io.smallrye.jwt.auth.principal.JWTAuthContextInfo Java Examples

@BeforeClass(alwaysRun = true)
public static void generateToken() throws Exception {
    HashMap<String, Long> timeClaims = new HashMap<>();
    token = TokenUtils.generateTokenString("/Token1.json", null, timeClaims);
    iatClaim = timeClaims.get(Claims.iat.name());
    authTimeClaim = timeClaims.get(Claims.auth_time.name());
    expClaim = timeClaims.get(Claims.exp.name());

    System.out.printf("TokenValidationTest.initClass\n");
    publicKey = TokenUtils.readPublicKey("/publicKey.pem");
    if (publicKey == null) {
        throw new IllegalStateException("Failed to load /publicKey.pem resource");
    }

    JWTAuthContextInfo contextInfo = new JWTAuthContextInfo((RSAPublicKey) publicKey, TEST_ISSUER);
    JWTCallerPrincipalFactory factory = JWTCallerPrincipalFactory.instance();
    jwt = factory.parse(token, contextInfo);
}
 

@Test
public void testAuthenticator() throws Exception {
    KeyPair keyPair = generateKeyPair();
    PublicKey pk1 = keyPair.getPublic();
    PrivateKey pk1Priv = keyPair.getPrivate();
    JWTAuthContextInfo contextInfo = new JWTAuthContextInfo((RSAPublicKey) pk1, "https://server.example.com");
    MpJwtValidator jwtValidator = new MpJwtValidator(new DefaultJWTParser(contextInfo));
    QuarkusIdentityProviderManagerImpl authenticator = QuarkusIdentityProviderManagerImpl.builder()
            .addProvider(new AnonymousIdentityProvider())
            .setBlockingExecutor(new Executor() {
                @Override
                public void execute(Runnable command) {
                    command.run();
                }
            })
            .addProvider(jwtValidator).build();

    String jwt = TokenUtils.generateTokenString("/Token1.json", pk1Priv, "testTokenRealm");
    TokenAuthenticationRequest tokenEvidence = new TokenAuthenticationRequest(new TokenCredential(jwt, "bearer"));
    SecurityIdentity securityIdentity = authenticator.authenticate(tokenEvidence).await().indefinitely();
    Assertions.assertNotNull(securityIdentity);
    Assertions.assertEquals("[email protected]", securityIdentity.getPrincipal().getName());
}
 

@Deprecated
public static void setWhitelistAlgorithms(JWTAuthContextInfo contextInfo, Optional<String> whitelistAlgorithms) {
    if (whitelistAlgorithms.isPresent()) {
        final List<String> algorithms = Arrays.stream(whitelistAlgorithms.get().split(","))
                .map(String::trim)
                .collect(Collectors.toList());

        for (String whitelistAlgorithm : algorithms) {
            if (SUPPORTED_ALGORITHMS.contains(whitelistAlgorithm)) {
                contextInfo.getWhitelistAlgorithms().add(whitelistAlgorithm);
            } else {
                JWTLogging.log.unsupportedAlgorithm(whitelistAlgorithm);
            }
        }
    }
}
 

@Test(groups = TEST_GROUP_JWT, description = "no sub validation")
public void noSubValidation() throws Exception {
    HashMap<String, Long> timeClaims = new HashMap<>();
    String token = TokenUtils.generateTokenString("/TokenSubPath.json", null, timeClaims);
    PublicKey publicKey = TokenUtils.readPublicKey("/publicKey.pem");
    if (publicKey == null) {
        throw new IllegalStateException("Failed to load /publicKey.pem resource");
    }

    JWTAuthContextInfo contextInfo = new JWTAuthContextInfo((RSAPublicKey) publicKey, TEST_ISSUER);
    contextInfo.setRequireNamedPrincipal(false);
    JWTCallerPrincipalFactory factory = JWTCallerPrincipalFactory.instance();
    JsonWebToken jwt = factory.parse(token, contextInfo);
    String sub = jwt.getSubject();
    Assert.assertNull(sub);
}
 

