Examples with AUTHORIZATION javax.ws.rs.core.HttpHeaders.AUTHORIZATION used on opensource projects

Example 1 with AUTHORIZATION

use of javax.ws.rs.core.HttpHeaders.AUTHORIZATION in project ddf by codice.

the class TestOidc method testCodeFlowLogin.

// --------------------------Code Flow Tests--------------------------//
@Test
public void testCodeFlowLogin() throws Exception {
    Map<String, String> initialResponseParams = sendInitialRequest(CODE);
    assertThat(initialResponseParams.get(SCOPE), is(DDF_SCOPE));
    assertThat(initialResponseParams.get(RESPONSE_TYPE), is(CODE));
    assertThat(initialResponseParams.get(CLIENT_ID), is(DDF_CLIENT_ID));
    assertTrue(initialResponseParams.containsKey(REDIRECT_URI));
    // recommended by spec
    assertTrue(initialResponseParams.containsKey(STATE));
    // optional but sent in DDF
    assertTrue(initialResponseParams.containsKey(RESPONSE_MODE));
    // optional but sent in DDF
    assertTrue(initialResponseParams.containsKey(NONCE));
    // Add token endpoint information to stub server
    String basicAuthHeader = "Basic " + java.util.Base64.getEncoder().encodeToString((DDF_CLIENT_ID + ":" + DDF_CLIENT_SECRET).getBytes(StandardCharsets.UTF_8));
    String validIdToken = getBaseIdTokenBuilder().withClaim(NONCE, initialResponseParams.get(NONCE)).sign(validAlgorithm);
    String validAccessToken = createAccessToken(true);
    String tokenEndpointResponse = createTokenEndpointResponse(validIdToken, validAccessToken);
    whenHttp(server).match(post(TOKEN_ENDPOINT_PATH), parameter(CODE, TEMPORARY_CODE), parameter("grant_type", "authorization_code"), withHeader(AUTHORIZATION, basicAuthHeader)).then(ok(), contentType(APPLICATION_JSON), bytesContent(tokenEndpointResponse.getBytes()));
    // Respond to request after user logged in with the temporary code
    Response searchResponse = given().cookie(JSESSIONID, initialResponseParams.get(JSESSIONID)).header(USER_AGENT, BROWSER_USER_AGENT).header(HOST, "localhost:" + HTTPS_PORT.getPort()).header("Origin", URL_START.toString()).param(CODE, TEMPORARY_CODE).param(STATE, initialResponseParams.get(STATE)).redirects().follow(false).expect().statusCode(200).when().post(initialResponseParams.get(REDIRECT_URI));
    // Verify that the stub server was hit
    List<Call> tokenEndpointCalls = server.getCalls().stream().filter(call -> call.getUrl().equals(URL_START + TOKEN_ENDPOINT_PATH)).collect(Collectors.toList());
    assertThat(tokenEndpointCalls.size(), is(1));
    // Verify that we're logged in as admin
    Map<String, Object> userInfoList = getUserInfo(initialResponseParams.get(JSESSIONID));
    assertThat(userInfoList.get("name"), is(ADMIN));
    logout(initialResponseParams.get(JSESSIONID));
}

Example 2 with AUTHORIZATION

use of javax.ws.rs.core.HttpHeaders.AUTHORIZATION in project ddf by codice.

the class TestOidc method processCredentialFlow.

/**
 * Processes a credential flow request/response
 *
 * <ul>
 *   <li>Sets up a userinfo endpoint that responds with the given {@param userInfoResponse} when
 *       given {@param accessToken}
 *   <li>Sends a request to Intrigue with the {@param accessToken} as a parameter
 *   <li>Asserts that the response is teh expected response
 *   <li>Verifies if the userinfo endpoint is hit or not
 * </ul>
 *
 * @return the response for additional verification
 */
private Response processCredentialFlow(String accessToken, String userInfoResponse, boolean isSigned, int expectedStatusCode, boolean userInfoShouldBeHit) {
    // Host the user info endpoint with the access token in the auth header
    String basicAuthHeader = "Bearer " + accessToken;
    String contentType = isSigned ? "application/jwt" : APPLICATION_JSON;
    whenHttp(server).match(get(USER_INFO_ENDPOINT_PATH), withHeader(AUTHORIZATION, basicAuthHeader)).then(ok(), contentType(contentType), bytesContent(userInfoResponse.getBytes()));
    // Send a request to DDF with the access token
    Response response = given().redirects().follow(false).expect().statusCode(expectedStatusCode).when().get(ROOT_URL.getUrl() + "?access_token=" + accessToken);
    List<Call> endpointCalls = server.getCalls().stream().filter(call -> call.getMethod().getMethodString().equals(GET)).filter(call -> call.getUrl().equals(URL_START + USER_INFO_ENDPOINT_PATH)).collect(Collectors.toList());
    if (userInfoShouldBeHit) {
        assertThat(endpointCalls.size(), is(greaterThanOrEqualTo(1)));
    } else {
        assertThat(endpointCalls.size(), is(0));
    }
    return response;
}