Examples with Jwe io.jans.as.model.jwe.Jwe used on opensource projects

Example 76 with Jwe

use of io.jans.as.model.jwe.Jwe in project jans by JanssenProject.

the class AuthorizationResponseModeJwtResponseTypeCodeSignedEncryptedHttpTest method ensureRequestObjectWithoutExpFails.

@Parameters({ "redirectUri", "redirectUris", "clientJwksUri", "RSA_OAEP_keyId", "PS256_keyId", "dnName", "keyStoreFile", "keyStoreSecret", "sectorIdentifierUri" })
// Enable FAPI to run this test!
@Test(enabled = false)
public void ensureRequestObjectWithoutExpFails(final String redirectUri, final String redirectUris, final String clientJwksUri, final String encryptionKeyId, final String signingKeyId, final String dnName, final String keyStoreFile, final String keyStoreSecret, final String sectorIdentifierUri) throws Exception {
    showTitle("ensureRequestObjectWithoutExpFails");
    List<ResponseType> responseTypes = Arrays.asList(ResponseType.CODE);
    // 1. Dynamic Client Registration
    RegisterResponse registerResponse = registerClient(redirectUris, responseTypes, sectorIdentifierUri, clientJwksUri, SignatureAlgorithm.PS256, KeyEncryptionAlgorithm.RSA_OAEP, BlockEncryptionAlgorithm.A256GCM);
    String clientId = registerResponse.getClientId();
    // 2. Request authorization
    List<String> scope = Arrays.asList("openid", "profile", "address", "email");
    String state = UUID.randomUUID().toString();
    String nonce = UUID.randomUUID().toString();
    AuthorizationRequest authorizationRequest = new AuthorizationRequest(responseTypes, clientId, scope, redirectUri, null);
    AuthCryptoProvider cryptoProvider1 = new AuthCryptoProvider(keyStoreFile, keyStoreSecret, dnName);
    JwtAuthorizationRequest jwsAuthorizationRequest = new JwtAuthorizationRequest(authorizationRequest, SignatureAlgorithm.PS256, cryptoProvider1);
    jwsAuthorizationRequest.setResponseMode(ResponseMode.JWT);
    jwsAuthorizationRequest.setKeyId(signingKeyId);
    jwsAuthorizationRequest.setRedirectUri(redirectUri);
    jwsAuthorizationRequest.setState(state);
    // FAPI: nonce param is required
    jwsAuthorizationRequest.setNonce(nonce);
    // FAPI: require the request object to contain an exp claim that has a lifetime of no longer than 60 minutes after the nbf claim
    jwsAuthorizationRequest.setNbf((int) Instant.now().getEpochSecond());
    // FAPI: exp param is required
    jwsAuthorizationRequest.setExp(null);
    Jwt authJws = Jwt.parse(jwsAuthorizationRequest.getEncodedJwt());
    JwkClient jwkClient = new JwkClient(jwksUri);
    JwkResponse jwkResponse = jwkClient.exec();
    String serverKeyId = jwkResponse.getKeyId(Algorithm.RSA_OAEP);
    assertNotNull(serverKeyId);
    JSONObject jwks = JwtUtil.getJSONWebKeys(jwksUri);
    AuthCryptoProvider cryptoProvider2 = new AuthCryptoProvider(keyStoreFile, keyStoreSecret, dnName);
    privateKey = cryptoProvider2.getPrivateKey(encryptionKeyId);
    JwtAuthorizationRequest jweAuthorizationRequest = new JwtAuthorizationRequest(authorizationRequest, KeyEncryptionAlgorithm.RSA_OAEP, BlockEncryptionAlgorithm.A256GCM, cryptoProvider2);
    jweAuthorizationRequest.setKeyId(serverKeyId);
    jweAuthorizationRequest.setNestedPayload(authJws);
    String authJwe = jweAuthorizationRequest.getEncodedJwt(jwks);
    authorizationRequest.setRequest(authJwe);
    AuthorizeClient authorizeClient = new AuthorizeClient(authorizationEndpoint);
    authorizeClient.setRequest(authorizationRequest);
    AuthorizationResponse authorizationResponse = authorizeClient.exec();
    showClient(authorizeClient);
    assertNotNull(authorizationResponse.getResponse());
    Jwe response = Jwe.parse(authorizationResponse.getResponse(), privateKey, null);
    assertJweResponse(response);
    assertTrue(Arrays.asList("invalid_request", "invalid_request_object", "invalid_request_uri", "access_denied").contains(response.getClaims().getClaimAsString("error")));
    // Clear private key to do not affect to other tests
    privateKey = null;
}

Example 77 with Jwe

use of io.jans.as.model.jwe.Jwe in project jans by JanssenProject.

the class AuthorizationResponseModeJwtResponseTypeCodeSignedEncryptedHttpTest method ensureRequestObjectWithUnregisteredRequestUrFails.