@Test
public void testValidation() throws Exception {
    String token = TokenUtils.generateTokenString("/Token1.json");
    RSAPublicKey publicKey = (RSAPublicKey) TokenUtils.readPublicKey("/publicKey.pem");
    JWTAuthContextInfo contextInfo = new JWTAuthContextInfo(publicKey, "https://server.example.com");
    contextInfo.setExpGracePeriodSecs(60);
    JsonWebToken jwt = validateToken(token, contextInfo);
}
 

@Test(groups = TEST_GROUP_JWT, description = "validate the name comes from the upn claim")
public void validateNameIsPreferredName() throws Exception {
    String token2 = TokenUtils.generateTokenString("/usePreferredName.json");
    JWTAuthContextInfo contextInfo = new JWTAuthContextInfo((RSAPublicKey) publicKey, TEST_ISSUER);
    JWTCallerPrincipalFactory factory = JWTCallerPrincipalFactory.instance();
    JsonWebToken jwt2 = factory.parse(token2, contextInfo);
    Assert.assertEquals("jdoe", jwt2.getName());
}
 

@Test(expectedExceptions = { ParseException.class }, description = "Illustrate validation of issuer")
public void testFailIssuer() throws Exception {
    HashSet<TokenUtils.InvalidClaims> invalidFields = new HashSet<>();
    invalidFields.add(TokenUtils.InvalidClaims.ISSUER);
    String token = TokenUtils.generateTokenString("/Token1.json", invalidFields);
    RSAPublicKey publicKey = (RSAPublicKey) TokenUtils.readPublicKey("/publicKey.pem");
    JWTAuthContextInfo contextInfo = new JWTAuthContextInfo(publicKey, "https://server.example.com");
    contextInfo.setExpGracePeriodSecs(60);
    JsonWebToken jwt = validateToken(token, contextInfo);
}
 

@Test(expectedExceptions = { ParseException.class }, description = "Illustrate validation of signer")
public void testNimbusFailSignature() throws Exception {
    HashSet<TokenUtils.InvalidClaims> invalidFields = new HashSet<>();
    invalidFields.add(TokenUtils.InvalidClaims.SIGNER);
    String token = TokenUtils.generateTokenString("/Token1.json", invalidFields);
    RSAPublicKey publicKey = (RSAPublicKey) TokenUtils.readPublicKey("/publicKey.pem");
    JWTAuthContextInfo contextInfo = new JWTAuthContextInfo(publicKey, "https://server.example.com");
    contextInfo.setExpGracePeriodSecs(60);
    JsonWebToken jwt = validateToken(token, contextInfo);
}
 

@Test(expectedExceptions = { ParseException.class }, description = "Illustrate validation of exp")
public void testNimbusFailExpired() throws Exception {
    HashMap<String, Long> timeClaims = new HashMap<>();
    HashSet<TokenUtils.InvalidClaims> invalidFields = new HashSet<>();
    invalidFields.add(TokenUtils.InvalidClaims.EXP);
    String token = TokenUtils.generateTokenString("/Token1.json", invalidFields, timeClaims);
    RSAPublicKey publicKey = (RSAPublicKey) TokenUtils.readPublicKey("/publicKey.pem");
    JWTAuthContextInfo contextInfo = new JWTAuthContextInfo(publicKey, "https://server.example.com");
    contextInfo.setExpGracePeriodSecs(60);
    JsonWebToken jwt = validateToken(token, contextInfo);
}
 

