Examples with JwtToken org.apache.cxf.rs.security.jose.jwt.JwtToken used on opensource projects

Example 71 with JwtToken

use of org.apache.cxf.rs.security.jose.jwt.JwtToken in project testcases by coheigea.

the class AuthorizationCodeFlowTest method validateIdToken.

private void validateIdToken(String idToken, String nonce) throws KeyStoreException, NoSuchAlgorithmException, CertificateException, IOException {
    JwsJwtCompactConsumer jwtConsumer = new JwsJwtCompactConsumer(idToken);
    JwtToken jwt = jwtConsumer.getJwtToken();
    // Validate claims
    Assert.assertEquals("alice", jwt.getClaim(JwtConstants.CLAIM_SUBJECT));
    Assert.assertEquals("OIDC IdP", jwt.getClaim(JwtConstants.CLAIM_ISSUER));
    Assert.assertEquals("consumer-id", jwt.getClaim(JwtConstants.CLAIM_AUDIENCE));
    Assert.assertNotNull(jwt.getClaim(JwtConstants.CLAIM_EXPIRY));
    Assert.assertNotNull(jwt.getClaim(JwtConstants.CLAIM_ISSUED_AT));
    if (nonce != null) {
        Assert.assertEquals(nonce, jwt.getClaim(IdToken.NONCE_CLAIM));
    }
    KeyStore keystore = KeyStore.getInstance("JKS");
    keystore.load(Loader.getResource("servicestore.jks").openStream(), "sspass".toCharArray());
    Certificate cert = keystore.getCertificate("myservicekey");
    Assert.assertNotNull(cert);
    Assert.assertTrue(jwtConsumer.verifySignatureWith((X509Certificate) cert, SignatureAlgorithm.RS256));
}

Example 72 with JwtToken

use of org.apache.cxf.rs.security.jose.jwt.JwtToken in project testcases by coheigea.

the class ImplicitFlowTest method validateIdToken.

private void validateIdToken(String idToken, String nonce) throws KeyStoreException, NoSuchAlgorithmException, CertificateException, IOException {
    JwsJwtCompactConsumer jwtConsumer = new JwsJwtCompactConsumer(idToken);
    JwtToken jwt = jwtConsumer.getJwtToken();
    // Validate claims
    Assert.assertEquals("alice", jwt.getClaim(JwtConstants.CLAIM_SUBJECT));
    Assert.assertEquals("OIDC IdP", jwt.getClaim(JwtConstants.CLAIM_ISSUER));
    Assert.assertEquals("consumer-id", jwt.getClaim(JwtConstants.CLAIM_AUDIENCE));
    Assert.assertNotNull(jwt.getClaim(JwtConstants.CLAIM_EXPIRY));
    Assert.assertNotNull(jwt.getClaim(JwtConstants.CLAIM_ISSUED_AT));
    if (nonce != null) {
        Assert.assertEquals(nonce, jwt.getClaim(IdToken.NONCE_CLAIM));
    }
    KeyStore keystore = KeyStore.getInstance("JKS");
    keystore.load(Loader.getResource("servicestore.jks").openStream(), "sspass".toCharArray());
    Certificate cert = keystore.getCertificate("myservicekey");
    Assert.assertNotNull(cert);
    Assert.assertTrue(jwtConsumer.verifySignatureWith((X509Certificate) cert, SignatureAlgorithm.RS256));
}

Example 73 with JwtToken

use of org.apache.cxf.rs.security.jose.jwt.JwtToken in project testcases by coheigea.

the class ImplicitFlowTest method testImplicitFlow.

@org.junit.Test
public void testImplicitFlow() throws Exception {
    URL busFile = ImplicitFlowTest.class.getResource("cxf-client.xml");
    String address = "https://localhost:" + PORT + "/services/";
    WebClient client = WebClient.create(address, setupProviders(), "alice", "security", busFile.toString());
    // Save the Cookie for the second request...
    WebClient.getConfig(client).getRequestContext().put(org.apache.cxf.message.Message.MAINTAIN_SESSION, Boolean.TRUE);
    // Get Access Token
    client.type("application/json").accept("application/json");
    client.query("client_id", "consumer-id");
    client.query("redirect_uri", "http://www.blah.apache.org");
    client.query("scope", "openid");
    client.query("response_type", "id_token token");
    client.query("nonce", "123456789");
    client.path("authorize-implicit/");
    Response response = client.get();
    OAuthAuthorizationData authzData = response.readEntity(OAuthAuthorizationData.class);
    // Now call "decision" to get the access token
    client.path("decision");
    client.type("application/x-www-form-urlencoded");
    Form form = new Form();
    form.param("session_authenticity_token", authzData.getAuthenticityToken());
    form.param("client_id", authzData.getClientId());
    form.param("redirect_uri", authzData.getRedirectUri());
    form.param("scope", authzData.getProposedScope());
    if (authzData.getResponseType() != null) {
        form.param("response_type", authzData.getResponseType());
    }
    if (authzData.getNonce() != null) {
        form.param("nonce", authzData.getNonce());
    }
    form.param("oauthDecision", "allow");
    response = client.post(form);
    String location = response.getHeaderString("Location");
    // Check Access Token
    String accessToken = getSubstring(location, "access_token");
    assertNotNull(accessToken);
    // Check IdToken
    String idToken = getSubstring(location, "id_token");
    assertNotNull(idToken);
    validateIdToken(idToken, null);
    JwsJwtCompactConsumer jwtConsumer = new JwsJwtCompactConsumer(idToken);
    JwtToken jwt = jwtConsumer.getJwtToken();
    Assert.assertNotNull(jwt.getClaims().getClaim(IdToken.ACCESS_TOKEN_HASH_CLAIM));
    Assert.assertNotNull(jwt.getClaims().getClaim(IdToken.NONCE_CLAIM));
}

