Examples with DelegatingOAuth2TokenValidator org.springframework.security.oauth2.core.DelegatingOAuth2TokenValidator used on opensource projects

Example 6 with DelegatingOAuth2TokenValidator

use of org.springframework.security.oauth2.core.DelegatingOAuth2TokenValidator in project spring-cloud-gcp by spring-cloud.

the class FirebaseJwtTokenDecoderTests method validTokenTests.

@Test
public void validTokenTests() throws Exception {
    JWSHeader header = new JWSHeader.Builder(JWSAlgorithm.RS256).keyID("one").build();
    JWTClaimsSet claimsSet = new JWTClaimsSet.Builder().subject("test-subject").audience("123456").expirationTime(Date.from(Instant.now().plusSeconds(36000))).issuer("https://securetoken.google.com/123456").issueTime(Date.from(Instant.now().minusSeconds(3600))).claim("auth_time", Instant.now().minusSeconds(3600).getEpochSecond()).build();
    SignedJWT signedJWT = signedJwt(keyGeneratorUtils.getPrivateKey(), header, claimsSet);
    List<OAuth2TokenValidator<Jwt>> validators = new ArrayList<>();
    validators.add(new JwtTimestampValidator());
    validators.add(new JwtIssuerValidator("https://securetoken.google.com/123456"));
    validators.add(new FirebaseTokenValidator("123456"));
    DelegatingOAuth2TokenValidator<Jwt> validator = new DelegatingOAuth2TokenValidator<Jwt>(validators);
    RestOperations operations = mockRestOperations();
    FirebaseJwtTokenDecoder decoder = new FirebaseJwtTokenDecoder(operations, "https://spring.local", validator);
    Jwt jwt = decoder.decode(signedJWT.serialize());
    assertThat(jwt.getClaims()).isNotEmpty();
}

Example 7 with DelegatingOAuth2TokenValidator

use of org.springframework.security.oauth2.core.DelegatingOAuth2TokenValidator in project spring-cloud-gcp by spring-cloud.

the class IapAuthenticationAutoConfigurationTests method testFixedStringAudienceValidatorAddedWhenAvailable.

@Test
public void testFixedStringAudienceValidatorAddedWhenAvailable() throws Exception {
    when(mockJwt.getExpiresAt()).thenReturn(Instant.now().plusSeconds(10));
    when(mockJwt.getNotBefore()).thenReturn(Instant.now().minusSeconds(10));
    this.contextRunner.withUserConfiguration(FixedAudienceValidatorConfiguration.class).run((context) -> {
        DelegatingOAuth2TokenValidator validator = context.getBean("iapJwtDelegatingValidator", DelegatingOAuth2TokenValidator.class);
        OAuth2TokenValidatorResult result = validator.validate(mockJwt);
        assertThat(result.hasErrors()).isTrue();
        assertThat(result.getErrors().size()).isEqualTo(2);
        assertThat(result.getErrors().stream().map(error -> error.getDescription())).containsExactlyInAnyOrder("The iss claim is not valid", "This aud claim is not equal to the configured audience");
    });
}

Example 8 with DelegatingOAuth2TokenValidator

use of org.springframework.security.oauth2.core.DelegatingOAuth2TokenValidator in project spring-boot by spring-projects.

the class OAuth2ResourceServerAutoConfigurationTests method autoConfigurationShouldConfigureResourceServerUsingJwkSetUriAndIssuerUri.

@SuppressWarnings("unchecked")
@Test
void autoConfigurationShouldConfigureResourceServerUsingJwkSetUriAndIssuerUri() throws Exception {
    this.server = new MockWebServer();
    this.server.start();
    String path = "test";
    String issuer = this.server.url(path).toString();
    String cleanIssuerPath = cleanIssuerPath(issuer);
    setupMockResponse(cleanIssuerPath);
    this.contextRunner.withPropertyValues("spring.security.oauth2.resourceserver.jwt.jwk-set-uri=https://jwk-set-uri.com", "spring.security.oauth2.resourceserver.jwt.issuer-uri=http://" + this.server.getHostName() + ":" + this.server.getPort() + "/" + path).run((context) -> {
        assertThat(context).hasSingleBean(JwtDecoder.class);
        JwtDecoder jwtDecoder = context.getBean(JwtDecoder.class);
        DelegatingOAuth2TokenValidator<Jwt> jwtValidator = (DelegatingOAuth2TokenValidator<Jwt>) ReflectionTestUtils.getField(jwtDecoder, "jwtValidator");
        Collection<OAuth2TokenValidator<Jwt>> tokenValidators = (Collection<OAuth2TokenValidator<Jwt>>) ReflectionTestUtils.getField(jwtValidator, "tokenValidators");
        assertThat(tokenValidators).hasAtLeastOneElementOfType(JwtIssuerValidator.class);
    });
}

Example 9 with DelegatingOAuth2TokenValidator

use of org.springframework.security.oauth2.core.DelegatingOAuth2TokenValidator in project spring-cloud-gcp by spring-cloud.

the class IapAuthenticationAutoConfiguration method iapJwtDecoder.

@Bean
@ConditionalOnMissingBean
public JwtDecoder iapJwtDecoder(IapAuthenticationProperties properties, @Qualifier("iapJwtDelegatingValidator") DelegatingOAuth2TokenValidator<Jwt> validator) {
    NimbusJwtDecoder jwtDecoder = NimbusJwtDecoder.withJwkSetUri(properties.getRegistry()).jwsAlgorithm(SignatureAlgorithm.from(properties.getAlgorithm())).build();
    jwtDecoder.setJwtValidator(validator);
    return jwtDecoder;
}

Example 10 with DelegatingOAuth2TokenValidator

use of org.springframework.security.oauth2.core.DelegatingOAuth2TokenValidator in project spring-cloud-gcp by spring-cloud.

the class FirebaseJwtTokenDecoderTests method invalidAudienceTests.

@Test
public void invalidAudienceTests() throws Exception {
    JWSHeader header = new JWSHeader.Builder(JWSAlgorithm.RS256).keyID("one").build();
    JWTClaimsSet claimsSet = new JWTClaimsSet.Builder().subject("test-subject").audience("123").expirationTime(Date.from(Instant.now().plusSeconds(36000))).issuer("https://securetoken.google.com/123456").issueTime(Date.from(Instant.now().minusSeconds(3600))).claim("auth_time", Instant.now().minusSeconds(3600).getEpochSecond()).build();
    SignedJWT signedJWT = signedJwt(keyGeneratorUtils.getPrivateKey(), header, claimsSet);
    List<OAuth2TokenValidator<Jwt>> validators = new ArrayList<>();
    validators.add(new JwtTimestampValidator());
    validators.add(new JwtIssuerValidator("https://securetoken.google.com/123456"));
    validators.add(new FirebaseTokenValidator("123456"));
    DelegatingOAuth2TokenValidator<Jwt> validator = new DelegatingOAuth2TokenValidator<Jwt>(validators);
    RestOperations operations = mockRestOperations();
    FirebaseJwtTokenDecoder decoder = new FirebaseJwtTokenDecoder(operations, "https://spring.local", validator);
    assertThatExceptionOfType(JwtException.class).isThrownBy(() -> decoder.decode(signedJWT.serialize())).withMessageStartingWith("An error occurred while attempting to decode the Jwt: This aud claim is not equal to the configured audience");
}