@Test(expectedExceptions = { ParseException.class }, description = "Illustrate validation of exp that has just expired")
public void testNimbusFailJustExpired() throws Exception {
    HashMap<String, Long> timeClaims = new HashMap<>();
    // Set exp to 61 seconds in past
    long exp = TokenUtils.currentTimeInSecs() - 61;
    timeClaims.put(Claims.exp.name(), exp);
    String token = TokenUtils.generateTokenString("/Token1.json", null, timeClaims);
    RSAPublicKey publicKey = (RSAPublicKey) TokenUtils.readPublicKey("/publicKey.pem");
    JWTAuthContextInfo contextInfo = new JWTAuthContextInfo(publicKey, "https://server.example.com");
    contextInfo.setExpGracePeriodSecs(60);
    JsonWebToken jwt = validateToken(token, contextInfo);
}
 

@Test(description = "Illustrate validation of exp that is in grace period")
public void testNimbusExpGrace() throws Exception {
    HashMap<String, Long> timeClaims = new HashMap<>();
    // Set exp to 45 seconds in past
    long exp = TokenUtils.currentTimeInSecs() - 45;
    timeClaims.put(Claims.exp.name(), exp);
    String token = TokenUtils.generateTokenString("/Token1.json", null, timeClaims);
    RSAPublicKey publicKey = (RSAPublicKey) TokenUtils.readPublicKey("/publicKey.pem");
    JWTAuthContextInfo contextInfo = new JWTAuthContextInfo(publicKey, "https://server.example.com");
    contextInfo.setExpGracePeriodSecs(60);
    JsonWebToken jwt = validateToken(token, contextInfo);
}
 

@Test(groups = TEST_GROUP_JWT, description = "validate the groups claim is not available")
public void groupsClaimIsNotAvailable() throws Exception {

    JWTAuthContextInfo contextInfo = new JWTAuthContextInfo((RSAPublicKey) publicKey, TEST_ISSUER);
    JWTCallerPrincipalFactory factory = JWTCallerPrincipalFactory.instance();
    JsonWebToken jwt = factory.parse(token, contextInfo);
    Assert.assertTrue(jwt.getGroups().isEmpty());
}
 

@Test(groups = TEST_GROUP_JWT, description = "validate sub")
public void defaultSubAvailable() throws Exception {
    HashMap<String, Long> timeClaims = new HashMap<>();
    String token = TokenUtils.generateTokenString("/Token1.json", null, timeClaims);
    PublicKey publicKey = TokenUtils.readPublicKey("/publicKey.pem");
    if (publicKey == null) {
        throw new IllegalStateException("Failed to load /publicKey.pem resource");
    }

    JWTAuthContextInfo contextInfo = new JWTAuthContextInfo((RSAPublicKey) publicKey, TEST_ISSUER);
    JWTCallerPrincipalFactory factory = JWTCallerPrincipalFactory.instance();
    JsonWebToken jwt = factory.parse(token, contextInfo);
    String sub = jwt.getSubject();
    Assert.assertEquals(sub, "24400320");
}
 

@Test(groups = TEST_GROUP_JWT, description = "validate sub fail", expectedExceptions = ParseException.class)
public void defaultSubNotAvailable() throws Exception {
    HashMap<String, Long> timeClaims = new HashMap<>();
    String token = TokenUtils.generateTokenString("/TokenSubPath.json", null, timeClaims);
    PublicKey publicKey = TokenUtils.readPublicKey("/publicKey.pem");
    if (publicKey == null) {
        throw new IllegalStateException("Failed to load /publicKey.pem resource");
    }

    JWTAuthContextInfo contextInfo = new JWTAuthContextInfo((RSAPublicKey) publicKey, TEST_ISSUER);
    JWTCallerPrincipalFactory factory = JWTCallerPrincipalFactory.instance();
    factory.parse(token, contextInfo);
}
 

@Test(groups = TEST_GROUP_JWT, description = "validate the token with default algorithm")
public void tokenDefaultAlgorithm() throws Exception {
    JWTAuthContextInfo contextInfo = new JWTAuthContextInfo((RSAPublicKey) publicKey, TEST_ISSUER);
    JWTCallerPrincipalFactory factory = JWTCallerPrincipalFactory.instance();
    JsonWebToken jwt = factory.parse(token, contextInfo);
    String sub = jwt.getSubject();
    Assert.assertEquals(sub, "24400320");
}
 

