GoogleJwtAuthenticator implements Authenticator { @Override public User authenticate(HttpServletRequest request) { Attribute attr = Attribute.from(request); if (attr.isEnabled(Attribute.SKIP_TOKEN_AUTH)) { return null; } String token = GoogleAuth.getAuthToken(request); if (!GoogleAuth.isJwt(token)) { return null; } GoogleIdToken idToken = verifyToken(token); if (idToken == null) { return null; } attr.set(Attribute.ID_TOKEN, idToken); String clientId = idToken.getPayload().getAuthorizedParty(); String audience = (String) idToken.getPayload().getAudience(); ApiMethodConfig config = attr.get(Attribute.API_METHOD_CONFIG); if ((attr.isEnabled(Attribute.ENABLE_CLIENT_ID_WHITELIST) && !GoogleAuth.checkClientId(clientId, config.getClientIds(), false))) { logger.atWarning().log("ClientId is not allowed: %s", clientId); return null; } if (!GoogleAuth.checkAudience(audience, config.getAudiences(), clientId)) { logger.atWarning().log("Audience is not allowed: %s", audience); return null; } String userId = idToken.getPayload().getSubject(); String email = idToken.getPayload().getEmail(); User user = (userId == null && email == null) ? null : new User(userId, email); if (attr.isEnabled(Attribute.REQUIRE_APPENGINE_USER)) { com.google.appengine.api.users.User appEngineUser = (email == null) ? null : new com.google.appengine.api.users.User(email, ""); attr.set(Attribute.AUTHENTICATED_APPENGINE_USER, appEngineUser); logger.atFine().log("appEngineUser = %s", appEngineUser); } else { logger.atFine().log("user = %s", user); } return user; } GoogleJwtAuthenticator();  GoogleJwtAuthenticator(GoogleIdTokenVerifier verifier); @Override User authenticate(HttpServletRequest request);  }
@Test public void testAuthenticate_skipTokenAuth() { attr.set(Attribute.SKIP_TOKEN_AUTH, true); assertNull(authenticator.authenticate(request)); assertNull(attr.get(Attribute.ID_TOKEN)); }
@Test public void testAuthenticate_notJwt() { request.addHeader(GoogleAuth.AUTHORIZATION_HEADER, "Bearer abc.abc"); assertNull(authenticator.authenticate(request)); assertNull(attr.get(Attribute.ID_TOKEN)); }
@Test public void testAuthenticate_invalidToken() throws Exception { when(verifier.verify(TOKEN)).thenReturn(null); assertNull(authenticator.authenticate(request)); assertNull(attr.get(Attribute.ID_TOKEN)); }
@Test public void testAuthenticate_clientIdNotAllowed() throws Exception { when(verifier.verify(TOKEN)).thenReturn(token); when(config.getClientIds()).thenReturn(ImmutableList.of("clientId2")); assertNull(authenticator.authenticate(request)); assertNotNull(attr.get(Attribute.ID_TOKEN)); }
@Test public void testAuthenticate_audienceNotAllowed() throws Exception { when(verifier.verify(TOKEN)).thenReturn(token); when(config.getClientIds()).thenReturn(ImmutableList.of(CLIENT_ID)); when(config.getAudiences()).thenReturn(ImmutableList.of("audience2")); assertNull(authenticator.authenticate(request)); assertNotNull(attr.get(Attribute.ID_TOKEN)); }
@Test public void testAuthenticate_skipClientIdCheck() throws Exception { request.removeAttribute(Attribute.ENABLE_CLIENT_ID_WHITELIST); when(verifier.verify(TOKEN)).thenReturn(token); when(config.getClientIds()).thenReturn(ImmutableList.of("clientId2")); when(config.getAudiences()).thenReturn(ImmutableList.of(AUDIENCE)); User user = authenticator.authenticate(request); assertEquals(EMAIL, user.getEmail()); assertEquals(USER_ID, user.getId()); assertNotNull(attr.get(Attribute.ID_TOKEN)); }
@Test public void testAuthenticate() throws Exception { when(verifier.verify(TOKEN)).thenReturn(token); when(config.getClientIds()).thenReturn(ImmutableList.of(CLIENT_ID)); when(config.getAudiences()).thenReturn(ImmutableList.of(AUDIENCE)); User user = authenticator.authenticate(request); assertEquals(EMAIL, user.getEmail()); assertEquals(USER_ID, user.getId()); GoogleIdToken idToken = attr.get(Attribute.ID_TOKEN); assertNotNull(idToken); assertEquals(EMAIL, idToken.getPayload().getEmail()); assertEquals(USER_ID, idToken.getPayload().getSubject()); }
@Test public void testAuthenticate_appEngineUser() throws GeneralSecurityException, IOException { attr.set(Attribute.REQUIRE_APPENGINE_USER, true); when(verifier.verify(TOKEN)).thenReturn(token); when(config.getClientIds()).thenReturn(ImmutableList.of(CLIENT_ID)); when(config.getAudiences()).thenReturn(ImmutableList.of(AUDIENCE)); User user = authenticator.authenticate(request); assertEquals(EMAIL, user.getEmail()); assertEquals(USER_ID, user.getId()); com.google.appengine.api.users.User appEngineuser = attr.get(Attribute.AUTHENTICATED_APPENGINE_USER); assertEquals(EMAIL, appEngineuser.getEmail()); assertNull(appEngineuser.getUserId()); }