instant.now().getEpochSecond());
    // contain an exp claim that has a
    // lifetime of no longer than 60 minutes
    // after the nbf claim
    // Added invalid exp value to request
    jweAuthorizationRequest.setExp(jwsAuthorizationRequest.getNbf() + 3600);
    // object which is 70 minutes in the
    // future
    String authJwe = jweAuthorizationRequest.getEncodedJwt(jwks);
    authorizationRequest.setRequest(authJwe);
    AuthorizeClient authorizeClient = new AuthorizeClient(authorizationEndpoint);
    authorizeClient.setRequest(authorizationRequest);
    AuthorizationResponse authorizationResponse = authorizeClient.exec();
    showClient(authorizeClient);
    assertNotNull(authorizationResponse.getResponse());
    Jwe response = Jwe.parse(authorizationResponse.getResponse(), privateKey, null);
    assertJweResponse(response);
    assertEquals(response.getClaims().getClaimAsString("error"), "invalid_request_object");
    // Clear private key to do not affect to other tests
    privateKey = null;
}

Example 68 with AuthCryptoProvider

use of io.jans.as.model.crypto.AuthCryptoProvider in project jans by JanssenProject.

the class AuthorizationResponseModeJwtResponseTypeCodeTokenEncryptedHttpTest method authorizationRequestObjectAlgRSA15EncA256CBCPLUSHS512.

@Parameters({ "userId", "userSecret", "redirectUri", "redirectUris", "clientJwksUri", "RSA1_5_keyId", "dnName", "keyStoreFile", "keyStoreSecret", "sectorIdentifierUri" })
@Test
public void authorizationRequestObjectAlgRSA15EncA256CBCPLUSHS512(final String userId, final String userSecret, final String redirectUri, final String redirectUris, final String clientJwksUri, final String clientKeyId, final String dnName, final String keyStoreFile, final String keyStoreSecret, final String sectorIdentifierUri) throws Exception {
    showTitle("authorizationRequestObjectAlgRSA15EncA256CBCPLUSHS512");
    List<ResponseType> responseTypes = Arrays.asList(ResponseType.CODE, ResponseType.TOKEN);
    // 1. Dynamic Client Registration
    RegisterResponse registerResponse = registerClient(redirectUris, responseTypes, sectorIdentifierUri, clientJwksUri, null, KeyEncryptionAlgorithm.RSA1_5, BlockEncryptionAlgorithm.A256CBC_PLUS_HS512);
    String clientId = registerResponse.getClientId();
    // 2. Choose encryption key
    JwkClient jwkClient = new JwkClient(jwksUri);
    JwkResponse jwkResponse = jwkClient.exec();
    String serverKeyId = jwkResponse.getKeyId(Algorithm.RSA1_5);
    assertNotNull(serverKeyId);
    // 3. Request authorization
    JSONObject jwks = JwtUtil.getJSONWebKeys(jwksUri);
    AuthCryptoProvider cryptoProvider = new AuthCryptoProvider(keyStoreFile, keyStoreSecret, dnName);
    privateKey = cryptoProvider.getPrivateKey(clientKeyId);
    List<String> scopes = Arrays.asList("openid", "profile", "address", "email");
    String nonce = UUID.randomUUID().toString();
    String state = UUID.randomUUID().toString();
    AuthorizationRequest authorizationRequest = new AuthorizationRequest(responseTypes, clientId, scopes, redirectUri, nonce);
    authorizationRequest.setResponseMode(ResponseMode.JWT);
    authorizationRequest.setState(state);
    JwtAuthorizationRequest jwtAuthorizationRequest = new JwtAuthorizationRequest(authorizationRequest, KeyEncryptionAlgorithm.RSA1_5, BlockEncryptionAlgorithm.A256CBC_PLUS_HS512, cryptoProvider);
    jwtAuthorizationRequest.setKeyId(serverKeyId);
    jwtAuthorizationRequest.addUserInfoClaim(new Claim(JwtClaimName.NAME, ClaimValue.createNull()));
    jwtAuthorizationRequest.addUserInfoClaim(new Claim(JwtClaimName.NICKNAME, ClaimValue.createEssential(false)));
    jwtAuthorizationRequest.addUserInfoClaim(new Claim(JwtClaimName.EMAIL, ClaimValue.createNull()));
    jwtAuthorizationRequest.addUserInfoClaim(new Claim(JwtClaimName.EMAIL_VERIFIED, ClaimValue.createNull()));
    jwtAuthorizationRequest.addUserInfoClaim(new Claim(JwtClaimName.PICTURE, ClaimValue.createEssential(false)));
    jwtAuthorizationRequest.addIdTokenClaim(new Claim(JwtClaimName.AUTHENTICATION_TIME, ClaimValue.createNull()));
    jwtAuthorizationRequest.getIdTokenMember().setMaxAge(86400);
    String authJwt = jwtAuthorizationRequest.getEncodedJwt(jwks);
    authorizationRequest.setRequest(authJwt);
    authorizationRequest(authorizationRequest, ResponseMode.FRAGMENT_JWT, userId, userSecret);
    // Clear private key to do not affect to other tests
    privateKey = null;
}

