@Test public void testSuccessfulLogin() throws Exception { UserStore testUserStore = new UserStore(); testUserStore.addUser(TEST_USER, SecurityUtils.NO_CREDENTIAL, new String[]{USER_ROLE}); TokenGenerator.TokenAndKeys tokenAndKeys = TokenGenerator.generateToken(TEST_USER); JwtLoginService loginService = new JwtLoginService(new UserStoreAuthorizationService(testUserStore), tokenAndKeys.publicKey(), null); Authenticator.AuthConfiguration configuration = mock(Authenticator.AuthConfiguration.class); expect(configuration.getLoginService()).andReturn(loginService); expect(configuration.getIdentityService()).andReturn(new DefaultIdentityService()); expect(configuration.isSessionRenewedOnAuthentication()).andReturn(true); Request request = niceMock(Request.class); expect(request.getMethod()).andReturn(HttpMethod.GET.asString()); expect(request.getHeader(HttpHeader.AUTHORIZATION.asString())).andReturn(null); request.setAttribute(JwtAuthenticator.JWT_TOKEN_REQUEST_ATTRIBUTE, tokenAndKeys.token()); expectLastCall().andVoid(); expect(request.getCookies()).andReturn(new Cookie[] {new Cookie(JWT_TOKEN, tokenAndKeys.token())}); expect(request.getAttribute(JwtAuthenticator.JWT_TOKEN_REQUEST_ATTRIBUTE)).andReturn(tokenAndKeys.token()); HttpServletResponse response = mock(HttpServletResponse.class); replay(configuration, request, response); JwtAuthenticator authenticator = new JwtAuthenticator(TOKEN_PROVIDER, JWT_TOKEN); authenticator.setConfiguration(configuration); UserAuthentication authentication = (UserAuthentication) authenticator.validateRequest(request, response, true); verify(configuration, request, response); assertNotNull(authentication); assertTrue(authentication.getUserIdentity().getUserPrincipal() instanceof JwtUserPrincipal); JwtUserPrincipal userPrincipal = (JwtUserPrincipal) authentication.getUserIdentity().getUserPrincipal(); assertEquals(TEST_USER, userPrincipal.getName()); assertEquals(tokenAndKeys.token(), userPrincipal.getSerializedToken()); }
@Override public Authentication validateRequest(ServletRequest request, ServletResponse response, boolean mandatory) throws ServerAuthException { JWT_LOGGER.trace("Authentication request received for " + request.toString()); if (!(request instanceof HttpServletRequest) && !(response instanceof HttpServletResponse)) { return Authentication.UNAUTHENTICATED; } String serializedJWT; HttpServletRequest req = (HttpServletRequest) request; if (HttpMethod.OPTIONS.name().toLowerCase().equals(req.getMethod().toLowerCase())) { return Authentication.NOT_CHECKED; } serializedJWT = getJwtFromBearerAuthorization(req); if (serializedJWT == null) { serializedJWT = getJwtFromCookie(req); } if (serializedJWT == null) { String loginURL = _authenticationProviderUrlGenerator.apply(req); JWT_LOGGER.info("No JWT token found, sending redirect to " + loginURL); try { ((HttpServletResponse) response).sendRedirect(loginURL); return Authentication.SEND_CONTINUE; } catch (IOException e) { JWT_LOGGER.error("Couldn't authenticate request", e); throw new ServerAuthException(e); } } else { try { SignedJWT jwtToken = SignedJWT.parse(serializedJWT); String userName = jwtToken.getJWTClaimsSet().getSubject(); request.setAttribute(JWT_TOKEN_REQUEST_ATTRIBUTE, serializedJWT); UserIdentity identity = login(userName, jwtToken, request); if (identity == null) { ((HttpServletResponse) response).setStatus(HttpStatus.UNAUTHORIZED_401); return Authentication.SEND_FAILURE; } else { return new UserAuthentication(getAuthMethod(), identity); } } catch (ParseException pe) { String loginURL = _authenticationProviderUrlGenerator.apply(req); JWT_LOGGER.warn("Unable to parse the JWT token, redirecting back to the login page", pe); try { ((HttpServletResponse) response).sendRedirect(loginURL); } catch (IOException e) { throw new ServerAuthException(e); } } } return Authentication.SEND_FAILURE; }
