Examples with JWTValidator org.wso2.carbon.apimgt.gateway.handlers.security.jwt.JWTValidator used on opensource projects

Example 16 with JWTValidator

use of org.wso2.carbon.apimgt.gateway.handlers.security.jwt.JWTValidator in project carbon-apimgt by wso2.

the class JWTValidatorImplTest method testValidateToken.

@Test
@PrepareForTest({ CertificateMgtUtils.class, JWTUtil.class, APIManagerConfiguration.class, ServiceReferenceHolder.class, APIManagerConfigurationService.class, APIUtil.class, X509CertUtils.class })
public void testValidateToken() {
    TokenIssuerDto tokenIssuerDto = new TokenIssuerDto("https://localhost:9444/services");
    Mockito.when(signedJWT.getHeader()).thenReturn(jwsHeader);
    PowerMockito.mockStatic(JWTUtil.class);
    byte[] encodedCertificateUnmatched = "aaaaaaaaaaaaaaaa".getBytes();
    try {
        PowerMockito.when(JWTUtil.verifyTokenSignature(signedJWT, KeyId)).thenReturn(true);
    } catch (APIManagementException e) {
        log.info("Exception while signature verification. " + e);
        Assert.fail();
    }
    // Create a mock APIManagerConfiguration Object for retrieving properties from the deployment.toml
    PowerMockito.mockStatic(ServiceReferenceHolder.class);
    PowerMockito.mockStatic(APIManagerConfiguration.class);
    PowerMockito.mockStatic(APIManagerConfigurationService.class);
    PowerMockito.mockStatic(APIUtil.class);
    PowerMockito.mockStatic(CertificateMgtUtils.class);
    PowerMockito.mockStatic(X509CertUtils.class);
    APIManagerConfiguration apiManagerConfiguration = PowerMockito.mock(APIManagerConfiguration.class);
    ServiceReferenceHolder serviceReferenceHolder = PowerMockito.mock(ServiceReferenceHolder.class);
    APIManagerConfigurationService apiManagerConfigurationService = PowerMockito.mock(APIManagerConfigurationService.class);
    OAuthServerConfiguration oAuthServerConfiguration = Mockito.mock(OAuthServerConfiguration.class);
    PowerMockito.when(ServiceReferenceHolder.getInstance()).thenReturn(serviceReferenceHolder);
    Mockito.when(serviceReferenceHolder.getAPIManagerConfigurationService()).thenReturn(apiManagerConfigurationService);
    Mockito.when(apiManagerConfigurationService.getAPIManagerConfiguration()).thenReturn(apiManagerConfiguration);
    Mockito.when(oAuthServerConfiguration.getTimeStampSkewInSeconds()).thenReturn(300L);
    Mockito.when(serviceReferenceHolder.getOauthServerConfiguration()).thenReturn(oAuthServerConfiguration);
    JWTValidatorImpl jwtValidator = new JWTValidatorImpl();
    JWKSConfigurationDTO jwksConfigurationDTO = new JWKSConfigurationDTO();
    tokenIssuerDto.setJwksConfigurationDTO(jwksConfigurationDTO);
    jwksConfigurationDTO.setEnabled(false);
    jwtValidator.loadTokenIssuerConfiguration(tokenIssuerDto);
    try {
        JWTValidationInfo validatedInfo = jwtValidator.validateToken(signedJWTInfo);
        assertTrue(validatedInfo.isValid(), "JWT certificate bound access token validation failed even when the" + " configuration is not enabled.");
    } catch (APIManagementException e) {
