Examples with OAuth2TokenRevocationAuthenticationToken org.springframework.security.oauth2.server.authorization.authentication.OAuth2TokenRevocationAuthenticationToken used on opensource projects

Example 1 with OAuth2TokenRevocationAuthenticationToken

use of org.springframework.security.oauth2.server.authorization.authentication.OAuth2TokenRevocationAuthenticationToken in project spring-authorization-server by spring-projects.

the class OAuth2TokenRevocationAuthenticationProviderTests method authenticateWhenInvalidTokenThenNotRevoked.

@Test
public void authenticateWhenInvalidTokenThenNotRevoked() {
    RegisteredClient registeredClient = TestRegisteredClients.registeredClient().build();
    OAuth2ClientAuthenticationToken clientPrincipal = new OAuth2ClientAuthenticationToken(registeredClient, ClientAuthenticationMethod.CLIENT_SECRET_BASIC, registeredClient.getClientSecret());
    OAuth2TokenRevocationAuthenticationToken authentication = new OAuth2TokenRevocationAuthenticationToken("token", clientPrincipal, OAuth2TokenType.ACCESS_TOKEN.getValue());
    OAuth2TokenRevocationAuthenticationToken authenticationResult = (OAuth2TokenRevocationAuthenticationToken) this.authenticationProvider.authenticate(authentication);
    assertThat(authenticationResult.isAuthenticated()).isFalse();
    verify(this.authorizationService, never()).save(any());
}

Example 2 with OAuth2TokenRevocationAuthenticationToken

use of org.springframework.security.oauth2.server.authorization.authentication.OAuth2TokenRevocationAuthenticationToken in project spring-authorization-server by spring-projects.

the class OAuth2TokenRevocationEndpointFilterTests method doFilterWhenCustomAuthenticationSuccessHandlerThenUsed.

@Test
public void doFilterWhenCustomAuthenticationSuccessHandlerThenUsed() throws Exception {
    RegisteredClient registeredClient = TestRegisteredClients.registeredClient().build();
    Authentication clientPrincipal = new OAuth2ClientAuthenticationToken(registeredClient, ClientAuthenticationMethod.CLIENT_SECRET_BASIC, registeredClient.getClientSecret());
    OAuth2AccessToken accessToken = new OAuth2AccessToken(OAuth2AccessToken.TokenType.BEARER, "token", Instant.now(), Instant.now().plus(Duration.ofHours(1)), new HashSet<>(Arrays.asList("scope1", "scope2")));
    OAuth2TokenRevocationAuthenticationToken tokenRevocationAuthentication = new OAuth2TokenRevocationAuthenticationToken(accessToken, clientPrincipal);
    AuthenticationSuccessHandler authenticationSuccessHandler = mock(AuthenticationSuccessHandler.class);
    this.filter.setAuthenticationSuccessHandler(authenticationSuccessHandler);
    when(this.authenticationManager.authenticate(any())).thenReturn(tokenRevocationAuthentication);
    SecurityContext securityContext = SecurityContextHolder.createEmptyContext();
    securityContext.setAuthentication(clientPrincipal);
    SecurityContextHolder.setContext(securityContext);
    MockHttpServletRequest request = createTokenRevocationRequest();
    MockHttpServletResponse response = new MockHttpServletResponse();
    FilterChain filterChain = mock(FilterChain.class);
    this.filter.doFilter(request, response, filterChain);
    verify(authenticationSuccessHandler).onAuthenticationSuccess(any(), any(), any());
}

Example 3 with OAuth2TokenRevocationAuthenticationToken

use of org.springframework.security.oauth2.server.authorization.authentication.OAuth2TokenRevocationAuthenticationToken in project spring-authorization-server by spring-projects.

the class OAuth2TokenRevocationTests method requestWhenTokenRevocationEndpointCustomizedThenUsed.

@Test
public void requestWhenTokenRevocationEndpointCustomizedThenUsed() throws Exception {
    this.spring.register(AuthorizationServerConfigurationCustomTokenRevocationEndpoint.class).autowire();
    RegisteredClient registeredClient = TestRegisteredClients.registeredClient().build();
    this.registeredClientRepository.save(registeredClient);
    OAuth2Authorization authorization = TestOAuth2Authorizations.authorization(registeredClient).build();
    OAuth2AccessToken token = authorization.getAccessToken().getToken();
    OAuth2TokenType tokenType = OAuth2TokenType.ACCESS_TOKEN;
    this.authorizationService.save(authorization);
    Authentication clientPrincipal = new OAuth2ClientAuthenticationToken(registeredClient, ClientAuthenticationMethod.CLIENT_SECRET_BASIC, registeredClient.getClientSecret());
    OAuth2TokenRevocationAuthenticationToken tokenRevocationAuthentication = new OAuth2TokenRevocationAuthenticationToken(token, clientPrincipal);
    when(authenticationConverter.convert(any())).thenReturn(tokenRevocationAuthentication);
    when(authenticationProvider.supports(eq(OAuth2TokenRevocationAuthenticationToken.class))).thenReturn(true);
    when(authenticationProvider.authenticate(any())).thenReturn(tokenRevocationAuthentication);
    this.mvc.perform(post(DEFAULT_TOKEN_REVOCATION_ENDPOINT_URI).params(getTokenRevocationRequestParameters(token, tokenType)).header(HttpHeaders.AUTHORIZATION, "Basic " + encodeBasicAuth(registeredClient.getClientId(), registeredClient.getClientSecret()))).andExpect(status().isOk());
    verify(authenticationConverter).convert(any());
    verify(authenticationProvider).authenticate(eq(tokenRevocationAuthentication));
    verify(authenticationSuccessHandler).onAuthenticationSuccess(any(), any(), eq(tokenRevocationAuthentication));
}

