|
| 1 | +/* |
| 2 | + * Copyright (c) 2016-2018 Contributors to the Eclipse Foundation |
| 3 | + * |
| 4 | + * See the NOTICE file(s) distributed with this work for additional |
| 5 | + * information regarding copyright ownership. |
| 6 | + * |
| 7 | + * Licensed under the Apache License, Version 2.0 (the "License"); |
| 8 | + * You may not use this file except in compliance with the License. |
| 9 | + * You may obtain a copy of the License at |
| 10 | + * |
| 11 | + * http://www.apache.org/licenses/LICENSE-2.0 |
| 12 | + * |
| 13 | + * Unless required by applicable law or agreed to in writing, software |
| 14 | + * distributed under the License is distributed on an "AS IS" BASIS, |
| 15 | + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
| 16 | + * See the License for the specific language governing permissions and |
| 17 | + * limitations under the License. |
| 18 | + * |
| 19 | + */ |
| 20 | +package org.eclipse.microprofile.jwt.tck.config; |
| 21 | + |
| 22 | +import java.io.StringReader; |
| 23 | +import java.io.StringWriter; |
| 24 | +import java.net.HttpURLConnection; |
| 25 | +import java.net.URL; |
| 26 | +import java.security.PrivateKey; |
| 27 | +import java.util.HashMap; |
| 28 | +import java.util.Properties; |
| 29 | + |
| 30 | +import javax.json.Json; |
| 31 | +import javax.json.JsonObject; |
| 32 | +import javax.json.JsonReader; |
| 33 | +import javax.ws.rs.client.ClientBuilder; |
| 34 | +import javax.ws.rs.client.WebTarget; |
| 35 | +import javax.ws.rs.core.HttpHeaders; |
| 36 | +import javax.ws.rs.core.Response; |
| 37 | + |
| 38 | +import org.eclipse.microprofile.jwt.config.Names; |
| 39 | +import org.eclipse.microprofile.jwt.tck.container.jaxrs.TCKApplication; |
| 40 | +import org.eclipse.microprofile.jwt.tck.util.TokenUtils; |
| 41 | +import org.jboss.arquillian.container.test.api.Deployment; |
| 42 | +import org.jboss.arquillian.container.test.api.RunAsClient; |
| 43 | +import org.jboss.arquillian.test.api.ArquillianResource; |
| 44 | +import org.jboss.arquillian.testng.Arquillian; |
| 45 | +import org.jboss.shrinkwrap.api.ShrinkWrap; |
| 46 | +import org.jboss.shrinkwrap.api.asset.StringAsset; |
| 47 | +import org.jboss.shrinkwrap.api.spec.WebArchive; |
| 48 | +import org.testng.Assert; |
| 49 | +import org.testng.Reporter; |
| 50 | +import org.testng.annotations.Test; |
| 51 | + |
| 52 | +import static javax.ws.rs.core.MediaType.APPLICATION_JSON; |
| 53 | +import static org.eclipse.microprofile.jwt.tck.TCKConstants.TEST_GROUP_CONFIG; |
| 54 | + |
| 55 | +/** |
| 56 | + * Validate the handling of the JWT iss claim. |
| 57 | + * |
| 58 | + * Validate that if there is a {@linkplain Names#REQUIRE_ISS} property set to false, validation of |
| 59 | + * the iss claim is not performed, and {@linkplain Names#ISSUER} property is ignored. |
| 60 | + */ |
| 61 | +public class IssNoValidationBadIssTest extends Arquillian { |
| 62 | + /** |
| 63 | + * The base URL for the container under test |
| 64 | + */ |
| 65 | + @ArquillianResource |
| 66 | + private URL baseURL; |
| 67 | + |
| 68 | + /** |
| 69 | + * The token used by the test |
| 70 | + */ |
| 71 | + private static String token; |
| 72 | + |
| 73 | + /** |
| 74 | + * Create a CDI aware base web application archive that includes an embedded PEM public key |
| 75 | + * that is included as the mp.jwt.verify.publickey property. |
