From commits-return-52318-apmail-cxf-commits-archive=cxf.apache.org@cxf.apache.org Mon Sep 16 12:20:25 2019 Return-Path: X-Original-To: apmail-cxf-commits-archive@www.apache.org Delivered-To: apmail-cxf-commits-archive@www.apache.org Received: from mail.apache.org (hermes.apache.org [207.244.88.153]) by minotaur.apache.org (Postfix) with SMTP id 1647A19DA5 for ; Mon, 16 Sep 2019 12:20:25 +0000 (UTC) Received: (qmail 71942 invoked by uid 500); 16 Sep 2019 12:20:24 -0000 Delivered-To: apmail-cxf-commits-archive@cxf.apache.org Received: (qmail 71760 invoked by uid 500); 16 Sep 2019 12:20:23 -0000 Mailing-List: contact commits-help@cxf.apache.org; run by ezmlm Precedence: bulk List-Help: List-Unsubscribe: List-Post: List-Id: Reply-To: dev@cxf.apache.org Delivered-To: mailing list commits@cxf.apache.org Received: (qmail 71494 invoked by uid 99); 16 Sep 2019 12:20:23 -0000 Received: from ec2-52-202-80-70.compute-1.amazonaws.com (HELO gitbox.apache.org) (52.202.80.70) by apache.org (qpsmtpd/0.29) with ESMTP; Mon, 16 Sep 2019 12:20:23 +0000 Received: by gitbox.apache.org (ASF Mail Server at gitbox.apache.org, from userid 33) id 9CCF98094A; Mon, 16 Sep 2019 12:20:22 +0000 (UTC) Date: Mon, 16 Sep 2019 12:20:27 +0000 To: "commits@cxf.apache.org" Subject: [cxf] 06/10: Adding OAuth token revocation tests MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit From: coheigea@apache.org In-Reply-To: <156863642168.14308.11458848071400681134@gitbox.apache.org> References: <156863642168.14308.11458848071400681134@gitbox.apache.org> X-Git-Host: gitbox.apache.org X-Git-Repo: cxf X-Git-Refname: refs/heads/master X-Git-Reftype: branch X-Git-Rev: 28d265696ec788fae048aa7ec49ef7938ad8c2ed X-Git-NotificationType: diff X-Git-Multimail-Version: 1.5.dev Auto-Submitted: auto-generated Message-Id: <20190916122022.9CCF98094A@gitbox.apache.org> This is an automated email from the ASF dual-hosted git repository. coheigea pushed a commit to branch master in repository https://gitbox.apache.org/repos/asf/cxf.git commit 28d265696ec788fae048aa7ec49ef7938ad8c2ed Author: Colm O hEigeartaigh AuthorDate: Thu Sep 12 22:14:11 2019 +0100 Adding OAuth token revocation tests --- .../oauth2/grants/RevocationServiceTest.java | 266 +++++++++++++++++++++ .../oauth2/grants/revocation-server-jcache-jwt.xml | 139 +++++++++++ .../oauth2/grants/revocation-server-jcache.xml | 128 ++++++++++ .../oauth2/grants/revocation-server-jpa.xml | 141 +++++++++++ 4 files changed, 674 insertions(+) diff --git a/systests/rs-security/src/test/java/org/apache/cxf/systest/jaxrs/security/oauth2/grants/RevocationServiceTest.java b/systests/rs-security/src/test/java/org/apache/cxf/systest/jaxrs/security/oauth2/grants/RevocationServiceTest.java new file mode 100644 index 0000000..057eda6 --- /dev/null +++ b/systests/rs-security/src/test/java/org/apache/cxf/systest/jaxrs/security/oauth2/grants/RevocationServiceTest.java @@ -0,0 +1,266 @@ +/** + * Licensed to the Apache Software Foundation (ASF) under one + * or more contributor license agreements. See the NOTICE file + * distributed with this work for additional information + * regarding copyright ownership. The ASF licenses this file + * to you under the Apache License, Version 2.0 (the + * "License"); you may not use this file except in compliance + * with the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + */ +package org.apache.cxf.systest.jaxrs.security.oauth2.grants; + +import java.net.URL; +import java.util.Arrays; +import java.util.Collection; + +import javax.ws.rs.core.Form; +import javax.ws.rs.core.Response; + +import org.apache.cxf.Bus; +import org.apache.cxf.BusFactory; +import