@Test(groups = TEST_GROUP_JWT, description = "ignore no valid algorithm")
public void ignoreNoValidAlgorithm() throws Exception {
    JWTAuthContextInfo contextInfo = new JWTAuthContextInfo((RSAPublicKey) publicKey, TEST_ISSUER);
    SmallryeJwtUtils.setWhitelistAlgorithms(contextInfo, Optional.of((HMAC_SHA256)));
    JWTCallerPrincipalFactory factory = JWTCallerPrincipalFactory.instance();
    JsonWebToken jwt = factory.parse(token, contextInfo);
    String sub = jwt.getSubject();
    Assert.assertEquals(sub, "24400320");
}
 

@Test(groups = TEST_GROUP_JWT, description = "invalid algorithm configuration")
public void invalidAlgorithmConfiguration() throws Exception {
    JWTAuthContextInfo contextInfo = new JWTAuthContextInfo((RSAPublicKey) publicKey, TEST_ISSUER);
    SmallryeJwtUtils.setWhitelistAlgorithms(contextInfo, Optional.of("abcqwe"));
    JWTCallerPrincipalFactory factory = JWTCallerPrincipalFactory.instance();
    JsonWebToken jwt = factory.parse(token, contextInfo);
    String sub = jwt.getSubject();
    Assert.assertEquals(sub, "24400320");
}
 

public JWTHttpAuthenticationMechanism(JWTAuthContextInfo authContextInfo,
        JWTParser jwtParser,
        PrincipalProducer producer) {
    this.authContextInfo = authContextInfo;
    this.jwtParser = jwtParser;
    this.producer = producer;
}
 

@Produces
Optional<JWTAuthContextInfo> getOptionalContextInfo() {
    // Log the config values
    ConfigLogging.log.configValues(mpJwtPublicKey.orElse("missing"), mpJwtIssuer, mpJwtLocation.orElse("missing"));
    JWTAuthContextInfo contextInfo = new JWTAuthContextInfo();

    if (mpJwtIssuer != null && !mpJwtIssuer.equals(NONE)) {
        contextInfo.setIssuedBy(mpJwtIssuer.trim());
    } else {
        // If there is no expected issuer configured, don't validate it; new in MP-JWT 1.1
        contextInfo.setRequireIssuer(false);
    }

    // Default is to require iss claim
    contextInfo.setRequireIssuer(mpJwtRequireIss.orElse(true));

    if (mpJwtPublicKey.isPresent() && !NONE.equals(mpJwtPublicKey.get())) {
        contextInfo.setPublicKeyContent(mpJwtPublicKey.get());
    } else if (mpJwtLocation.isPresent() && !NONE.equals(mpJwtLocation.get())) {
        String mpJwtLocationTrimmed = mpJwtLocation.get().trim();
        if (mpJwtLocationTrimmed.startsWith("http")) {
            contextInfo.setPublicKeyLocation(mpJwtLocationTrimmed);
        } else {
            try {
                contextInfo.setPublicKeyContent(ResourceUtils.readResource(mpJwtLocationTrimmed));
                if (contextInfo.getPublicKeyContent() == null) {
                    throw ConfigMessages.msg.invalidPublicKeyLocation();
                }
            } catch (IOException ex) {
                throw ConfigMessages.msg.readingPublicKeyLocationFailed(ex);
            }
        }
    }
    if (tokenHeader != null) {
        contextInfo.setTokenHeader(tokenHeader);
    }

    contextInfo.setAlwaysCheckAuthorization(alwaysCheckAuthorization);

