Examples with OidcClientRegistration org.springframework.security.oauth2.core.oidc.OidcClientRegistration used on opensource projects

Example 1 with OidcClientRegistration

use of org.springframework.security.oauth2.core.oidc.OidcClientRegistration in project spring-authorization-server by spring-projects.

the class OidcClientRegistrationHttpMessageConverterTests method readInternalWhenRequiredParametersThenSuccess.

@Test
public void readInternalWhenRequiredParametersThenSuccess() {
    // @formatter:off
    String clientRegistrationRequest = "{\n" + "		\"redirect_uris\": [\n" + "			\"https://client.example.com\"\n" + "		]\n" + "}\n";
    // @formatter:on
    MockClientHttpResponse response = new MockClientHttpResponse(clientRegistrationRequest.getBytes(), HttpStatus.OK);
    OidcClientRegistration clientRegistration = this.messageConverter.readInternal(OidcClientRegistration.class, response);
    assertThat(clientRegistration.getClaims()).hasSize(1);
    assertThat(clientRegistration.getRedirectUris()).containsOnly("https://client.example.com");
}

Example 2 with OidcClientRegistration

use of org.springframework.security.oauth2.core.oidc.OidcClientRegistration in project spring-authorization-server by spring-projects.

the class OidcClientRegistrationHttpMessageConverterTests method readInternalWhenValidParametersThenSuccess.

@Test
public void readInternalWhenValidParametersThenSuccess() throws Exception {
    // @formatter:off
    String clientRegistrationRequest = "{\n" + "		\"client_id\": \"client-id\",\n" + "		\"client_id_issued_at\": 1607633867,\n" + "		\"client_secret\": \"client-secret\",\n" + "		\"client_secret_expires_at\": 1607637467,\n" + "		\"client_name\": \"client-name\",\n" + "		\"redirect_uris\": [\n" + "			\"https://client.example.com\"\n" + "		],\n" + "		\"token_endpoint_auth_method\": \"client_secret_jwt\",\n" + "		\"token_endpoint_auth_signing_alg\": \"HS256\",\n" + "		\"grant_types\": [\n" + "			\"authorization_code\",\n" + "			\"client_credentials\"\n" + "		],\n" + "		\"response_types\":[\n" + "			\"code\"\n" + "		],\n" + "		\"scope\": \"scope1 scope2\",\n" + "		\"jwks_uri\": \"https://client.example.com/jwks\",\n" + "		\"id_token_signed_response_alg\": \"RS256\",\n" + "		\"a-claim\": \"a-value\"\n" + "}\n";
    // @formatter:on
    MockClientHttpResponse response = new MockClientHttpResponse(clientRegistrationRequest.getBytes(), HttpStatus.OK);
    OidcClientRegistration clientRegistration = this.messageConverter.readInternal(OidcClientRegistration.class, response);
    assertThat(clientRegistration.getClientId()).isEqualTo("client-id");
    assertThat(clientRegistration.getClientIdIssuedAt()).isEqualTo(Instant.ofEpochSecond(1607633867L));
    assertThat(clientRegistration.getClientSecret()).isEqualTo("client-secret");
    assertThat(clientRegistration.getClientSecretExpiresAt()).isEqualTo(Instant.ofEpochSecond(1607637467L));
    assertThat(clientRegistration.getClientName()).isEqualTo("client-name");
    assertThat(clientRegistration.getRedirectUris()).containsOnly("https://client.example.com");
    assertThat(clientRegistration.getTokenEndpointAuthenticationMethod()).isEqualTo(ClientAuthenticationMethod.CLIENT_SECRET_JWT.getValue());
    assertThat(clientRegistration.getTokenEndpointAuthenticationSigningAlgorithm()).isEqualTo(MacAlgorithm.HS256.getName());
    assertThat(clientRegistration.getGrantTypes()).containsExactlyInAnyOrder("authorization_code", "client_credentials");
    assertThat(clientRegistration.getResponseTypes()).containsOnly("code");
    assertThat(clientRegistration.getScopes()).containsExactlyInAnyOrder("scope1", "scope2");
    assertThat(clientRegistration.getJwkSetUrl()).isEqualTo(new URL("https://client.example.com/jwks"));
    assertThat(clientRegistration.getIdTokenSignedResponseAlgorithm()).isEqualTo("RS256");
    assertThat(clientRegistration.getClaimAsString("a-claim")).isEqualTo("a-value");
}

Example 3 with OidcClientRegistration

use of org.springframework.security.oauth2.core.oidc.OidcClientRegistration in project spring-authorization-server by spring-projects.

the class OidcClientRegistrationAuthenticationProviderTests method authenticateWhenRegistrationAccessTokenNotGeneratedThenThrowOAuth2AuthenticationException.

