Examples with BearerTokenAuthenticationToken org.springframework.security.oauth2.server.resource.BearerTokenAuthenticationToken used on opensource projects

Example 16 with BearerTokenAuthenticationToken

use of org.springframework.security.oauth2.server.resource.BearerTokenAuthenticationToken in project spring-security by spring-projects.

the class BearerPayloadExchangeConverter method convert.

@Override
public Mono<Authentication> convert(PayloadExchange exchange) {
    ByteBuf metadata = exchange.getPayload().metadata();
    CompositeMetadata compositeMetadata = new CompositeMetadata(metadata, false);
    for (CompositeMetadata.Entry entry : compositeMetadata) {
        if (BEARER_MIME_TYPE_VALUE.equals(entry.getMimeType())) {
            ByteBuf content = entry.getContent();
            String token = content.toString(StandardCharsets.UTF_8);
            return Mono.just(new BearerTokenAuthenticationToken(token));
        }
    }
    return Mono.empty();
}

Example 17 with BearerTokenAuthenticationToken

use of org.springframework.security.oauth2.server.resource.BearerTokenAuthenticationToken in project spring-security by spring-projects.

the class JwtIssuerReactiveAuthenticationManagerResolverTests method resolveWhenUsingTrustedIssuerThenReturnsAuthenticationManager.

@Test
public void resolveWhenUsingTrustedIssuerThenReturnsAuthenticationManager() throws Exception {
    try (MockWebServer server = new MockWebServer()) {
        String issuer = server.url("").toString();
        server.enqueue(new MockResponse().setResponseCode(200).setHeader("Content-Type", "application/json").setBody(String.format(DEFAULT_RESPONSE_TEMPLATE, issuer, issuer)));
        server.enqueue(new MockResponse().setResponseCode(200).setHeader("Content-Type", "application/json").setBody(JWK_SET));
        server.enqueue(new MockResponse().setResponseCode(200).setHeader("Content-Type", "application/json").setBody(JWK_SET));
        JWSObject jws = new JWSObject(new JWSHeader(JWSAlgorithm.RS256), new Payload(new JSONObject(Collections.singletonMap(JwtClaimNames.ISS, issuer))));
        jws.sign(new RSASSASigner(TestKeys.DEFAULT_PRIVATE_KEY));
        JwtIssuerReactiveAuthenticationManagerResolver authenticationManagerResolver = new JwtIssuerReactiveAuthenticationManagerResolver(issuer);
        ReactiveAuthenticationManager authenticationManager = authenticationManagerResolver.resolve(null).block();
        assertThat(authenticationManager).isNotNull();
        BearerTokenAuthenticationToken token = withBearerToken(jws.serialize());
        Authentication authentication = authenticationManager.authenticate(token).block();
        assertThat(authentication).isNotNull();
        assertThat(authentication.isAuthenticated()).isTrue();
    }
}

Example 18 with BearerTokenAuthenticationToken

use of org.springframework.security.oauth2.server.resource.BearerTokenAuthenticationToken in project spring-security by spring-projects.

the class OpaqueTokenAuthenticationProviderTests method authenticateWhenMissingScopeAttributeThenNoAuthorities.

@Test
public void authenticateWhenMissingScopeAttributeThenNoAuthorities() {
    OAuth2AuthenticatedPrincipal principal = new OAuth2IntrospectionAuthenticatedPrincipal(Collections.singletonMap("claim", "value"), null);
    OpaqueTokenIntrospector introspector = mock(OpaqueTokenIntrospector.class);
    given(introspector.introspect(any())).willReturn(principal);
    OpaqueTokenAuthenticationProvider provider = new OpaqueTokenAuthenticationProvider(introspector);
    Authentication result = provider.authenticate(new BearerTokenAuthenticationToken("token"));
    assertThat(result.getPrincipal()).isInstanceOf(OAuth2AuthenticatedPrincipal.class);
    Map<String, Object> attributes = ((OAuth2AuthenticatedPrincipal) result.getPrincipal()).getAttributes();
    // @formatter:off
    assertThat(attributes).isNotNull().doesNotContainKey(OAuth2TokenIntrospectionClaimNames.SCOPE);
    // @formatter:on
    assertThat(result.getAuthorities()).isEmpty();
}

Example 19 with BearerTokenAuthenticationToken

use of org.springframework.security.oauth2.server.resource.BearerTokenAuthenticationToken in project spring-security by spring-projects.

the class OpaqueTokenAuthenticationProviderTests method authenticateWhenActiveTokenThenOk.

