IntrospectEndpoint { @RequestMapping(value = "/introspect", method = POST) @ResponseBody public IntrospectionClaims introspect(@RequestParam("token") String token) { IntrospectionClaims introspectionClaims = new IntrospectionClaims(); try { OAuth2AccessToken oAuth2AccessToken = resourceServerTokenServices.readAccessToken(token); if (oAuth2AccessToken.isExpired()) { introspectionClaims.setActive(false); return introspectionClaims; } resourceServerTokenServices.loadAuthentication(token); introspectionClaims = getClaimsForToken(oAuth2AccessToken.getValue()); introspectionClaims.setActive(true); } catch (InvalidTokenException e) { introspectionClaims.setActive(false); return introspectionClaims; } return introspectionClaims; } IntrospectEndpoint(
            final @Qualifier("tokenServices") ResourceServerTokenServices resourceServerTokenServices); @RequestMapping(value = "/introspect", method = POST) @ResponseBody IntrospectionClaims introspect(@RequestParam("token") String token); @RequestMapping(value = "/introspect") @ResponseBody IntrospectionClaims methodNotSupported(HttpServletRequest request);  }
@Test void validToken() { OAuth2AccessToken token = mock(OAuth2AccessToken.class); when(resourceServerTokenServices.readAccessToken(validToken)).thenReturn(token); when(token.isExpired()).thenReturn(false); when(token.getValue()).thenReturn(validToken); IntrospectionClaims claims = introspectEndpoint.introspect(validToken); assertTrue(claims.isActive()); verify(resourceServerTokenServices).readAccessToken(validToken); verify(resourceServerTokenServices).loadAuthentication(validToken); verify(token).isExpired(); }
@Test void expiredTokenIsInactive() { OAuth2AccessToken token = mock(OAuth2AccessToken.class); when(resourceServerTokenServices.readAccessToken(validToken)).thenReturn(token); when(token.isExpired()).thenReturn(true); IntrospectionClaims claims = introspectEndpoint.introspect(validToken); assertFalse(claims.isActive()); }
@Test void invalidToken_inReadAccessToken() { when(resourceServerTokenServices.readAccessToken(validToken)).thenThrow(new InvalidTokenException("Bla")); IntrospectionClaims claims = introspectEndpoint.introspect(validToken); assertFalse(claims.isActive()); }
@Test void invalidToken_inLoadAuthentication() { OAuth2AccessToken token = mock(OAuth2AccessToken.class); when(resourceServerTokenServices.readAccessToken(validToken)).thenReturn(token); when(resourceServerTokenServices.loadAuthentication(validToken)).thenThrow(new InvalidTokenException("Bla")); IntrospectionClaims claims = introspectEndpoint.introspect(validToken); assertFalse(claims.isActive()); }
@Test void claimsForValidToken() { OAuth2AccessToken token = mock(OAuth2AccessToken.class); when(resourceServerTokenServices.readAccessToken(validToken)).thenReturn(token); when(token.isExpired()).thenReturn(false); when(token.getValue()).thenReturn(validToken); IntrospectionClaims claimsResult = introspectEndpoint.introspect(validToken); assertTrue(claimsResult.isActive()); assertEquals("UAA username", claimsResult.getName()); }
@Test void invalidJSONInClaims() { String invalidToken = "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.e3RoaXMgaXMgbm90IHZhbGlkIEpTT059.LFFpQ0Gc28vd1YIF4OlgVSi2PjCXtImDC6HlJn75sbQ"; OAuth2AccessToken token = mock(OAuth2AccessToken.class); when(resourceServerTokenServices.readAccessToken(invalidToken)).thenReturn(token); when(token.isExpired()).thenReturn(false); when(token.getValue()).thenReturn(invalidToken); IntrospectionClaims claimsResult = introspectEndpoint.introspect(invalidToken); assertFalse(claimsResult.isActive()); assertNull(claimsResult.getName()); }