@Test public void validationFails_whenJwksDoesNotMatchIdentityServiceDomain() { when(token.getHeaderParameterAsString(JWKS_URL)).thenReturn("https: ValidationResult validationResult = cut.validate(token); assertThat(validationResult.isErroneous(), is(true)); assertThat(validationResult.getErrorDescription(), startsWith( "Issuer is not trusted because 'jku' 'https: }
@Override public ValidationResult validate(Token token) { String tokenKeyUrl = token.getHeaderParameterAsString(TokenHeader.JWKS_URL); URI jkuUri; if (tokenKeyUrl == null || tokenKeyUrl.trim().isEmpty()) { return createInvalid( "Issuer validation can not be performed because Jwt token does not contain 'jku' header parameter."); } try { jkuUri = URI.create(tokenKeyUrl); } catch (IllegalArgumentException e) { return createInvalid( "Issuer validation can not be performed because Jwt token does not contain a valid uri as 'jku' header parameter."); } if (!matchesTokenKeyUrlDomain(jkuUri)) { return createInvalid( "Issuer is not trusted because 'jku' '{}' does not match uaa domain '{}' of the identity service.", jkuUri, domain); } if (!matchesTokenKeyEndpoint(jkuUri)) { return createInvalid( "Jwt token does not contain a valid 'jku' header parameter.", jkuUri, domain); } return createValid(); }
XsuaaJkuValidator implements Validator<Token> { @Override public ValidationResult validate(Token token) { String tokenKeyUrl = token.getHeaderParameterAsString(TokenHeader.JWKS_URL); URI jkuUri; if (tokenKeyUrl == null || tokenKeyUrl.trim().isEmpty()) { return createInvalid( "Issuer validation can not be performed because Jwt token does not contain 'jku' header parameter."); } try { jkuUri = URI.create(tokenKeyUrl); } catch (IllegalArgumentException e) { return createInvalid( "Issuer validation can not be performed because Jwt token does not contain a valid uri as 'jku' header parameter."); } if (!matchesTokenKeyUrlDomain(jkuUri)) { return createInvalid( "Issuer is not trusted because 'jku' '{}' does not match uaa domain '{}' of the identity service.", jkuUri, domain); } if (!matchesTokenKeyEndpoint(jkuUri)) { return createInvalid( "Jwt token does not contain a valid 'jku' header parameter.", jkuUri, domain); } return createValid(); } }
XsuaaJkuValidator implements Validator<Token> { @Override public ValidationResult validate(Token token) { String tokenKeyUrl = token.getHeaderParameterAsString(TokenHeader.JWKS_URL); URI jkuUri; if (tokenKeyUrl == null || tokenKeyUrl.trim().isEmpty()) { return createInvalid( "Issuer validation can not be performed because Jwt token does not contain 'jku' header parameter."); } try { jkuUri = URI.create(tokenKeyUrl); } catch (IllegalArgumentException e) { return createInvalid( "Issuer validation can not be performed because Jwt token does not contain a valid uri as 'jku' header parameter."); } if (!matchesTokenKeyUrlDomain(jkuUri)) { return createInvalid( "Issuer is not trusted because 'jku' '{}' does not match uaa domain '{}' of the identity service.", jkuUri, domain); } if (!matchesTokenKeyEndpoint(jkuUri)) { return createInvalid( "Jwt token does not contain a valid 'jku' header parameter.", jkuUri, domain); } return createValid(); } XsuaaJkuValidator(String uaaDomain); }
XsuaaJkuValidator implements Validator<Token> { @Override public ValidationResult validate(Token token) { String tokenKeyUrl = token.getHeaderParameterAsString(TokenHeader.JWKS_URL); URI jkuUri; if (tokenKeyUrl == null || tokenKeyUrl.trim().isEmpty()) { return createInvalid( "Issuer validation can not be performed because Jwt token does not contain 'jku' header parameter."); } try { jkuUri = URI.create(tokenKeyUrl); } catch (IllegalArgumentException e) { return createInvalid( "Issuer validation can not be performed because Jwt token does not contain a valid uri as 'jku' header parameter."); } if (!matchesTokenKeyUrlDomain(jkuUri)) { return createInvalid( "Issuer is not trusted because 'jku' '{}' does not match uaa domain '{}' of the identity service.", jkuUri, domain); } if (!matchesTokenKeyEndpoint(jkuUri)) { return createInvalid( "Jwt token does not contain a valid 'jku' header parameter.", jkuUri, domain); } return createValid(); } XsuaaJkuValidator(String uaaDomain); @Override ValidationResult validate(Token token); @Override boolean equals(Object o); @Override int hashCode(); }
XsuaaJkuValidator implements Validator<Token> { @Override public ValidationResult validate(Token token) { String tokenKeyUrl = token.getHeaderParameterAsString(TokenHeader.JWKS_URL); URI jkuUri; if (tokenKeyUrl == null || tokenKeyUrl.trim().isEmpty()) { return createInvalid( "Issuer validation can not be performed because Jwt token does not contain 'jku' header parameter."); } try { jkuUri = URI.create(tokenKeyUrl); } catch (IllegalArgumentException e) { return createInvalid( "Issuer validation can not be performed because Jwt token does not contain a valid uri as 'jku' header parameter."); } if (!matchesTokenKeyUrlDomain(jkuUri)) { return createInvalid( "Issuer is not trusted because 'jku' '{}' does not match uaa domain '{}' of the identity service.", jkuUri, domain); } if (!matchesTokenKeyEndpoint(jkuUri)) { return createInvalid( "Jwt token does not contain a valid 'jku' header parameter.", jkuUri, domain); } return createValid(); } XsuaaJkuValidator(String uaaDomain); @Override ValidationResult validate(Token token); @Override boolean equals(Object o); @Override int hashCode();  }