@Test
public void authenticateWhenActiveTokenThenOk() throws Exception {
    OAuth2AuthenticatedPrincipal principal = TestOAuth2AuthenticatedPrincipals.active((attributes) -> attributes.put("extension_field", "twenty-seven"));
    OpaqueTokenIntrospector introspector = mock(OpaqueTokenIntrospector.class);
    given(introspector.introspect(any())).willReturn(principal);
    OpaqueTokenAuthenticationProvider provider = new OpaqueTokenAuthenticationProvider(introspector);
    Authentication result = provider.authenticate(new BearerTokenAuthenticationToken("token"));
    assertThat(result.getPrincipal()).isInstanceOf(OAuth2IntrospectionAuthenticatedPrincipal.class);
    Map<String, Object> attributes = ((OAuth2AuthenticatedPrincipal) result.getPrincipal()).getAttributes();
    // @formatter:off
    assertThat(attributes).isNotNull().containsEntry(OAuth2TokenIntrospectionClaimNames.ACTIVE, true).containsEntry(OAuth2TokenIntrospectionClaimNames.AUD, Arrays.asList("https://protected.example.net/resource")).containsEntry(OAuth2TokenIntrospectionClaimNames.CLIENT_ID, "l238j323ds-23ij4").containsEntry(OAuth2TokenIntrospectionClaimNames.EXP, Instant.ofEpochSecond(1419356238)).containsEntry(OAuth2TokenIntrospectionClaimNames.ISS, new URL("https://server.example.com/")).containsEntry(OAuth2TokenIntrospectionClaimNames.NBF, Instant.ofEpochSecond(29348723984L)).containsEntry(OAuth2TokenIntrospectionClaimNames.SCOPE, Arrays.asList("read", "write", "dolphin")).containsEntry(OAuth2TokenIntrospectionClaimNames.SUB, "Z5O3upPC88QrAjx00dis").containsEntry(OAuth2TokenIntrospectionClaimNames.USERNAME, "jdoe").containsEntry("extension_field", "twenty-seven");
    assertThat(result.getAuthorities()).extracting("authority").containsExactly("SCOPE_read", "SCOPE_write", "SCOPE_dolphin");
// @formatter:on
}

Example 20 with BearerTokenAuthenticationToken

use of org.springframework.security.oauth2.server.resource.BearerTokenAuthenticationToken in project spring-security by spring-projects.

the class OpaqueTokenReactiveAuthenticationManagerTests method authenticateWhenMissingScopeAttributeThenNoAuthorities.

@Test
public void authenticateWhenMissingScopeAttributeThenNoAuthorities() {
    OAuth2AuthenticatedPrincipal authority = new OAuth2IntrospectionAuthenticatedPrincipal(Collections.singletonMap("claim", "value"), null);
    ReactiveOpaqueTokenIntrospector introspector = mock(ReactiveOpaqueTokenIntrospector.class);
    given(introspector.introspect(any())).willReturn(Mono.just(authority));
    OpaqueTokenReactiveAuthenticationManager provider = new OpaqueTokenReactiveAuthenticationManager(introspector);
    Authentication result = provider.authenticate(new BearerTokenAuthenticationToken("token")).block();
    assertThat(result.getPrincipal()).isInstanceOf(OAuth2IntrospectionAuthenticatedPrincipal.class);
    Map<String, Object> attributes = ((OAuth2AuthenticatedPrincipal) result.getPrincipal()).getAttributes();
    assertThat(attributes).isNotNull().doesNotContainKey(OAuth2TokenIntrospectionClaimNames.SCOPE);
    assertThat(result.getAuthorities()).isEmpty();
}