@Test public void testValidateTicketWithBadAudience() throws Exception { JWTAuthenticator auth = new JWTAuthenticator(); HttpServletRequest request = mock(HttpServletRequest.class); HttpServletResponse response = mock(HttpServletResponse.class); String ticket = service.newBuilder().withClaim(JWTClaims.CLAIM_AUDIENCE, "nxfile").build(); when(request.getHeader(eq(AUTHORIZATION))).thenReturn(BEARER_SP + ticket); when(request.getServletPath()).thenReturn("/api/v1"); when(request.getPathInfo()).thenReturn("/foo/bar"); UserIdentificationInfo uii = auth.handleRetrieveIdentity(request, response); assertNull(uii); }
@Override public UserIdentificationInfo handleRetrieveIdentity(HttpServletRequest request, HttpServletResponse response) { String token = retrieveToken(request); if (token == null) { log.trace("No JWT token"); return null; } JWTService service = Framework.getService(JWTService.class); Map<String, Object> claims = service.verifyToken(token); if (claims == null) { log.trace("JWT token invalid"); return null; } Object sub = claims.get(CLAIM_SUBJECT); if (!(sub instanceof String)) { log.trace("JWT token contains non-String subject claim"); return null; } String username = (String) sub; if (log.isTraceEnabled()) { log.trace("JWT token valid for username: " + username); } Object aud = claims.get(CLAIM_AUDIENCE); if (aud != null) { if (!(aud instanceof String)) { log.trace("JWT token contains non-String audience claim"); return null; } String audience = StringUtils.strip((String) aud, "/"); String path = getRequestPath(request); if (!isEqualOrPathPrefix(path, audience)) { if (log.isTraceEnabled()) { log.trace("JWT token for audience: " + audience + " but used with path: " + path); } return null; } } return new UserIdentificationInfo(username); }
JWTAuthenticator implements NuxeoAuthenticationPlugin { @Override public UserIdentificationInfo handleRetrieveIdentity(HttpServletRequest request, HttpServletResponse response) { String token = retrieveToken(request); if (token == null) { log.trace("No JWT token"); return null; } JWTService service = Framework.getService(JWTService.class); Map<String, Object> claims = service.verifyToken(token); if (claims == null) { log.trace("JWT token invalid"); return null; } Object sub = claims.get(CLAIM_SUBJECT); if (!(sub instanceof String)) { log.trace("JWT token contains non-String subject claim"); return null; } String username = (String) sub; if (log.isTraceEnabled()) { log.trace("JWT token valid for username: " + username); } Object aud = claims.get(CLAIM_AUDIENCE); if (aud != null) { if (!(aud instanceof String)) { log.trace("JWT token contains non-String audience claim"); return null; } String audience = StringUtils.strip((String) aud, "/"); String path = getRequestPath(request); if (!isEqualOrPathPrefix(path, audience)) { if (log.isTraceEnabled()) { log.trace("JWT token for audience: " + audience + " but used with path: " + path); } return null; } } return new UserIdentificationInfo(username); } }
JWTAuthenticator implements NuxeoAuthenticationPlugin { @Override public UserIdentificationInfo handleRetrieveIdentity(HttpServletRequest request, HttpServletResponse response) { String token = retrieveToken(request); if (token == null) { log.trace("No JWT token"); return null; } JWTService service = Framework.getService(JWTService.class); Map<String, Object> claims = service.verifyToken(token); if (claims == null) { log.trace("JWT token invalid"); return null; } Object sub = claims.get(CLAIM_SUBJECT); if (!(sub instanceof String)) { log.trace("JWT token contains non-String subject claim"); return null; } String username = (String) sub; if (log.isTraceEnabled()) { log.trace("JWT token valid for username: " + username); } Object aud = claims.get(CLAIM_AUDIENCE); if (aud != null) { if (!(aud instanceof String)) { log.trace("JWT token contains non-String audience claim"); return null; } String audience = StringUtils.strip((String) aud, "/"); String path = getRequestPath(request); if (!isEqualOrPathPrefix(path, audience)) { if (log.isTraceEnabled()) { log.trace("JWT token for audience: " + audience + " but used with path: " + path); } return null; } } return new UserIdentificationInfo(username); }  }
JWTAuthenticator implements NuxeoAuthenticationPlugin { @Override public UserIdentificationInfo handleRetrieveIdentity(HttpServletRequest request, HttpServletResponse response) { String token = retrieveToken(request); if (token == null) { log.trace("No JWT token"); return null; } JWTService service = Framework.getService(JWTService.class); Map<String, Object> claims = service.verifyToken(token); if (claims == null) { log.trace("JWT token invalid"); return null; } Object sub = claims.get(CLAIM_SUBJECT); if (!(sub instanceof String)) { log.trace("JWT token contains non-String subject claim"); return null; } String username = (String) sub; if (log.isTraceEnabled()) { log.trace("JWT token valid for username: " + username); } Object aud = claims.get(CLAIM_AUDIENCE); if (aud != null) { if (!(aud instanceof String)) { log.trace("JWT token contains non-String audience claim"); return null; } String audience = StringUtils.strip((String) aud, "/"); String path = getRequestPath(request); if (!isEqualOrPathPrefix(path, audience)) { if (log.isTraceEnabled()) { log.trace("JWT token for audience: " + audience + " but used with path: " + path); } return null; } } return new UserIdentificationInfo(username); }  @Override void initPlugin(Map<String, String> parameters); @Override List<String> getUnAuthenticatedURLPrefix(); @Override Boolean needLoginPrompt(HttpServletRequest httpRequest); @Override Boolean handleLoginPrompt(HttpServletRequest httpRequest, HttpServletResponse httpResponse, String baseURL); @Override UserIdentificationInfo handleRetrieveIdentity(HttpServletRequest request, HttpServletResponse response); }
JWTAuthenticator implements NuxeoAuthenticationPlugin { @Override public UserIdentificationInfo handleRetrieveIdentity(HttpServletRequest request, HttpServletResponse response) { String token = retrieveToken(request); if (token == null) { log.trace("No JWT token"); return null; } JWTService service = Framework.getService(JWTService.class); Map<String, Object> claims = service.verifyToken(token); if (claims == null) { log.trace("JWT token invalid"); return null; } Object sub = claims.get(CLAIM_SUBJECT); if (!(sub instanceof String)) { log.trace("JWT token contains non-String subject claim"); return null; } String username = (String) sub; if (log.isTraceEnabled()) { log.trace("JWT token valid for username: " + username); } Object aud = claims.get(CLAIM_AUDIENCE); if (aud != null) { if (!(aud instanceof String)) { log.trace("JWT token contains non-String audience claim"); return null; } String audience = StringUtils.strip((String) aud, "/"); String path = getRequestPath(request); if (!isEqualOrPathPrefix(path, audience)) { if (log.isTraceEnabled()) { log.trace("JWT token for audience: " + audience + " but used with path: " + path); } return null; } } return new UserIdentificationInfo(username); }  @Override void initPlugin(Map<String, String> parameters); @Override List<String> getUnAuthenticatedURLPrefix(); @Override Boolean needLoginPrompt(HttpServletRequest httpRequest); @Override Boolean handleLoginPrompt(HttpServletRequest httpRequest, HttpServletResponse httpResponse, String baseURL); @Override UserIdentificationInfo handleRetrieveIdentity(HttpServletRequest request, HttpServletResponse response);  }