        Assert.fail();
    }
    // test when certificate is found in the trust store but cnf thumbprint is not matching with the certificate
    MessageContext messageContext = Mockito.mock(Axis2MessageContext.class);
    org.apache.axis2.context.MessageContext axis2MsgCntxt = Mockito.mock(org.apache.axis2.context.MessageContext.class);
    X509Certificate x509Certificate = Mockito.mock(X509Certificate.class);
    java.security.cert.X509Certificate x509CertificateJava = Mockito.mock(java.security.cert.X509Certificate.class);
    PowerMockito.when(CertificateMgtUtils.convert(x509Certificate)).thenReturn(Optional.of(x509CertificateJava));
    X509Certificate[] sslCertObject = new X509Certificate[] { x509Certificate };
    Mockito.when(axis2MsgCntxt.getProperty(NhttpConstants.SSL_CLIENT_AUTH_CERT_X509)).thenReturn(sslCertObject);
    Map<String, String> headers = new HashMap<>();
    Mockito.when(axis2MsgCntxt.getProperty(org.apache.axis2.context.MessageContext.TRANSPORT_HEADERS)).thenReturn(headers);
    Mockito.when(((Axis2MessageContext) messageContext).getAxis2MessageContext()).thenReturn(axis2MsgCntxt);
    X509Certificate x509CertificateUnMatched = Mockito.mock(X509Certificate.class);
    java.security.cert.X509Certificate x509CertificateUnMatchedJava = Mockito.mock(java.security.cert.X509Certificate.class);
    PowerMockito.when(CertificateMgtUtils.convert(x509CertificateUnMatched)).thenReturn(Optional.of(x509CertificateUnMatchedJava));
    PowerMockito.when(X509CertUtils.computeSHA256Thumbprint(x509CertificateJava)).thenReturn(new Base64URL(CERT_HASH));
    PowerMockito.when(X509CertUtils.computeSHA256Thumbprint(x509CertificateUnMatchedJava)).thenReturn(new Base64URL(encodedCertificateUnmatched.toString()));
    signedJWTInfo.setX509ClientCertificate(x509CertificateUnMatched);
    // Mock the properties read from the deployment.toml
    Mockito.when(apiManagerConfiguration.getFirstProperty(APIConstants.ENABLE_CERTIFICATE_BOUND_ACCESS_TOKEN)).thenReturn("true");
    try {
        JWTValidationInfo validatedInfo = jwtValidator.validateToken(signedJWTInfo);
        assertFalse(validatedInfo.isValid(), "JWT certificate bound access token validation successful even if the certificate thumbprint" + " is incorrect.");
    } catch (APIManagementException e) {
        Assert.fail();
    }
    // validate with correct certificate thumbprint
    signedJWTInfo.setX509ClientCertificate(x509Certificate);
    try {
        JWTValidationInfo validatedInfo = jwtValidator.validateToken(signedJWTInfo);
        assertTrue(validatedInfo.isValid(), "JWT certificate bound access token validation failed with the correct certificate thumbprint.");
    } catch (APIManagementException e) {
        Assert.fail();
    }
    // Test when certificate bound access token validation is enabled and cnf thumbprint validation is successful
    // when client certificate is added in the trust store
    signedJWTInfo.setX509ClientCertificate(null);
    headers.put(BASE64_ENCODED_CLIENT_CERTIFICATE_HEADER, BASE64_ENCODED_CERT);
}

