io.vertx.ext.auth.authentication.TokenCredentials Java Examples

@Test
public void testExpiration() {
  JsonObject payload = new JsonObject()
    .put("sub", "Paulo");

  final String token = authProvider.generateToken(payload,
    new JWTOptions().setExpiresInSeconds(1).setNoTimestamp(true));

  assertNotNull(token);

  vertx.setTimer(2000L, t -> {
    TokenCredentials authInfo = new TokenCredentials(token);
    authProvider.authenticate(authInfo, onFailure(thr -> {
      assertNotNull(thr);
      testComplete();
    }));
  });

  await();
}
 

@Test
public void testGenerateNewTokenWithMacSecret() {
  authProvider = JWTAuth.create(vertx, new JWTAuthOptions()
    .addJwk(new JsonObject()
      .put("kty", "oct")
      .put("k", "notasecret"))
  );

  String token = authProvider.generateToken(new JsonObject(), new JWTOptions().setAlgorithm("HS256"));
  assertNotNull(token);

  // reverse
  TokenCredentials authInfo = new TokenCredentials(token);
  authProvider.authenticate(authInfo, onSuccess(res -> {
    assertNotNull(res);
    testComplete();
  }));
  await();
}
 

@Test
public void testGenerateNewTokenES256() {
  authProvider = JWTAuth.create(vertx, new JWTAuthOptions()
    .setKeyStore(new KeyStoreOptions()
      .setPath("es256-keystore.jceks")
      .setType("jceks")
      .setPassword("secret")));

  String token = authProvider.generateToken(new JsonObject().put("sub", "paulo"), new JWTOptions().setAlgorithm("ES256"));
  assertNotNull(token);

  TokenCredentials authInfo = new TokenCredentials(token);

  authProvider.authenticate(authInfo, res -> {
    if (res.failed()) {
      res.cause().printStackTrace();
      fail();
    }

    assertNotNull(res.result());
    testComplete();
  });
  await();
}
 

@Test
public void testBadScopesFormat() {
  //JWT is not valid because the authProvider is expecting an array of scope while the JWT has a string scope.
  authProvider = JWTAuth.create(vertx, getConfig().setJWTOptions(
    new JWTOptions()
      .addScope("a")
      .addScope("b")));

  JsonObject payload = new JsonObject()
    .put("sub", "Paulo");

  final String token = authProvider.generateToken(payload,
    new JWTOptions().addScope("a").addScope("b").addScope("c").withScopeDelimiter(","));

  assertNotNull(token);

  TokenCredentials authInfo = new TokenCredentials(token);

  authProvider.authenticate(authInfo, onFailure(thr -> {
    assertNotNull(thr);
    testComplete();
  }));
  await();
}
 

@Test
public void testBadScopes() {
  //JWT is not valid because the required scopes "d" is not included in the access_token.
  authProvider = JWTAuth.create(vertx, getConfig().setJWTOptions(
    new JWTOptions()
      .addScope("b")
      .addScope("d")));

  JsonObject payload = new JsonObject()
    .put("sub", "Paulo");

  final String token = authProvider.generateToken(payload,
    new JWTOptions().addScope("a").addScope("b").addScope("c"));

  assertNotNull(token);

  TokenCredentials authInfo = new TokenCredentials(token);

  authProvider.authenticate(authInfo, onFailure(thr -> {
    assertNotNull(thr);
    testComplete();
  }));
  await();
}
 

@Test
public void testGoodScopesWithDefaultDelimiter() {
  //JWT is valid because required scopes "a" & "b" are well included in the access_token.
  authProvider = JWTAuth.create(vertx, getConfig().setJWTOptions(
    new JWTOptions()
      .addScope("a")
      .addScope("b")));

  JsonObject payload = new JsonObject()
    .put("sub", "Paulo");

  final String token = authProvider.generateToken(payload,
    new JWTOptions().addScope("a").addScope("b").addScope("c").withScopeDelimiter(" "));

  assertNotNull(token);

  TokenCredentials authInfo = new TokenCredentials(token);

  authProvider.authenticate(authInfo, onSuccess(res -> {
    assertNotNull(res);
    testComplete();
  }));
  await();
}
 

@Test
public void testGoodScopesWithDelimiter() {
  //JWT is valid because required scopes "a" & "b" are well included in the access_token.
  authProvider = JWTAuth.create(vertx, getConfig().setJWTOptions(
    new JWTOptions()
      .addScope("a")
      .addScope("b")
      .withScopeDelimiter(",")));

  JsonObject payload = new JsonObject()
    .put("sub", "Paulo");

  final String token = authProvider.generateToken(payload,
    new JWTOptions().addScope("a").addScope("b").addScope("c").withScopeDelimiter(","));

  assertNotNull(token);