@Parameters({ "redirectUri", "redirectUris", "clientJwksUri", "RSA_OAEP_keyId", "PS256_keyId", "dnName", "keyStoreFile", "keyStoreSecret", "sectorIdentifierUri" })
// Enable FAPI to run this test!
@Test(enabled = false)
public void ensureRequestObjectWithUnregisteredRequestUrFails(final String redirectUri, final String redirectUris, final String clientJwksUri, final String encryptionKeyId, final String signingKeyId, final String dnName, final String keyStoreFile, final String keyStoreSecret, final String sectorIdentifierUri) throws Exception {
    showTitle("ensureRequestObjectWithUnregisteredRequestUrFails");
    List<ResponseType> responseTypes = Arrays.asList(ResponseType.CODE);
    List<GrantType> GrantTypes = Arrays.asList(GrantType.AUTHORIZATION_CODE);
    // 1. Dynamic Client Registration
    RegisterResponse registerResponse = registerClient(redirectUris, responseTypes, GrantTypes, sectorIdentifierUri, clientJwksUri, SignatureAlgorithm.PS256, KeyEncryptionAlgorithm.RSA_OAEP, BlockEncryptionAlgorithm.A256GCM);
    String clientId = registerResponse.getClientId();
    // 2. Request authorization
    List<String> scope = Arrays.asList("openid", "profile", "address", "email");
    String state = UUID.randomUUID().toString();
    String nonce = UUID.randomUUID().toString();
    AuthorizationRequest authorizationRequest = new AuthorizationRequest(responseTypes, clientId, scope, redirectUri + "987987", null);
    AuthCryptoProvider cryptoProvider1 = new AuthCryptoProvider(keyStoreFile, keyStoreSecret, dnName);
    JwtAuthorizationRequest jwsAuthorizationRequest = new JwtAuthorizationRequest(authorizationRequest, SignatureAlgorithm.PS256, cryptoProvider1);
    jwsAuthorizationRequest.setKeyId(signingKeyId);
    // Added bad aud to request object claims
    jwsAuthorizationRequest.setAud("https://www.other1.example.com/");
    jwsAuthorizationRequest.setResponseMode(ResponseMode.JWT);
    jwsAuthorizationRequest.setState(state);
    // FAPI: nonce param is required
    jwsAuthorizationRequest.setNonce(nonce);
    // FAPI: require the request object to
    jwsAuthorizationRequest.setNbf((int) Instant.now().getEpochSecond());
    // contain an exp claim that has a
    // lifetime of no longer than 60 minutes
    // after the nbf claim
    // FAPI: require the request object to
    jwsAuthorizationRequest.setExp(jwsAuthorizationRequest.getNbf() + 3600);
    // contain an exp claim that has a
    // lifetime of no longer than 60
    // minutes after the nbf claim
    Jwt authJws = Jwt.parse(jwsAuthorizationRequest.getEncodedJwt());
    JwkClient jwkClient = new JwkClient(jwksUri);
    JwkResponse jwkResponse = jwkClient.exec();
    String serverKeyId = jwkResponse.getKeyId(Algorithm.RSA_OAEP);
    assertNotNull(serverKeyId);
    JSONObject jwks = JwtUtil.getJSONWebKeys(jwksUri);
    AuthCryptoProvider cryptoProvider2 = new AuthCryptoProvider(keyStoreFile, keyStoreSecret, dnName);
    privateKey = cryptoProvider2.getPrivateKey(encryptionKeyId);
    JwtAuthorizationRequest jweAuthorizationRequest = new JwtAuthorizationRequest(authorizationRequest, SignatureAlgorithm.PS256, cryptoProvider2);
    jweAuthorizationRequest.setKeyId(serverKeyId);
    jweAuthorizationRequest.setNestedPayload(authJws);
    jweAuthorizationRequest.setKeyId(signingKeyId);
    jweAuthorizationRequest.setResponseMode(ResponseMode.JWT);
    jweAuthorizationRequest.setState(state);
    jweAuthorizationRequest.setScopes(scope);
    jweAuthorizationRequest.setResponseTypes(responseTypes);
    jweAuthorizationRequest.setRedirectUri(redirectUri + "987987");
    // FAPI: nonce param is required
    jweAuthorizationRequest.setNonce(nonce);
    // FAPI: require the request object to
    jweAuthorizationRequest.setNbf((int) Instant.now().getEpochSecond());
    // contain an exp claim that has a
    // lifetime of no longer than 60 minutes
    // after the nbf claim
    // Added invalid exp value to request
    jweAuthorizationRequest.setExp(jwsAuthorizationRequest.getNbf() + 3600);
    // object which is 70 minutes in the
    // future
    String authJwe = jweAuthorizationRequest.getEncodedJwt(jwks);
    authorizationRequest.setRequest(authJwe);
    AuthorizeClient authorizeClient = new AuthorizeClient(authorizationEndpoint);
    authorizeClient.setRequest(authorizationRequest);
    AuthorizationResponse authorizationResponse = authorizeClient.exec();
    showClient(authorizeClient);
    assertNotNull(authorizationResponse.getResponse());
    Jwe response = Jwe.parse(authorizationResponse.getResponse(), privateKey, null);
    assertJweResponse(response);
    assertEquals(response.getClaims().getClaimAsString("error"), "invalid_request_object");
    // Clear private key to do not affect to other tests
    privateKey = null;
}

