DefaultOAuthJwtAccessTokenValidator implements OAuthJwtAccessTokenValidator { @Override public void validate(OAuthJwtAccessToken jwt) throws OAuthJwtAccessTokenException { this.verifyIssuer(jwt); this.verifyAudiences(jwt); this.verifyScopes(jwt); if (jwt.getExpiration() <= 0L) { throw new OAuthJwtAccessTokenException("exp is empty"); } } DefaultOAuthJwtAccessTokenValidator(String trustedIssuer, Set<String> requiredAudiences, Set<String> requiredScopes, Map<String, Set<String>> authorizedClientIds); @Override void validate(OAuthJwtAccessToken jwt); @Override void validateClientId(OAuthJwtAccessToken jwt, String clientId); @Override void validateCertificateBinding(OAuthJwtAccessToken jwt, String certificateThumbprint);  }
@Test public void testValidateVerifyIssuer() { final DefaultOAuthJwtAccessTokenValidator validator = this.baseValidator; final OAuthJwtAccessToken mock = Mockito.spy(baseJwt); Mockito.doReturn(new ArrayList<>(this.requiredAudiences)).when(mock).getAudiences(); Mockito.doReturn(new ArrayList<>(this.requiredScopes)).when(mock).getScopes(); Mockito.doReturn(1L).when(mock).getExpiration(); Mockito.doReturn(null).when(mock).getIssuer(); assertThrowable.accept(new ThrowingRunnable() { public void run() throws Throwable { validator.validate(mock); } }, "iss not trusted: got=null"); Mockito.doReturn("").when(mock).getIssuer(); assertThrowable.accept(new ThrowingRunnable() { public void run() throws Throwable { validator.validate(mock); } }, "iss not trusted: got="); Mockito.doReturn("untrusty_issuer").when(mock).getIssuer(); assertThrowable.accept(new ThrowingRunnable() { public void run() throws Throwable { validator.validate(mock); } }, "iss not trusted: got=untrusty_issuer"); Mockito.doReturn("trustedIssuer").when(mock).getIssuer(); assertDoesNotThrow.accept(new ThrowingRunnable() { public void run() throws Throwable { validator.validate(mock); } }); }
@Test public void testValidateVerifyAudiences() { final DefaultOAuthJwtAccessTokenValidator validator = this.baseValidator; final OAuthJwtAccessToken mock = Mockito.spy(baseJwt); Mockito.doReturn(this.trustedIssuer).when(mock).getIssuer(); Mockito.doReturn(new ArrayList<>(this.requiredScopes)).when(mock).getScopes(); Mockito.doReturn(1L).when(mock).getExpiration(); Mockito.doReturn(null).when(mock).getAudiences(); assertThrowable.accept(new ThrowingRunnable() { public void run() throws Throwable { validator.validate(mock); } }, "required aud not found: got=null"); Mockito.doReturn(new ArrayList<>()).when(mock).getAudiences(); assertThrowable.accept(new ThrowingRunnable() { public void run() throws Throwable { validator.validate(mock); } }, "required aud not found: got="); Mockito.doReturn(Arrays.asList("aud_1", "unknown_aud")).when(mock).getAudiences(); assertThrowable.accept(new ThrowingRunnable() { public void run() throws Throwable { validator.validate(mock); } }, "required aud not found: got=aud_1, unknown_aud"); Mockito.doReturn(Arrays.asList("aud_3", "aud_2", "aud_1")).when(mock).getAudiences(); assertDoesNotThrow.accept(new ThrowingRunnable() { public void run() throws Throwable { validator.validate(mock); } }); }
@Test public void testValidateVerifyScopes() { final DefaultOAuthJwtAccessTokenValidator validator = this.baseValidator; final OAuthJwtAccessToken mock = Mockito.spy(baseJwt); Mockito.doReturn(this.trustedIssuer).when(mock).getIssuer(); Mockito.doReturn(new ArrayList<>(this.requiredAudiences)).when(mock).getAudiences(); Mockito.doReturn(1L).when(mock).getExpiration(); Mockito.doReturn(null).when(mock).getScope(); assertThrowable.accept(new ThrowingRunnable() { public void run() throws Throwable { validator.validate(mock); } }, "required scope not found: got=null"); Mockito.doReturn("").when(mock).getScope(); assertThrowable.accept(new ThrowingRunnable() { public void run() throws Throwable { validator.validate(mock); } }, "required scope not found: got="); Mockito.doReturn("scope_1 unknown_scope").when(mock).getScope(); assertThrowable.accept(new ThrowingRunnable() { public void run() throws Throwable { validator.validate(mock); } }, "required scope not found: got=scope_1 unknown_scope"); Mockito.doReturn("scope_3 scope_2 scope_1").when(mock).getScope(); assertDoesNotThrow.accept(new ThrowingRunnable() { public void run() throws Throwable { validator.validate(mock); } }); }
@Test public void testValidateExpiration() { final DefaultOAuthJwtAccessTokenValidator validator = new DefaultOAuthJwtAccessTokenValidator(this.trustedIssuer, this.requiredAudiences, this.requiredScopes, this.authorizedClientIds); final OAuthJwtAccessToken mock = Mockito.spy(baseJwt); Mockito.doReturn("trustedIssuer").when(mock).getIssuer(); Mockito.doReturn(Arrays.asList("aud_1", "aud_2")).when(mock).getAudiences(); Mockito.doReturn(Arrays.asList("scope_1", "scope_2")).when(mock).getScopes(); Mockito.doReturn(0L).when(mock).getExpiration(); assertThrowable.accept(new ThrowingRunnable() { public void run() throws Throwable { validator.validate(mock); } }, "exp is empty"); Mockito.doReturn(-1L).when(mock).getExpiration(); assertThrowable.accept(new ThrowingRunnable() { public void run() throws Throwable { validator.validate(mock); } }, "exp is empty"); Mockito.doReturn(1L).when(mock).getExpiration(); assertDoesNotThrow.accept(new ThrowingRunnable() { public void run() throws Throwable { validator.validate(mock); } }); }