OAuth2AuthenticationFilter implements ContainerRequestFilter { @Override public void filter(final ContainerRequestContext request) throws IOException { SecurityContext oldContext = request.getSecurityContext(); if (oldContext == null) { throw new OAuth2NotAuthorizedException( request.getUriInfo(), scopesAllowed); } String header = request.getHeaderString(HttpHeaders.AUTHORIZATION); BigInteger tokenId = getTokenIdFromHeader(header); Application a = loadAdminApplication(); Session session = sessionProvider.get(); session.getTransaction().begin(); Criteria c = session.createCriteria(OAuthToken.class) .createAlias("client", "c") .createAlias("c.application", "a") .add(Restrictions.eq("id", tokenId)) .add(Restrictions.eq("a.id", a.getId())) .add(Restrictions.eq("tokenType", OAuthTokenType.Bearer)) .setMaxResults(1) .setResultTransformer(Criteria.DISTINCT_ROOT_ENTITY); OAuthToken token = (OAuthToken) c.uniqueResult(); if (token == null || token.isExpired()) { session.getTransaction().commit(); throw new OAuth2NotAuthorizedException( request.getUriInfo(), scopesAllowed); } SecurityContext context = new OAuth2SecurityContext(token, true); request.setSecurityContext(context); session.getTransaction().commit(); } OAuth2AuthenticationFilter(final Provider<Session> sessionProvider,
                                      final Provider<Configuration>
                                              configProvider,
                                      final String[] scopesAllowed); @Override void filter(final ContainerRequestContext request);  }
@Test public void assertValidToken() throws Exception { OAuthToken token = context.getBuilder() .bearerToken("one") .build() .getToken(); OAuth2AuthenticationFilter filter = new OAuth2AuthenticationFilter( sessionProvider, configProvider, new String[]{"one"}); String header = HttpUtil.authHeaderBearer(token.getId()); doReturn(header).when(requestContext) .getHeaderString(HttpHeaders.AUTHORIZATION); filter.filter(requestContext); ArgumentCaptor<OAuth2SecurityContext> contextCaptor = ArgumentCaptor.forClass(OAuth2SecurityContext.class); verify(requestContext, times(1)) .setSecurityContext(contextCaptor.capture()); assertEquals(token, contextCaptor.getValue().getUserPrincipal()); }
@Test(expected = OAuth2NotAuthorizedException.class) public void assertNoContext() throws Exception { doReturn(null).when(requestContext).getSecurityContext(); OAuth2AuthenticationFilter filter = new OAuth2AuthenticationFilter( sessionProvider, configProvider, new String[]{"one"}); filter.filter(requestContext); }
@Test(expected = OAuth2NotAuthorizedException.class) public void assertEmptyToken() throws Exception { OAuth2AuthenticationFilter filter = new OAuth2AuthenticationFilter( sessionProvider, configProvider, new String[]{"one"}); String header = HttpUtil.authHeaderBearer(""); doReturn(header).when(requestContext) .getHeaderString(HttpHeaders.AUTHORIZATION); filter.filter(requestContext); }
@Test(expected = OAuth2NotAuthorizedException.class) public void assertInvalidToken() throws Exception { OAuth2AuthenticationFilter filter = new OAuth2AuthenticationFilter( sessionProvider, configProvider, new String[]{"one"}); String header = HttpUtil.authHeaderBearer(IdUtil.next()); doReturn(header).when(requestContext) .getHeaderString(HttpHeaders.AUTHORIZATION); filter.filter(requestContext); }
@Test(expected = OAuth2NotAuthorizedException.class) public void assertExpiredToken() throws Exception { OAuthToken token = context.getBuilder() .token(OAuthTokenType.Bearer, true, "one", null, null) .build() .getToken(); OAuth2AuthenticationFilter filter = new OAuth2AuthenticationFilter( sessionProvider, configProvider, new String[]{"one"}); String header = HttpUtil.authHeaderBearer(token.getId()); doReturn(header).when(requestContext) .getHeaderString(HttpHeaders.AUTHORIZATION); filter.filter(requestContext); }
@Test(expected = OAuth2NotAuthorizedException.class) public void assertEmptyHeader() throws Exception { OAuth2AuthenticationFilter filter = new OAuth2AuthenticationFilter( sessionProvider, configProvider, new String[]{"one"}); doReturn("").when(requestContext) .getHeaderString(HttpHeaders.AUTHORIZATION); filter.filter(requestContext); }
@Test(expected = OAuth2NotAuthorizedException.class) public void assertBadlyFormattedHeader() throws Exception { OAuth2AuthenticationFilter filter = new OAuth2AuthenticationFilter( sessionProvider, configProvider, new String[]{"one"}); doReturn("invalid_format").when(requestContext) .getHeaderString(HttpHeaders.AUTHORIZATION); filter.filter(requestContext); }
@Test(expected = OAuth2NotAuthorizedException.class) public void assertNoBearerHeader() throws Exception { OAuth2AuthenticationFilter filter = new OAuth2AuthenticationFilter( sessionProvider, configProvider, new String[]{"one"}); doReturn("HMAC Token").when(requestContext) .getHeaderString(HttpHeaders.AUTHORIZATION); filter.filter(requestContext); }
@Test(expected = OAuth2NotAuthorizedException.class) public void assertBadlyFormedToken() throws Exception { OAuth2AuthenticationFilter filter = new OAuth2AuthenticationFilter( sessionProvider, configProvider, new String[]{"one"}); doReturn("Bearer not_a_BigInteger").when(requestContext) .getHeaderString(HttpHeaders.AUTHORIZATION); filter.filter(requestContext); }