Example 4 with OAuth2TokenRevocationAuthenticationToken

use of org.springframework.security.oauth2.server.authorization.authentication.OAuth2TokenRevocationAuthenticationToken in project spring-authorization-server by spring-projects.

the class OAuth2TokenRevocationEndpointFilterTests method doFilterWhenTokenRevocationRequestValidThenSuccessResponse.

@Test
public void doFilterWhenTokenRevocationRequestValidThenSuccessResponse() throws Exception {
    RegisteredClient registeredClient = TestRegisteredClients.registeredClient().build();
    Authentication clientPrincipal = new OAuth2ClientAuthenticationToken(registeredClient, ClientAuthenticationMethod.CLIENT_SECRET_BASIC, registeredClient.getClientSecret());
    OAuth2AccessToken accessToken = new OAuth2AccessToken(OAuth2AccessToken.TokenType.BEARER, "token", Instant.now(), Instant.now().plus(Duration.ofHours(1)), new HashSet<>(Arrays.asList("scope1", "scope2")));
    OAuth2TokenRevocationAuthenticationToken tokenRevocationAuthentication = new OAuth2TokenRevocationAuthenticationToken(accessToken, clientPrincipal);
    when(this.authenticationManager.authenticate(any())).thenReturn(tokenRevocationAuthentication);
    SecurityContext securityContext = SecurityContextHolder.createEmptyContext();
    securityContext.setAuthentication(clientPrincipal);
    SecurityContextHolder.setContext(securityContext);
    MockHttpServletRequest request = createTokenRevocationRequest();
    MockHttpServletResponse response = new MockHttpServletResponse();
    FilterChain filterChain = mock(FilterChain.class);
    this.filter.doFilter(request, response, filterChain);
    verifyNoInteractions(filterChain);
    verify(this.authenticationManager).authenticate(any());
    assertThat(response.getStatus()).isEqualTo(HttpStatus.OK.value());
}

Example 5 with OAuth2TokenRevocationAuthenticationToken

use of org.springframework.security.oauth2.server.authorization.authentication.OAuth2TokenRevocationAuthenticationToken in project spring-authorization-server by spring-projects.

the class OAuth2TokenRevocationEndpointFilterTests method doFilterWhenCustomAuthenticationConverterThenUsed.

@Test
public void doFilterWhenCustomAuthenticationConverterThenUsed() throws Exception {
    RegisteredClient registeredClient = TestRegisteredClients.registeredClient().build();
    Authentication clientPrincipal = new OAuth2ClientAuthenticationToken(registeredClient, ClientAuthenticationMethod.CLIENT_SECRET_BASIC, registeredClient.getClientSecret());
    OAuth2AccessToken accessToken = new OAuth2AccessToken(OAuth2AccessToken.TokenType.BEARER, "token", Instant.now(), Instant.now().plus(Duration.ofHours(1)), new HashSet<>(Arrays.asList("scope1", "scope2")));
    OAuth2TokenRevocationAuthenticationToken tokenRevocationAuthentication = new OAuth2TokenRevocationAuthenticationToken(accessToken, clientPrincipal);
    AuthenticationConverter authenticationConverter = mock(AuthenticationConverter.class);
    when(authenticationConverter.convert(any())).thenReturn(tokenRevocationAuthentication);
    this.filter.setAuthenticationConverter(authenticationConverter);
    when(this.authenticationManager.authenticate(any())).thenReturn(tokenRevocationAuthentication);
    SecurityContext securityContext = SecurityContextHolder.createEmptyContext();
    securityContext.setAuthentication(clientPrincipal);
    SecurityContextHolder.setContext(securityContext);
    MockHttpServletRequest request = createTokenRevocationRequest();
    MockHttpServletResponse response = new MockHttpServletResponse();
    FilterChain filterChain = mock(FilterChain.class);
    this.filter.doFilter(request, response, filterChain);
    verify(authenticationConverter).convert(any());
}