Examples with JwtToken org.apache.cxf.rs.security.jose.jwt.JwtToken used on opensource projects

Example 66 with JwtToken

use of org.apache.cxf.rs.security.jose.jwt.JwtToken in project syncope by apache.

the class JWTITCase method notBefore.

@Test
public void notBefore() throws ParseException {
    // Get an initial token
    SyncopeClient localClient = clientFactory.create(ADMIN_UNAME, ADMIN_PWD);
    AccessTokenService accessTokenService = localClient.getService(AccessTokenService.class);
    Response response = accessTokenService.login();
    String token = response.getHeaderString(RESTHeaders.TOKEN);
    assertNotNull(token);
    JwsJwtCompactConsumer consumer = new JwsJwtCompactConsumer(token);
    String tokenId = consumer.getJwtClaims().getTokenId();
    // Create a new token using the Id of the first token
    Date now = new Date();
    long currentTime = now.getTime() / 1000L;
    Calendar expiry = Calendar.getInstance();
    expiry.setTime(now);
    expiry.add(Calendar.MINUTE, 5);
    JwtClaims jwtClaims = new JwtClaims();
    jwtClaims.setTokenId(tokenId);
    jwtClaims.setSubject(ADMIN_UNAME);
    jwtClaims.setIssuedAt(currentTime);
    jwtClaims.setIssuer(JWT_ISSUER);
    jwtClaims.setExpiryTime(expiry.getTime().getTime() / 1000L);
    jwtClaims.setNotBefore(currentTime + 60L);
    JwsHeaders jwsHeaders = new JwsHeaders(JoseType.JWT, SignatureAlgorithm.HS512);
    JwtToken jwtToken = new JwtToken(jwsHeaders, jwtClaims);
    JwsJwtCompactProducer producer = new JwsJwtCompactProducer(jwtToken);
    JwsSignatureProvider jwsSignatureProvider = new HmacJwsSignatureProvider(JWS_KEY.getBytes(), SignatureAlgorithm.HS512);
    String signed = producer.signWith(jwsSignatureProvider);
    SyncopeClient jwtClient = clientFactory.create(signed);
    UserSelfService jwtUserSelfService = jwtClient.getService(UserSelfService.class);
    try {
        jwtUserSelfService.read();
        fail("Failure expected on a token that is not valid yet");
    } catch (AccessControlException ex) {
    // expected
    }
}

Example 67 with JwtToken

use of org.apache.cxf.rs.security.jose.jwt.JwtToken in project syncope by apache.

the class JWTITCase method thirdPartyToken.

@Test
public void thirdPartyToken() throws ParseException {
    // Create a new token
    Date now = new Date();
    long currentTime = now.getTime() / 1000L;
    Calendar expiry = Calendar.getInstance();
    expiry.setTime(now);
    expiry.add(Calendar.MINUTE, 5);
    JwtClaims jwtClaims = new JwtClaims();
    jwtClaims.setTokenId(UUID.randomUUID().toString());
    jwtClaims.setSubject("puccini@apache.org");
    jwtClaims.setIssuedAt(currentTime);
    jwtClaims.setIssuer(CustomJWTSSOProvider.ISSUER);
    jwtClaims.setExpiryTime(expiry.getTime().getTime() / 1000L);
    jwtClaims.setNotBefore(currentTime);
    JwsHeaders jwsHeaders = new JwsHeaders(JoseType.JWT, SignatureAlgorithm.HS512);
    JwtToken jwtToken = new JwtToken(jwsHeaders, jwtClaims);
    JwsJwtCompactProducer producer = new JwsJwtCompactProducer(jwtToken);
    JwsSignatureProvider jwsSignatureProvider = new HmacJwsSignatureProvider(CustomJWTSSOProvider.CUSTOM_KEY.getBytes(), SignatureAlgorithm.HS512);
    String signed = producer.signWith(jwsSignatureProvider);
    SyncopeClient jwtClient = clientFactory.create(signed);
    Pair<Map<String, Set<String>>, UserTO> self = jwtClient.self();
    assertFalse(self.getLeft().isEmpty());
    assertEquals("puccini", self.getRight().getUsername());
}

Example 68 with JwtToken

use of org.apache.cxf.rs.security.jose.jwt.JwtToken in project syncope by apache.

the class AccessTokenDataBinderImpl method update.

