Search in sources :

Example 96 with ReceivedToken

use of org.apache.cxf.sts.request.ReceivedToken in project cxf by apache.

the class JWTTokenValidatorTest method testInvalidSignature.

@org.junit.Test
public void testInvalidSignature() throws Exception {
    // Create
    TokenProvider jwtTokenProvider = new JWTTokenProvider();
    ((JWTTokenProvider) jwtTokenProvider).setSignToken(true);
    TokenProviderParameters providerParameters = createProviderParameters();
    Crypto crypto = CryptoFactory.getInstance(getEveCryptoProperties());
    CallbackHandler callbackHandler = new EveCallbackHandler();
    providerParameters.getStsProperties().setSignatureCrypto(crypto);
    providerParameters.getStsProperties().setCallbackHandler(callbackHandler);
    providerParameters.getStsProperties().setSignatureUsername("eve");
    assertTrue(jwtTokenProvider.canHandleToken(JWTTokenProvider.JWT_TOKEN_TYPE));
    TokenProviderResponse providerResponse = jwtTokenProvider.createToken(providerParameters);
    assertTrue(providerResponse != null);
    assertTrue(providerResponse.getToken() != null && providerResponse.getTokenId() != null);
    String token = (String) providerResponse.getToken();
    assertNotNull(token);
    assertTrue(token.split("\\.").length == 3);
    // Validate the token
    TokenValidator jwtTokenValidator = new JWTTokenValidator();
    TokenValidatorParameters validatorParameters = createValidatorParameters();
    TokenRequirements tokenRequirements = validatorParameters.getTokenRequirements();
    // Create a ValidateTarget consisting of a JWT Token
    ReceivedToken validateTarget = new ReceivedToken(createTokenWrapper(token));
    tokenRequirements.setValidateTarget(validateTarget);
    validatorParameters.setToken(validateTarget);
    assertTrue(jwtTokenValidator.canHandleToken(validateTarget));
    TokenValidatorResponse validatorResponse = jwtTokenValidator.validateToken(validatorParameters);
    assertTrue(validatorResponse != null);
    assertTrue(validatorResponse.getToken() != null);
    assertTrue(validatorResponse.getToken().getState() == STATE.INVALID);
}
Also used : CallbackHandler(javax.security.auth.callback.CallbackHandler) PasswordCallbackHandler(org.apache.cxf.sts.common.PasswordCallbackHandler) TokenProviderParameters(org.apache.cxf.sts.token.provider.TokenProviderParameters) TokenProvider(org.apache.cxf.sts.token.provider.TokenProvider) JWTTokenProvider(org.apache.cxf.sts.token.provider.jwt.JWTTokenProvider) Crypto(org.apache.wss4j.common.crypto.Crypto) JWTTokenValidator(org.apache.cxf.sts.token.validator.jwt.JWTTokenValidator) TokenRequirements(org.apache.cxf.sts.request.TokenRequirements) JWTTokenValidator(org.apache.cxf.sts.token.validator.jwt.JWTTokenValidator) TokenProviderResponse(org.apache.cxf.sts.token.provider.TokenProviderResponse) ReceivedToken(org.apache.cxf.sts.request.ReceivedToken) JWTTokenProvider(org.apache.cxf.sts.token.provider.jwt.JWTTokenProvider)

Example 97 with ReceivedToken

use of org.apache.cxf.sts.request.ReceivedToken in project cxf by apache.

the class JWTTokenValidatorTest method testChangedSignature.