  TokenCredentials authInfo = new TokenCredentials(token);

  authProvider.authenticate(authInfo, onSuccess(res -> {
    assertNotNull(res);
    testComplete();
  }));
  await();
}
 

@Test
public void testGoodScopes() {
  //JWT is valid because required scopes "a" & "b" are well included in the access_token.
  authProvider = JWTAuth.create(vertx, getConfig().setJWTOptions(
    new JWTOptions()
      .addScope("a")
      .addScope("b")));

  JsonObject payload = new JsonObject()
    .put("sub", "Paulo");

  final String token = authProvider.generateToken(payload,
    new JWTOptions().addScope("a").addScope("b").addScope("c"));

  assertNotNull(token);

  TokenCredentials authInfo = new TokenCredentials(token);

  authProvider.authenticate(authInfo, onSuccess(res -> {
    assertNotNull(res);
    testComplete();
  }));
  await();
}
 

@Test
public void testBadAudience() {

  authProvider = JWTAuth.create(vertx, getConfig().setJWTOptions(
    new JWTOptions()
      .addAudience("e")
      .addAudience("d")));

  JsonObject payload = new JsonObject()
    .put("sub", "Paulo");

  final String token = authProvider.generateToken(payload,
    new JWTOptions().addAudience("a").addAudience("b").addAudience("c"));

  assertNotNull(token);

  TokenCredentials authInfo = new TokenCredentials(token);

  authProvider.authenticate(authInfo, onFailure(thr -> {
    assertNotNull(thr);
    testComplete();
  }));
  await();
}
 

@Test
public void testGoodAudience() {

  authProvider = JWTAuth.create(vertx, getConfig().setJWTOptions(
    new JWTOptions()
      .addAudience("b")
      .addAudience("d")));

  JsonObject payload = new JsonObject()
    .put("sub", "Paulo");

  final String token = authProvider.generateToken(payload,
    new JWTOptions().addAudience("a").addAudience("b").addAudience("c"));

  assertNotNull(token);

  TokenCredentials authInfo = new TokenCredentials(token);

  authProvider.authenticate(authInfo, onSuccess(res -> {
    assertNotNull(res);
    testComplete();
  }));
  await();
}
 

@Test
public void testBadIssuer() {

  authProvider = JWTAuth.create(vertx, getConfig().setJWTOptions(new JWTOptions().setIssuer("https://vertx.io")));

  JsonObject payload = new JsonObject().put("sub", "Paulo");

  final String token = authProvider.generateToken(payload, new JWTOptions().setIssuer("https://auth0.io"));
  assertNotNull(token);

  TokenCredentials authInfo = new TokenCredentials(token);

  authProvider.authenticate(authInfo, onFailure(thr -> {
    assertNotNull(thr);
    testComplete();
  }));
  await();
}
 

@Test
public void testGoodIssuer() {
  JsonObject payload = new JsonObject()
    .put("sub", "Paulo");

  final String token = authProvider.generateToken(payload, new JWTOptions().setIssuer("https://vertx.io"));
  assertNotNull(token);

  TokenCredentials authInfo = new TokenCredentials(token);

  authProvider.authenticate(authInfo, onSuccess(res -> {
    assertNotNull(res);
    testComplete();
  }));
  await();
}
 

@Test
public void testTokenWithTimestamp() {
  JsonObject payload = new JsonObject()
    .put("sub", "Paulo");

  final String token = authProvider.generateToken(payload, new JWTOptions());
  assertNotNull(token);

  TokenCredentials authInfo = new TokenCredentials(token);
  authProvider.authenticate(authInfo, onSuccess(res -> {
    assertNotNull(res);
    assertTrue(res.principal().containsKey("iat"));
    testComplete();
  }));
  await();
}
 

@Test
public void testTokenWithoutTimestamp() {
  JsonObject payload = new JsonObject()
    .put("sub", "Paulo");

  final String token = authProvider.generateToken(payload,
    new JWTOptions().setExpiresInMinutes(5).setNoTimestamp(true));

  assertNotNull(token);

  TokenCredentials authInfo = new TokenCredentials(token);

  authProvider.authenticate(authInfo, onSuccess(res -> {
    assertNotNull(res);
    assertTrue(res.principal().containsKey("exp"));
    assertFalse(res.principal().containsKey("iat"));
    testComplete();
  }));

  await();
}
 

@Test
public void testGenerateNewTokenForceAlgorithm() {
  authProvider = JWTAuth.create(vertx, new JWTAuthOptions()
    .setKeyStore(new KeyStoreOptions()
      .setPath("keystore.jceks")
      .setType("jceks")
      .setPassword("secret")));

  String token = authProvider.generateToken(new JsonObject(), new JWTOptions().setAlgorithm("RS256"));
  assertNotNull(token);