    contextInfo.setTokenKeyId(tokenKeyId.orElse(null));
    contextInfo.setRequireNamedPrincipal(requireNamedPrincipal.orElse(null));
    SmallryeJwtUtils.setContextTokenCookie(contextInfo, tokenCookie);
    SmallryeJwtUtils.setTokenSchemes(contextInfo, tokenSchemes);
    contextInfo.setDefaultSubjectClaim(defaultSubClaim.orElse(null));
    SmallryeJwtUtils.setContextSubPath(contextInfo, subPath);
    contextInfo.setDefaultGroupsClaim(defaultGroupsClaim.orElse(null));
    SmallryeJwtUtils.setContextGroupsPath(contextInfo, groupsPath);
    contextInfo.setExpGracePeriodSecs(expGracePeriodSecs.orElse(null));
    contextInfo.setMaxTimeToLiveSecs(maxTimeToLiveSecs.orElse(null));
    contextInfo.setJwksRefreshInterval(jwksRefreshInterval.orElse(null));
    contextInfo.setForcedJwksRefreshInterval(forcedJwksRefreshInterval);
    if (signatureAlgorithm.orElse(null) == SignatureAlgorithm.HS256) {
        throw ConfigMessages.msg.hs256NotSupported();
    }
    contextInfo.setSignatureAlgorithm(signatureAlgorithm.orElse(SignatureAlgorithm.RS256));
    contextInfo.setKeyFormat(keyFormat);
    contextInfo.setExpectedAudience(expectedAudience.orElse(null));
    contextInfo.setGroupsSeparator(groupsSeparator);
    contextInfo.setRequiredClaims(requiredClaims.orElse(null));
    contextInfo.setRelaxVerificationKeyValidation(relaxVerificationKeyValidation);

    return Optional.of(contextInfo);
}
 

public static void setContextTokenCookie(JWTAuthContextInfo contextInfo, Optional<String> cookieName) {
    if (cookieName.isPresent()) {
        if (!COOKIE_HEADER.equals(contextInfo.getTokenHeader())) {
            JWTLogging.log.tokenHeaderIsNotCookieHeader();
        } else {
            contextInfo.setTokenCookie(cookieName.get());
        }
    }
}
 

public static void setTokenSchemes(JWTAuthContextInfo contextInfo, Optional<String> tokenSchemes) {
    if (tokenSchemes.isPresent()) {
        final List<String> schemes = new ArrayList<>();
        for (final String s : tokenSchemes.get().split(",")) {
            schemes.add(s.trim());
        }
        contextInfo.setTokenSchemes(schemes);
    }
}
 

@Override
public JWTCallerPrincipal parse(final String token, final JWTAuthContextInfo authContextInfo) throws ParseException {
    try {
        JWSInput jwsInput = new JWSInput(token);
        AccessToken accessToken = AdapterTokenVerifier.verifyToken(jwsInput.getWireString(), deployment);
        return new KeycloakJWTCallerPrincipal(jwsInput.readContentAsString(), accessToken);
    } catch (Throwable ex) {
        throw new ParseException("Failure to parse the token", ex);
    }
}
 

@Test
public void missingRequiredClaims() throws Exception {
    String token = TokenUtils.generateTokenString("/Token1.json");
    PublicKey publicKey = TokenUtils.readPublicKey("/publicKey.pem");
    JWTAuthContextInfo contextInfo = new JWTAuthContextInfo((RSAPublicKey) publicKey, TEST_ISSUER);
    contextInfo.setRequiredClaims(Stream.of("something", "else").collect(toSet()));
    JWTCallerPrincipalFactory factory = JWTCallerPrincipalFactory.instance();

    final ParseException exception = assertThrows(ParseException.class, () -> factory.parse(token, contextInfo));
    assertTrue(exception.getCause() instanceof InvalidJwtException);
}
 

@Test(groups = TEST_GROUP_JWT, description = "validate the custom sub claim is available on the path")
public void subClaimIsAvailableOnPath() throws Exception {
    JWTAuthContextInfo contextInfo = new JWTAuthContextInfo((RSAPublicKey) publicKey, TEST_ISSUER);
    contextInfo.setSubjectPath("realm/access/sub/principal");
    JWTCallerPrincipalFactory factory = JWTCallerPrincipalFactory.instance();
    JsonWebToken jwt = factory.parse(token, contextInfo);
    String sub = jwt.getSubject();
    Assert.assertEquals(sub, "microprofile_jwt_principal");
}
 

