Merge "Added authorization request with GET and deprecated that with POST."
diff --git a/full/Changes b/full/Changes
index 5117c88..4902952 100644
--- a/full/Changes
+++ b/full/Changes
@@ -8,6 +8,8 @@
- Added registration_date, refresh_token_expiry, source and is_permitted
to the oauth2_client database table, and updated the OAuth2 client
registration mechanism.
+ - Added authorization request with GET and deprecated that with POST.
+
# version 0.65.2
diff --git a/full/src/main/java/de/ids_mannheim/korap/web/controller/OAuth2Controller.java b/full/src/main/java/de/ids_mannheim/korap/web/controller/OAuth2Controller.java
index 0b1d438..e29ad15 100644
--- a/full/src/main/java/de/ids_mannheim/korap/web/controller/OAuth2Controller.java
+++ b/full/src/main/java/de/ids_mannheim/korap/web/controller/OAuth2Controller.java
@@ -6,9 +6,11 @@
import javax.servlet.http.HttpServletRequest;
import javax.ws.rs.Consumes;
import javax.ws.rs.FormParam;
+import javax.ws.rs.GET;
import javax.ws.rs.POST;
import javax.ws.rs.Path;
import javax.ws.rs.Produces;
+import javax.ws.rs.QueryParam;
import javax.ws.rs.core.Context;
import javax.ws.rs.core.MediaType;
import javax.ws.rs.core.MultivaluedMap;
@@ -92,6 +94,7 @@
* form parameters
* @return a redirect URL
*/
+ @Deprecated
@POST
@Path("authorize")
@Consumes(MediaType.APPLICATION_FORM_URLENCODED)
@@ -125,6 +128,38 @@
throw responseHandler.throwit(e, state);
}
}
+
+ @GET
+ @Path("authorize")
+ public Response requestAuthorizationCode (
+ @Context HttpServletRequest request,
+ @Context SecurityContext context,
+ @QueryParam("state") String state
+ ) {
+
+ TokenContext tokenContext = (TokenContext) context.getUserPrincipal();
+ String username = tokenContext.getUsername();
+ ZonedDateTime authTime = tokenContext.getAuthenticationTime();
+
+ try {
+ scopeService.verifyScope(tokenContext, OAuth2Scope.AUTHORIZE);
+
+ OAuth2AuthorizationRequest authzRequest =
+ new OAuth2AuthorizationRequest(request);
+ String uri = authorizationService.requestAuthorizationCode(
+ request, authzRequest, username, authTime);
+ return responseHandler.sendRedirect(uri);
+ }
+ catch (OAuthSystemException e) {
+ throw responseHandler.throwit(e, state);
+ }
+ catch (OAuthProblemException e) {
+ throw responseHandler.throwit(e, state);
+ }
+ catch (KustvaktException e) {
+ throw responseHandler.throwit(e, state);
+ }
+ }
/**
* Grants a client an access token, namely a string used in
diff --git a/full/src/main/resources/db/test/V3.5__insert_oauth2_clients.sql b/full/src/main/resources/db/test/V3.5__insert_oauth2_clients.sql
index 043426d..b2d6949 100644
--- a/full/src/main/resources/db/test/V3.5__insert_oauth2_clients.sql
+++ b/full/src/main/resources/db/test/V3.5__insert_oauth2_clients.sql
@@ -24,12 +24,11 @@
"http://third.party.com/confidential", CURRENT_TIMESTAMP,1);
INSERT INTO oauth2_client(id,name,secret,type,super,
- redirect_uri,registered_by, description,url, registration_date,
+ registered_by, description,url, registration_date,
is_permitted)
VALUES ("52atrL0ajex_3_5imd9Mgw","confidential client 2",
"$2a$08$vi1FbuN3p6GcI1tSxMAoeuIYL8Yw3j6A8wJthaN8ZboVnrQaTwLPq",
- "CONFIDENTIAL", 0,
- "https://example.client.de/redirect", "system",
+ "CONFIDENTIAL", 0,"system",
"This is a test nonsuper confidential client.",
"http://example.client.de", CURRENT_TIMESTAMP, 1);
diff --git a/full/src/test/java/de/ids_mannheim/korap/web/controller/OAuth2AccessTokenTest.java b/full/src/test/java/de/ids_mannheim/korap/web/controller/OAuth2AccessTokenTest.java
