Examples with TokenSettings org.springframework.security.oauth2.server.authorization.config.TokenSettings used on opensource projects

Example 1 with TokenSettings

use of org.springframework.security.oauth2.server.authorization.config.TokenSettings in project spring-authorization-server by spring-projects.

the class OAuth2RefreshTokenAuthenticationProviderTests method authenticateWhenAccessTokenFormatReferenceThenAccessTokenGeneratorCalled.

@Test
public void authenticateWhenAccessTokenFormatReferenceThenAccessTokenGeneratorCalled() {
    // @formatter:off
    RegisteredClient registeredClient = TestRegisteredClients.registeredClient().tokenSettings(TokenSettings.builder().accessTokenFormat(OAuth2TokenFormat.REFERENCE).build()).build();
    // @formatter:on
    OAuth2Authorization authorization = TestOAuth2Authorizations.authorization(registeredClient).build();
    when(this.authorizationService.findByToken(eq(authorization.getRefreshToken().getToken().getTokenValue()), eq(OAuth2TokenType.REFRESH_TOKEN))).thenReturn(authorization);
    OAuth2ClientAuthenticationToken clientPrincipal = new OAuth2ClientAuthenticationToken(registeredClient, ClientAuthenticationMethod.CLIENT_SECRET_BASIC, registeredClient.getClientSecret());
    OAuth2RefreshTokenAuthenticationToken authentication = new OAuth2RefreshTokenAuthenticationToken(authorization.getRefreshToken().getToken().getTokenValue(), clientPrincipal, null, null);
    this.authenticationProvider.authenticate(authentication);
    verify(this.accessTokenCustomizer).customize(any());
}

Example 2 with TokenSettings

use of org.springframework.security.oauth2.server.authorization.config.TokenSettings in project spring-authorization-server by spring-projects.

the class OAuth2ClientCredentialsAuthenticationProviderTests method authenticateWhenAccessTokenFormatReferenceThenAccessTokenGeneratorCalled.

@Test
public void authenticateWhenAccessTokenFormatReferenceThenAccessTokenGeneratorCalled() {
    // @formatter:off
    RegisteredClient registeredClient = TestRegisteredClients.registeredClient2().tokenSettings(TokenSettings.builder().accessTokenFormat(OAuth2TokenFormat.REFERENCE).build()).build();
    // @formatter:on
    OAuth2ClientAuthenticationToken clientPrincipal = new OAuth2ClientAuthenticationToken(registeredClient, ClientAuthenticationMethod.CLIENT_SECRET_BASIC, registeredClient.getClientSecret());
    OAuth2ClientCredentialsAuthenticationToken authentication = new OAuth2ClientCredentialsAuthenticationToken(clientPrincipal, null, null);
    this.authenticationProvider.authenticate(authentication);
    verify(this.accessTokenCustomizer).customize(any());
}

Example 3 with TokenSettings

use of org.springframework.security.oauth2.server.authorization.config.TokenSettings in project spring-authorization-server by spring-projects.

the class JwtGeneratorTests method generateWhenUnsupportedTokenFormatThenReturnNull.

@Test
public void generateWhenUnsupportedTokenFormatThenReturnNull() {
    // @formatter:off
    TokenSettings tokenSettings = TokenSettings.builder().accessTokenFormat(new OAuth2TokenFormat("unsupported_token_format")).build();
    RegisteredClient registeredClient = TestRegisteredClients.registeredClient().tokenSettings(tokenSettings).build();
    OAuth2TokenContext tokenContext = DefaultOAuth2TokenContext.builder().registeredClient(registeredClient).tokenType(OAuth2TokenType.ACCESS_TOKEN).build();
    // @formatter:on
    assertThat(this.jwtGenerator.generate(tokenContext)).isNull();
}

Example 4 with TokenSettings

use of org.springframework.security.oauth2.server.authorization.config.TokenSettings in project spring-authorization-server by spring-projects.

the class OAuth2AccessTokenGeneratorTests method generateWhenUnsupportedTokenTypeThenReturnNull.

@Test
public void generateWhenUnsupportedTokenTypeThenReturnNull() {
    // @formatter:off
    TokenSettings tokenSettings = TokenSettings.builder().accessTokenFormat(OAuth2TokenFormat.REFERENCE).build();
    RegisteredClient registeredClient = TestRegisteredClients.registeredClient().tokenSettings(tokenSettings).build();
    OAuth2TokenContext tokenContext = DefaultOAuth2TokenContext.builder().registeredClient(registeredClient).tokenType(new OAuth2TokenType("unsupported_token_type")).build();
    // @formatter:on
    assertThat(this.accessTokenGenerator.generate(tokenContext)).isNull();
}

Example 5 with TokenSettings

use of org.springframework.security.oauth2.server.authorization.config.TokenSettings in project spring-authorization-server by spring-projects.

the class OAuth2TokenIntrospectionTests method requestWhenObtainReferenceAccessTokenAndIntrospectThenActive.