org.apache.cxf.bus.spring.SpringBusFactory; +import org.apache.cxf.jaxrs.client.WebClient; +import org.apache.cxf.rs.security.oauth2.common.ClientAccessToken; +import org.apache.cxf.rs.security.oauth2.common.TokenIntrospection; +import org.apache.cxf.systest.jaxrs.security.SecurityTestUtil; +import org.apache.cxf.systest.jaxrs.security.oauth2.common.OAuth2TestUtils; +import org.apache.cxf.testutil.common.AbstractBusClientServerTestBase; +import org.apache.cxf.testutil.common.AbstractBusTestServerBase; +import org.apache.cxf.testutil.common.TestUtil; + +import org.junit.AfterClass; +import org.junit.BeforeClass; +import org.junit.runner.RunWith; +import org.junit.runners.Parameterized.Parameters; + +import static org.junit.Assert.assertEquals; +import static org.junit.Assert.assertFalse; +import static org.junit.Assert.assertNotNull; +import static org.junit.Assert.assertTrue; + +/** + * Some unit tests for the token revocation service in CXF. The tests are run multiple times with different + * OAuthDataProvider implementations: + * a) JCACHE_PORT - JCache + * b) JWT_JCACHE_PORT - JCache with useJwtFormatForAccessTokens enabled + * c) JPA_PORT - JPA provider + */ +@RunWith(value = org.junit.runners.Parameterized.class) +public class RevocationServiceTest extends AbstractBusClientServerTestBase { + + public static final String JCACHE_PORT = TestUtil.getPortNumber("jaxrs-oauth2-revocation-jcache"); + public static final String JCACHE_PORT2 = TestUtil.getPortNumber("jaxrs-oauth2-revocation2-jcache"); + public static final String JWT_JCACHE_PORT = TestUtil.getPortNumber("jaxrs-oauth2-revocation-jcache-jwt"); + public static final String JWT_JCACHE_PORT2 = TestUtil.getPortNumber("jaxrs-oauth2-revocation2-jcache-jwt"); + public static final String JPA_PORT = TestUtil.getPortNumber("jaxrs-oauth2-revocation-jpa"); + public static final String JPA_PORT2 = TestUtil.getPortNumber("jaxrs-oauth2-revocation2-jpa"); + + final String port; + + public RevocationServiceTest(String port) { + this.port = port; + } + + @BeforeClass + public static void startServers() throws Exception { + assertTrue("server did not launch correctly", + launchServer(BookServerOAuth2RevocationJCache.class, true)); + assertTrue("server did not launch correctly", + launchServer(BookServerOAuth2RevocationJCacheJWT.class, true)); + assertTrue("server did not launch correctly", + launchServer(BookServerOAuth2RevocationJPA.class, true)); + } + + @AfterClass + public static void cleanup() throws Exception { + SecurityTestUtil.cleanup(); + } + + @Parameters(name = "{0}") + public static Collection data() { + + return Arrays.asList(JCACHE_PORT, JWT_JCACHE_PORT, JPA_PORT); + } + + @org.junit.Test + public void testAccessTokenRevocation() throws Exception { + URL busFile = RevocationServiceTest.class.getResource("client.xml"); + + String address = "https://localhost:" + port + "/services/"; + WebClient client = WebClient.create(address, OAuth2TestUtils.setupProviders(), + "alice", "security", busFile.toString()); + // Save the Cookie for the second request... + WebClient.getConfig(client).getRequestContext().put( + org.apache.cxf.message.Message.MAINTAIN_SESSION, Boolean.TRUE); + + // Get Authorization Code + String code = OAuth2TestUtils.getAuthorizationCode(client); + assertNotNull(code); + + // Now get the access token + client = WebClient.create(address, OAuth2TestUtils.setupProviders(), + "consumer-id", "this-is-a-secret", busFile.toString()); + // Save the Cookie for the second request... + WebClient.getConfig(client).getRequestContext().put( + org.apache.cxf.message.Message.MAINTAIN_SESSION, Boolean.TRUE); + + ClientAccessToken accessToken = OAuth2TestUtils.getAccessTokenWithAuthorizationCode(client, code); + assertNotNull(accessToken.getTokenKey()); + + // Now query the token introspection service to make sure the token is valid + client = WebClient.create(address, OAuth2TestUtils.setupProviders(), + "consumer-id", "this-is-a-secret", busFile.toString()); + client.accept("application/json").type("application/x-www-form-urlencoded"); + Form form = new Form(); + form.param("token", accessToken.getTokenKey()); + client.path("introspect/"); + Response response = client.post(form); + + TokenIntrospection tokenIntrospection = response.readEntity(TokenIntrospection.class); + assertTrue(tokenIntrospection.isActive()); + + // Now revoke the token + client = WebClient.create(address, OAuth2TestUtils.setupProviders(), + "consumer-id", "this-is-a-secret", busFile.toString()); + client.accept("application/json").type("application/x-www-form-urlencoded"); + form = new Form(); + form.param("token", accessToken.getTokenKey()); + client.path("revoke/"); + response = client.post(form); + assertEquals(200, response.getStatus()); + + // Now check the token introspection service again to make sure the token is not valid + client = WebClient.create(address, OAuth2TestUtils.setupProviders(), + "consumer-id", "this-is-a-secret", busFile.toString()); + client.accept("application/json").type("application/x-www-form-urlencoded"); + form = new Form(); + form.param("token", accessToken.getTokenKey()); + client.path("introspect/"); + response = client.post(form); + + tokenIntrospection = response.readEntity(TokenIntrospection.class); + assertFalse(tokenIntrospection.isActive()); + } + + @org.junit.Test + public void testRefreshTokenRevocation() throws Exception { + URL busFile = RevocationServiceTest.class.getResource("client.xml"); + + String address = "https://localhost:" + port + "/services/"; + WebClient client = WebClient.create(address, OAuth2TestUtils.setupProviders(), + "alice", "security", busFile.toString()); + // Save the Cookie for the second request... + WebClient.getConfig(client).getRequestContext().put( + org.apache.cxf.message.Message.MAINTAIN_SESSION, Boolean.TRUE); + + // Get Authorization Code + String code = OAuth2TestUtils.getAuthorizationCode(client); + assertNotNull(code); + + // Now get the access token + client = WebClient.create(address, OAuth2TestUtils.setupProviders(), + "consumer-id", "this-is-a-secret", busFile.toString()); + // Save the Cookie for the second request... + WebClient.getConfig(client).getRequestContext().put( + org.apache.cxf.message.Message.MAINTAIN_SESSION, Boolean.TRUE); + + ClientAccessToken accessToken = OAuth2TestUtils.getAccessTokenWithAuthorizationCode(client, code); + assertNotNull(accessToken.getTokenKey()); + assertNotNull(accessToken.getRefreshToken()); + + // Now revoke the refresh token + client = WebClient.create(address, OAuth2TestUtils.setupProviders(), + "consumer-id", "this-is-a-secret", busFile.toString()); + client.accept("application/json").type("application/x-www-form-urlencoded"); + Form form = new Form(); + form.param("token", accessToken.getRefreshToken()); + client.path("revoke/"); + Response response = client.post(form); + assertEquals(200, response.getStatus()); + + // Now check we can't get an access token with the revoked refresh token + client = WebClient.create(address, OAuth2TestUtils.setupProviders(), + "consumer-id", "this-is-a-secret", busFile.toString()); + client.type("application/x-www-form-urlencoded").accept("application/json"); + + form = new Form(); + form.param("grant_type", "refresh_token"); + form.param("refresh_token", accessToken.getRefreshToken()); + form.param("client_id", "consumer-id"); + client.path("token"); + response = client.post(form); + assertEquals(400, response.getStatus()); + } + + // + // Server implementations + // + + public static class BookServerOAuth2RevocationJCache extends AbstractBusTestServerBase { + private static final URL SERVER_CONFIG_FILE = + BookServerOAuth2RevocationJCache.class.getResource("revocation-server-jcache.xml"); + + protected void run() { + SpringBusFactory bf = new SpringBusFactory(); + Bus springBus = bf.createBus(SERVER_CONFIG_FILE); + BusFactory.setDefaultBus(springBus); + setBus(springBus); + + try { + new BookServerOAuth2RevocationJCache(); + } catch (Exception e) { + throw new RuntimeException(e); + } + } + + } + + public static class BookServerOAuth2RevocationJCacheJWT extends AbstractBusTestServerBase { + private static final URL SERVER_CONFIG_FILE = + BookServerOAuth2RevocationJCacheJWT.class.getResource("revocation-server-jcache-jwt.xml"); + + protected void run() { + SpringBusFactory bf = new SpringBusFactory(); + Bus springBus = bf.createBus(SERVER_CONFIG_FILE); + BusFactory.setDefaultBus(springBus); + setBus(springBus); + + try { + new BookServerOAuth2RevocationJCacheJWT(); + } catch (Exception e) { + throw new RuntimeException(e); + } + } + + } + + public static class BookServerOAuth2RevocationJPA extends AbstractBusTestServerBase { + private static final URL SERVER_CONFIG_FILE = + BookServerOAuth2RevocationJPA.class.getResource("revocation-server-jpa.xml"); + + protected void run() { + SpringBusFactory bf = new SpringBusFactory(); + Bus springBus = bf.createBus(SERVER_CONFIG_FILE); + BusFactory.setDefaultBus(springBus); + setBus(springBus); + + try { + new BookServerOAuth2RevocationJPA(); + } catch (Exception e) { + throw new RuntimeException(e); + } + } + + } + + +} diff --git a/systests/rs-security/src/test/resources/org/apache/cxf/systest/jaxrs/security/oauth2/grants/revocation-server-jcache-jwt.xml b/systests/rs-security/src/test/resources/org/apache/cxf/systest/jaxrs/security/oauth2/grants/revocation-server-jcache-jwt.xml new file mode 100644 index 0000000..a846f9e --- /dev/null +++ b/systests/rs-security/src/test/resources/org/apache/cxf/systest/jaxrs/security/oauth2/grants/revocation-server-jcache-jwt.xml @@ -0,0 +1,139 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + true + + + + + ${testutil.ports.jaxrs-oauth2-revocation2-jcache-jwt} + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/systests/rs-security/src/test/resources/org/apache/cxf/systest/jaxrs/security/oauth2/grants/revocation-server-jcache.xml b/systests/rs-security/src/test/resources/org/apache/cxf/systest/jaxrs/security/oauth2/grants/revocation-server-jcache.xml new file mode 100644 index 0000000..9350e9a --- /dev/null +++ b/systests/rs-security/src/test/resources/org/apache/cxf/systest/jaxrs/security/oauth2/grants/revocation-server-jcache.xml @@ -0,0 +1,128 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + true + + + + + ${testutil.ports.jaxrs-oauth2-revocation2-jcache} + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/systests/rs-security/src/test/resources/org/apache/cxf/systest/jaxrs/security/oauth2/grants/revocation-server-jpa.xml b/systests/rs-security/src/test/resources/org/apache/cxf/systest/jaxrs/security/oauth2/grants/revocation-server-jpa.xml new file mode 100644 index 0000000..cb77014 --- /dev/null +++ b/systests/rs-security/src/test/resources/org/apache/cxf/systest/jaxrs/security/oauth2/grants/revocation-server-jpa.xml @@ -0,0 +1,141 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + true + + + + + + + + + + + + + + + ${testutil.ports.jaxrs-oauth2-revocation2-jpa} + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +