Search in sources :

Example 1 with AuthorizationMetadata

use of org.apache.cxf.rs.security.oauth2.services.AuthorizationMetadata in project cxf by apache.

the class OAuth2JwtFiltersTest method doTestServiceWithJwtTokenAndScope.

private void doTestServiceWithJwtTokenAndScope(String oauthService, String rsAddress) throws Exception {
    final AuthorizationMetadata authorizationMetadata = OAuthClientUtils.getAuthorizationMetadata(oauthService);
    final String scope = "create_book";
    final URI authorizationURI = OAuthClientUtils.getAuthorizationURI(authorizationMetadata.getAuthorizationEndpoint().toString(), "consumer-id", null, null, scope);
    // Get Authorization Code
    WebClient oauthClient = WebClient.create(authorizationURI.toString(), OAuth2TestUtils.setupProviders(), "alice", "security", null);
    // Save the Cookie for the second request...
    WebClient.getConfig(oauthClient).getRequestContext().put(org.apache.cxf.message.Message.MAINTAIN_SESSION, Boolean.TRUE);
    final String location = OAuth2TestUtils.getLocation(oauthClient, oauthClient.accept(MediaType.APPLICATION_JSON).get(OAuthAuthorizationData.class), null);
    final String code = OAuth2TestUtils.getSubstring(location, "code");
    assertNotNull(code);
    // Now get the access token
    final ClientAccessToken accessToken = OAuthClientUtils.getAccessToken(authorizationMetadata.getTokenEndpoint().toString(), new Consumer("consumer-id", "this-is-a-secret"), new AuthorizationCodeGrant(code), true);
    assertNotNull(accessToken.getTokenKey());
    JwsJwtCompactConsumer jwtConsumer = new JwsJwtCompactConsumer(accessToken.getTokenKey());
    JwsSignatureVerifier verifier = JwsUtils.loadSignatureVerifier("org/apache/cxf/systest/jaxrs/security/alice.rs.properties", null);
    assertTrue(jwtConsumer.verifySignatureWith(verifier));
    JwtClaims claims = jwtConsumer.getJwtClaims();
    assertEquals("consumer-id", claims.getStringProperty(OAuthConstants.CLIENT_ID));
    assertEquals("alice", claims.getStringProperty("username"));
    assertTrue(claims.getStringProperty(OAuthConstants.SCOPE).contains(scope));
    // Now invoke on the service with the access token
    WebClient client = WebClient.create(rsAddress, OAuth2TestUtils.setupProviders()).authorization(new ClientAccessToken(BEARER_AUTHORIZATION_SCHEME, accessToken.getTokenKey()));
    Book returnedBook = client.type("application/xml").post(new Book("book", 123L), Book.class);
    assertEquals(returnedBook.getName(), "book");
    assertEquals(returnedBook.getId(), 123L);
}
Also used : JwsSignatureVerifier(org.apache.cxf.rs.security.jose.jws.JwsSignatureVerifier) AuthorizationMetadata(org.apache.cxf.rs.security.oauth2.services.AuthorizationMetadata) JwsJwtCompactConsumer(org.apache.cxf.rs.security.jose.jws.JwsJwtCompactConsumer) Consumer(org.apache.cxf.rs.security.oauth2.client.Consumer) AuthorizationCodeGrant(org.apache.cxf.rs.security.oauth2.grants.code.AuthorizationCodeGrant) JwtClaims(org.apache.cxf.rs.security.jose.jwt.JwtClaims) Book(org.apache.cxf.systest.jaxrs.security.Book) ClientAccessToken(org.apache.cxf.rs.security.oauth2.common.ClientAccessToken) JwsJwtCompactConsumer(org.apache.cxf.rs.security.jose.jws.JwsJwtCompactConsumer) URI(java.net.URI) WebClient(org.apache.cxf.jaxrs.client.WebClient) OAuthAuthorizationData(org.apache.cxf.rs.security.oauth2.common.OAuthAuthorizationData)

Aggregations

URI (java.net.URI)1 WebClient (org.apache.cxf.jaxrs.client.WebClient)1 JwsJwtCompactConsumer (org.apache.cxf.rs.security.jose.jws.JwsJwtCompactConsumer)1 JwsSignatureVerifier (org.apache.cxf.rs.security.jose.jws.JwsSignatureVerifier)1 JwtClaims (org.apache.cxf.rs.security.jose.jwt.JwtClaims)1 Consumer (org.apache.cxf.rs.security.oauth2.client.Consumer)1 ClientAccessToken (org.apache.cxf.rs.security.oauth2.common.ClientAccessToken)1 OAuthAuthorizationData (org.apache.cxf.rs.security.oauth2.common.OAuthAuthorizationData)1 AuthorizationCodeGrant (org.apache.cxf.rs.security.oauth2.grants.code.AuthorizationCodeGrant)1 AuthorizationMetadata (org.apache.cxf.rs.security.oauth2.services.AuthorizationMetadata)1 Book (org.apache.cxf.systest.jaxrs.security.Book)1