Example 78 with Jwe

use of io.jans.as.model.jwe.Jwe in project jans by JanssenProject.

the class AuthorizationResponseModeJwtResponseTypeCodeSignedEncryptedHttpTest method ensureExpiredRequestObjectFails.

@Parameters({ "redirectUri", "redirectUris", "clientJwksUri", "RSA_OAEP_keyId", "PS256_keyId", "dnName", "keyStoreFile", "keyStoreSecret", "sectorIdentifierUri" })
// Enable FAPI to run this test!
@Test(enabled = false)
public void ensureExpiredRequestObjectFails(final String redirectUri, final String redirectUris, final String clientJwksUri, final String encryptionKeyId, final String signingKeyId, final String dnName, final String keyStoreFile, final String keyStoreSecret, final String sectorIdentifierUri) throws Exception {
    showTitle("ensureExpiredRequestObjectFails");
    List<ResponseType> responseTypes = Arrays.asList(ResponseType.CODE);
    // 1. Dynamic Client Registration
    RegisterResponse registerResponse = registerClient(redirectUris, responseTypes, sectorIdentifierUri, clientJwksUri, SignatureAlgorithm.PS256, KeyEncryptionAlgorithm.RSA_OAEP, BlockEncryptionAlgorithm.A256GCM);
    String clientId = registerResponse.getClientId();
    // 2. Request authorization
    List<String> scope = Arrays.asList("openid", "profile", "address", "email");
    String state = UUID.randomUUID().toString();
    String nonce = UUID.randomUUID().toString();
    AuthorizationRequest authorizationRequest = new AuthorizationRequest(responseTypes, clientId, scope, redirectUri, null);
    AuthCryptoProvider cryptoProvider1 = new AuthCryptoProvider(keyStoreFile, keyStoreSecret, dnName);
    JwtAuthorizationRequest jwsAuthorizationRequest = new JwtAuthorizationRequest(authorizationRequest, SignatureAlgorithm.PS256, cryptoProvider1);
    jwsAuthorizationRequest.setKeyId(signingKeyId);
    jwsAuthorizationRequest.setRedirectUri(redirectUri);
    jwsAuthorizationRequest.setResponseMode(ResponseMode.JWT);
    jwsAuthorizationRequest.setState(state);
    // FAPI: nonce param is required
    jwsAuthorizationRequest.setNonce(nonce);
    // FAPI: require the request object to contain an exp claim that has a lifetime of no longer than 60 minutes after the nbf claim
    jwsAuthorizationRequest.setNbf((int) Instant.now().getEpochSecond());
    // Address expired exp
    jwsAuthorizationRequest.setExp(jwsAuthorizationRequest.getNbf() - 3600);
    Jwt authJws = Jwt.parse(jwsAuthorizationRequest.getEncodedJwt());
    JwkClient jwkClient = new JwkClient(jwksUri);
    JwkResponse jwkResponse = jwkClient.exec();
    String serverKeyId = jwkResponse.getKeyId(Algorithm.RSA_OAEP);
    assertNotNull(serverKeyId);
    JSONObject jwks = JwtUtil.getJSONWebKeys(jwksUri);
    AuthCryptoProvider cryptoProvider2 = new AuthCryptoProvider(keyStoreFile, keyStoreSecret, dnName);
    privateKey = cryptoProvider2.getPrivateKey(encryptionKeyId);
    JwtAuthorizationRequest jweAuthorizationRequest = new JwtAuthorizationRequest(authorizationRequest, KeyEncryptionAlgorithm.RSA_OAEP, BlockEncryptionAlgorithm.A256GCM, cryptoProvider2);
    jweAuthorizationRequest.setKeyId(serverKeyId);
    jweAuthorizationRequest.setNestedPayload(authJws);
    String authJwe = jweAuthorizationRequest.getEncodedJwt(jwks);
    authorizationRequest.setRequest(authJwe);
    AuthorizeClient authorizeClient = new AuthorizeClient(authorizationEndpoint);
    authorizeClient.setRequest(authorizationRequest);
    AuthorizationResponse authorizationResponse = authorizeClient.exec();
    showClient(authorizeClient);
    assertNotNull(authorizationResponse.getResponse());
    Jwe response = Jwe.parse(authorizationResponse.getResponse(), privateKey, null);
    assertJweResponse(response);
    assertEquals(response.getClaims().getClaimAsString("error"), "invalid_request_object");
    // Clear private key to do not affect to other tests
    privateKey = null;
}

