GoogleOAuth2Authenticator implements Authenticator { @Override public User authenticate(HttpServletRequest request) throws ServiceUnavailableException { Attribute attr = Attribute.from(request); if (attr.isEnabled(Attribute.SKIP_TOKEN_AUTH)) { return null; } String token = GoogleAuth.getAuthToken(request); if (!GoogleAuth.isOAuth2Token(token)) { return null; } GoogleAuth.TokenInfo tokenInfo = getTokenInfoRemote(token); if (tokenInfo == null) { return null; } attr.set(Attribute.TOKEN_INFO, tokenInfo); ApiMethodConfig config = (ApiMethodConfig) request.getAttribute(Attribute.API_METHOD_CONFIG); if (Strings.isEmptyOrWhitespace(tokenInfo.scopes)) { logger.atWarning().log("Access token does not contain a valid scope"); return null; } String[] authorizedScopes = tokenInfo.scopes.split("\\s+"); if (!config.getScopeExpression().isAuthorized(ImmutableSet.copyOf(authorizedScopes))) { logger.atWarning().log( "Access token does not contain sufficient scopes from: %s", config.getScopeExpression()); return null; } if (attr.isEnabled(Attribute.ENABLE_CLIENT_ID_WHITELIST) && !GoogleAuth.checkClientId(tokenInfo.clientId, config.getClientIds(), true)) { logger.atWarning().log("ClientId is not allowed: %s", tokenInfo.clientId); return null; } User user = new User(tokenInfo.userId, tokenInfo.email); if (attr.isEnabled(Attribute.REQUIRE_APPENGINE_USER)) { com.google.appengine.api.users.User appEngineUser = new com.google.appengine.api.users.User(tokenInfo.email, ""); logger.atInfo().log("appEngineUser = %s", appEngineUser); request.setAttribute(Attribute.AUTHENTICATED_APPENGINE_USER, appEngineUser); } else { logger.atInfo().log("user = %s", user); } return user; }  @Override User authenticate(HttpServletRequest request);  }
@Test public void testAuthenticate_skipTokenAuth() throws ServiceUnavailableException { attr.set(Attribute.SKIP_TOKEN_AUTH, true); assertNull(authenticator.authenticate(request)); assertNull(attr.get(Attribute.TOKEN_INFO)); }
@Test public void testAuthenticate_notOAuth2() throws ServiceUnavailableException { initializeRequest("Bearer badToken"); assertNull(authenticator.authenticate(request)); assertNull(attr.get(Attribute.TOKEN_INFO)); }
@Test public void testAuthenticate_nullTokenInfo() throws ServiceUnavailableException { authenticator = createAuthenticator(null, null, null, null); assertNull(authenticator.authenticate(request)); assertNull(attr.get(Attribute.TOKEN_INFO)); }
@Test public void testAuthenticate_scopeNotAllowed() throws ServiceUnavailableException { when(config.getScopeExpression()).thenReturn(AuthScopeExpressions.interpret("scope3")); assertNull(authenticator.authenticate(request)); assertNotNull(attr.get(Attribute.TOKEN_INFO)); }
@Test public void testAuthenticate_clientIdNotAllowed() throws ServiceUnavailableException { when(config.getScopeExpression()).thenReturn(AuthScopeExpressions.interpret("scope1")); when(config.getClientIds()).thenReturn(ImmutableList.of("clientId2")); assertNull(authenticator.authenticate(request)); assertNotNull(attr.get(Attribute.TOKEN_INFO)); }
@Test public void testAuthenticate_skipClientIdCheck() throws ServiceUnavailableException { request.removeAttribute(Attribute.ENABLE_CLIENT_ID_WHITELIST); when(config.getScopeExpression()).thenReturn(AuthScopeExpressions.interpret("scope1")); when(config.getClientIds()).thenReturn(ImmutableList.of("clientId2")); User user = authenticator.authenticate(request); assertEquals(EMAIL, user.getEmail()); assertEquals(USER_ID, user.getId()); assertNotNull(attr.get(Attribute.TOKEN_INFO)); }
@Test public void testAuthenticate() throws ServiceUnavailableException { when(config.getScopeExpression()).thenReturn(AuthScopeExpressions.interpret("scope1")); when(config.getClientIds()).thenReturn(ImmutableList.of(CLIENT_ID)); User user = authenticator.authenticate(request); assertEquals(EMAIL, user.getEmail()); assertEquals(USER_ID, user.getId()); final TokenInfo tokenInfo = attr.get(Attribute.TOKEN_INFO); assertNotNull(tokenInfo); assertEquals(EMAIL, tokenInfo.email); assertEquals(USER_ID, tokenInfo.userId); }
@Test public void testAuthenticate_appEngineUser() throws ServiceUnavailableException { attr.set(Attribute.REQUIRE_APPENGINE_USER, true); when(config.getScopeExpression()).thenReturn(AuthScopeExpressions.interpret("scope1")); when(config.getClientIds()).thenReturn(ImmutableList.of(CLIENT_ID)); User user = authenticator.authenticate(request); assertEquals(EMAIL, user.getEmail()); assertEquals(USER_ID, user.getId()); com.google.appengine.api.users.User appEngineuser = (com.google.appengine.api.users.User) attr.get(Attribute.AUTHENTICATED_APPENGINE_USER); assertEquals(EMAIL, appEngineuser.getEmail()); assertNull(appEngineuser.getUserId()); }