Example 17 with JWTValidator

use of org.wso2.carbon.apimgt.gateway.handlers.security.jwt.JWTValidator in project carbon-apimgt by wso2.

the class OAuthJwtAuthenticatorImpl method validateJWTToken.

/**
 * Validate the JWT token.
 *
 * @param jti           jwtTokenIdentifier
 * @param signedJWTInfo signed jwt info object
 * @return JWTValidationInfo : token validated info
 */
@MethodStats
private JWTValidationInfo validateJWTToken(SignedJWTInfo signedJWTInfo, String jti, String accessToken, String maskedToken, URL basePath) throws APIManagementException {
    JWTValidationInfo jwtValidationInfo;
    String issuer = signedJWTInfo.getJwtClaimsSet().getIssuer();
    if (StringUtils.isNotEmpty(issuer)) {
        // validate Issuer
        List<String> tokenAudiences = signedJWTInfo.getJwtClaimsSet().getAudience();
        if (tokenIssuers != null && tokenIssuers.containsKey(issuer)) {
            // validate audience
            if (audiencesMap != null && audiencesMap.get(basePath.getPath()) != null && tokenAudiences.stream().anyMatch(audiencesMap.get(basePath.getPath())::contains)) {
                if (isRESTApiTokenCacheEnabled) {
                    JWTValidationInfo tempJWTValidationInfo = (JWTValidationInfo) getRESTAPITokenCache().get(jti);
                    if (tempJWTValidationInfo != null) {
                        Boolean isExpired = checkTokenExpiration(new Date(tempJWTValidationInfo.getExpiryTime()));
                        if (isExpired) {
                            tempJWTValidationInfo.setValid(false);
                            getRESTAPITokenCache().remove(jti);
                            getRESTAPIInvalidTokenCache().put(jti, tempJWTValidationInfo);
                            log.error("JWT token validation failed. Reason: Expired Token. " + maskedToken);
                            return tempJWTValidationInfo;
                        }
                        // check accessToken
                        if (!tempJWTValidationInfo.getRawPayload().equals(accessToken)) {
                            tempJWTValidationInfo.setValid(false);
                            getRESTAPITokenCache().remove(jti);
                            getRESTAPIInvalidTokenCache().put(jti, tempJWTValidationInfo);
                            log.error("JWT token validation failed. Reason: Invalid Token. " + maskedToken);
                            return tempJWTValidationInfo;
                        }
                        return tempJWTValidationInfo;
                    } else if (getRESTAPIInvalidTokenCache().get(jti) != null) {
                        if (log.isDebugEnabled()) {
                            log.debug("Token retrieved from the invalid token cache. Token: " + maskedToken);
                        }
                        return (JWTValidationInfo) getRESTAPIInvalidTokenCache().get(jti);
                    }
                }
                // info not in cache. validate signature and exp
                JWTValidator jwtValidator = APIMConfigUtil.getJWTValidatorMap().get(issuer);
                jwtValidationInfo = jwtValidator.validateToken(signedJWTInfo);
                if (jwtValidationInfo.isValid()) {
                    // valid token
                    if (isRESTApiTokenCacheEnabled) {
                        getRESTAPITokenCache().put(jti, jwtValidationInfo);
                    }
                } else {
                    // put in invalid cache
                    if (isRESTApiTokenCacheEnabled) {
                        getRESTAPIInvalidTokenCache().put(jti, jwtValidationInfo);
                    }
                    // invalid credentials : 900901 error code
                    log.error("JWT token validation failed. Reason: Invalid Credentials. " + "Make sure you have provided the correct security credentials in the token :" + maskedToken);
                }
            } else {
                if (audiencesMap == null) {
                    log.error("JWT token audience validation failed. Reason: No audiences registered " + "in the server");
                } else if (audiencesMap.get(basePath.getPath()) == null) {
                    log.error("JWT token audience validation failed. Reason: No audiences registered " + "in the server for the base path (" + basePath.getPath() + ")");
                } else {
                    log.error("JWT token audience validation failed. Reason: None of the aud present " + "in the JWT (" + tokenAudiences.toString() + ") matches the intended audience (" + audiencesMap.get(basePath.getPath()).toString() + ") for base path ( " + basePath.getPath() + " ).");
                }
                return null;
            }
        } else {
            // invalid issuer. invalid token
            log.error("JWT token issuer validation failed. Reason: Issuer present in the JWT (" + issuer + ") does not match with the token issuer (" + tokenIssuers.keySet().toString() + ")");
            return null;
        }
    } else {
        log.error("Issuer is not found in the token " + maskedToken);
        return null;
    }
    return jwtValidationInfo;
}

Example 18 with JWTValidator

use of org.wso2.carbon.apimgt.gateway.handlers.security.jwt.JWTValidator in project carbon-apimgt by wso2.

the class KeyManagerHolder method getJWTValidator.

private static JWTValidator getJWTValidator(KeyManagerConfiguration keyManagerConfiguration, String jwtValidatorImplementation) throws APIManagementException {
    Object selfValidateJWT = keyManagerConfiguration.getParameter(APIConstants.KeyManager.SELF_VALIDATE_JWT);
    if (selfValidateJWT != null && (Boolean) selfValidateJWT) {
        Object issuer = keyManagerConfiguration.getParameter(APIConstants.KeyManager.ISSUER);
        if (issuer != null) {
            TokenIssuerDto tokenIssuerDto = new TokenIssuerDto((String) issuer);
            Object claimMappings = keyManagerConfiguration.getParameter(APIConstants.KeyManager.CLAIM_MAPPING);
            if (claimMappings instanceof List) {
                Gson gson = new Gson();
                JsonElement jsonElement = gson.toJsonTree(claimMappings);
                ClaimMappingDto[] claimMappingDto = gson.fromJson(jsonElement, ClaimMappingDto[].class);
                tokenIssuerDto.addClaimMappings(claimMappingDto);
            }
            Object consumerKeyClaim = keyManagerConfiguration.getParameter(APIConstants.KeyManager.CONSUMER_KEY_CLAIM);
            if (consumerKeyClaim instanceof String && StringUtils.isNotEmpty((String) consumerKeyClaim)) {
                tokenIssuerDto.setConsumerKeyClaim((String) consumerKeyClaim);
            }
            Object scopeClaim = keyManagerConfiguration.getParameter(APIConstants.KeyManager.SCOPES_CLAIM);
            if (scopeClaim instanceof String && StringUtils.isNotEmpty((String) scopeClaim)) {
                tokenIssuerDto.setScopesClaim((String) scopeClaim);
            }
            Object jwksEndpoint = keyManagerConfiguration.getParameter(APIConstants.KeyManager.JWKS_ENDPOINT);
            if (jwksEndpoint != null) {
                if (StringUtils.isNotEmpty((String) jwksEndpoint)) {
                    JWKSConfigurationDTO jwksConfigurationDTO = new JWKSConfigurationDTO();
                    jwksConfigurationDTO.setEnabled(true);
                    jwksConfigurationDTO.setUrl((String) jwksEndpoint);
                    tokenIssuerDto.setJwksConfigurationDTO(jwksConfigurationDTO);
                }
            }
            Object certificateType = keyManagerConfiguration.getParameter(APIConstants.KeyManager.CERTIFICATE_TYPE);
            Object certificateValue = keyManagerConfiguration.getParameter(APIConstants.KeyManager.CERTIFICATE_VALUE);
            if (certificateType != null && StringUtils.isNotEmpty((String) certificateType) && certificateValue != null && StringUtils.isNotEmpty((String) certificateValue)) {
                if (APIConstants.KeyManager.CERTIFICATE_TYPE_JWKS_ENDPOINT.equals(certificateType)) {
                    JWKSConfigurationDTO jwksConfigurationDTO = new JWKSConfigurationDTO();
                    jwksConfigurationDTO.setEnabled(true);
                    jwksConfigurationDTO.setUrl((String) certificateValue);
                    tokenIssuerDto.setJwksConfigurationDTO(jwksConfigurationDTO);
                } else {
                    X509Certificate x509Certificate = APIUtil.retrieveCertificateFromContent((String) certificateValue);
                    if (x509Certificate != null) {
                        tokenIssuerDto.setCertificate(x509Certificate);
                    }
                }
            }
            JWTValidator jwtValidator;
            if (StringUtils.isEmpty(jwtValidatorImplementation)) {
                jwtValidator = new JWTValidatorImpl();
            } else {
                try {
                    jwtValidator = (JWTValidator) Class.forName(jwtValidatorImplementation).newInstance();
                } catch (InstantiationException | IllegalAccessException | ClassNotFoundException e) {
                    log.error("Error while initializing JWT Validator", e);
                    throw new APIManagementException("Error while initializing JWT Validator", e);
                }
            }
            jwtValidator.loadTokenIssuerConfiguration(tokenIssuerDto);
            return jwtValidator;
        }
    }
    return null;
}

Example 19 with JWTValidator

use of org.wso2.carbon.apimgt.gateway.handlers.security.jwt.JWTValidator in project carbon-apimgt by wso2.

the class KeyManagerHolder method addGlobalJWTValidators.

