AccessToken extends OAuth2Token { public String getSignedToken(final PrivateKey key, final String keyId, final SignatureAlgorithm keyAlg) { return Jwts.builder().setSubject(subject) .setIssuedAt(Date.from(Instant.ofEpochSecond(issueTime))) .setExpiration(Date.from(Instant.ofEpochSecond(expiryTime))) .setIssuer(issuer) .setAudience(audience) .claim(CLAIM_AUTH_TIME, authTime) .claim(CLAIM_VERSION, version) .claim(CLAIM_SCOPE, scope) .claim(CLAIM_UID, userId) .claim(CLAIM_CLIENT_ID, clientId) .claim(CLAIM_CONFIRM, confirm) .claim(CLAIM_PROXY, proxyPrincipal) .setHeaderParam(HDR_KEY_ID, keyId) .setHeaderParam(HDR_TOKEN_TYPE, HDR_TOKEN_JWT) .signWith(key, keyAlg) .compact(); } AccessToken();  AccessToken(final String token, JwtsSigningKeyResolver keyResolver);  AccessToken(final String token, PublicKey publicKey);  AccessToken(final String token, JwtsSigningKeyResolver keyResolver,
                       X509Certificate x509Cert);  AccessToken(final String token, JwtsSigningKeyResolver keyResolver,
                       X509Certificate x509Cert, final String x509CertHash); static void setAccessTokenCertOffset(long offset); static void setAccessTokenProxyPrincipals(Set<String> proxyPrincipals); String getClientId(); void setClientId(String clientId); String getProxyPrincipal(); void setProxyPrincipal(String proxyPrincipal); String getUserId(); void setUserId(String userId); List<String> getScope(); void setScope(List<String> scope); LinkedHashMap<String, Object> getConfirm(); void setConfirm(LinkedHashMap<String, Object> confirm); void setConfirmEntry(final String key, final Object value); void setConfirmX509CertHash(X509Certificate cert); boolean confirmMTLSBoundToken(X509Certificate x509Cert, final String x509CertHash); Object getConfirmEntry(final String key); String getSignedToken(final PrivateKey key, final String keyId,
            final SignatureAlgorithm keyAlg); static final String HDR_TOKEN_TYPE; static final String HDR_TOKEN_JWT; static final String CLAIM_SCOPE; static final String CLAIM_UID; static final String CLAIM_CLIENT_ID; static final String CLAIM_CONFIRM; static final String CLAIM_PROXY; static final String CLAIM_CONFIRM_X509_HASH; }
@Test public void testAccessTokenWithX509Cert() throws IOException { long now = System.currentTimeMillis() / 1000; AccessToken accessToken = createAccessToken(now); PrivateKey privateKey = Crypto.loadPrivateKey(ecPrivateKey); String accessJws = accessToken.getSignedToken(privateKey, "eckey1", SignatureAlgorithm.ES256); assertNotNull(accessJws); JwtsSigningKeyResolver resolver = new JwtsSigningKeyResolver(null, null); resolver.addPublicKey("eckey1", Crypto.loadPublicKey(ecPublicKey)); Path path = Paths.get("src/test/resources/mtls_token_spec.cert"); String certStr = new String(Files.readAllBytes(path)); X509Certificate cert = Crypto.loadX509Certificate(certStr); AccessToken checkToken = new AccessToken(accessJws, resolver, cert); validateAccessToken(checkToken, now); }
@Test public void testAccessTokenWithMismatchX509Cert() throws IOException { long now = System.currentTimeMillis() / 1000; AccessToken accessToken = createAccessToken(now); PrivateKey privateKey = Crypto.loadPrivateKey(ecPrivateKey); String accessJws = accessToken.getSignedToken(privateKey, "eckey1", SignatureAlgorithm.ES256); assertNotNull(accessJws); JwtsSigningKeyResolver resolver = new JwtsSigningKeyResolver(null, null); resolver.addPublicKey("eckey1", Crypto.loadPublicKey(ecPublicKey)); Path path = Paths.get("src/test/resources/rsa_public_x509.cert"); String certStr = new String(Files.readAllBytes(path)); X509Certificate cert = Crypto.loadX509Certificate(certStr); try { new AccessToken(accessJws, resolver, cert); fail(); } catch (CryptoException ex) { assertTrue(ex.getMessage().contains("X.509 Certificate Confirmation failure")); } }
@Test public void testAccessTokenSignedToken() { long now = System.currentTimeMillis() / 1000; AccessToken accessToken = createAccessToken(now); PrivateKey privateKey = Crypto.loadPrivateKey(ecPrivateKey); String accessJws = accessToken.getSignedToken(privateKey, "eckey1", SignatureAlgorithm.ES256); assertNotNull(accessJws); JwtsSigningKeyResolver resolver = new JwtsSigningKeyResolver(null, null); resolver.addPublicKey("eckey1", Crypto.loadPublicKey(ecPublicKey)); AccessToken checkToken = new AccessToken(accessJws, resolver); validateAccessToken(checkToken, now); }