Example 79 with Jwe

use of io.jans.as.model.jwe.Jwe in project jans by JanssenProject.

the class AuthorizationResponseModeJwtResponseTypeCodeSignedEncryptedHttpTest method ensureRequestObjectWithoutNonceFails.

@Parameters({ "redirectUri", "redirectUris", "clientJwksUri", "RSA_OAEP_keyId", "PS256_keyId", "dnName", "keyStoreFile", "keyStoreSecret", "sectorIdentifierUri" })
// Enable FAPI to run this test!
@Test(enabled = false)
public void ensureRequestObjectWithoutNonceFails(final String redirectUri, final String redirectUris, final String clientJwksUri, final String encryptionKeyId, final String signingKeyId, final String dnName, final String keyStoreFile, final String keyStoreSecret, final String sectorIdentifierUri) throws Exception {
    showTitle("ensureRequestObjectWithoutNonceFails");
    List<ResponseType> responseTypes = Arrays.asList(ResponseType.CODE);
    // 1. Dynamic Client Registration
    RegisterResponse registerResponse = registerClient(redirectUris, responseTypes, sectorIdentifierUri, clientJwksUri, SignatureAlgorithm.PS256, KeyEncryptionAlgorithm.RSA_OAEP, BlockEncryptionAlgorithm.A256GCM);
    String clientId = registerResponse.getClientId();
    // 2. Request authorization
    List<String> scope = Arrays.asList("openid", "profile", "address", "email");
    String state = UUID.randomUUID().toString();
    String nonce = UUID.randomUUID().toString();
    AuthorizationRequest authorizationRequest = new AuthorizationRequest(responseTypes, clientId, scope, redirectUri, nonce);
    AuthCryptoProvider cryptoProvider1 = new AuthCryptoProvider(keyStoreFile, keyStoreSecret, dnName);
    JwtAuthorizationRequest jwsAuthorizationRequest = new JwtAuthorizationRequest(authorizationRequest, SignatureAlgorithm.PS256, cryptoProvider1);
    jwsAuthorizationRequest.setKeyId(signingKeyId);
    jwsAuthorizationRequest.setResponseMode(ResponseMode.JWT);
    jwsAuthorizationRequest.setState(state);
    jwsAuthorizationRequest.setScopes(scope);
    jwsAuthorizationRequest.setRedirectUri(redirectUri);
    // FAPI: nonce param is required
    jwsAuthorizationRequest.setNonce(null);
    // FAPI: require the request object to contain an exp claim that has a lifetime of no longer than 60 minutes after the nbf claim
    jwsAuthorizationRequest.setNbf((int) Instant.now().getEpochSecond());
    // FAPI: require the request object to contain an exp claim that has a lifetime of no longer than 60 minutes after the nbf claim
    jwsAuthorizationRequest.setExp(jwsAuthorizationRequest.getNbf() + 3600);
    Jwt authJws = Jwt.parse(jwsAuthorizationRequest.getEncodedJwt());
    JwkClient jwkClient = new JwkClient(jwksUri);
    JwkResponse jwkResponse = jwkClient.exec();
    String serverKeyId = jwkResponse.getKeyId(Algorithm.RSA_OAEP);
    assertNotNull(serverKeyId);
    JSONObject jwks = JwtUtil.getJSONWebKeys(jwksUri);
    AuthCryptoProvider cryptoProvider2 = new AuthCryptoProvider(keyStoreFile, keyStoreSecret, dnName);
    privateKey = cryptoProvider2.getPrivateKey(encryptionKeyId);
    JwtAuthorizationRequest jweAuthorizationRequest = new JwtAuthorizationRequest(authorizationRequest, KeyEncryptionAlgorithm.RSA_OAEP, BlockEncryptionAlgorithm.A256GCM, cryptoProvider2);
    jweAuthorizationRequest.setKeyId(serverKeyId);
    jweAuthorizationRequest.setNestedPayload(authJws);
    String authJwe = jweAuthorizationRequest.getEncodedJwt(jwks);
    authorizationRequest.setRequest(authJwe);
    AuthorizeClient authorizeClient = new AuthorizeClient(authorizationEndpoint);
    authorizeClient.setRequest(authorizationRequest);
    AuthorizationResponse authorizationResponse = authorizeClient.exec();
    showClient(authorizeClient);
    assertNotNull(authorizationResponse.getResponse());
    Jwe response = Jwe.parse(authorizationResponse.getResponse(), privateKey, null);
    assertJweResponse(response);
    assertTrue(Arrays.asList("invalid_request", "invalid_request_object", "invalid_request_uri").contains(response.getClaims().getClaimAsString("error")));
    // Clear private key to do not affect to other tests
    privateKey = null;
}

