AccessToken extends OAuth2Token { public boolean confirmMTLSBoundToken(X509Certificate x509Cert, final String x509CertHash) { if (x509Cert == null) { LOG.error("confirmMTLSBoundToken: null certificate"); return false; } final String cnfHash = (String) getConfirmEntry(CLAIM_CONFIRM_X509_HASH); if (cnfHash == null) { LOG.error("confirmMTLSBoundToken: token does not have confirmation entry"); return false; } if (confirmX509CertHash(x509Cert, cnfHash)) { return true; } final String cn = Crypto.extractX509CertCommonName(x509Cert); if (cn == null) { LOG.error("confirmMTLSBoundToken: null principal in certificate}"); return false; } if (confirmX509CertPrincipal(x509Cert, cn)) { return true; } return confirmX509ProxyPrincipal(cn, x509CertHash, cnfHash); } AccessToken();  AccessToken(final String token, JwtsSigningKeyResolver keyResolver);  AccessToken(final String token, PublicKey publicKey);  AccessToken(final String token, JwtsSigningKeyResolver keyResolver,
                       X509Certificate x509Cert);  AccessToken(final String token, JwtsSigningKeyResolver keyResolver,
                       X509Certificate x509Cert, final String x509CertHash); static void setAccessTokenCertOffset(long offset); static void setAccessTokenProxyPrincipals(Set<String> proxyPrincipals); String getClientId(); void setClientId(String clientId); String getProxyPrincipal(); void setProxyPrincipal(String proxyPrincipal); String getUserId(); void setUserId(String userId); List<String> getScope(); void setScope(List<String> scope); LinkedHashMap<String, Object> getConfirm(); void setConfirm(LinkedHashMap<String, Object> confirm); void setConfirmEntry(final String key, final Object value); void setConfirmX509CertHash(X509Certificate cert); boolean confirmMTLSBoundToken(X509Certificate x509Cert, final String x509CertHash); Object getConfirmEntry(final String key); String getSignedToken(final PrivateKey key, final String keyId,
            final SignatureAlgorithm keyAlg); static final String HDR_TOKEN_TYPE; static final String HDR_TOKEN_JWT; static final String CLAIM_SCOPE; static final String CLAIM_UID; static final String CLAIM_CLIENT_ID; static final String CLAIM_CONFIRM; static final String CLAIM_PROXY; static final String CLAIM_CONFIRM_X509_HASH; }
@Test public void testConfirmMTLSBoundTokenNullX509Cert() { long now = System.currentTimeMillis() / 1000; AccessToken accessToken = createAccessToken(now); assertFalse(accessToken.confirmMTLSBoundToken(null, "cnf-hash")); }
@Test public void testConfirmMTLSBoundTokenCertPrincipalAllowed() throws IOException { AccessToken accessToken = createAccessToken(1565245568 + 3600 - 100); Path path = Paths.get("src/test/resources/mtls_token2_spec.cert"); String certStr = new String(Files.readAllBytes(path)); X509Certificate cert = Crypto.loadX509Certificate(certStr); assertTrue(accessToken.confirmMTLSBoundToken(cert, null)); }
@Test public void testConfirmMTLSBoundTokenNoCN() throws IOException { long now = System.currentTimeMillis() / 1000; AccessToken accessToken = createAccessToken(now); Path path = Paths.get("src/test/resources/no_cn_x509.cert"); String certStr = new String(Files.readAllBytes(path)); X509Certificate cert = Crypto.loadX509Certificate(certStr); assertFalse(accessToken.confirmMTLSBoundToken(cert, "cnf-hash")); }