JwtAuthenticator extends LoginAuthenticator { @Override public Authentication validateRequest(ServletRequest request, ServletResponse response, boolean mandatory) throws ServerAuthException { JWT_LOGGER.trace("Authentication request received for " + request.toString()); if (!(request instanceof HttpServletRequest) && !(response instanceof HttpServletResponse)) { return Authentication.UNAUTHENTICATED; } String serializedJWT; HttpServletRequest req = (HttpServletRequest) request; if (HttpMethod.OPTIONS.name().toLowerCase().equals(req.getMethod().toLowerCase())) { return Authentication.NOT_CHECKED; } serializedJWT = getJwtFromBearerAuthorization(req); if (serializedJWT == null) { serializedJWT = getJwtFromCookie(req); } if (serializedJWT == null) { String loginURL = _authenticationProviderUrlGenerator.apply(req); JWT_LOGGER.info("No JWT token found, sending redirect to " + loginURL); try { ((HttpServletResponse) response).sendRedirect(loginURL); return Authentication.SEND_CONTINUE; } catch (IOException e) { JWT_LOGGER.error("Couldn't authenticate request", e); throw new ServerAuthException(e); } } else { try { SignedJWT jwtToken = SignedJWT.parse(serializedJWT); String userName = jwtToken.getJWTClaimsSet().getSubject(); request.setAttribute(JWT_TOKEN_REQUEST_ATTRIBUTE, serializedJWT); UserIdentity identity = login(userName, jwtToken, request); if (identity == null) { ((HttpServletResponse) response).setStatus(HttpStatus.UNAUTHORIZED_401); return Authentication.SEND_FAILURE; } else { return new UserAuthentication(getAuthMethod(), identity); } } catch (ParseException pe) { String loginURL = _authenticationProviderUrlGenerator.apply(req); JWT_LOGGER.warn("Unable to parse the JWT token, redirecting back to the login page", pe); try { ((HttpServletResponse) response).sendRedirect(loginURL); } catch (IOException e) { throw new ServerAuthException(e); } } } return Authentication.SEND_FAILURE; } }
JwtAuthenticator extends LoginAuthenticator { @Override public Authentication validateRequest(ServletRequest request, ServletResponse response, boolean mandatory) throws ServerAuthException { JWT_LOGGER.trace("Authentication request received for " + request.toString()); if (!(request instanceof HttpServletRequest) && !(response instanceof HttpServletResponse)) { return Authentication.UNAUTHENTICATED; } String serializedJWT; HttpServletRequest req = (HttpServletRequest) request; if (HttpMethod.OPTIONS.name().toLowerCase().equals(req.getMethod().toLowerCase())) { return Authentication.NOT_CHECKED; } serializedJWT = getJwtFromBearerAuthorization(req); if (serializedJWT == null) { serializedJWT = getJwtFromCookie(req); } if (serializedJWT == null) { String loginURL = _authenticationProviderUrlGenerator.apply(req); JWT_LOGGER.info("No JWT token found, sending redirect to " + loginURL); try { ((HttpServletResponse) response).sendRedirect(loginURL); return Authentication.SEND_CONTINUE; } catch (IOException e) { JWT_LOGGER.error("Couldn't authenticate request", e); throw new ServerAuthException(e); } } else { try { SignedJWT jwtToken = SignedJWT.parse(serializedJWT); String userName = jwtToken.getJWTClaimsSet().getSubject(); request.setAttribute(JWT_TOKEN_REQUEST_ATTRIBUTE, serializedJWT); UserIdentity identity = login(userName, jwtToken, request); if (identity == null) { ((HttpServletResponse) response).setStatus(HttpStatus.UNAUTHORIZED_401); return Authentication.SEND_FAILURE; } else { return new UserAuthentication(getAuthMethod(), identity); } } catch (ParseException pe) { String loginURL = _authenticationProviderUrlGenerator.apply(req); JWT_LOGGER.warn("Unable to parse the JWT token, redirecting back to the login page", pe); try { ((HttpServletResponse) response).sendRedirect(loginURL); } catch (IOException e) { throw new ServerAuthException(e); } } } return Authentication.SEND_FAILURE; } JwtAuthenticator(String authenticationProviderUrl, String cookieName); }
