Search in sources :

Example 61 with Consumer

use of org.apache.cxf.rs.security.oauth2.client.Consumer in project cxf by apache.

the class UserInfoTest method testEncryptedUserInfo.

@org.junit.Test
public void testEncryptedUserInfo() throws Exception {
    URL busFile = UserInfoTest.class.getResource("client.xml");
    String address = "https://localhost:" + PORT + "/services/oidc";
    WebClient client = WebClient.create(address, OAuth2TestUtils.setupProviders(), "alice", "security", busFile.toString());
    // Save the Cookie for the second request...
    WebClient.getConfig(client).getRequestContext().put(org.apache.cxf.message.Message.MAINTAIN_SESSION, Boolean.TRUE);
    // Get Authorization Code
    String code = OAuth2TestUtils.getAuthorizationCode(client, "openid");
    assertNotNull(code);
    // Now get the access token
    client = WebClient.create(address, OAuth2TestUtils.setupProviders(), "consumer-id", "this-is-a-secret", busFile.toString());
    // Save the Cookie for the second request...
    WebClient.getConfig(client).getRequestContext().put(org.apache.cxf.message.Message.MAINTAIN_SESSION, Boolean.TRUE);
    ClientAccessToken accessToken = OAuth2TestUtils.getAccessTokenWithAuthorizationCode(client, code);
    assertNotNull(accessToken.getTokenKey());
    assertTrue(accessToken.getApprovedScope().contains("openid"));
    String idToken = accessToken.getParameters().get("id_token");
    assertNotNull(idToken);
    validateIdToken(idToken, null);
    // Now invoke on the UserInfo service with the access token
    String userInfoAddress = "https://localhost:" + PORT + "/services/encrypted/userinfo";
    WebClient userInfoClient = WebClient.create(userInfoAddress, OAuth2TestUtils.setupProviders(), busFile.toString());
    userInfoClient.accept("application/jwt");
    userInfoClient.header("Authorization", "Bearer " + accessToken.getTokenKey());
    Response serviceResponse = userInfoClient.get();
    assertEquals(200, serviceResponse.getStatus());
    String token = serviceResponse.readEntity(String.class);
    assertNotNull(token);
    KeyStore keystore = KeyStore.getInstance("JKS");
    keystore.load(ClassLoaderUtils.getResourceAsStream("keys/bob.jks", this.getClass()), "password".toCharArray());
    JweJwtCompactConsumer jwtConsumer = new JweJwtCompactConsumer(token);
    PrivateKey privateKey = (PrivateKey) keystore.getKey("bob", "password".toCharArray());
    JwtToken jwt = jwtConsumer.decryptWith(privateKey);
    assertEquals("alice", jwt.getClaim(JwtConstants.CLAIM_SUBJECT));
    assertEquals("consumer-id", jwt.getClaim(JwtConstants.CLAIM_AUDIENCE));
}
Also used : Response(javax.ws.rs.core.Response) JwtToken(org.apache.cxf.rs.security.jose.jwt.JwtToken) PrivateKey(java.security.PrivateKey) ClientAccessToken(org.apache.cxf.rs.security.oauth2.common.ClientAccessToken) JweJwtCompactConsumer(org.apache.cxf.rs.security.jose.jwe.JweJwtCompactConsumer) WebClient(org.apache.cxf.jaxrs.client.WebClient) KeyStore(java.security.KeyStore) URL(java.net.URL)

Aggregations

WebClient (org.apache.cxf.jaxrs.client.WebClient)56 ClientAccessToken (org.apache.cxf.rs.security.oauth2.common.ClientAccessToken)51 URL (java.net.URL)45 Response (javax.ws.rs.core.Response)34 Form (javax.ws.rs.core.Form)22 JwsJwtCompactConsumer (org.apache.cxf.rs.security.jose.jws.JwsJwtCompactConsumer)12 Consumer (org.apache.cxf.rs.security.oauth2.client.Consumer)10 Book (org.apache.cxf.systest.jaxrs.security.Book)9 Test (org.junit.Test)8 JwtToken (org.apache.cxf.rs.security.jose.jwt.JwtToken)7 OAuthAuthorizationData (org.apache.cxf.rs.security.oauth2.common.OAuthAuthorizationData)5 TokenIntrospection (org.apache.cxf.rs.security.oauth2.common.TokenIntrospection)5 ResponseProcessingException (javax.ws.rs.client.ResponseProcessingException)4 OAuthServiceException (org.apache.cxf.rs.security.oauth2.provider.OAuthServiceException)4 JwtClaims (org.apache.cxf.rs.security.jose.jwt.JwtClaims)3 KeyStore (java.security.KeyStore)2 OAuthJSONProvider (org.apache.cxf.rs.security.oauth2.provider.OAuthJSONProvider)2 UserInfo (org.apache.cxf.rs.security.oidc.common.UserInfo)2 AuthorizationCodeParameters (org.apache.cxf.systest.jaxrs.security.oauth2.common.OAuth2TestUtils.AuthorizationCodeParameters)2 IOException (java.io.IOException)1