Examples with JwsJwtCompactProducer org.apache.cxf.rs.security.jose.jws.JwsJwtCompactProducer used on opensource projects

Example 6 with JwsJwtCompactProducer

use of org.apache.cxf.rs.security.jose.jws.JwsJwtCompactProducer in project cxf by apache.

the class OIDCNegativeTest method testJWTRequestNonmatchingResponseType.

@org.junit.Test
public void testJWTRequestNonmatchingResponseType() throws Exception {
    URL busFile = OIDCNegativeTest.class.getResource("client.xml");
    String address = "https://localhost:" + PORT + "/unsignedjwtservices/";
    WebClient client = WebClient.create(address, OAuth2TestUtils.setupProviders(), "alice", "security", busFile.toString());
    // Save the Cookie for the second request...
    WebClient.getConfig(client).getRequestContext().put(org.apache.cxf.message.Message.MAINTAIN_SESSION, Boolean.TRUE);
    JwtClaims claims = new JwtClaims();
    claims.setIssuer("consumer-id");
    claims.setIssuedAt(Instant.now().getEpochSecond());
    claims.setAudiences(Collections.singletonList("https://localhost:" + PORT + "/unsignedjwtservices/"));
    claims.setProperty("response_type", "token");
    JwsHeaders headers = new JwsHeaders();
    headers.setAlgorithm("none");
    JwtToken token = new JwtToken(headers, claims);
    JwsJwtCompactProducer jws = new JwsJwtCompactProducer(token);
    String request = jws.getSignedEncodedJws();
    AuthorizationCodeParameters parameters = new AuthorizationCodeParameters();
    parameters.setConsumerId("consumer-id");
    parameters.setScope("openid");
    parameters.setResponseType("code");
    parameters.setPath("authorize/");
    parameters.setRequest(request);
    // Get Authorization Code
    try {
        OAuth2TestUtils.getLocation(client, parameters);
        fail("Failure expected on a non-matching response_type");
    } catch (ResponseProcessingException ex) {
    // expected
    }
}

Example 7 with JwsJwtCompactProducer

use of org.apache.cxf.rs.security.jose.jws.JwsJwtCompactProducer in project cxf by apache.

the class OAuth2TestUtils method createToken.

public static String createToken(String issuer, String subject, String audience, boolean expiry, boolean sign) {
    // Create the JWT Token
    JwtClaims claims = new JwtClaims();
    claims.setSubject(subject);
    if (issuer != null) {
        claims.setIssuer(issuer);
    }
    Instant now = Instant.now();
    claims.setIssuedAt(now.getEpochSecond());
    if (expiry) {
        claims.setExpiryTime(now.plusSeconds(60L).getEpochSecond());
    }
    if (audience != null) {
        claims.setAudiences(Collections.singletonList(audience));
    }
    if (sign) {
        // Sign the JWT Token
        Properties signingProperties = new Properties();
        signingProperties.put("rs.security.keystore.type", "jks");
        signingProperties.put("rs.security.keystore.password", "password");
        signingProperties.put("rs.security.keystore.alias", "alice");
        signingProperties.put("rs.security.keystore.file", "keys/alice.jks");
        signingProperties.put("rs.security.key.password", "password");
        signingProperties.put("rs.security.signature.algorithm", "RS256");
        JwsHeaders jwsHeaders = new JwsHeaders(signingProperties);
        JwsJwtCompactProducer jws = new JwsJwtCompactProducer(jwsHeaders, claims);
        JwsSignatureProvider sigProvider = JwsUtils.loadSignatureProvider(signingProperties, jwsHeaders);
        return jws.signWith(sigProvider);
    }
    JwsHeaders jwsHeaders = new JwsHeaders(SignatureAlgorithm.NONE);
    JwsJwtCompactProducer jws = new JwsJwtCompactProducer(jwsHeaders, claims);
    return jws.getSignedEncodedJws();
}

Example 8 with JwsJwtCompactProducer

use of org.apache.cxf.rs.security.jose.jws.JwsJwtCompactProducer in project cxf by apache.

the class JWTTokenProvider method signToken.