JwtAuthenticator extends LoginAuthenticator { @Override public Authentication validateRequest(ServletRequest request, ServletResponse response, boolean mandatory) throws ServerAuthException { JWT_LOGGER.trace("Authentication request received for " + request.toString()); if (!(request instanceof HttpServletRequest) && !(response instanceof HttpServletResponse)) { return Authentication.UNAUTHENTICATED; } String serializedJWT; HttpServletRequest req = (HttpServletRequest) request; if (HttpMethod.OPTIONS.name().toLowerCase().equals(req.getMethod().toLowerCase())) { return Authentication.NOT_CHECKED; } serializedJWT = getJwtFromBearerAuthorization(req); if (serializedJWT == null) { serializedJWT = getJwtFromCookie(req); } if (serializedJWT == null) { String loginURL = _authenticationProviderUrlGenerator.apply(req); JWT_LOGGER.info("No JWT token found, sending redirect to " + loginURL); try { ((HttpServletResponse) response).sendRedirect(loginURL); return Authentication.SEND_CONTINUE; } catch (IOException e) { JWT_LOGGER.error("Couldn't authenticate request", e); throw new ServerAuthException(e); } } else { try { SignedJWT jwtToken = SignedJWT.parse(serializedJWT); String userName = jwtToken.getJWTClaimsSet().getSubject(); request.setAttribute(JWT_TOKEN_REQUEST_ATTRIBUTE, serializedJWT); UserIdentity identity = login(userName, jwtToken, request); if (identity == null) { ((HttpServletResponse) response).setStatus(HttpStatus.UNAUTHORIZED_401); return Authentication.SEND_FAILURE; } else { return new UserAuthentication(getAuthMethod(), identity); } } catch (ParseException pe) { String loginURL = _authenticationProviderUrlGenerator.apply(req); JWT_LOGGER.warn("Unable to parse the JWT token, redirecting back to the login page", pe); try { ((HttpServletResponse) response).sendRedirect(loginURL); } catch (IOException e) { throw new ServerAuthException(e); } } } return Authentication.SEND_FAILURE; } JwtAuthenticator(String authenticationProviderUrl, String cookieName); @Override String getAuthMethod(); @Override void prepareRequest(ServletRequest request); @Override Authentication validateRequest(ServletRequest request, ServletResponse response, boolean mandatory); @Override boolean secureResponse(ServletRequest request, ServletResponse response, boolean mandatory, Authentication.User validatedUser); }
JwtAuthenticator extends LoginAuthenticator { @Override public Authentication validateRequest(ServletRequest request, ServletResponse response, boolean mandatory) throws ServerAuthException { JWT_LOGGER.trace("Authentication request received for " + request.toString()); if (!(request instanceof HttpServletRequest) && !(response instanceof HttpServletResponse)) { return Authentication.UNAUTHENTICATED; } String serializedJWT; HttpServletRequest req = (HttpServletRequest) request; if (HttpMethod.OPTIONS.name().toLowerCase().equals(req.getMethod().toLowerCase())) { return Authentication.NOT_CHECKED; } serializedJWT = getJwtFromBearerAuthorization(req); if (serializedJWT == null) { serializedJWT = getJwtFromCookie(req); } if (serializedJWT == null) { String loginURL = _authenticationProviderUrlGenerator.apply(req); JWT_LOGGER.info("No JWT token found, sending redirect to " + loginURL); try { ((HttpServletResponse) response).sendRedirect(loginURL); return Authentication.SEND_CONTINUE; } catch (IOException e) { JWT_LOGGER.error("Couldn't authenticate request", e); throw new ServerAuthException(e); } } else { try { SignedJWT jwtToken = SignedJWT.parse(serializedJWT); String userName = jwtToken.getJWTClaimsSet().getSubject(); request.setAttribute(JWT_TOKEN_REQUEST_ATTRIBUTE, serializedJWT); UserIdentity identity = login(userName, jwtToken, request); if (identity == null) { ((HttpServletResponse) response).setStatus(HttpStatus.UNAUTHORIZED_401); return Authentication.SEND_FAILURE; } else { return new UserAuthentication(getAuthMethod(), identity); } } catch (ParseException pe) { String loginURL = _authenticationProviderUrlGenerator.apply(req); JWT_LOGGER.warn("Unable to parse the JWT token, redirecting back to the login page", pe); try { ((HttpServletResponse) response).sendRedirect(loginURL); } catch (IOException e) { throw new ServerAuthException(e); } } } return Authentication.SEND_FAILURE; } JwtAuthenticator(String authenticationProviderUrl, String cookieName); @Override String getAuthMethod(); @Override void prepareRequest(ServletRequest request); @Override Authentication validateRequest(ServletRequest request, ServletResponse response, boolean mandatory); @Override boolean secureResponse(ServletRequest request, ServletResponse response, boolean mandatory, Authentication.User validatedUser); static final String JWT_TOKEN_REQUEST_ATTRIBUTE; }