Examples with JwtToken org.apache.cxf.rs.security.jose.jwt.JwtToken used on opensource projects

Example 76 with JwtToken

use of org.apache.cxf.rs.security.jose.jwt.JwtToken in project testcases by coheigea.

the class JWTAuthorizationTest method testWrongRole.

@org.junit.Test
public void testWrongRole() throws Exception {
    URL busFile = JWTAuthorizationTest.class.getResource("cxf-client.xml");
    List<Object> providers = new ArrayList<Object>();
    providers.add(new JacksonJsonProvider());
    providers.add(new JwtAuthenticationClientFilter());
    String address = "http://localhost:" + PORT + "/doubleit/services";
    WebClient client = WebClient.create(address, providers, busFile.toString());
    client.type("application/json").accept("application/json");
    // Create the JWT Token
    JwtClaims claims = new JwtClaims();
    claims.setSubject("alice");
    claims.setIssuer("DoubleItSTSIssuer");
    claims.setIssuedAt(new Date().getTime() / 1000L);
    claims.setProperty("role", "employee");
    claims.setAudiences(Collections.singletonList(address));
    JwtToken token = new JwtToken(claims);
    Map<String, Object> properties = new HashMap<String, Object>();
    properties.put("rs.security.keystore.type", "jks");
    properties.put("rs.security.keystore.password", "ispass");
    properties.put("rs.security.keystore.alias", "imposter");
    properties.put("rs.security.keystore.file", "imposter.jks");
    properties.put("rs.security.key.password", "ikpass");
    properties.put("rs.security.signature.algorithm", "RS256");
    properties.put(JwtConstants.JWT_TOKEN, token);
    WebClient.getConfig(client).getRequestContext().putAll(properties);
    Number numberToDouble = new Number();
    numberToDouble.setDescription("This is the number to double");
    numberToDouble.setNumber(25);
    Response response = client.post(numberToDouble);
    assertNotEquals(response.getStatus(), 200);
}

Example 77 with JwtToken

use of org.apache.cxf.rs.security.jose.jwt.JwtToken in project testcases by coheigea.

the class JWTEncryptedTest method testEncryptedToken.

@org.junit.Test
public void testEncryptedToken() throws Exception {
    URL busFile = JWETest.class.getResource("cxf-client.xml");
    List<Object> providers = new ArrayList<Object>();
    providers.add(new JacksonJsonProvider());
    JwtAuthenticationClientFilter jwtFilter = new JwtAuthenticationClientFilter();
    jwtFilter.setJwsRequired(false);
    jwtFilter.setJweRequired(true);
    providers.add(jwtFilter);
    String address = "http://localhost:" + PORT + "/doubleit/services";
    WebClient client = WebClient.create(address, providers, busFile.toString());
    client.type("application/json").accept("application/json");
    // Create the JWT Token
    JwtClaims claims = new JwtClaims();
    claims.setSubject("alice");
    claims.setIssuer("DoubleItSTSIssuer");
    claims.setIssuedAt(new Date().getTime() / 1000L);
    claims.setAudiences(Collections.singletonList(address));
    JwtToken token = new JwtToken(claims);
    Map<String, Object> properties = new HashMap<String, Object>();
    properties.put("rs.security.encryption.properties", "clientEncKeystore.properties");
    properties.put(JwtConstants.JWT_TOKEN, token);
    WebClient.getConfig(client).getRequestContext().putAll(properties);
    Number numberToDouble = new Number();
    numberToDouble.setDescription("This is the number to double");
    numberToDouble.setNumber(25);
    Response response = client.post(numberToDouble);
    assertEquals(response.getStatus(), 200);
    assertEquals(response.readEntity(Number.class).getNumber(), 50);
}

Example 78 with JwtToken

use of org.apache.cxf.rs.security.jose.jwt.JwtToken in project testcases by coheigea.

the class JWTRequestTest method testAuthorizationCodeFlowUnsignedJWTWithState.

@org.junit.Test
public void testAuthorizationCodeFlowUnsignedJWTWithState() throws Exception {
    URL busFile = JWTRequestTest.class.getResource("cxf-client.xml");
    String address = "https://localhost:" + PORT + "/unsignedjwtservices/";
    WebClient client = WebClient.create(address, setupProviders(), "alice", "security", busFile.toString());
    // Save the Cookie for the second request...
    WebClient.getConfig(client).getRequestContext().put(org.apache.cxf.message.Message.MAINTAIN_SESSION, Boolean.TRUE);
    JwtClaims claims = new JwtClaims();
    claims.setIssuer("consumer-id");
    claims.setIssuedAt(new Date().getTime() / 1000L);
    claims.setAudiences(Collections.singletonList("https://localhost:" + PORT + "/unsignedjwtservices/"));
    JwsHeaders headers = new JwsHeaders();
    headers.setAlgorithm("none");
    JwtToken token = new JwtToken(headers, claims);
    JwsJwtCompactProducer jws = new JwsJwtCompactProducer(token);
    String request = jws.getSignedEncodedJws();
    // Get Authorization Code
    String code = getAuthorizationCode(client, "openid", null, "123456789", "consumer-id", request);
    assertNotNull(code);
}