public static void addGlobalJWTValidators(TokenIssuerDto tokenIssuerDto) {
    KeyManagerDto keyManagerDto = new KeyManagerDto();
    keyManagerDto.setIssuer(tokenIssuerDto.getIssuer());
    keyManagerDto.setName(APIConstants.KeyManager.DEFAULT_KEY_MANAGER);
    JWTValidator jwtValidator = new JWTValidatorImpl();
    jwtValidator.loadTokenIssuerConfiguration(tokenIssuerDto);
    keyManagerDto.setJwtValidator(jwtValidator);
    globalJWTValidatorMap.put(tokenIssuerDto.getIssuer(), keyManagerDto);
}

Example 20 with JWTValidator

use of org.wso2.carbon.apimgt.gateway.handlers.security.jwt.JWTValidator in project carbon-apimgt by wso2.

the class KeyManagerHolder method addKeyManagerConfiguration.

public static void addKeyManagerConfiguration(String organization, String name, String type, KeyManagerConfiguration keyManagerConfiguration) throws APIManagementException {
    String issuer = (String) keyManagerConfiguration.getParameter(APIConstants.KeyManager.ISSUER);
    OrganizationKeyManagerDto organizationKeyManagerDto = organizationWiseMap.get(organization);
    if (organizationKeyManagerDto == null) {
        organizationKeyManagerDto = new OrganizationKeyManagerDto();
    }
    if (organizationKeyManagerDto.getKeyManagerByName(name) != null) {
        log.warn("Key Manager " + name + " already initialized in tenant " + organization);
    }
    if (keyManagerConfiguration.isEnabled() && !KeyManagerConfiguration.TokenType.EXCHANGED.equals(keyManagerConfiguration.getTokenType())) {
        KeyManager keyManager = null;
        JWTValidator jwtValidator = null;
        APIManagerConfiguration apiManagerConfiguration = ServiceReferenceHolder.getInstance().getAPIManagerConfigurationService().getAPIManagerConfiguration();
        String defaultKeyManagerType = apiManagerConfiguration.getFirstProperty(APIConstants.DEFAULT_KEY_MANAGER_TYPE);
        KeyManagerConnectorConfiguration keyManagerConnectorConfiguration = ServiceReferenceHolder.getInstance().getKeyManagerConnectorConfiguration(type);
        if (keyManagerConnectorConfiguration != null) {
            if (StringUtils.isNotEmpty(keyManagerConnectorConfiguration.getImplementation())) {
                try {
                    keyManager = (KeyManager) Class.forName(keyManagerConnectorConfiguration.getImplementation()).newInstance();
                    keyManager.setTenantDomain(organization);
                    if (StringUtils.isNotEmpty(defaultKeyManagerType) && defaultKeyManagerType.equals(type)) {
                        keyManagerConfiguration.addParameter(APIConstants.KEY_MANAGER_USERNAME, apiManagerConfiguration.getFirstProperty(APIConstants.API_KEY_VALIDATOR_USERNAME));
                        keyManagerConfiguration.addParameter(APIConstants.KEY_MANAGER_PASSWORD, apiManagerConfiguration.getFirstProperty(APIConstants.API_KEY_VALIDATOR_PASSWORD));
                    }
                    keyManager.loadConfiguration(keyManagerConfiguration);
                } catch (ClassNotFoundException | IllegalAccessException | InstantiationException e) {
                    throw new APIManagementException("Error while loading keyManager configuration", e);
                }
            }
            jwtValidator = getJWTValidator(keyManagerConfiguration, keyManagerConnectorConfiguration.getJWTValidator());
        } else {
            if (APIConstants.KeyManager.DEFAULT_KEY_MANAGER_TYPE.equals(type)) {
                keyManager = new AMDefaultKeyManagerImpl();
                keyManager.setTenantDomain(organization);
                keyManager.loadConfiguration(keyManagerConfiguration);
                jwtValidator = getJWTValidator(keyManagerConfiguration, null);
            }
        }
        KeyManagerDto keyManagerDto = new KeyManagerDto();
        keyManagerDto.setName(name);
        keyManagerDto.setIssuer(issuer);
        keyManagerDto.setJwtValidator(jwtValidator);
        keyManagerDto.setKeyManager(keyManager);
        organizationKeyManagerDto.putKeyManagerDto(keyManagerDto);
        organizationWiseMap.put(organization, organizationKeyManagerDto);
    }
}