Examples with JWSInput org.keycloak.jose.jws.JWSInput used on opensource projects

Example 56 with JWSInput

use of org.keycloak.jose.jws.JWSInput in project keycloak by keycloak.

the class HoKTest method verifyHoKTokenCertThumbPrint.

private void verifyHoKTokenCertThumbPrint(AccessTokenResponse response, String certThumbPrint, boolean checkRefreshToken) {
    JWSInput jws = null;
    AccessToken at = null;
    try {
        jws = new JWSInput(response.getAccessToken());
        at = jws.readJsonContent(AccessToken.class);
    } catch (JWSInputException e) {
        Assert.fail(e.toString());
    }
    assertTrue(MessageDigest.isEqual(certThumbPrint.getBytes(), at.getCertConf().getCertThumbprint().getBytes()));
    if (checkRefreshToken) {
        RefreshToken rt = null;
        try {
            jws = new JWSInput(response.getRefreshToken());
            rt = jws.readJsonContent(RefreshToken.class);
        } catch (JWSInputException e) {
            Assert.fail(e.toString());
        }
        assertTrue(MessageDigest.isEqual(certThumbPrint.getBytes(), rt.getCertConf().getCertThumbprint().getBytes()));
    }
}

Example 57 with JWSInput

use of org.keycloak.jose.jws.JWSInput in project keycloak by keycloak.

the class HoKTest method testIntrospectHoKAccessToken.

@Test
public void testIntrospectHoKAccessToken() throws Exception {
    // get an access token with client certificate in mutual authenticate TLS
    // mimic Client
    oauth.doLogin("test-user@localhost", "password");
    String code = oauth.getCurrentQuery().get(OAuth2Constants.CODE);
    EventRepresentation loginEvent = events.expectLogin().assertEvent();
    AccessTokenResponse accessTokenResponse = null;
    try (CloseableHttpClient client = MutualTLSUtils.newCloseableHttpClientWithDefaultKeyStoreAndTrustStore()) {
        accessTokenResponse = oauth.doAccessTokenRequest(code, "password", client);
    } catch (IOException ioe) {
        throw new RuntimeException(ioe);
    }
    // Do token introspection
    // mimic Resource Server
    String tokenResponse;
    try (CloseableHttpClient client = MutualTLSUtils.newCloseableHttpClientWithoutKeyStoreAndTrustStore()) {
        tokenResponse = oauth.introspectTokenWithClientCredential("confidential-cli", "secret1", "access_token", accessTokenResponse.getAccessToken(), client);
    } catch (IOException ioe) {
        throw new RuntimeException(ioe);
    }
    TokenMetadataRepresentation rep = JsonSerialization.readValue(tokenResponse, TokenMetadataRepresentation.class);
    JWSInput jws = new JWSInput(accessTokenResponse.getAccessToken());
    AccessToken at = jws.readJsonContent(AccessToken.class);
    jws = new JWSInput(accessTokenResponse.getRefreshToken());
    RefreshToken rt = jws.readJsonContent(RefreshToken.class);
    String certThumprintFromAccessToken = at.getCertConf().getCertThumbprint();
    String certThumprintFromRefreshToken = rt.getCertConf().getCertThumbprint();
    String certThumprintFromTokenIntrospection = rep.getCertConf().getCertThumbprint();
    String certThumprintFromBoundClientCertificate = MutualTLSUtils.getThumbprintFromDefaultClientCert();
    assertTrue(rep.isActive());
    assertEquals("test-user@localhost", rep.getUserName());
    assertEquals("test-app", rep.getClientId());
    assertEquals(loginEvent.getUserId(), rep.getSubject());
    assertEquals(certThumprintFromTokenIntrospection, certThumprintFromBoundClientCertificate);
    assertEquals(certThumprintFromBoundClientCertificate, certThumprintFromAccessToken);
    assertEquals(certThumprintFromAccessToken, certThumprintFromRefreshToken);
}

Example 58 with JWSInput

use of org.keycloak.jose.jws.JWSInput in project keycloak by keycloak.

the class LogoutTest method testFrontChannelLogout.