  // reverse
  TokenCredentials authInfo = new TokenCredentials(token);
  authProvider.authenticate(authInfo, onSuccess(res -> {
    assertNotNull(res);
    testComplete();
  }));
  await();
}
 

@Test
public void testAlgNone() {

  JWTAuth authProvider = JWTAuth.create(vertx, new JWTAuthOptions());

  JsonObject payload = new JsonObject()
    .put("sub", "UserUnderTest")
    .put("aud", "OrganizationUnderTest")
    .put("iat", 1431695313)
    .put("exp", 1747055313)
    .put("roles", new JsonArray().add("admin").add("developer").add("user"))
    .put("permissions", new JsonArray().add("read").add("write").add("execute"));

  final String token = authProvider.generateToken(payload, new JWTOptions().setSubject("UserUnderTest").setAlgorithm("none"));
  assertNotNull(token);

  TokenCredentials authInfo = new TokenCredentials(token);

  authProvider.authenticate(authInfo, onSuccess(res -> {
    assertNotNull(res);
    testComplete();
  }));
  await();
}
 

@Test
public void testLeeway() {
  authProvider = JWTAuth.create(vertx, getConfig().setJWTOptions(new JWTOptions().setLeeway(0)));

  long now = System.currentTimeMillis() / 1000;

  JsonObject payload = new JsonObject()
    .put("sub", "Paulo")
    .put("exp", now);

  String token = authProvider.generateToken(payload);
  assertNotNull(token);

  TokenCredentials authInfo = new TokenCredentials(token);
  // fail because exp is <= to now
  authProvider.authenticate(authInfo, onFailure(t -> testComplete()));
  await();
}
 

@Test
public void testLeeway2() {
  authProvider = JWTAuth.create(vertx, getConfig().setJWTOptions(new JWTOptions().setLeeway(0)));

  long now = (System.currentTimeMillis() / 1000) + 2;

  JsonObject payload = new JsonObject()
    .put("sub", "Paulo")
    .put("iat", now);

  String token = authProvider.generateToken(payload);
  assertNotNull(token);

  TokenCredentials authInfo = new TokenCredentials(token);
  // fail because iat is > now (clock drifted 2 sec)
  authProvider.authenticate(authInfo, onFailure(t -> testComplete()));
  await();
}
 

@Test
public void testLeeway3() {
  authProvider = JWTAuth.create(vertx, getConfig().setJWTOptions(new JWTOptions().setLeeway(5)));

  long now = System.currentTimeMillis() / 1000;

  JsonObject payload = new JsonObject()
    .put("sub", "Paulo")
    .put("exp", now)
    .put("iat", now);

  String token = authProvider.generateToken(payload);
  assertNotNull(token);

  TokenCredentials authInfo = new TokenCredentials(token);
  // fail because exp is <= to now
  authProvider.authenticate(authInfo, onSuccess(t -> testComplete()));
  await();
}
 

@Test
public void testLeeway4() {
  authProvider = JWTAuth.create(vertx, getConfig().setJWTOptions(new JWTOptions().setLeeway(5)));

  long now = (System.currentTimeMillis() / 1000) + 2;

  JsonObject payload = new JsonObject()
    .put("sub", "Paulo")
    .put("iat", now);

  String token = authProvider.generateToken(payload);
  assertNotNull(token);

  TokenCredentials authInfo = new TokenCredentials(token);
  // pass because iat is > now (clock drifted 2 sec) and we have a leeway of 5sec
  authProvider.authenticate(authInfo, onSuccess(t -> testComplete()));
  await();
}
 

@Test
public void testValidateTokenWithIgnoreExpired() throws InterruptedException {
  authProvider = JWTAuth.create(vertx, new JWTAuthOptions()
    .addJwk(new JsonObject()
      .put("kty", "oct")
      .put("k", "AyM1SysPpbyDfgZld3umj1qzKObwVMkoqQ-EstJQLr_T-1qS0gZH75aKtMN3Yj0iPS4hcgUuTwjAzZr1Z9CAow"))
    .setJWTOptions(new JWTOptions()
      .setIgnoreExpiration(true)));

  String token = authProvider
    .generateToken(
      new JsonObject(),
      new JWTOptions()
        .setExpiresInSeconds(1)
        .setSubject("subject")
        .setAlgorithm("HS256"));

  // force a sleep to invalidate the token
  Thread.sleep(1001);

  TokenCredentials authInfo = new TokenCredentials(token);

  authProvider.authenticate(authInfo, onSuccess(res -> {
    assertNotNull(res);
    testComplete();
  }));
  await();
}
 

