use of org.apache.cxf.systest.jaxrs.security.Book in project cxf by apache.
the class OAuth2FiltersTest method testServiceWithTokenUsingIncorrectAudience.
@org.junit.Test
public void testServiceWithTokenUsingIncorrectAudience() throws Exception {
// Get Authorization Code
String oauthService = "https://localhost:" + OAUTH_PORT + "/services/";
WebClient oauthClient = WebClient.create(oauthService, OAuth2TestUtils.setupProviders(), "alice", "security", null);
// Save the Cookie for the second request...
WebClient.getConfig(oauthClient).getRequestContext().put(org.apache.cxf.message.Message.MAINTAIN_SESSION, Boolean.TRUE);
String code = OAuth2TestUtils.getAuthorizationCode(oauthClient, null, "consumer-id-aud2");
assertNotNull(code);
// Now get the access token
oauthClient = WebClient.create(oauthService, "consumer-id-aud2", "this-is-a-secret", null);
String address = "https://localhost:" + PORT + "/securedxyz/bookstore/books";
ClientAccessToken accessToken = OAuth2TestUtils.getAccessTokenWithAuthorizationCode(oauthClient, code, "consumer-id-aud2", address);
assertNotNull(accessToken.getTokenKey());
// Now invoke on the service with the access token
WebClient client = WebClient.create(address, OAuth2TestUtils.setupProviders()).authorization(new ClientAccessToken(BEARER_AUTHORIZATION_SCHEME, accessToken.getTokenKey()));
Response response = client.post(new Book("book", 123L));
assertEquals(Family.CLIENT_ERROR, response.getStatusInfo().getFamily());
}
use of org.apache.cxf.systest.jaxrs.security.Book in project cxf by apache.
the class OAuth2FiltersTest method testServiceWithFakeToken.
@org.junit.Test
public void testServiceWithFakeToken() throws Exception {
// Now invoke on the service with the faked access token
String address = "https://localhost:" + PORT + "/secured/bookstore/books";
WebClient client = WebClient.create(address, OAuth2TestUtils.setupProviders()).authorization(new ClientAccessToken(BEARER_AUTHORIZATION_SCHEME, UUID.randomUUID().toString()));
Response response = client.post(new Book("book", 123L));
assertEquals(Family.CLIENT_ERROR, response.getStatusInfo().getFamily());
}
use of org.apache.cxf.systest.jaxrs.security.Book in project cxf by apache.
the class OAuth2FiltersTest method testServiceWithTokenAndIncorrectScopeVerb.
@org.junit.Test
public void testServiceWithTokenAndIncorrectScopeVerb() throws Exception {
// Get Authorization Code
String oauthService = "https://localhost:" + OAUTH_PORT + "/services/";
WebClient oauthClient = WebClient.create(oauthService, OAuth2TestUtils.setupProviders(), "alice", "security", null);
// Save the Cookie for the second request...
WebClient.getConfig(oauthClient).getRequestContext().put(org.apache.cxf.message.Message.MAINTAIN_SESSION, Boolean.TRUE);
String code = OAuth2TestUtils.getAuthorizationCode(oauthClient, "read_book");
assertNotNull(code);
// Now get the access token
oauthClient = WebClient.create(oauthService, "consumer-id", "this-is-a-secret", null);
ClientAccessToken accessToken = OAuth2TestUtils.getAccessTokenWithAuthorizationCode(oauthClient, code);
assertNotNull(accessToken.getTokenKey());
// Now invoke on the service with the access token
String address = "https://localhost:" + PORT + "/secured/bookstore/books";
WebClient client = WebClient.create(address, OAuth2TestUtils.setupProviders()).authorization(new ClientAccessToken(BEARER_AUTHORIZATION_SCHEME, accessToken.getTokenKey()));
// We don't have the scope to post a book here
Response response = client.post(new Book("book", 123L));
assertEquals(Family.CLIENT_ERROR, response.getStatusInfo().getFamily());
}
use of org.apache.cxf.systest.jaxrs.security.Book in project cxf by apache.
the class JWTAlgorithmTest method testSignatureProperties.
//
// Signature tests
//
@org.junit.Test
public void testSignatureProperties() throws Exception {
URL busFile = JWTAlgorithmTest.class.getResource("client.xml");
List<Object> providers = new ArrayList<>();
providers.add(new JacksonJsonProvider());
providers.add(new JwtAuthenticationClientFilter());
String address = "https://localhost:" + PORT + "/signedjwt/bookstore/books";
WebClient client = WebClient.create(address, providers, busFile.toString());
client.type("application/json").accept("application/json");
// Create the JWT Token
JwtClaims claims = new JwtClaims();
claims.setSubject("alice");
claims.setIssuer("DoubleItSTSIssuer");
claims.setIssuedAt(Instant.now().getEpochSecond());
claims.setAudiences(toList(address));
JwtToken token = new JwtToken(claims);
Map<String, Object> properties = new HashMap<>();
properties.put("rs.security.signature.properties", "org/apache/cxf/systest/jaxrs/security/alice.jwk.properties");
properties.put(JwtConstants.JWT_TOKEN, token);
WebClient.getConfig(client).getRequestContext().putAll(properties);
Response response = client.post(new Book("book", 123L));
assertEquals(response.getStatus(), 200);
Book returnedBook = response.readEntity(Book.class);
assertEquals(returnedBook.getName(), "book");
assertEquals(returnedBook.getId(), 123L);
}
use of org.apache.cxf.systest.jaxrs.security.Book in project cxf by apache.
the class JWTAlgorithmTest method testSignatureDynamic.
@org.junit.Test
public void testSignatureDynamic() throws Exception {
URL busFile = JWTAlgorithmTest.class.getResource("client.xml");
List<Object> providers = new ArrayList<>();
providers.add(new JacksonJsonProvider());
providers.add(new JwtAuthenticationClientFilter());
String address = "https://localhost:" + PORT + "/signedjwt/bookstore/books";
WebClient client = WebClient.create(address, providers, busFile.toString());
client.type("application/json").accept("application/json");
// Create the JWT Token
JwtClaims claims = new JwtClaims();
claims.setSubject("alice");
claims.setIssuer("DoubleItSTSIssuer");
claims.setIssuedAt(Instant.now().getEpochSecond());
claims.setAudiences(toList(address));
JwtToken token = new JwtToken(claims);
Map<String, Object> properties = new HashMap<>();
properties.put("rs.security.keystore.type", "jwk");
properties.put("rs.security.keystore.alias", "2011-04-29");
properties.put("rs.security.keystore.file", "org/apache/cxf/systest/jaxrs/security/certs/jwkPrivateSet.txt");
properties.put("rs.security.signature.algorithm", "RS256");
properties.put(JwtConstants.JWT_TOKEN, token);
WebClient.getConfig(client).getRequestContext().putAll(properties);
Response response = client.post(new Book("book", 123L));
assertEquals(response.getStatus(), 200);
Book returnedBook = response.readEntity(Book.class);
assertEquals(returnedBook.getName(), "book");
assertEquals(returnedBook.getId(), 123L);
}
Aggregations