DecryptionKeyLocationResolver extends AbstractKeyLocationResolver implements DecryptionKeyResolver { @Override public Key resolveKey(JsonWebEncryption jwe, List<JsonWebStructure> nestingContext) throws UnresolvableKeyException { verifyKid(jwe, authContextInfo.getTokenDecryptionKeyId()); if (key != null) { return key; } Key theKey = tryAsDecryptionJwk(jwe); if (theKey == null) { reportUnresolvableKeyException(authContextInfo.getDecryptionKeyContent(), authContextInfo.getDecryptionKeyLocation()); } return theKey; } DecryptionKeyLocationResolver(JWTAuthContextInfo authContextInfo); @Override Key resolveKey(JsonWebEncryption jwe, List<JsonWebStructure> nestingContext);  }
@Test public void testLoadPemKeyWithWrongLocation() throws Exception { expectedEx.expect(UnresolvableKeyException.class); JWTAuthContextInfo contextInfo = new JWTAuthContextInfo(); contextInfo.setDecryptionKeyLocation("wrong_location.pem"); new DecryptionKeyLocationResolver(contextInfo).resolveKey(encryption, emptyList()); }
@Test public void testLoadRsaKeyFromHttpsJwks() throws Exception { JWTAuthContextInfo contextInfo = new JWTAuthContextInfo(); contextInfo.setDecryptionKeyLocation("https: contextInfo.setJwksRefreshInterval(10); DecryptionKeyLocationResolver keyLocationResolver = new DecryptionKeyLocationResolver(contextInfo) { protected HttpsJwks initializeHttpsJwks(String loc) { return mockedHttpsJwks; } }; RsaJsonWebKey jwk = RsaJwkGenerator.generateJwk(2048); jwk.setKeyId("1"); when(mockedHttpsJwks.getJsonWebKeys()).thenReturn(Collections.singletonList(jwk)); keyLocationResolver = Mockito.spy(keyLocationResolver); when(encryption.getHeaders()).thenReturn(headers); when(headers.getStringHeaderValue(JsonWebKey.KEY_ID_PARAMETER)).thenReturn("1"); assertEquals(jwk.getPrivateKey(), keyLocationResolver.resolveKey(encryption, emptyList())); assertNull(keyLocationResolver.key); }
@Test public void testLoadSecretKeyFromHttpsJwks() throws Exception { JWTAuthContextInfo contextInfo = new JWTAuthContextInfo(); contextInfo.setDecryptionKeyLocation("https: contextInfo.setJwksRefreshInterval(10); DecryptionKeyLocationResolver keyLocationResolver = new DecryptionKeyLocationResolver(contextInfo) { protected HttpsJwks initializeHttpsJwks(String loc) { return mockedHttpsJwks; } }; SecretKey secretKey = new SecretKeySpec("123456789ABCDEF".getBytes(StandardCharsets.UTF_8), "AES"); OctetSequenceJsonWebKey jwk = new OctetSequenceJsonWebKey(secretKey); jwk.setKeyId("1"); when(mockedHttpsJwks.getJsonWebKeys()).thenReturn(Collections.singletonList(jwk)); keyLocationResolver = Mockito.spy(keyLocationResolver); when(encryption.getHeaders()).thenReturn(headers); when(headers.getStringHeaderValue(JsonWebKey.KEY_ID_PARAMETER)).thenReturn("1"); assertEquals(secretKey, keyLocationResolver.resolveKey(encryption, emptyList())); assertNull(keyLocationResolver.key); }
@Test public void testLoadHttpsJwksNonMathchingKidAndRefresh() throws Exception { JWTAuthContextInfo contextInfo = new JWTAuthContextInfo(); contextInfo.setDecryptionKeyLocation("https: contextInfo.setJwksRefreshInterval(10); DecryptionKeyLocationResolver keyLocationResolver = new DecryptionKeyLocationResolver(contextInfo) { protected HttpsJwks initializeHttpsJwks(String loc) { return mockedHttpsJwks; } }; when(encryption.getHeaders()).thenReturn(headers); when(headers.getStringHeaderValue(JsonWebKey.KEY_ID_PARAMETER)).thenReturn("1"); RsaJsonWebKey jwk = RsaJwkGenerator.generateJwk(2048); jwk.setKeyId("2"); when(mockedHttpsJwks.getJsonWebKeys()).thenReturn(Collections.singletonList(jwk)); doAnswer((i) -> { jwk.setKeyId("1"); return null; }).when(mockedHttpsJwks).refresh(); keyLocationResolver = Mockito.spy(keyLocationResolver); assertEquals(jwk.getPrivateKey(), keyLocationResolver.resolveKey(encryption, emptyList())); assertNull(keyLocationResolver.key); }
@Test(expected = UnresolvableKeyException.class) public void testLoadHttpsJwksNonMathchingKidAndRefreshDeclined() throws Exception { JWTAuthContextInfo contextInfo = new JWTAuthContextInfo(); contextInfo.setDecryptionKeyLocation("https: contextInfo.setJwksRefreshInterval(10); contextInfo.setForcedJwksRefreshInterval(10); DecryptionKeyLocationResolver keyLocationResolver = new DecryptionKeyLocationResolver(contextInfo) { protected HttpsJwks initializeHttpsJwks(String loc) { return mockedHttpsJwks; } }; when(encryption.getHeaders()).thenReturn(headers); when(headers.getStringHeaderValue(JsonWebKey.KEY_ID_PARAMETER)).thenReturn("1"); RsaJsonWebKey jwk = RsaJwkGenerator.generateJwk(2048); jwk.setKeyId("2"); when(mockedHttpsJwks.getJsonWebKeys()).thenReturn(Collections.singletonList(jwk)); doAnswer((i) -> { jwk.setKeyId("1"); return null; }).when(mockedHttpsJwks).refresh(); keyLocationResolver = Mockito.spy(keyLocationResolver); assertEquals(jwk.getPrivateKey(), keyLocationResolver.resolveKey(encryption, emptyList())); assertNull(keyLocationResolver.key); jwk.setKeyId("2"); keyLocationResolver.resolveKey(encryption, emptyList()); }
@Test public void testLoadJWKOnClassPath() throws Exception { JWTAuthContextInfo contextInfo = new JWTAuthContextInfo(); contextInfo.setDecryptionKeyLocation("decryptPrivateKey.jwk"); contextInfo.setTokenDecryptionKeyId("key1"); when(encryption.getHeaders()).thenReturn(headers); when(headers.getStringHeaderValue(JsonWebKey.KEY_ID_PARAMETER)).thenReturn("key1"); DecryptionKeyLocationResolver keyLocationResolver = new DecryptionKeyLocationResolver(contextInfo); assertNotNull(keyLocationResolver.key); assertEquals(keyLocationResolver.key, keyLocationResolver.resolveKey(encryption, emptyList())); assertEquals(keyLocationResolver.key, ((PublicJsonWebKey) keyLocationResolver.getJsonWebKey("key1", null)).getPrivateKey()); }