@Test
public void testValidateTokenWithValidMacSecret() {
  String token = "eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJpYXQiOjE1MDE3ODUyMDZ9.08K_rROcCmKTF1cKfPCli2GQFYIOP8dePxeS1SE4dc8";
  authProvider = JWTAuth.create(vertx, new JWTAuthOptions()
    .addJwk(new JsonObject()
      .put("kty", "oct")
      .put("k", "notasecret"))
  );
  TokenCredentials authInfo = new TokenCredentials(token);
  authProvider.authenticate(authInfo, onSuccess(res -> {
    assertNotNull(res);
    testComplete();
  }));
  await();
}
 

@Test
public void testAcceptInvalidJWT() {
  String[] segments = JWT_INVALID.split("\\.");
  // All segment should be base64
  String headerSeg = segments[0];

  // change alg to none
  JsonObject headerJson = new JsonObject(new String(Base64.getUrlDecoder().decode(headerSeg.getBytes(StandardCharsets.UTF_8)), StandardCharsets.UTF_8));
  headerJson.put("alg", "none");
  headerSeg = Base64.getUrlEncoder().encodeToString(headerJson.encode().getBytes(StandardCharsets.UTF_8));

  // fix time exp
  String payloadSeg = segments[1];
  JsonObject bodyJson = new JsonObject(new String(Base64.getUrlDecoder().decode(payloadSeg.getBytes(StandardCharsets.UTF_8)), StandardCharsets.UTF_8));
  bodyJson.put("exp", System.currentTimeMillis() + 10000);
  payloadSeg = Base64.getUrlEncoder().encodeToString(headerJson.encode().getBytes(StandardCharsets.UTF_8));

  String signatureSeg = segments[2];

  // build attack token
  String attackerJWT = headerSeg + "." + payloadSeg + "." + signatureSeg;
  TokenCredentials authInfo = new TokenCredentials(attackerJWT);
  authProvider.authenticate(authInfo, onFailure(thr -> {
    assertNotNull(thr);
    testComplete();
  }));
  await();
}
 

@Override
public void parseCredentials(RoutingContext context, Handler<AsyncResult<Credentials>> handler) {

  parseAuthorization(context, false, parseAuthorization -> {
    if (parseAuthorization.failed()) {
      handler.handle(Future.failedFuture(parseAuthorization.cause()));
      return;
    }

    handler.handle(Future.succeededFuture(new TokenCredentials(parseAuthorization.result())));
  });
}
 

@Test
public void testValidateTokenWithInvalidMacSecret() {
  String token = "eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJpYXQiOjE1MDE3ODUyMDZ9.08K_rROcCmKTF1cKfPCli2GQFYIOP8dePxeS1SE4dc8";
  authProvider = JWTAuth.create(vertx, new JWTAuthOptions()
    .addJwk(new JsonObject()
      .put("kty", "oct")
      .put("k", "a bad secret"))
  );
  TokenCredentials authInfo = new TokenCredentials(token);
  authProvider.authenticate(authInfo, onFailure(res -> {
    assertNotNull(res);
    testComplete();
  }));
  await();
}
 

@Test
public void testJWTInvalidPermission() {
  TokenCredentials authInfo = new TokenCredentials(JWT_VALID);
  authProvider.authenticate(authInfo, onSuccess(user -> {
    assertNotNull(user);
    JWTAuthorization.create("permissions").getAuthorizations(user, res -> {
      assertTrue(res.succeeded());
      assertFalse(PermissionBasedAuthorization.create("drop").match(user));
      testComplete();
    });
  }));
  await();
}
 

@Test
public void testJWTValidPermission() {
  TokenCredentials authInfo = new TokenCredentials(JWT_VALID);
  authProvider.authenticate(authInfo, onSuccess(user -> {
    assertNotNull(user);
    JWTAuthorization.create("permissions").getAuthorizations(user, res -> {
      assertTrue(res.succeeded());
      assertTrue(PermissionBasedAuthorization.create("write").match(user));
      testComplete();
    });
  }));
  await();
}
 

@Test
public void testInvalidJWT() {
  TokenCredentials authInfo = new TokenCredentials(JWT_INVALID);
  authProvider.authenticate(authInfo, onFailure(thr -> {
    assertNotNull(thr);
    testComplete();
  }));
  await();
}
 

@Test
public void testValidJWT() {
  TokenCredentials authInfo = new TokenCredentials(JWT_VALID);
  authProvider.authenticate(authInfo, onSuccess(res -> {
    assertNotNull(res);
    testComplete();
  }));
  await();
}
 

@Override
public void authenticate(JsonObject authInfo, Handler<AsyncResult<User>> handler) {
  if (authInfo.containsKey("access_token")) {
    authenticate(new TokenCredentials(authInfo.getString("access_token")), handler);
    return;
  }
  if (authInfo.containsKey("username") && authInfo.containsKey("password")) {
    authenticate(new UsernamePasswordCredentials(authInfo.getString("username"), authInfo.getString("password")), handler);
    return;
  }
  authenticate(new Oauth2Credentials(authInfo), handler);
}