| 76 | + * The root url is / |
| 77 | + * @return the base base web application archive |
| 78 | + * @throws Exception - on resource failure |
| 79 | + */ |
| 80 | + @Deployment() |
| 81 | + public static WebArchive createDeployment() throws Exception { |
| 82 | + URL publicKey = PublicKeyAsPEMTest.class.getResource("/publicKey4k.pem"); |
| 83 | + |
| 84 | + PrivateKey privateKey = TokenUtils.readPrivateKey("/privateKey4k.pem"); |
| 85 | + String kid = "publicKey4k"; |
| 86 | + HashMap<String, Long> timeClaims = new HashMap<>(); |
| 87 | + token = TokenUtils.generateTokenString(privateKey, kid, "/TokenBadIss.json", null, timeClaims); |
| 88 | + |
| 89 | + // Setup the microprofile-config.properties content |
| 90 | + Properties configProps = new Properties(); |
| 91 | + // Location points to the PEM bundled in the deployment |
| 92 | + configProps.setProperty(Names.VERIFIER_PUBLIC_KEY_LOCATION, "/publicKey4k.pem"); |
| 93 | + // Don't require validation of iss claim |
| 94 | + configProps.setProperty(Names.REQUIRE_ISS, "false"); |
| 95 | + // The issuer config value should be ignored |
| 96 | + configProps.setProperty(Names.ISSUER, "https://ignore-me"); |
| 97 | + StringWriter configSW = new StringWriter(); |
| 98 | + configProps.store(configSW, "IssNoValidationBadIssTest microprofile-config.properties"); |
| 99 | + StringAsset configAsset = new StringAsset(configSW.toString()); |
| 100 | + |
| 101 | + WebArchive webArchive = ShrinkWrap |
| 102 | + .create(WebArchive.class, "IssNoValidationBadIssTest.war") |
| 103 | + .addAsResource(publicKey, "/publicKey.pem") |
| 104 | + .addAsResource(publicKey, "/publicKey4k.pem") |
| 105 | + // Include the token for inspection by ApplicationArchiveProcessor |
| 106 | + .add(new StringAsset(token), "MP-JWT") |
| 107 | + .addClass(PublicKeyEndpoint.class) |
| 108 | + .addClass(TCKApplication.class) |
| 109 | + .addClass(SimpleTokenUtils.class) |
| 110 | + .addAsWebInfResource("beans.xml", "beans.xml") |
| 111 | + .addAsManifestResource(configAsset, "microprofile-config.properties") |
| 112 | + ; |
| 113 | + System.out.printf("WebArchive: %s\n", webArchive.toString(true)); |
| 114 | + return webArchive; |
| 115 | + } |
| 116 | + |
| 117 | + @RunAsClient |
| 118 | + @Test(groups = TEST_GROUP_CONFIG, |
| 119 | + description = "Validate that JWK with iss and mp.jwt.verify.requireiss=false returns HTTP_OK") |
| 120 | + public void testNotRequiredIssIgnored() throws Exception { |
| 121 | + Reporter.log("testNotRequiredIssIgnored, expect HTTP_OK"); |
| 122 | + |
| 123 | + String uri = baseURL.toExternalForm() + "endp/verifyBadIssIsOk"; |
| 124 | + WebTarget echoEndpointTarget = ClientBuilder.newClient() |
| 125 | + .target(uri) |
| 126 | + ; |
| 127 | + Response response = echoEndpointTarget.request(APPLICATION_JSON).header(HttpHeaders.AUTHORIZATION, "Bearer "+token).get(); |
| 128 | + Assert.assertEquals(response.getStatus(), HttpURLConnection.HTTP_OK); |
| 129 | + String replyString = response.readEntity(String.class); |
| 130 | + JsonReader jsonReader = Json.createReader(new StringReader(replyString)); |
| 131 | + JsonObject reply = jsonReader.readObject(); |
| 132 | + Reporter.log(reply.toString()); |
| 133 | + Assert.assertTrue(reply.getBoolean("pass"), reply.getString("msg")); |
| 134 | + } |
| 135 | + |
| 136 | +} |
0 commit comments