@Test
public void testFrontChannelLogout() throws Exception {
    ClientsResource clients = adminClient.realm(oauth.getRealm()).clients();
    ClientRepresentation rep = clients.findByClientId(oauth.getClientId()).get(0);
    rep.setName("My Testing App");
    rep.setFrontchannelLogout(true);
    rep.getAttributes().put(OIDCConfigAttributes.FRONT_CHANNEL_LOGOUT_URI, oauth.APP_ROOT + "/admin/frontchannelLogout");
    clients.get(rep.getId()).update(rep);
    try {
        oauth.clientSessionState("client-session");
        oauth.doLogin("test-user@localhost", "password");
        String code = oauth.getCurrentQuery().get(OAuth2Constants.CODE);
        OAuthClient.AccessTokenResponse tokenResponse = oauth.doAccessTokenRequest(code, "password");
        String idTokenString = tokenResponse.getIdToken();
        String logoutUrl = oauth.getLogoutUrl().idTokenHint(idTokenString).build();
        driver.navigate().to(logoutUrl);
        LogoutToken logoutToken = testingClient.testApp().getFrontChannelLogoutToken();
        Assert.assertNotNull(logoutToken);
        IDToken idToken = new JWSInput(idTokenString).readJsonContent(IDToken.class);
        Assert.assertEquals(logoutToken.getIssuer(), idToken.getIssuer());
        Assert.assertEquals(logoutToken.getSid(), idToken.getSessionId());
        assertTrue(driver.getTitle().equals("Logging out"));
        assertTrue(driver.getPageSource().contains("You are logging out from following apps"));
        assertTrue(driver.getPageSource().contains("My Testing App"));
    } finally {
        rep.setFrontchannelLogout(false);
        rep.getAttributes().put(OIDCConfigAttributes.FRONT_CHANNEL_LOGOUT_URI, "");
        clients.get(rep.getId()).update(rep);
    }
}

Example 59 with JWSInput

use of org.keycloak.jose.jws.JWSInput in project keycloak by keycloak.

the class LogoutTest method testFrontChannelLogoutWithPostLogoutRedirectUri.

@Test
public void testFrontChannelLogoutWithPostLogoutRedirectUri() throws Exception {
    ClientsResource clients = adminClient.realm(oauth.getRealm()).clients();
    ClientRepresentation rep = clients.findByClientId(oauth.getClientId()).get(0);
    rep.setFrontchannelLogout(true);
    rep.getAttributes().put(OIDCConfigAttributes.FRONT_CHANNEL_LOGOUT_URI, oauth.APP_ROOT + "/admin/frontchannelLogout");
    clients.get(rep.getId()).update(rep);
    try {
        oauth.clientSessionState("client-session");
        oauth.doLogin("test-user@localhost", "password");
        String code = oauth.getCurrentQuery().get(OAuth2Constants.CODE);
        OAuthClient.AccessTokenResponse tokenResponse = oauth.doAccessTokenRequest(code, "password");
        String idTokenString = tokenResponse.getIdToken();
        String logoutUrl = oauth.getLogoutUrl().idTokenHint(idTokenString).postLogoutRedirectUri(oauth.APP_AUTH_ROOT).build();
        driver.navigate().to(logoutUrl);
        LogoutToken logoutToken = testingClient.testApp().getFrontChannelLogoutToken();
        Assert.assertNotNull(logoutToken);
        IDToken idToken = new JWSInput(idTokenString).readJsonContent(IDToken.class);
        Assert.assertEquals(logoutToken.getIssuer(), idToken.getIssuer());
        Assert.assertEquals(logoutToken.getSid(), idToken.getSessionId());
    } finally {
        rep.setFrontchannelLogout(false);
        rep.getAttributes().put(OIDCConfigAttributes.FRONT_CHANNEL_LOGOUT_URI, "");
        clients.get(rep.getId()).update(rep);
    }
}

Example 60 with JWSInput

use of org.keycloak.jose.jws.JWSInput in project keycloak by keycloak.

the class SecureSigningAlgorithmForSignedJwtExecutor method executeOnEvent.

@Override
public void executeOnEvent(ClientPolicyContext context) throws ClientPolicyException {
    switch(context.getEvent()) {
        case TOKEN_REQUEST:
        case SERVICE_ACCOUNT_TOKEN_REQUEST:
        case TOKEN_REFRESH:
        case TOKEN_REVOKE:
        case TOKEN_INTROSPECT:
        case LOGOUT_REQUEST:
            boolean isRequireClientAssertion = Optional.ofNullable(configuration.isRequireClientAssertion()).orElse(Boolean.FALSE).booleanValue();
            HttpRequest req = session.getContext().getContextObject(HttpRequest.class);
            String clientAssertion = req.getDecodedFormParameters().getFirst(OAuth2Constants.CLIENT_ASSERTION);
            if (!isRequireClientAssertion && ObjectUtil.isBlank(clientAssertion)) {
                break;
            }
            JWSInput jws = null;
            try {
                jws = new JWSInput(clientAssertion);
            } catch (JWSInputException e) {
                throw new ClientPolicyException(OAuthErrorException.INVALID_REQUEST, "not allowed input format.");
            }
            verifySecureSigningAlgorithm(jws.getHeader().getAlgorithm().name());
            break;
        default:
            return;
    }
}