Examples with OAuth2Authorization org.springframework.security.oauth2.server.authorization.OAuth2Authorization used on opensource projects

Example 96 with OAuth2Authorization

use of org.springframework.security.oauth2.server.authorization.OAuth2Authorization in project spring-authorization-server by spring-projects.

the class OAuth2RefreshTokenAuthenticationProviderTests method authenticateWhenClientNotAuthorizedToRefreshTokenThenThrowOAuth2AuthenticationException.

@Test
public void authenticateWhenClientNotAuthorizedToRefreshTokenThenThrowOAuth2AuthenticationException() {
    RegisteredClient registeredClient = TestRegisteredClients.registeredClient().authorizationGrantTypes(grantTypes -> grantTypes.remove(AuthorizationGrantType.REFRESH_TOKEN)).build();
    OAuth2Authorization authorization = TestOAuth2Authorizations.authorization(registeredClient).build();
    when(this.authorizationService.findByToken(eq(authorization.getRefreshToken().getToken().getTokenValue()), eq(OAuth2TokenType.REFRESH_TOKEN))).thenReturn(authorization);
    OAuth2ClientAuthenticationToken clientPrincipal = new OAuth2ClientAuthenticationToken(registeredClient, ClientAuthenticationMethod.CLIENT_SECRET_BASIC, registeredClient.getClientSecret());
    OAuth2RefreshTokenAuthenticationToken authentication = new OAuth2RefreshTokenAuthenticationToken(authorization.getRefreshToken().getToken().getTokenValue(), clientPrincipal, null, null);
    assertThatThrownBy(() -> this.authenticationProvider.authenticate(authentication)).isInstanceOf(OAuth2AuthenticationException.class).extracting(ex -> ((OAuth2AuthenticationException) ex).getError()).extracting("errorCode").isEqualTo(OAuth2ErrorCodes.UNAUTHORIZED_CLIENT);
}

Example 97 with OAuth2Authorization

use of org.springframework.security.oauth2.server.authorization.OAuth2Authorization in project spring-authorization-server by spring-projects.

the class OAuth2RefreshTokenAuthenticationProviderTests method authenticateWhenRefreshTokenNotGeneratedThenThrowOAuth2AuthenticationException.

@Test
public void authenticateWhenRefreshTokenNotGeneratedThenThrowOAuth2AuthenticationException() {
    RegisteredClient registeredClient = TestRegisteredClients.registeredClient().tokenSettings(TokenSettings.builder().reuseRefreshTokens(false).build()).build();
    OAuth2Authorization authorization = TestOAuth2Authorizations.authorization(registeredClient).build();
    when(this.authorizationService.findByToken(eq(authorization.getRefreshToken().getToken().getTokenValue()), eq(OAuth2TokenType.REFRESH_TOKEN))).thenReturn(authorization);
    OAuth2ClientAuthenticationToken clientPrincipal = new OAuth2ClientAuthenticationToken(registeredClient, ClientAuthenticationMethod.CLIENT_SECRET_BASIC, registeredClient.getClientSecret());
    OAuth2RefreshTokenAuthenticationToken authentication = new OAuth2RefreshTokenAuthenticationToken(authorization.getRefreshToken().getToken().getTokenValue(), clientPrincipal, null, null);
    doAnswer(answer -> {
        OAuth2TokenContext context = answer.getArgument(0);
        if (OAuth2TokenType.REFRESH_TOKEN.equals(context.getTokenType())) {
            return null;
        } else {
            return answer.callRealMethod();
        }
    }).when(this.tokenGenerator).generate(any());
    assertThatThrownBy(() -> this.authenticationProvider.authenticate(authentication)).isInstanceOf(OAuth2AuthenticationException.class).extracting(ex -> ((OAuth2AuthenticationException) ex).getError()).satisfies(error -> {
        assertThat(error.getErrorCode()).isEqualTo(OAuth2ErrorCodes.SERVER_ERROR);
        assertThat(error.getDescription()).contains("The token generator failed to generate the refresh token.");
    });
}

Example 98 with OAuth2Authorization

use of org.springframework.security.oauth2.server.authorization.OAuth2Authorization in project spring-authorization-server by spring-projects.

the class OAuth2RefreshTokenAuthenticationProviderTests method authenticateWhenIdTokenNotGeneratedThenThrowOAuth2AuthenticationException.