Example 80 with Jwe

use of io.jans.as.model.jwe.Jwe in project jans by JanssenProject.

the class RedirectUri method getJweResponse.

private String getJweResponse(String nestedJws) throws InvalidJweException, InvalidJwtException, CryptoProviderException {
    Jwe jwe = new Jwe();
    // Header
    jwe.getHeader().setType(JwtType.JWT);
    jwe.getHeader().setAlgorithm(keyEncryptionAlgorithm);
    jwe.getHeader().setEncryptionMethod(blockEncryptionAlgorithm);
    // Claims
    if (nestedJws == null) {
        jwe.getClaims().setClaim(ISS, issuer);
        jwe.getClaims().setClaim(AUD, audience);
        if (responseParameters.containsKey(EXPIRES_IN)) {
            jwe.getClaims().setClaim(EXP, responseParameters.get(EXPIRES_IN));
        } else {
            final Calendar calendar = Calendar.getInstance();
            calendar.add(Calendar.SECOND, authorizationCodeLifetime);
            jwe.getClaims().setClaim(EXP, calendar.getTime());
        }
        for (Map.Entry<String, String> entry : responseParameters.entrySet()) {
            jwe.getClaims().setClaim(entry.getKey(), entry.getValue());
        }
    } else {
        Jwt jwt = Jwt.parse(nestedJws);
        jwe.setSignedJWTPayload(jwt);
    }
    // Encryption
    if (keyEncryptionAlgorithm == KeyEncryptionAlgorithm.RSA_OAEP || keyEncryptionAlgorithm == KeyEncryptionAlgorithm.RSA1_5) {
        PublicKey publicKey = cryptoProvider.getPublicKey(keyId, jsonWebKeys, null);
        if (publicKey == null) {
            throw new InvalidJweException("The public key is not valid");
        }
        JweEncrypterImpl jweEncrypter = new JweEncrypterImpl(keyEncryptionAlgorithm, blockEncryptionAlgorithm, publicKey);
        jwe = jweEncrypter.encrypt(jwe);
    } else if (keyEncryptionAlgorithm == KeyEncryptionAlgorithm.A128KW || keyEncryptionAlgorithm == KeyEncryptionAlgorithm.A256KW) {
        JweEncrypterImpl jweEncrypter = new JweEncrypterImpl(keyEncryptionAlgorithm, blockEncryptionAlgorithm, sharedSymmetricKey);
        jwe = jweEncrypter.encrypt(jwe);
    }
    return jwe.toString();
}