Example 69 with AuthCryptoProvider

use of io.jans.as.model.crypto.AuthCryptoProvider in project jans by JanssenProject.

the class AuthorizationResponseModeJwtResponseTypeCodeTokenEncryptedHttpTest method testAlgRSA15EncA256CBCPLUSHS512.

@Parameters({ "userId", "userSecret", "redirectUris", "redirectUri", "clientJwksUri", "RSA1_5_keyId", "keyStoreFile", "keyStoreSecret", "sectorIdentifierUri" })
@Test
public void testAlgRSA15EncA256CBCPLUSHS512(final String userId, final String userSecret, final String redirectUris, final String redirectUri, final String clientJwksUri, final String keyId, final String keyStoreFile, final String keyStoreSecret, final String sectorIdentifierUri) throws Exception {
    showTitle("testAlgRSA15EncA256CBCPLUSHS512");
    List<ResponseType> responseTypes = Arrays.asList(ResponseType.CODE, ResponseType.TOKEN);
    // 1. Register client
    RegisterResponse registerResponse = registerClient(redirectUris, responseTypes, sectorIdentifierUri, clientJwksUri, null, KeyEncryptionAlgorithm.RSA1_5, BlockEncryptionAlgorithm.A256CBC_PLUS_HS512);
    String clientId = registerResponse.getClientId();
    // 2. Request authorization
    List<String> scopes = Arrays.asList("openid", "profile", "address", "email");
    String state = UUID.randomUUID().toString();
    AuthCryptoProvider cryptoProvider = new AuthCryptoProvider(keyStoreFile, keyStoreSecret, null);
    privateKey = cryptoProvider.getPrivateKey(keyId);
    authorizationRequest(responseTypes, ResponseMode.JWT, ResponseMode.FRAGMENT_JWT, clientId, scopes, redirectUri, null, state, userId, userSecret);
}

Example 70 with AuthCryptoProvider

use of io.jans.as.model.crypto.AuthCryptoProvider in project jans by JanssenProject.

the class AuthorizationResponseModeJwtResponseTypeCodeTokenEncryptedHttpTest method testAlgRSA15EncA128CBCPLUSHS256.

@Parameters({ "userId", "userSecret", "redirectUris", "redirectUri", "clientJwksUri", "RSA1_5_keyId", "keyStoreFile", "keyStoreSecret", "sectorIdentifierUri" })
@Test
public void testAlgRSA15EncA128CBCPLUSHS256(final String userId, final String userSecret, final String redirectUris, final String redirectUri, final String clientJwksUri, final String keyId, final String keyStoreFile, final String keyStoreSecret, final String sectorIdentifierUri) throws Exception {
    showTitle("testAlgRSA15EncA128CBCPLUSHS256");
    List<ResponseType> responseTypes = Arrays.asList(ResponseType.CODE, ResponseType.TOKEN);
    // 1. Register client
    RegisterResponse registerResponse = registerClient(redirectUris, responseTypes, sectorIdentifierUri, clientJwksUri, null, KeyEncryptionAlgorithm.RSA1_5, BlockEncryptionAlgorithm.A128CBC_PLUS_HS256);
    String clientId = registerResponse.getClientId();
    // 2. Request authorization
    List<String> scopes = Arrays.asList("openid", "profile", "address", "email");
    String state = UUID.randomUUID().toString();
    AuthCryptoProvider cryptoProvider = new AuthCryptoProvider(keyStoreFile, keyStoreSecret, null);
    privateKey = cryptoProvider.getPrivateKey(keyId);
    authorizationRequest(responseTypes, ResponseMode.JWT, ResponseMode.FRAGMENT_JWT, clientId, scopes, redirectUri, null, state, userId, userSecret);
}