@Test
public void authenticateWhenIdTokenNotGeneratedThenThrowOAuth2AuthenticationException() {
    RegisteredClient registeredClient = TestRegisteredClients.registeredClient().scope(OidcScopes.OPENID).build();
    OAuth2Authorization authorization = TestOAuth2Authorizations.authorization(registeredClient).build();
    when(this.authorizationService.findByToken(eq(authorization.getRefreshToken().getToken().getTokenValue()), eq(OAuth2TokenType.REFRESH_TOKEN))).thenReturn(authorization);
    OAuth2ClientAuthenticationToken clientPrincipal = new OAuth2ClientAuthenticationToken(registeredClient, ClientAuthenticationMethod.CLIENT_SECRET_BASIC, registeredClient.getClientSecret());
    OAuth2RefreshTokenAuthenticationToken authentication = new OAuth2RefreshTokenAuthenticationToken(authorization.getRefreshToken().getToken().getTokenValue(), clientPrincipal, null, null);
    doAnswer(answer -> {
        OAuth2TokenContext context = answer.getArgument(0);
        if (OidcParameterNames.ID_TOKEN.equals(context.getTokenType().getValue())) {
            return null;
        } else {
            return answer.callRealMethod();
        }
    }).when(this.tokenGenerator).generate(any());
    assertThatThrownBy(() -> this.authenticationProvider.authenticate(authentication)).isInstanceOf(OAuth2AuthenticationException.class).extracting(ex -> ((OAuth2AuthenticationException) ex).getError()).satisfies(error -> {
        assertThat(error.getErrorCode()).isEqualTo(OAuth2ErrorCodes.SERVER_ERROR);
        assertThat(error.getDescription()).contains("The token generator failed to generate the ID token.");
    });
}

Example 99 with OAuth2Authorization

use of org.springframework.security.oauth2.server.authorization.OAuth2Authorization in project spring-authorization-server by spring-projects.

the class OAuth2RefreshTokenAuthenticationProviderTests method authenticateWhenValidRefreshTokenThenReturnIdToken.

@Test
public void authenticateWhenValidRefreshTokenThenReturnIdToken() {
    RegisteredClient registeredClient = TestRegisteredClients.registeredClient().scope(OidcScopes.OPENID).build();
    OAuth2Authorization authorization = TestOAuth2Authorizations.authorization(registeredClient).build();
    when(this.authorizationService.findByToken(eq(authorization.getRefreshToken().getToken().getTokenValue()), eq(OAuth2TokenType.REFRESH_TOKEN))).thenReturn(authorization);
    OAuth2ClientAuthenticationToken clientPrincipal = new OAuth2ClientAuthenticationToken(registeredClient, ClientAuthenticationMethod.CLIENT_SECRET_BASIC, registeredClient.getClientSecret());
    OAuth2RefreshTokenAuthenticationToken authentication = new OAuth2RefreshTokenAuthenticationToken(authorization.getRefreshToken().getToken().getTokenValue(), clientPrincipal, null, null);
    OAuth2AccessTokenAuthenticationToken accessTokenAuthentication = (OAuth2AccessTokenAuthenticationToken) this.authenticationProvider.authenticate(authentication);
    ArgumentCaptor<JwtEncodingContext> jwtEncodingContextCaptor = ArgumentCaptor.forClass(JwtEncodingContext.class);
    verify(this.jwtCustomizer, times(2)).customize(jwtEncodingContextCaptor.capture());
    // Access Token context
    JwtEncodingContext accessTokenContext = jwtEncodingContextCaptor.getAllValues().get(0);
    assertThat(accessTokenContext.getRegisteredClient()).isEqualTo(registeredClient);
    assertThat(accessTokenContext.<Authentication>getPrincipal()).isEqualTo(authorization.getAttribute(Principal.class.getName()));
    assertThat(accessTokenContext.getAuthorization()).isEqualTo(authorization);
    assertThat(accessTokenContext.getAuthorizedScopes()).isEqualTo(authorization.getAttribute(OAuth2Authorization.AUTHORIZED_SCOPE_ATTRIBUTE_NAME));
    assertThat(accessTokenContext.getTokenType()).isEqualTo(OAuth2TokenType.ACCESS_TOKEN);
    assertThat(accessTokenContext.getAuthorizationGrantType()).isEqualTo(AuthorizationGrantType.REFRESH_TOKEN);
    assertThat(accessTokenContext.<OAuth2AuthorizationGrantAuthenticationToken>getAuthorizationGrant()).isEqualTo(authentication);
    assertThat(accessTokenContext.getHeaders()).isNotNull();
    assertThat(accessTokenContext.getClaims()).isNotNull();
    Map<String, Object> claims = new HashMap<>();
    accessTokenContext.getClaims().claims(claims::putAll);
    assertThat(claims).flatExtracting(OAuth2ParameterNames.SCOPE).containsExactlyInAnyOrder(OidcScopes.OPENID, "scope1");
    // ID Token context
    JwtEncodingContext idTokenContext = jwtEncodingContextCaptor.getAllValues().get(1);
    assertThat(idTokenContext.getRegisteredClient()).isEqualTo(registeredClient);
    assertThat(idTokenContext.<Authentication>getPrincipal()).isEqualTo(authorization.getAttribute(Principal.class.getName()));
    assertThat(idTokenContext.getAuthorization()).isEqualTo(authorization);
    assertThat(idTokenContext.getAuthorizedScopes()).isEqualTo(authorization.getAttribute(OAuth2Authorization.AUTHORIZED_SCOPE_ATTRIBUTE_NAME));
    assertThat(idTokenContext.getTokenType().getValue()).isEqualTo(OidcParameterNames.ID_TOKEN);
    assertThat(idTokenContext.getAuthorizationGrantType()).isEqualTo(AuthorizationGrantType.REFRESH_TOKEN);
    assertThat(idTokenContext.<OAuth2AuthorizationGrantAuthenticationToken>getAuthorizationGrant()).isEqualTo(authentication);
    assertThat(idTokenContext.getHeaders()).isNotNull();
    assertThat(idTokenContext.getClaims()).isNotNull();
    // Access token and ID Token
    verify(this.jwtEncoder, times(2)).encode(any(), any());
    ArgumentCaptor<OAuth2Authorization> authorizationCaptor = ArgumentCaptor.forClass(OAuth2Authorization.class);
    verify(this.authorizationService).save(authorizationCaptor.capture());
    OAuth2Authorization updatedAuthorization = authorizationCaptor.getValue();
    assertThat(accessTokenAuthentication.getRegisteredClient().getId()).isEqualTo(updatedAuthorization.getRegisteredClientId());
    assertThat(accessTokenAuthentication.getPrincipal()).isEqualTo(clientPrincipal);
    assertThat(accessTokenAuthentication.getAccessToken()).isEqualTo(updatedAuthorization.getAccessToken().getToken());
    assertThat(updatedAuthorization.getAccessToken()).isNotEqualTo(authorization.getAccessToken());
    OAuth2Authorization.Token<OidcIdToken> idToken = updatedAuthorization.getToken(OidcIdToken.class);
    assertThat(idToken).isNotNull();
    assertThat(accessTokenAuthentication.getAdditionalParameters()).containsExactly(entry(OidcParameterNames.ID_TOKEN, idToken.getToken().getTokenValue()));
    assertThat(accessTokenAuthentication.getRefreshToken()).isEqualTo(updatedAuthorization.getRefreshToken().getToken());
    // By default, refresh token is reused
    assertThat(updatedAuthorization.getRefreshToken()).isEqualTo(authorization.getRefreshToken());
}