@org.junit.Test
public void testChangedSignature() throws Exception {
    // Create
    TokenProvider jwtTokenProvider = new JWTTokenProvider();
    ((JWTTokenProvider) jwtTokenProvider).setSignToken(true);
    DefaultJWTClaimsProvider jwtClaimsProvider = new DefaultJWTClaimsProvider();
    jwtClaimsProvider.setLifetime(1L);
    ((JWTTokenProvider) jwtTokenProvider).setJwtClaimsProvider(jwtClaimsProvider);
    TokenProviderParameters providerParameters = createProviderParameters();
    assertTrue(jwtTokenProvider.canHandleToken(JWTTokenProvider.JWT_TOKEN_TYPE));
    TokenProviderResponse providerResponse = jwtTokenProvider.createToken(providerParameters);
    assertTrue(providerResponse != null);
    assertTrue(providerResponse.getToken() != null && providerResponse.getTokenId() != null);
    String token = (String) providerResponse.getToken();
    // Change the signature
    token += "blah";
    assertNotNull(token);
    assertTrue(token.split("\\.").length == 3);
    Thread.sleep(1500L);
    // Validate the token
    TokenValidator jwtTokenValidator = new JWTTokenValidator();
    TokenValidatorParameters validatorParameters = createValidatorParameters();
    TokenRequirements tokenRequirements = validatorParameters.getTokenRequirements();
    // Create a ValidateTarget consisting of a JWT Token
    ReceivedToken validateTarget = new ReceivedToken(createTokenWrapper(token));
    tokenRequirements.setValidateTarget(validateTarget);
    validatorParameters.setToken(validateTarget);
    assertTrue(jwtTokenValidator.canHandleToken(validateTarget));
    TokenValidatorResponse validatorResponse = jwtTokenValidator.validateToken(validatorParameters);
    assertTrue(validatorResponse != null);
    assertTrue(validatorResponse.getToken() != null);
    assertTrue(validatorResponse.getToken().getState() == STATE.INVALID);
}
Also used : TokenProvider(org.apache.cxf.sts.token.provider.TokenProvider) JWTTokenProvider(org.apache.cxf.sts.token.provider.jwt.JWTTokenProvider) JWTTokenValidator(org.apache.cxf.sts.token.validator.jwt.JWTTokenValidator) TokenRequirements(org.apache.cxf.sts.request.TokenRequirements) JWTTokenValidator(org.apache.cxf.sts.token.validator.jwt.JWTTokenValidator) DefaultJWTClaimsProvider(org.apache.cxf.sts.token.provider.jwt.DefaultJWTClaimsProvider) TokenProviderResponse(org.apache.cxf.sts.token.provider.TokenProviderResponse) ReceivedToken(org.apache.cxf.sts.request.ReceivedToken) JWTTokenProvider(org.apache.cxf.sts.token.provider.jwt.JWTTokenProvider) TokenProviderParameters(org.apache.cxf.sts.token.provider.TokenProviderParameters)

Example 98 with ReceivedToken

use of org.apache.cxf.sts.request.ReceivedToken in project cxf by apache.

the class JWTTokenValidatorTest method testUnsignedToken.

@org.junit.Test
public void testUnsignedToken() throws Exception {
    // Create
    TokenProvider jwtTokenProvider = new JWTTokenProvider();
    ((JWTTokenProvider) jwtTokenProvider).setSignToken(false);
    TokenProviderParameters providerParameters = createProviderParameters();
    Crypto crypto = CryptoFactory.getInstance(getEveCryptoProperties());
    CallbackHandler callbackHandler = new EveCallbackHandler();
    providerParameters.getStsProperties().setSignatureCrypto(crypto);
    providerParameters.getStsProperties().setCallbackHandler(callbackHandler);
    providerParameters.getStsProperties().setSignatureUsername("eve");
    assertTrue(jwtTokenProvider.canHandleToken(JWTTokenProvider.JWT_TOKEN_TYPE));
    TokenProviderResponse providerResponse = jwtTokenProvider.createToken(providerParameters);
    assertTrue(providerResponse != null);
    assertTrue(providerResponse.getToken() != null && providerResponse.getTokenId() != null);
    String token = (String) providerResponse.getToken();
    assertNotNull(token);
    assertTrue(token.split("\\.").length == 2);
    // Validate the token
    TokenValidator jwtTokenValidator = new JWTTokenValidator();
    TokenValidatorParameters validatorParameters = createValidatorParameters();
    TokenRequirements tokenRequirements = validatorParameters.getTokenRequirements();
    // Create a ValidateTarget consisting of a JWT Token
    ReceivedToken validateTarget = new ReceivedToken(createTokenWrapper(token));
    tokenRequirements.setValidateTarget(validateTarget);
    validatorParameters.setToken(validateTarget);
    assertTrue(jwtTokenValidator.canHandleToken(validateTarget));
    TokenValidatorResponse validatorResponse = jwtTokenValidator.validateToken(validatorParameters);
    assertTrue(validatorResponse != null);
    assertTrue(validatorResponse.getToken() != null);
    assertTrue(validatorResponse.getToken().getState() == STATE.INVALID);
}
Also used : CallbackHandler(javax.security.auth.callback.CallbackHandler) PasswordCallbackHandler(org.apache.cxf.sts.common.PasswordCallbackHandler) TokenProviderParameters(org.apache.cxf.sts.token.provider.TokenProviderParameters) TokenProvider(org.apache.cxf.sts.token.provider.TokenProvider) JWTTokenProvider(org.apache.cxf.sts.token.provider.jwt.JWTTokenProvider) Crypto(org.apache.wss4j.common.crypto.Crypto) JWTTokenValidator(org.apache.cxf.sts.token.validator.jwt.JWTTokenValidator) TokenRequirements(org.apache.cxf.sts.request.TokenRequirements) JWTTokenValidator(org.apache.cxf.sts.token.validator.jwt.JWTTokenValidator) TokenProviderResponse(org.apache.cxf.sts.token.provider.TokenProviderResponse) ReceivedToken(org.apache.cxf.sts.request.ReceivedToken) JWTTokenProvider(org.apache.cxf.sts.token.provider.jwt.JWTTokenProvider)