private String signToken(JwtClaims claims, RealmProperties jwtRealm, STSPropertiesMBean stsProperties) throws Exception {
    if (signToken) {
        // Initialise signature objects with defaults of STSPropertiesMBean
        Crypto signatureCrypto = stsProperties.getSignatureCrypto();
        CallbackHandler callbackHandler = stsProperties.getCallbackHandler();
        SignatureProperties signatureProperties = stsProperties.getSignatureProperties();
        String alias = stsProperties.getSignatureUsername();
        if (jwtRealm != null) {
            // callbackhandler and alias of STSPropertiesMBean is ignored
            if (jwtRealm.getSignatureCrypto() != null) {
                LOG.fine("SAMLRealm signature keystore used");
                signatureCrypto = jwtRealm.getSignatureCrypto();
                callbackHandler = jwtRealm.getCallbackHandler();
                alias = jwtRealm.getSignatureAlias();
            }
            // SignatureProperties can be defined independently of SignatureCrypto
            if (jwtRealm.getSignatureProperties() != null) {
                signatureProperties = jwtRealm.getSignatureProperties();
            }
        }
        // Get the signature algorithm to use - for now we don't allow the client to ask
        // for a particular signature algorithm, as with SAML
        String signatureAlgorithm = signatureProperties.getSignatureAlgorithm();
        try {
            SignatureAlgorithm.getAlgorithm(signatureAlgorithm);
        } catch (IllegalArgumentException ex) {
            signatureAlgorithm = SignatureAlgorithm.RS256.name();
        }
        // If alias not defined, get the default of the SignatureCrypto
        if ((alias == null || "".equals(alias)) && (signatureCrypto != null)) {
            alias = signatureCrypto.getDefaultX509Identifier();
            if (LOG.isLoggable(Level.FINE)) {
                LOG.fine("Signature alias is null so using default alias: " + alias);
            }
        }
        // Get the password
        String password = null;
        if (callbackHandler != null) {
            WSPasswordCallback[] cb = { new WSPasswordCallback(alias, WSPasswordCallback.SIGNATURE) };
            callbackHandler.handle(cb);
            password = cb[0].getPassword();
        }
        Properties signingProperties = new Properties();
        signingProperties.put(JoseConstants.RSSEC_SIGNATURE_ALGORITHM, signatureAlgorithm);
        if (alias != null) {
            signingProperties.put(JoseConstants.RSSEC_KEY_STORE_ALIAS, alias);
        }
        if (password != null) {
            signingProperties.put(JoseConstants.RSSEC_KEY_PSWD, password);
        } else {
            throw new STSException("Can't get the password", STSException.REQUEST_FAILED);
        }
        if (!(signatureCrypto instanceof Merlin)) {
            throw new STSException("Can't get the keystore", STSException.REQUEST_FAILED);
        }
        KeyStore keystore = ((Merlin) signatureCrypto).getKeyStore();
        signingProperties.put(JoseConstants.RSSEC_KEY_STORE, keystore);
        JwsHeaders jwsHeaders = new JwsHeaders(signingProperties);
        JwsJwtCompactProducer jws = new JwsJwtCompactProducer(jwsHeaders, claims);
        JwsSignatureProvider sigProvider = JwsUtils.loadSignatureProvider(signingProperties, jwsHeaders);
        return jws.signWith(sigProvider);
    }
    JwsHeaders jwsHeaders = new JwsHeaders(SignatureAlgorithm.NONE);
    JwsJwtCompactProducer jws = new JwsJwtCompactProducer(jwsHeaders, claims);
    return jws.getSignedEncodedJws();
}

Example 9 with JwsJwtCompactProducer

use of org.apache.cxf.rs.security.jose.jws.JwsJwtCompactProducer in project cxf by apache.

the class JoseJwtProducer method processJwt.

public String processJwt(JwtToken jwt, JweEncryptionProvider theEncProvider, JwsSignatureProvider theSigProvider) {
    super.checkProcessRequirements();
    String data = null;
    if (isJweRequired() && theEncProvider == null) {
        theEncProvider = getInitializedEncryptionProvider(jwt.getJweHeaders());
        if (theEncProvider == null) {
            throw new JwtException("Unable to encrypt JWT");
        }
    }
    if (isJwsRequired()) {
        JwsJwtCompactProducer jws = new JwsJwtCompactProducer(jwt);
        if (jws.isPlainText()) {
            data = jws.getSignedEncodedJws();
        } else {
            if (theSigProvider == null) {
                theSigProvider = getInitializedSignatureProvider(jws.getJwsHeaders());
            }
            if (theSigProvider == null) {
                throw new JwtException("Unable to sign JWT");
            }
            data = jws.signWith(theSigProvider);
        }
        if (theEncProvider != null) {
            data = theEncProvider.encrypt(StringUtils.toBytesUTF8(data), jwt.getJweHeaders());
        }
    } else {
        JweJwtCompactProducer jwe = new JweJwtCompactProducer(jwt.getJweHeaders(), jwt.getClaims());
        data = jwe.encryptWith(theEncProvider);
    }
    return data;
}