GoogleAppEngineAuthenticator implements Authenticator { @VisibleForTesting com.google.appengine.api.users.User getOAuth2User(HttpServletRequest request, ApiMethodConfig config) throws ServiceUnavailableException { String token = GoogleAuth.getAuthToken(request); if (!GoogleAuth.isOAuth2Token(token)) { return null; } AuthScopeExpression scopeExpression = config.getScopeExpression(); String[] allScopes = scopeExpression.getAllScopes(); String clientId = null; if (EnvUtil.isRunningOnAppEngineProd()) { try { String[] authorizedScopes = oauthService.getAuthorizedScopes(allScopes); boolean authorized = false; if (authorizedScopes != null) { authorized = scopeExpression.isAuthorized(ImmutableSet.copyOf(authorizedScopes)); } if (!authorized) { logger.atWarning().log( "Access token does not contain sufficient scopes from: %s", scopeExpression); return null; } clientId = oauthService.getClientId(allScopes); } catch (OAuthRequestException e) { logger.atWarning().withCause(e).log("Failed to get client id for '%s'", scopeExpression); return null; } } else { clientId = getOAuth2ClientIdDev(token); } if ((Attribute.from(request).isEnabled(Attribute.ENABLE_CLIENT_ID_WHITELIST) && !GoogleAuth.checkClientId(clientId, config.getClientIds(), true))) { logger.atWarning().log("ClientId is not allowed: %s", clientId); return null; } try { com.google.appengine.api.users.User appEngineUser = oauthService.getCurrentUser(allScopes); return appEngineUser; } catch (OAuthRequestException e) { logger.atWarning().withCause(e).log("Failed to get user for '%s'", scopeExpression); } return null; } GoogleAppEngineAuthenticator();  GoogleAppEngineAuthenticator(OAuthService oauthService, UserService userService); @Override User authenticate(HttpServletRequest request);  }
@Test public void testGetOAuth2UserNonOAuth2() throws ServiceUnavailableException { initializeRequest("Bearer badToken"); assertNull(authenticator.getOAuth2User(request, config)); initializeRequest("Bearer"); assertNull(authenticator.getOAuth2User(request, config)); initializeRequest("Random abc"); assertNull(authenticator.getOAuth2User(request, config)); }
@Test public void testGetOAuth2UserScopeNotAllowed() throws Exception { when(config.getScopeExpression()).thenReturn(AuthScopeExpressions.interpret(SCOPES)); when(oauthService.getAuthorizedScopes(SCOPES)).thenThrow(new OAuthRequestException("any")) .thenReturn(null).thenReturn(new String[] {"scope3"}); for (int i = 0; i < 3; i++) { assertNull(authenticator.getOAuth2User(request, config)); } }
@Test public void testGetOAuth2UserAppEngineProdClientIdNotAllowed() throws Exception { when(config.getScopeExpression()).thenReturn(AuthScopeExpressions.interpret(SCOPES)); when(oauthService.getAuthorizedScopes(SCOPES)).thenReturn(SCOPES); when(oauthService.getClientId(SCOPES)).thenThrow(new OAuthRequestException("any")) .thenReturn(null).thenReturn(CLIENT_ID); when(config.getClientIds()).thenReturn(ImmutableList.of("clientId2")); for (int i = 0; i < 3; i++) { assertNull(authenticator.getOAuth2User(request, config)); } }
@Test public void testGetOAuth2UserUserFailure() throws Exception { when(config.getScopeExpression()).thenReturn(AuthScopeExpressions.interpret(SCOPES)); when(oauthService.getAuthorizedScopes(SCOPES)).thenReturn(SCOPES); when(oauthService.getClientId(SCOPES)).thenReturn(CLIENT_ID); when(config.getClientIds()).thenReturn(ImmutableList.of(CLIENT_ID)); when(oauthService.getCurrentUser(SCOPES)).thenReturn(null); assertNull(authenticator.getOAuth2User(request, config)); }
@Test public void testGetOAuth2User() throws Exception { when(config.getScopeExpression()).thenReturn(AuthScopeExpressions.interpret(SCOPES)); when(oauthService.getAuthorizedScopes(SCOPES)).thenReturn(SCOPES); when(oauthService.getClientId(SCOPES)).thenReturn(CLIENT_ID); when(config.getClientIds()).thenReturn(ImmutableList.of(CLIENT_ID)); when(oauthService.getCurrentUser(SCOPES)).thenReturn(APP_ENGINE_USER); assertEquals(APP_ENGINE_USER, authenticator.getOAuth2User(request, config)); }
@Test public void testGetOAuth2UserSkipClientIdCheck() throws Exception { request.removeAttribute(Attribute.ENABLE_CLIENT_ID_WHITELIST); when(config.getScopeExpression()).thenReturn(AuthScopeExpressions.interpret(SCOPES)); when(oauthService.getAuthorizedScopes(SCOPES)).thenReturn(SCOPES); when(oauthService.getClientId(SCOPES)).thenReturn(CLIENT_ID); when(config.getClientIds()).thenReturn(ImmutableList.of("clienId2")); when(oauthService.getCurrentUser(SCOPES)).thenReturn(APP_ENGINE_USER); assertEquals(APP_ENGINE_USER, authenticator.getOAuth2User(request, config)); }
@Test public void testGetOAuth2UserAppEngineDevClientIdNotAllowed() throws ServiceUnavailableException { System.setProperty(EnvUtil.ENV_APPENGINE_RUNTIME, "Developement"); when(config.getScopeExpression()).thenReturn(AuthScopeExpressions.interpret(SCOPES)); when(config.getClientIds()).thenReturn(ImmutableList.of("clientId2")); assertNull(authenticator.getOAuth2User(request, config)); }