@Override
public Pair<String, Date> update(final AccessToken accessToken, final byte[] authorities) {
    JwsJwtCompactConsumer consumer = new JwsJwtCompactConsumer(accessToken.getBody());
    credentialChecker.checkIsDefaultJWSKeyInUse();
    long duration = confDAO.find("jwt.lifetime.minutes", 120L);
    long currentTime = new Date().getTime() / 1000L;
    long expiry = currentTime + 60L * duration;
    consumer.getJwtClaims().setExpiryTime(expiry);
    Date expiryDate = new Date(expiry * 1000L);
    JwsHeaders jwsHeaders = new JwsHeaders(JoseType.JWT, jwsSignatureProvider.getAlgorithm());
    JwtToken token = new JwtToken(jwsHeaders, consumer.getJwtClaims());
    JwsJwtCompactProducer producer = new JwsJwtCompactProducer(token);
    String body = producer.signWith(jwsSignatureProvider);
    accessToken.setBody(body);
    // AccessToken stores expiry time in milliseconds, as opposed to seconds for the JWT tokens.
    accessToken.setExpiryTime(expiryDate);
    if (!adminUser.equals(accessToken.getOwner())) {
        accessToken.setAuthorities(authorities);
    }
    accessTokenDAO.save(accessToken);
    return Pair.of(body, expiryDate);
}

Example 69 with JwtToken

use of org.apache.cxf.rs.security.jose.jwt.JwtToken in project syncope by apache.

the class AccessTokenDataBinderImpl method generateJWT.

@Override
public Triple<String, String, Date> generateJWT(final String subject, final long duration, final Map<String, Object> claims) {
    credentialChecker.checkIsDefaultJWSKeyInUse();
    long currentTime = new Date().getTime() / 1000L;
    long expiryTime = currentTime + 60L * duration;
    JwtClaims jwtClaims = new JwtClaims();
    jwtClaims.setTokenId(UUID_GENERATOR.generate().toString());
    jwtClaims.setSubject(subject);
    jwtClaims.setIssuedAt(currentTime);
    jwtClaims.setIssuer(jwtIssuer);
    jwtClaims.setExpiryTime(expiryTime);
    jwtClaims.setNotBefore(currentTime);
    for (Map.Entry<String, Object> entry : claims.entrySet()) {
        jwtClaims.setClaim(entry.getKey(), entry.getValue());
    }
    JwsHeaders jwsHeaders = new JwsHeaders(JoseType.JWT, jwsSignatureProvider.getAlgorithm());
    JwtToken token = new JwtToken(jwsHeaders, jwtClaims);
    JwsJwtCompactProducer producer = new JwsJwtCompactProducer(token);
    String signed = producer.signWith(jwsSignatureProvider);
    return Triple.of(jwtClaims.getTokenId(), signed, new Date(expiryTime * 1000L));
}

Example 70 with JwtToken

use of org.apache.cxf.rs.security.jose.jwt.JwtToken in project testcases by coheigea.

the class JWTJAXRSAuthenticationTest method testJWTKerberosAccessToken.

@org.junit.Test
public void testJWTKerberosAccessToken() throws Exception {
    URL busFile = JWTJAXRSAuthenticationTest.class.getResource("cxf-client.xml");
    // 1. Get a JWT Token from the STS via the REST interface for "alice"
    String jwtToken = getJWTTokenFromSTS(busFile);
    JwsJwtCompactConsumer jwtConsumer = new JwsJwtCompactConsumer(jwtToken);
    JwtToken jwt = jwtConsumer.getJwtToken();
    Assert.assertEquals("alice", jwt.getClaim(JwtConstants.CLAIM_SUBJECT));
    Assert.assertTrue(((List<?>) jwt.getClaim(ROLE)).contains("boss"));
    // 2. Now call on the service using a custom HttpAuthSupplier
    String address = "https://localhost:" + PORT + "/doubleit/services";
    WebClient client = WebClient.create(address, busFile.toString()).type("application/xml");
    Map<String, Object> requestContext = WebClient.getConfig(client).getRequestContext();
    requestContext.put("auth.spnego.useKerberosOid", "true");
    KerbyHttpAuthSupplier authSupplier = new KerbyHttpAuthSupplier();
    authSupplier.setServicePrincipalName("bob/service.ws.apache.org@service.ws.apache.org");
    authSupplier.setServiceNameType(GSSName.NT_HOSTBASED_SERVICE);
    authSupplier.setJwtToken(jwtToken);
    WebClient.getConfig(client).getHttpConduit().setAuthSupplier(authSupplier);
    Number numberToDouble = new Number();
    numberToDouble.setDescription("This is the number to double");
    numberToDouble.setNumber(25);
    Response response = client.post(numberToDouble);
    Assert.assertEquals(response.getStatus(), 200);
    Assert.assertEquals(response.readEntity(Number.class).getNumber(), 50);
}