Example 74 with JwtToken

use of org.apache.cxf.rs.security.jose.jwt.JwtToken in project testcases by coheigea.

the class JWTAuthenticationTest method testUnauthenticatedRequest.

@org.junit.Test
public void testUnauthenticatedRequest() throws Exception {
    URL busFile = JWTAuthenticationTest.class.getResource("cxf-client.xml");
    List<Object> providers = new ArrayList<Object>();
    providers.add(new JacksonJsonProvider());
    providers.add(new JwtAuthenticationClientFilter());
    String address = "http://localhost:" + PORT + "/doubleit/services";
    WebClient client = WebClient.create(address, providers, busFile.toString());
    client.type("application/json").accept("application/json");
    // Create the JWT Token
    JwtClaims claims = new JwtClaims();
    claims.setSubject("alice");
    claims.setIssuer("DoubleItSTSIssuer");
    claims.setIssuedAt(new Date().getTime() / 1000L);
    claims.setAudiences(Collections.singletonList(address));
    JwtToken token = new JwtToken(claims);
    Map<String, Object> properties = new HashMap<String, Object>();
    properties.put("rs.security.keystore.type", "jks");
    properties.put("rs.security.keystore.password", "ispass");
    properties.put("rs.security.keystore.alias", "imposter");
    properties.put("rs.security.keystore.file", "imposter.jks");
    properties.put("rs.security.key.password", "ikpass");
    properties.put("rs.security.signature.algorithm", "RS256");
    properties.put(JwtConstants.JWT_TOKEN, token);
    WebClient.getConfig(client).getRequestContext().putAll(properties);
    Number numberToDouble = new Number();
    numberToDouble.setDescription("This is the number to double");
    numberToDouble.setNumber(25);
    Response response = client.post(numberToDouble);
    assertNotEquals(response.getStatus(), 200);
}

Example 75 with JwtToken

use of org.apache.cxf.rs.security.jose.jwt.JwtToken in project testcases by coheigea.

the class JWTAuthorizationTest method testNoRole.

@org.junit.Test
public void testNoRole() throws Exception {
    URL busFile = JWTAuthorizationTest.class.getResource("cxf-client.xml");
    List<Object> providers = new ArrayList<Object>();
    providers.add(new JacksonJsonProvider());
    providers.add(new JwtAuthenticationClientFilter());
    String address = "http://localhost:" + PORT + "/doubleit/services";
    WebClient client = WebClient.create(address, providers, busFile.toString());
    client.type("application/json").accept("application/json");
    // Create the JWT Token
    JwtClaims claims = new JwtClaims();
    claims.setSubject("alice");
    claims.setIssuer("DoubleItSTSIssuer");
    claims.setIssuedAt(new Date().getTime() / 1000L);
    claims.setAudiences(Collections.singletonList(address));
    JwtToken token = new JwtToken(claims);
    Map<String, Object> properties = new HashMap<String, Object>();
    properties.put("rs.security.keystore.type", "jks");
    properties.put("rs.security.keystore.password", "ispass");
    properties.put("rs.security.keystore.alias", "imposter");
    properties.put("rs.security.keystore.file", "imposter.jks");
    properties.put("rs.security.key.password", "ikpass");
    properties.put("rs.security.signature.algorithm", "RS256");
    properties.put(JwtConstants.JWT_TOKEN, token);
    WebClient.getConfig(client).getRequestContext().putAll(properties);
    Number numberToDouble = new Number();
    numberToDouble.setDescription("This is the number to double");
    numberToDouble.setNumber(25);
    Response response = client.post(numberToDouble);
    assertNotEquals(response.getStatus(), 200);
}