@Test
public void authenticateWhenRegistrationAccessTokenNotGeneratedThenThrowOAuth2AuthenticationException() {
    Jwt jwt = createJwtClientRegistration();
    OAuth2AccessToken jwtAccessToken = new OAuth2AccessToken(OAuth2AccessToken.TokenType.BEARER, jwt.getTokenValue(), jwt.getIssuedAt(), jwt.getExpiresAt(), jwt.getClaim(OAuth2ParameterNames.SCOPE));
    RegisteredClient registeredClient = TestRegisteredClients.registeredClient().build();
    OAuth2Authorization authorization = TestOAuth2Authorizations.authorization(registeredClient, jwtAccessToken, jwt.getClaims()).build();
    when(this.authorizationService.findByToken(eq(jwtAccessToken.getTokenValue()), eq(OAuth2TokenType.ACCESS_TOKEN))).thenReturn(authorization);
    doReturn(null).when(this.tokenGenerator).generate(any());
    JwtAuthenticationToken principal = new JwtAuthenticationToken(jwt, AuthorityUtils.createAuthorityList("SCOPE_client.create"));
    // @formatter:off
    OidcClientRegistration clientRegistration = OidcClientRegistration.builder().clientName("client-name").redirectUri("https://client.example.com").grantType(AuthorizationGrantType.AUTHORIZATION_CODE.getValue()).grantType(AuthorizationGrantType.CLIENT_CREDENTIALS.getValue()).scope("scope1").scope("scope2").build();
    // @formatter:on
    OidcClientRegistrationAuthenticationToken authentication = new OidcClientRegistrationAuthenticationToken(principal, clientRegistration);
    assertThatThrownBy(() -> this.authenticationProvider.authenticate(authentication)).isInstanceOf(OAuth2AuthenticationException.class).extracting(ex -> ((OAuth2AuthenticationException) ex).getError()).satisfies(error -> {
        assertThat(error.getErrorCode()).isEqualTo(OAuth2ErrorCodes.SERVER_ERROR);
        assertThat(error.getDescription()).contains("The token generator failed to generate the registration access token.");
    });
}

Example 4 with OidcClientRegistration

use of org.springframework.security.oauth2.core.oidc.OidcClientRegistration in project spring-authorization-server by spring-projects.

the class OidcClientRegistrationAuthenticationProviderTests method authenticateWhenClientRegistrationRequestAndAccessTokenContainsRequiredScopeAndAdditionalScopeThenThrowOAuth2AuthenticationException.

@Test
public void authenticateWhenClientRegistrationRequestAndAccessTokenContainsRequiredScopeAndAdditionalScopeThenThrowOAuth2AuthenticationException() {
    Jwt jwt = createJwt(new HashSet<>(Arrays.asList("client.create", "scope1")));
    OAuth2AccessToken jwtAccessToken = new OAuth2AccessToken(OAuth2AccessToken.TokenType.BEARER, jwt.getTokenValue(), jwt.getIssuedAt(), jwt.getExpiresAt(), jwt.getClaim(OAuth2ParameterNames.SCOPE));
    RegisteredClient registeredClient = TestRegisteredClients.registeredClient().build();
    OAuth2Authorization authorization = TestOAuth2Authorizations.authorization(registeredClient, jwtAccessToken, jwt.getClaims()).build();
    when(this.authorizationService.findByToken(eq(jwtAccessToken.getTokenValue()), eq(OAuth2TokenType.ACCESS_TOKEN))).thenReturn(authorization);
    JwtAuthenticationToken principal = new JwtAuthenticationToken(jwt, AuthorityUtils.createAuthorityList("SCOPE_client.create", "SCOPE_scope1"));
    OidcClientRegistration clientRegistration = OidcClientRegistration.builder().redirectUri("https://client.example.com").build();
    OidcClientRegistrationAuthenticationToken authentication = new OidcClientRegistrationAuthenticationToken(principal, clientRegistration);
    assertThatThrownBy(() -> this.authenticationProvider.authenticate(authentication)).isInstanceOf(OAuth2AuthenticationException.class).extracting(ex -> ((OAuth2AuthenticationException) ex).getError()).extracting("errorCode").isEqualTo(OAuth2ErrorCodes.INVALID_TOKEN);
    verify(this.authorizationService).findByToken(eq(jwtAccessToken.getTokenValue()), eq(OAuth2TokenType.ACCESS_TOKEN));
}

Example 5 with OidcClientRegistration

use of org.springframework.security.oauth2.core.oidc.OidcClientRegistration in project spring-authorization-server by spring-projects.

the class OidcClientRegistrationAuthenticationProviderTests method authenticateWhenAccessTokenNotActiveThenThrowOAuth2AuthenticationException.

@Test
public void authenticateWhenAccessTokenNotActiveThenThrowOAuth2AuthenticationException() {
    Jwt jwt = createJwtClientRegistration();
    OAuth2AccessToken jwtAccessToken = new OAuth2AccessToken(OAuth2AccessToken.TokenType.BEARER, jwt.getTokenValue(), jwt.getIssuedAt(), jwt.getExpiresAt(), jwt.getClaim(OAuth2ParameterNames.SCOPE));
    RegisteredClient registeredClient = TestRegisteredClients.registeredClient().build();
    OAuth2Authorization authorization = TestOAuth2Authorizations.authorization(registeredClient, jwtAccessToken, jwt.getClaims()).build();
    authorization = OidcAuthenticationProviderUtils.invalidate(authorization, jwtAccessToken);
    when(this.authorizationService.findByToken(eq(jwtAccessToken.getTokenValue()), eq(OAuth2TokenType.ACCESS_TOKEN))).thenReturn(authorization);
    JwtAuthenticationToken principal = new JwtAuthenticationToken(jwt, AuthorityUtils.createAuthorityList("SCOPE_client.create"));
    OidcClientRegistration clientRegistration = OidcClientRegistration.builder().redirectUri("https://client.example.com").build();
    OidcClientRegistrationAuthenticationToken authentication = new OidcClientRegistrationAuthenticationToken(principal, clientRegistration);
    assertThatThrownBy(() -> this.authenticationProvider.authenticate(authentication)).isInstanceOf(OAuth2AuthenticationException.class).extracting(ex -> ((OAuth2AuthenticationException) ex).getError()).extracting("errorCode").isEqualTo(OAuth2ErrorCodes.INVALID_TOKEN);
    verify(this.authorizationService).findByToken(eq(jwtAccessToken.getTokenValue()), eq(OAuth2TokenType.ACCESS_TOKEN));
}