Examples with JWSInput org.keycloak.jose.jws.JWSInput used on opensource projects

Example 61 with JWSInput

use of org.keycloak.jose.jws.JWSInput in project keycloak by keycloak.

the class UserInfoTest method testSuccessSignedResponse.

private void testSuccessSignedResponse(Algorithm sigAlg) throws Exception {
    try {
        // Require signed userInfo request
        ClientResource clientResource = ApiUtil.findClientByClientId(adminClient.realm("test"), "test-app");
        ClientRepresentation clientRep = clientResource.toRepresentation();
        OIDCAdvancedConfigWrapper.fromClientRepresentation(clientRep).setUserInfoSignedResponseAlg(sigAlg);
        clientResource.update(clientRep);
        // test signed response
        Client client = AdminClientUtil.createResteasyClient();
        try {
            AccessTokenResponse accessTokenResponse = executeGrantAccessTokenRequest(client);
            Response response = UserInfoClientUtil.executeUserInfoRequest_getMethod(client, accessTokenResponse.getToken());
            events.expect(EventType.USER_INFO_REQUEST).session(Matchers.notNullValue(String.class)).detail(Details.AUTH_METHOD, Details.VALIDATE_ACCESS_TOKEN).detail(Details.USERNAME, "test-user@localhost").detail(Details.SIGNATURE_REQUIRED, "true").detail(Details.SIGNATURE_ALGORITHM, sigAlg.toString()).assertEvent();
            Assert.assertEquals(200, response.getStatus());
            Assert.assertEquals(response.getHeaderString(HttpHeaders.CONTENT_TYPE), MediaType.APPLICATION_JWT);
            String signedResponse = response.readEntity(String.class);
            response.close();
            JWSInput jwsInput = new JWSInput(signedResponse);
            assertEquals(sigAlg.toString(), jwsInput.getHeader().getAlgorithm().name());
            UserInfo userInfo = JsonSerialization.readValue(jwsInput.getContent(), UserInfo.class);
            Assert.assertNotNull(userInfo);
            Assert.assertNotNull(userInfo.getSubject());
            Assert.assertEquals("test-user@localhost", userInfo.getEmail());
            Assert.assertEquals("test-user@localhost", userInfo.getPreferredUsername());
            Assert.assertTrue(userInfo.hasAudience("test-app"));
            String expectedIssuer = Urls.realmIssuer(new URI(AUTH_SERVER_ROOT), "test");
            Assert.assertEquals(expectedIssuer, userInfo.getIssuer());
        } finally {
            client.close();
        }
        // Revert signed userInfo request
        OIDCAdvancedConfigWrapper.fromClientRepresentation(clientRep).setUserInfoSignedResponseAlg(null);
        clientResource.update(clientRep);
    } finally {
        TokenSignatureUtil.changeRealmTokenSignatureProvider(adminClient, org.keycloak.crypto.Algorithm.RS256);
    }
}

Example 62 with JWSInput

use of org.keycloak.jose.jws.JWSInput in project keycloak by keycloak.

the class OpenshiftClientStorageTest method assertSuccessfulRedirect.

private void assertSuccessfulRedirect(String... expectedScopes) {
    String code = oauth.getCurrentQuery().get(OAuth2Constants.CODE);
    OAuthClient.AccessTokenResponse tokenResponse = oauth.doAccessTokenRequest(code, null);
    String accessToken = tokenResponse.getAccessToken();
    Assert.assertNotNull(accessToken);
    try {
        AccessToken token = new JWSInput(accessToken).readJsonContent(AccessToken.class);
        for (String expectedScope : expectedScopes) {
            token.getScope().contains(expectedScope);
        }
    } catch (Exception e) {
        fail("Failed to parse access token");
        e.printStackTrace();
    }
    Assert.assertNotNull(tokenResponse.getRefreshToken());
    oauth.doLogout(tokenResponse.getRefreshToken(), null);
    events.clear();
}