Example 99 with ReceivedToken

use of org.apache.cxf.sts.request.ReceivedToken in project cxf by apache.

the class JWTTokenValidatorTest method testJWTWithRoles.

@org.junit.Test
public void testJWTWithRoles() throws Exception {
    // Create
    TokenProvider jwtTokenProvider = new JWTTokenProvider();
    ((JWTTokenProvider) jwtTokenProvider).setSignToken(true);
    JWTClaimsProvider claimsProvider = new RoleJWTClaimsProvider("manager");
    ((JWTTokenProvider) jwtTokenProvider).setJwtClaimsProvider(claimsProvider);
    TokenProviderParameters providerParameters = createProviderParameters();
    assertTrue(jwtTokenProvider.canHandleToken(JWTTokenProvider.JWT_TOKEN_TYPE));
    TokenProviderResponse providerResponse = jwtTokenProvider.createToken(providerParameters);
    assertTrue(providerResponse != null);
    assertTrue(providerResponse.getToken() != null && providerResponse.getTokenId() != null);
    String token = (String) providerResponse.getToken();
    assertNotNull(token);
    assertTrue(token.split("\\.").length == 3);
    // Validate the token
    TokenValidator jwtTokenValidator = new JWTTokenValidator();
    // Set the role
    DefaultJWTRoleParser roleParser = new DefaultJWTRoleParser();
    roleParser.setRoleClaim("role");
    ((JWTTokenValidator) jwtTokenValidator).setRoleParser(roleParser);
    TokenValidatorParameters validatorParameters = createValidatorParameters();
    TokenRequirements tokenRequirements = validatorParameters.getTokenRequirements();
    // Create a ValidateTarget consisting of a JWT Token
    ReceivedToken validateTarget = new ReceivedToken(createTokenWrapper(token));
    tokenRequirements.setValidateTarget(validateTarget);
    validatorParameters.setToken(validateTarget);
    assertTrue(jwtTokenValidator.canHandleToken(validateTarget));
    TokenValidatorResponse validatorResponse = jwtTokenValidator.validateToken(validatorParameters);
    assertTrue(validatorResponse != null);
    assertTrue(validatorResponse.getToken() != null);
    assertTrue(validatorResponse.getToken().getState() == STATE.VALID);
    Principal principal = validatorResponse.getPrincipal();
    assertTrue(principal != null && principal.getName() != null);
    Set<Principal> roles = validatorResponse.getRoles();
    assertTrue(roles != null && !roles.isEmpty());
    assertTrue(roles.iterator().next().getName().equals("manager"));
}
Also used : TokenProviderParameters(org.apache.cxf.sts.token.provider.TokenProviderParameters) TokenProvider(org.apache.cxf.sts.token.provider.TokenProvider) JWTTokenProvider(org.apache.cxf.sts.token.provider.jwt.JWTTokenProvider) JWTTokenValidator(org.apache.cxf.sts.token.validator.jwt.JWTTokenValidator) JWTClaimsProvider(org.apache.cxf.sts.token.provider.jwt.JWTClaimsProvider) DefaultJWTClaimsProvider(org.apache.cxf.sts.token.provider.jwt.DefaultJWTClaimsProvider) TokenRequirements(org.apache.cxf.sts.request.TokenRequirements) JWTTokenValidator(org.apache.cxf.sts.token.validator.jwt.JWTTokenValidator) DefaultJWTRoleParser(org.apache.cxf.sts.token.validator.jwt.DefaultJWTRoleParser) TokenProviderResponse(org.apache.cxf.sts.token.provider.TokenProviderResponse) ReceivedToken(org.apache.cxf.sts.request.ReceivedToken) CustomTokenPrincipal(org.apache.wss4j.common.principal.CustomTokenPrincipal) Principal(java.security.Principal) JWTTokenProvider(org.apache.cxf.sts.token.provider.jwt.JWTTokenProvider)

Example 100 with ReceivedToken

use of org.apache.cxf.sts.request.ReceivedToken in project cxf by apache.

the class SAMLTokenValidatorCachedRealmTest method testValidCachedRealm.