Example 79 with JwtToken

use of org.apache.cxf.rs.security.jose.jwt.JwtToken in project testcases by coheigea.

the class JWTRequestTest method testAuthorizationCodeFlowUnsignedJWT.

@org.junit.Test
public void testAuthorizationCodeFlowUnsignedJWT() throws Exception {
    URL busFile = JWTRequestTest.class.getResource("cxf-client.xml");
    String address = "https://localhost:" + PORT + "/unsignedjwtservices/";
    WebClient client = WebClient.create(address, setupProviders(), "alice", "security", busFile.toString());
    // Save the Cookie for the second request...
    WebClient.getConfig(client).getRequestContext().put(org.apache.cxf.message.Message.MAINTAIN_SESSION, Boolean.TRUE);
    JwtClaims claims = new JwtClaims();
    claims.setIssuer("consumer-id");
    claims.setIssuedAt(new Date().getTime() / 1000L);
    claims.setAudiences(Collections.singletonList("https://localhost:" + PORT + "/unsignedjwtservices/"));
    JwsHeaders headers = new JwsHeaders();
    headers.setAlgorithm("none");
    JwtToken token = new JwtToken(headers, claims);
    JwsJwtCompactProducer jws = new JwsJwtCompactProducer(token);
    String request = jws.getSignedEncodedJws();
    // Get Authorization Code
    String code = getAuthorizationCode(client, "openid", request);
    assertNotNull(code);
}

Example 80 with JwtToken

use of org.apache.cxf.rs.security.jose.jwt.JwtToken in project testcases by coheigea.

the class UserInfoTest method testSignedUserInfo.

@org.junit.Test
public void testSignedUserInfo() throws Exception {
    URL busFile = UserInfoTest.class.getResource("cxf-client.xml");
    String address = "https://localhost:" + PORT + "/services/";
    WebClient client = WebClient.create(address, setupProviders(), "alice", "security", busFile.toString());
    // Save the Cookie for the second request...
    WebClient.getConfig(client).getRequestContext().put(org.apache.cxf.message.Message.MAINTAIN_SESSION, Boolean.TRUE);
    // Get Authorization Code
    String code = getAuthorizationCode(client, "openid");
    assertNotNull(code);
    // Now get the access token
    client = WebClient.create(address, setupProviders(), "consumer-id", "this-is-a-secret", busFile.toString());
    // Save the Cookie for the second request...
    WebClient.getConfig(client).getRequestContext().put(org.apache.cxf.message.Message.MAINTAIN_SESSION, Boolean.TRUE);
    ClientAccessToken accessToken = getAccessTokenWithAuthorizationCode(client, code);
    assertNotNull(accessToken.getTokenKey());
    assertTrue(accessToken.getApprovedScope().contains("openid"));
    // Now invoke on the UserInfo service with the access token
    String userInfoAddress = "https://localhost:" + USERINFO_PORT + "/services/signed/userinfo";
    WebClient userInfoClient = WebClient.create(userInfoAddress, busFile.toString());
    userInfoClient.accept("application/jwt");
    userInfoClient.header("Authorization", "Bearer " + accessToken.getTokenKey());
    Response serviceResponse = userInfoClient.get();
    assertEquals(serviceResponse.getStatus(), 200);
    String token = serviceResponse.readEntity(String.class);
    assertNotNull(token);
    JwsJwtCompactConsumer jwtConsumer = new JwsJwtCompactConsumer(token);
    JwtToken jwt = jwtConsumer.getJwtToken();
    assertEquals("alice", jwt.getClaim(JwtConstants.CLAIM_SUBJECT));
    assertEquals("consumer-id", jwt.getClaim(JwtConstants.CLAIM_AUDIENCE));
    KeyStore keystore = KeyStore.getInstance("JKS");
    keystore.load(Loader.getResource("servicestore.jks").openStream(), "sspass".toCharArray());
    Certificate cert = keystore.getCertificate("myservicekey");
    Assert.assertNotNull(cert);
    Assert.assertTrue(jwtConsumer.verifySignatureWith((X509Certificate) cert, SignatureAlgorithm.RS256));
}