Example 100 with OAuth2Authorization

use of org.springframework.security.oauth2.server.authorization.OAuth2Authorization in project spring-authorization-server by spring-projects.

the class OAuth2RefreshTokenAuthenticationProviderTests method authenticateWhenReuseRefreshTokensFalseThenReturnNewRefreshToken.

@Test
public void authenticateWhenReuseRefreshTokensFalseThenReturnNewRefreshToken() {
    RegisteredClient registeredClient = TestRegisteredClients.registeredClient().tokenSettings(TokenSettings.builder().reuseRefreshTokens(false).build()).build();
    OAuth2Authorization authorization = TestOAuth2Authorizations.authorization(registeredClient).build();
    when(this.authorizationService.findByToken(eq(authorization.getRefreshToken().getToken().getTokenValue()), eq(OAuth2TokenType.REFRESH_TOKEN))).thenReturn(authorization);
    OAuth2ClientAuthenticationToken clientPrincipal = new OAuth2ClientAuthenticationToken(registeredClient, ClientAuthenticationMethod.CLIENT_SECRET_BASIC, registeredClient.getClientSecret());
    OAuth2RefreshTokenAuthenticationToken authentication = new OAuth2RefreshTokenAuthenticationToken(authorization.getRefreshToken().getToken().getTokenValue(), clientPrincipal, null, null);
    OAuth2AccessTokenAuthenticationToken accessTokenAuthentication = (OAuth2AccessTokenAuthenticationToken) this.authenticationProvider.authenticate(authentication);
    ArgumentCaptor<OAuth2Authorization> authorizationCaptor = ArgumentCaptor.forClass(OAuth2Authorization.class);
    verify(this.authorizationService).save(authorizationCaptor.capture());
    OAuth2Authorization updatedAuthorization = authorizationCaptor.getValue();
    assertThat(accessTokenAuthentication.getRefreshToken()).isEqualTo(updatedAuthorization.getRefreshToken().getToken());
    assertThat(updatedAuthorization.getRefreshToken()).isNotEqualTo(authorization.getRefreshToken());
}