@Test
public void requestWhenObtainReferenceAccessTokenAndIntrospectThenActive() throws Exception {
    this.spring.register(AuthorizationServerConfiguration.class).autowire();
    // @formatter:off
    TokenSettings tokenSettings = TokenSettings.builder().accessTokenFormat(OAuth2TokenFormat.REFERENCE).build();
    RegisteredClient authorizedRegisteredClient = TestRegisteredClients.registeredClient().tokenSettings(tokenSettings).build();
    // @formatter:on
    this.registeredClientRepository.save(authorizedRegisteredClient);
    OAuth2Authorization authorization = TestOAuth2Authorizations.authorization(authorizedRegisteredClient).build();
    this.authorizationService.save(authorization);
    // @formatter:off
    MvcResult mvcResult = this.mvc.perform(post(providerSettings.getTokenEndpoint()).params(getAuthorizationCodeTokenRequestParameters(authorizedRegisteredClient, authorization)).header(HttpHeaders.AUTHORIZATION, getAuthorizationHeader(authorizedRegisteredClient))).andExpect(status().isOk()).andReturn();
    // @formatter:on
    OAuth2AccessTokenResponse accessTokenResponse = readAccessTokenResponse(mvcResult);
    OAuth2AccessToken accessToken = accessTokenResponse.getAccessToken();
    RegisteredClient introspectRegisteredClient = TestRegisteredClients.registeredClient2().build();
    this.registeredClientRepository.save(introspectRegisteredClient);
    // @formatter:off
    mvcResult = this.mvc.perform(post(providerSettings.getTokenIntrospectionEndpoint()).params(getTokenIntrospectionRequestParameters(accessToken, OAuth2TokenType.ACCESS_TOKEN)).header(HttpHeaders.AUTHORIZATION, getAuthorizationHeader(introspectRegisteredClient))).andExpect(status().isOk()).andReturn();
    // @formatter:on
    OAuth2TokenIntrospection tokenIntrospectionResponse = readTokenIntrospectionResponse(mvcResult);
    ArgumentCaptor<OAuth2TokenClaimsContext> accessTokenClaimsContextCaptor = ArgumentCaptor.forClass(OAuth2TokenClaimsContext.class);
    verify(accessTokenCustomizer).customize(accessTokenClaimsContextCaptor.capture());
    OAuth2TokenClaimsContext accessTokenClaimsContext = accessTokenClaimsContextCaptor.getValue();
    OAuth2TokenClaimsSet accessTokenClaims = accessTokenClaimsContext.getClaims().build();
    assertThat(tokenIntrospectionResponse.isActive()).isTrue();
    assertThat(tokenIntrospectionResponse.getClientId()).isEqualTo(authorizedRegisteredClient.getClientId());
    assertThat(tokenIntrospectionResponse.getUsername()).isNull();
    assertThat(tokenIntrospectionResponse.getIssuedAt()).isBetween(accessTokenClaims.getIssuedAt().minusSeconds(1), accessTokenClaims.getIssuedAt().plusSeconds(1));
    assertThat(tokenIntrospectionResponse.getExpiresAt()).isBetween(accessTokenClaims.getExpiresAt().minusSeconds(1), accessTokenClaims.getExpiresAt().plusSeconds(1));
    List<String> scopes = new ArrayList<>(accessTokenClaims.getClaim(OAuth2ParameterNames.SCOPE));
    assertThat(tokenIntrospectionResponse.getScopes()).containsExactlyInAnyOrderElementsOf(scopes);
    assertThat(tokenIntrospectionResponse.getTokenType()).isEqualTo(accessToken.getTokenType().getValue());
    assertThat(tokenIntrospectionResponse.getNotBefore()).isBetween(accessTokenClaims.getNotBefore().minusSeconds(1), accessTokenClaims.getNotBefore().plusSeconds(1));
    assertThat(tokenIntrospectionResponse.getSubject()).isEqualTo(accessTokenClaims.getSubject());
    assertThat(tokenIntrospectionResponse.getAudience()).containsExactlyInAnyOrderElementsOf(accessTokenClaims.getAudience());
    assertThat(tokenIntrospectionResponse.getIssuer()).isEqualTo(accessTokenClaims.getIssuer());
    assertThat(tokenIntrospectionResponse.getId()).isEqualTo(accessTokenClaims.getId());
}