@Test public void testAccessTokenWithoutSignedToken() { long now = System.currentTimeMillis() / 1000; AccessToken accessToken = createAccessToken(now); PrivateKey privateKey = Crypto.loadPrivateKey(ecPrivateKey); String accessJws = accessToken.getSignedToken(privateKey, "eckey1", SignatureAlgorithm.ES256); assertNotNull(accessJws); JwtsSigningKeyResolver resolver = new JwtsSigningKeyResolver(null, null); resolver.addPublicKey("eckey1", Crypto.loadPublicKey(ecPublicKey)); int idx = accessJws.lastIndexOf('.'); final String unsignedJws = accessJws.substring(0, idx + 1); try { new AccessToken(unsignedJws, resolver); fail(); } catch (Exception ex) { assertTrue(ex instanceof UnsupportedJwtException); } }
@Test public void testAccessTokenSignedTokenPublicKey() { long now = System.currentTimeMillis() / 1000; AccessToken accessToken = createAccessToken(now); PrivateKey privateKey = Crypto.loadPrivateKey(ecPrivateKey); String accessJws = accessToken.getSignedToken(privateKey, "eckey1", SignatureAlgorithm.ES256); assertNotNull(accessJws); AccessToken checkToken = new AccessToken(accessJws, Crypto.loadPublicKey(ecPublicKey)); validateAccessToken(checkToken, now); }
@Test public void testAccessTokenSignedTokenConfigFile() { long now = System.currentTimeMillis() / 1000; AccessToken accessToken = createAccessToken(now); PrivateKey privateKey = Crypto.loadPrivateKey(ecPrivateKey); String accessJws = accessToken.getSignedToken(privateKey, "eckey1", SignatureAlgorithm.ES256); assertNotNull(accessJws); final String oldConf = System.setProperty(JwtsSigningKeyResolver.ZTS_PROP_ATHENZ_CONF, "src/test/resources/athenz.conf"); JwtsSigningKeyResolver resolver = new JwtsSigningKeyResolver(null, null); AccessToken checkToken = new AccessToken(accessJws, resolver); validateAccessToken(checkToken, now); if (oldConf == null) { System.clearProperty(JwtsSigningKeyResolver.ZTS_PROP_ATHENZ_CONF); } else { System.setProperty(JwtsSigningKeyResolver.ZTS_PROP_ATHENZ_CONF, oldConf); } }
@Test public void testAccessTokenSignedTokenServerKeys() { long now = System.currentTimeMillis() / 1000; AccessToken accessToken = createAccessToken(now); PrivateKey privateKey = Crypto.loadPrivateKey(ecPrivateKey); String accessJws = accessToken.getSignedToken(privateKey, "eckey1", SignatureAlgorithm.ES256); assertNotNull(accessJws); final String oldConf = System.setProperty(JwtsSigningKeyResolver.ZTS_PROP_ATHENZ_CONF, "src/test/resources/athenz-no-keys.conf"); MockJwtsSigningKeyResolver.setResponseCode(200); MockJwtsSigningKeyResolver.setResponseBody(JWT_KEYS); MockJwtsSigningKeyResolver resolver = new MockJwtsSigningKeyResolver("https: AccessToken checkToken = new AccessToken(accessJws, resolver); validateAccessToken(checkToken, now); if (oldConf == null) { System.clearProperty(JwtsSigningKeyResolver.ZTS_PROP_ATHENZ_CONF); } else { System.setProperty(JwtsSigningKeyResolver.ZTS_PROP_ATHENZ_CONF, oldConf); } }
@Test public void testAccessTokenSignedTokenServerKeysFailure() { long now = System.currentTimeMillis() / 1000; AccessToken accessToken = createAccessToken(now); PrivateKey privateKey = Crypto.loadPrivateKey(ecPrivateKey); String accessJws = accessToken.getSignedToken(privateKey, "eckey1", SignatureAlgorithm.ES256); assertNotNull(accessJws); final String oldConf = System.setProperty(JwtsSigningKeyResolver.ZTS_PROP_ATHENZ_CONF, "src/test/resources/athenz-no-keys.conf"); MockJwtsSigningKeyResolver.setResponseCode(401); MockJwtsSigningKeyResolver.setResponseBody(""); SSLContext sslContext = Mockito.mock(SSLContext.class); MockJwtsSigningKeyResolver resolver = new MockJwtsSigningKeyResolver("https: try { new AccessToken(accessJws, resolver); fail(); } catch (Exception ex) { assertTrue(ex instanceof IllegalArgumentException, ex.getMessage()); } if (oldConf == null) { System.clearProperty(JwtsSigningKeyResolver.ZTS_PROP_ATHENZ_CONF); } else { System.setProperty(JwtsSigningKeyResolver.ZTS_PROP_ATHENZ_CONF, oldConf); } }
@Test public void testAccessTokenExpired() { long now = System.currentTimeMillis() / 1000; AccessToken accessToken = createAccessToken(now - 3661); PrivateKey privateKey = Crypto.loadPrivateKey(ecPrivateKey); String accessJws = accessToken.getSignedToken(privateKey, "eckey1", SignatureAlgorithm.ES256); assertNotNull(accessJws); final String oldConf = System.setProperty(JwtsSigningKeyResolver.ZTS_PROP_ATHENZ_CONF, "src/test/resources/athenz.conf"); JwtsSigningKeyResolver resolver = new JwtsSigningKeyResolver(null, null); try { new AccessToken(accessJws, resolver); fail(); } catch (Exception ex) { assertTrue(ex.getMessage().contains("expired")); } if (oldConf == null) { System.clearProperty(JwtsSigningKeyResolver.ZTS_PROP_ATHENZ_CONF); } else { System.setProperty(JwtsSigningKeyResolver.ZTS_PROP_ATHENZ_CONF, oldConf); } }