Examples with OAuth2AuthenticatedPrincipal org.springframework.security.oauth2.core.OAuth2AuthenticatedPrincipal used on opensource projects

Example 6 with OAuth2AuthenticatedPrincipal

use of org.springframework.security.oauth2.core.OAuth2AuthenticatedPrincipal in project spring-security by spring-projects.

the class SecurityMockServerConfigurerOpaqueTokenTests method mockOpaqueTokenWhenPrincipalSpecifiedThenLastCalledTakesPrecedence.

@Test
public void mockOpaqueTokenWhenPrincipalSpecifiedThenLastCalledTakesPrecedence() {
    OAuth2AuthenticatedPrincipal principal = TestOAuth2AuthenticatedPrincipals.active((a) -> a.put("scope", "user"));
    this.client.mutateWith(SecurityMockServerConfigurers.mockOpaqueToken().attributes((a) -> a.put(OAuth2TokenIntrospectionClaimNames.SUB, "foo")).principal(principal)).get().exchange().expectStatus().isOk();
    SecurityContext context = this.securityContextController.removeSecurityContext();
    assertThat(context.getAuthentication()).isInstanceOf(BearerTokenAuthentication.class);
    BearerTokenAuthentication token = (BearerTokenAuthentication) context.getAuthentication();
    assertThat((String) ((OAuth2AuthenticatedPrincipal) token.getPrincipal()).getAttribute(OAuth2TokenIntrospectionClaimNames.SUB)).isEqualTo(principal.getAttribute(OAuth2TokenIntrospectionClaimNames.SUB));
    this.client.mutateWith(SecurityMockServerConfigurers.mockOpaqueToken().principal(principal).attributes((a) -> a.put(OAuth2TokenIntrospectionClaimNames.SUB, "bar"))).get().exchange().expectStatus().isOk();
    context = this.securityContextController.removeSecurityContext();
    assertThat(context.getAuthentication()).isInstanceOf(BearerTokenAuthentication.class);
    token = (BearerTokenAuthentication) context.getAuthentication();
    assertThat((String) ((OAuth2AuthenticatedPrincipal) token.getPrincipal()).getAttribute(OAuth2TokenIntrospectionClaimNames.SUB)).isEqualTo("bar");
}

Example 7 with OAuth2AuthenticatedPrincipal

use of org.springframework.security.oauth2.core.OAuth2AuthenticatedPrincipal in project spring-security by spring-projects.

the class OpaqueTokenAuthenticationProvider method authenticate.

/**
 * Introspect and validate the opaque
 * <a href="https://tools.ietf.org/html/rfc6750#section-1.2" target="_blank">Bearer
 * Token</a>.
 * @param authentication the authentication request object.
 * @return A successful authentication
 * @throws AuthenticationException if authentication failed for some reason
 */
@Override
public Authentication authenticate(Authentication authentication) throws AuthenticationException {
    if (!(authentication instanceof BearerTokenAuthenticationToken)) {
        return null;
    }
    BearerTokenAuthenticationToken bearer = (BearerTokenAuthenticationToken) authentication;
    OAuth2AuthenticatedPrincipal principal = getOAuth2AuthenticatedPrincipal(bearer);
    AbstractAuthenticationToken result = convert(principal, bearer.getToken());
    result.setDetails(bearer.getDetails());
    this.logger.debug("Authenticated token");
    return result;
}

Example 8 with OAuth2AuthenticatedPrincipal

use of org.springframework.security.oauth2.core.OAuth2AuthenticatedPrincipal in project spring-security by spring-projects.

the class SpringOpaqueTokenIntrospectorTests method introspectWhenActiveTokenThenParsesValuesInResponse.

@Test
public void introspectWhenActiveTokenThenParsesValuesInResponse() {
    Map<String, Object> introspectedValues = new HashMap<>();
    introspectedValues.put(OAuth2TokenIntrospectionClaimNames.ACTIVE, true);
    introspectedValues.put(OAuth2TokenIntrospectionClaimNames.AUD, Arrays.asList("aud"));
    introspectedValues.put(OAuth2TokenIntrospectionClaimNames.NBF, 29348723984L);
    RestOperations restOperations = mock(RestOperations.class);
    OpaqueTokenIntrospector introspectionClient = new SpringOpaqueTokenIntrospector(INTROSPECTION_URL, restOperations);
    given(restOperations.exchange(any(RequestEntity.class), eq(STRING_OBJECT_MAP))).willReturn(response(introspectedValues));
    OAuth2AuthenticatedPrincipal authority = introspectionClient.introspect("token");
    // @formatter:off
    assertThat(authority.getAttributes()).isNotNull().containsEntry(OAuth2TokenIntrospectionClaimNames.ACTIVE, true).containsEntry(OAuth2TokenIntrospectionClaimNames.AUD, Arrays.asList("aud")).containsEntry(OAuth2TokenIntrospectionClaimNames.NBF, Instant.ofEpochSecond(29348723984L)).doesNotContainKey(OAuth2TokenIntrospectionClaimNames.CLIENT_ID).doesNotContainKey(OAuth2TokenIntrospectionClaimNames.SCOPE);
// @formatter:on
}

Example 9 with OAuth2AuthenticatedPrincipal

use of org.springframework.security.oauth2.core.OAuth2AuthenticatedPrincipal in project spring-security by spring-projects.

the class SpringOpaqueTokenIntrospectorTests method introspectWhenIntrospectionTokenReturnsMalformedScopeThenEmptyAuthorities.

// gh-7563
@Test
public void introspectWhenIntrospectionTokenReturnsMalformedScopeThenEmptyAuthorities() {
    RestOperations restOperations = mock(RestOperations.class);
    OpaqueTokenIntrospector introspectionClient = new SpringOpaqueTokenIntrospector(INTROSPECTION_URL, restOperations);
    given(restOperations.exchange(any(RequestEntity.class), eq(STRING_OBJECT_MAP))).willReturn(MALFORMED_SCOPE);
    OAuth2AuthenticatedPrincipal principal = introspectionClient.introspect("token");
    assertThat(principal.getAuthorities()).isEmpty();
    Collection<String> scope = principal.getAttribute("scope");
    assertThat(scope).containsExactly("read", "write", "dolphin");
}

Example 10 with OAuth2AuthenticatedPrincipal

use of org.springframework.security.oauth2.core.OAuth2AuthenticatedPrincipal in project spring-security by spring-projects.

the class SecurityMockServerConfigurerOpaqueTokenTests method mockOpaqueTokenWhenPrincipalThenBearerTokenAuthentication.

@Test
public void mockOpaqueTokenWhenPrincipalThenBearerTokenAuthentication() {
    OAuth2AuthenticatedPrincipal principal = TestOAuth2AuthenticatedPrincipals.active();
    this.client.mutateWith(SecurityMockServerConfigurers.mockOpaqueToken().principal(principal)).get().exchange().expectStatus().isOk();
    SecurityContext context = this.securityContextController.removeSecurityContext();
    assertThat(context.getAuthentication()).isInstanceOf(BearerTokenAuthentication.class);
    BearerTokenAuthentication token = (BearerTokenAuthentication) context.getAuthentication();
    assertThat(token.getPrincipal()).isSameAs(principal);
}