@Test(groups = TEST_GROUP_JWT, description = "validate the custom sub claim is available on the path with namespace")
public void subClaimIsAvailableOnPathWithNamespace() throws Exception {
    JWTAuthContextInfo contextInfo = new JWTAuthContextInfo((RSAPublicKey) publicKey, TEST_ISSUER);
    contextInfo.setSubjectPath("realm/\"https://idp/access\"/sub/principal");
    JWTCallerPrincipalFactory factory = JWTCallerPrincipalFactory.instance();
    JsonWebToken jwt = factory.parse(token, contextInfo);
    String sub = jwt.getSubject();
    Assert.assertEquals(sub, "namespace_microprofile_jwt_principal");
}
 

@Test(groups = TEST_GROUP_JWT, description = "validate the custom sub claim is not available on the long path")
public void subClaimIsNotAvailableOnTooDeepPath() throws Exception {
    JWTAuthContextInfo contextInfo = new JWTAuthContextInfo((RSAPublicKey) publicKey, TEST_ISSUER);
    contextInfo.setRequireNamedPrincipal(false);
    contextInfo.setSubjectPath("realm/access/sub/principal/5");
    JWTCallerPrincipalFactory factory = JWTCallerPrincipalFactory.instance();
    JsonWebToken jwt = factory.parse(token, contextInfo);
    Assert.assertNull(jwt.getSubject());
}
 

@Test(groups = TEST_GROUP_JWT, description = "validate the custom sub claim is not available if the claim is not array")
public void subClaimIsNotAvailableIfClaimIsNotString() throws Exception {
    JWTAuthContextInfo contextInfo = new JWTAuthContextInfo((RSAPublicKey) publicKey, TEST_ISSUER);
    contextInfo.setRequireNamedPrincipal(false);
    contextInfo.setSubjectPath("realm/access/sub");
    JWTCallerPrincipalFactory factory = JWTCallerPrincipalFactory.instance();
    JsonWebToken jwt = factory.parse(token, contextInfo);
    Assert.assertNull(jwt.getSubject());
}
 

@Test(groups = TEST_GROUP_JWT, description = "validate the name comes from the sub claim")
public void validateNameIsSubject() throws Exception {
    String token2 = TokenUtils.generateTokenString("/useSubject.json");
    JWTAuthContextInfo contextInfo = new JWTAuthContextInfo((RSAPublicKey) publicKey, TEST_ISSUER);
    JWTCallerPrincipalFactory factory = JWTCallerPrincipalFactory.instance();
    JsonWebToken jwt2 = factory.parse(token2, contextInfo);
    Assert.assertEquals("24400320", jwt2.getName());
}
 

@Test(groups = TEST_GROUP_JWT, description = "validate the custom sub claim is not available on the wrong path")
public void subClaimIsNotAvailableOnWrongPath() throws Exception {
    JWTAuthContextInfo contextInfo = new JWTAuthContextInfo((RSAPublicKey) publicKey, TEST_ISSUER);
    contextInfo.setRequireNamedPrincipal(false);
    contextInfo.setSubjectPath("realm/access/user/principal");
    JWTCallerPrincipalFactory factory = JWTCallerPrincipalFactory.instance();
    JsonWebToken jwt = factory.parse(token, contextInfo);
    Assert.assertNull(jwt.getSubject());
}
 

@Test
public void base() throws Exception {
    String token = TokenUtils.generateTokenString("/Token1.json");
    PublicKey publicKey = TokenUtils.readPublicKey("/publicKey.pem");
    JWTAuthContextInfo contextInfo = new JWTAuthContextInfo((RSAPublicKey) publicKey, TEST_ISSUER);
    JWTCallerPrincipalFactory factory = JWTCallerPrincipalFactory.instance();
    factory.parse(token, contextInfo);
}