/**
 * Test a SAML Assertion with valid cached realm.
 */
@org.junit.Test
public void testValidCachedRealm() throws Exception {
    TokenValidator samlTokenValidator = new SAMLTokenValidator();
    TokenValidatorParameters validatorParameters = createValidatorParameters();
    TokenRequirements tokenRequirements = validatorParameters.getTokenRequirements();
    // Create a ValidateTarget consisting of a SAML Assertion
    Crypto crypto = CryptoFactory.getInstance(getEncryptionProperties());
    CallbackHandler callbackHandler = new PasswordCallbackHandler();
    Element samlToken = createSAMLAssertion(WSS4JConstants.WSS_SAML_TOKEN_TYPE, crypto, "mystskey", callbackHandler, "A");
    Document doc = samlToken.getOwnerDocument();
    samlToken = (Element) doc.appendChild(samlToken);
    ReceivedToken validateTarget = new ReceivedToken(samlToken);
    tokenRequirements.setValidateTarget(validateTarget);
    validatorParameters.setToken(validateTarget);
    // Now set the SAMLRealmCodec implementation on the Validator
    SAMLRealmCodec samlRealmCodec = new IssuerSAMLRealmCodec();
    ((SAMLTokenValidator) samlTokenValidator).setSamlRealmCodec(samlRealmCodec);
    TokenValidatorResponse validatorResponse = samlTokenValidator.validateToken(validatorParameters);
    assertTrue(validatorResponse != null);
    assertTrue(validatorResponse.getToken() != null);
    assertTrue(validatorResponse.getToken().getState() == STATE.VALID);
    assertTrue(validatorResponse.getTokenRealm().equals("A"));
}
Also used : CallbackHandler(javax.security.auth.callback.CallbackHandler) PasswordCallbackHandler(org.apache.cxf.sts.common.PasswordCallbackHandler) Element(org.w3c.dom.Element) SAMLRealmCodec(org.apache.cxf.sts.token.realm.SAMLRealmCodec) Document(org.w3c.dom.Document) Crypto(org.apache.wss4j.common.crypto.Crypto) TokenRequirements(org.apache.cxf.sts.request.TokenRequirements) PasswordCallbackHandler(org.apache.cxf.sts.common.PasswordCallbackHandler) ReceivedToken(org.apache.cxf.sts.request.ReceivedToken)

Aggregations

ReceivedToken (org.apache.cxf.sts.request.ReceivedToken)115 Crypto (org.apache.wss4j.common.crypto.Crypto)59 TokenRequirements (org.apache.cxf.sts.request.TokenRequirements)55 Element (org.w3c.dom.Element)44 CallbackHandler (javax.security.auth.callback.CallbackHandler)42 TokenValidatorResponse (org.apache.cxf.sts.token.validator.TokenValidatorResponse)42 PasswordCallbackHandler (org.apache.cxf.sts.common.PasswordCallbackHandler)38 Document (org.w3c.dom.Document)37 CustomTokenPrincipal (org.apache.wss4j.common.principal.CustomTokenPrincipal)35 TokenValidatorParameters (org.apache.cxf.sts.token.validator.TokenValidatorParameters)32 BinarySecurityTokenType (org.apache.cxf.ws.security.sts.provider.model.secext.BinarySecurityTokenType)26 WSSecurityException (org.apache.wss4j.common.ext.WSSecurityException)25 Test (org.junit.Test)25 Principal (java.security.Principal)24 STSPropertiesMBean (org.apache.cxf.sts.STSPropertiesMBean)22 STSException (org.apache.cxf.ws.security.sts.provider.STSException)19 TokenProviderParameters (org.apache.cxf.sts.token.provider.TokenProviderParameters)13 TokenProviderResponse (org.apache.cxf.sts.token.provider.TokenProviderResponse)13 TokenValidator (org.apache.cxf.sts.token.validator.TokenValidator)13 RequestData (org.apache.wss4j.dom.handler.RequestData)13