index f6768f1..eeae3b7 100644
--- a/full/src/test/java/de/ids_mannheim/korap/web/controller/OAuth2AccessTokenTest.java
+++ b/full/src/test/java/de/ids_mannheim/korap/web/controller/OAuth2AccessTokenTest.java
@@ -5,6 +5,7 @@
import static org.junit.Assert.assertTrue;
import java.io.IOException;
+import java.net.URI;
import javax.ws.rs.core.MultivaluedMap;
import javax.ws.rs.core.Response.Status;
@@ -12,6 +13,8 @@
import org.apache.http.entity.ContentType;
import org.apache.oltu.oauth2.common.message.types.GrantType;
import org.junit.Test;
+import org.springframework.util.MultiValueMap;
+import org.springframework.web.util.UriComponentsBuilder;
import com.fasterxml.jackson.databind.JsonNode;
import com.google.common.net.HttpHeaders;
@@ -60,9 +63,17 @@
@Test
public void testCustomScope () throws KustvaktException {
- String code = requestAuthorizationCode(confidentialClientId,
- clientSecret, OAuth2Scope.VC_INFO.toString(), userAuthHeader);
- ClientResponse response = requestTokenWithAuthorizationCodeAndForm(
+ ClientResponse response =
+ requestAuthorizationCode("code", confidentialClientId, "",
+ OAuth2Scope.VC_INFO.toString(), "", userAuthHeader);
+ assertEquals(Status.TEMPORARY_REDIRECT.getStatusCode(),
+ response.getStatus());
+ URI redirectUri = response.getLocation();
+ MultiValueMap<String, String> params = UriComponentsBuilder
+ .fromUri(redirectUri).build().getQueryParams();
+ String code = params.getFirst("code");
+
+ response = requestTokenWithAuthorizationCodeAndForm(
confidentialClientId, clientSecret, code);
JsonNode node = JsonUtils.readTree(response.getEntity(String.class));
@@ -82,8 +93,7 @@
@Test
public void testDefaultScope () throws KustvaktException, IOException {
- String code = requestAuthorizationCode(confidentialClientId, clientSecret,
- null, userAuthHeader);
+ String code = requestAuthorizationCode(confidentialClientId, userAuthHeader);
ClientResponse response = requestTokenWithAuthorizationCodeAndForm(
confidentialClientId, clientSecret, code);
assertEquals(Status.OK.getStatusCode(), response.getStatus());
@@ -160,7 +170,7 @@
public void testRevokeAccessTokenConfidentialClient ()
throws KustvaktException {
String code = requestAuthorizationCode(confidentialClientId,
- clientSecret, null, userAuthHeader);
+ userAuthHeader);
JsonNode node = requestTokenWithAuthorizationCodeAndHeader(
confidentialClientId, code, clientAuthHeader);
@@ -183,7 +193,7 @@
@Test
public void testRevokeAccessTokenPublicClientViaSuperClient()
throws KustvaktException {
- String code = requestAuthorizationCode(publicClientId, "", null,
+ String code = requestAuthorizationCode(publicClientId,
userAuthHeader);
ClientResponse response = requestTokenWithAuthorizationCodeAndForm(
publicClientId, "", code);
@@ -211,8 +221,8 @@
@Test
public void testAccessTokenAfterRequestRefreshToken ()
throws KustvaktException, IOException {
- String code = requestAuthorizationCode(confidentialClientId,
- clientSecret, null, userAuthHeader);
+ String code =
+ requestAuthorizationCode(confidentialClientId, userAuthHeader);
JsonNode node = requestTokenWithAuthorizationCodeAndHeader(
confidentialClientId, code, clientAuthHeader);
@@ -245,22 +255,13 @@
public void testRequestAuthorizationWithBearerTokenUnauthorized ()
throws KustvaktException {
String code = requestAuthorizationCode(confidentialClientId,
- clientSecret, null, userAuthHeader);
+ userAuthHeader);
JsonNode node = requestTokenWithAuthorizationCodeAndHeader(
confidentialClientId, code, clientAuthHeader);
String userAuthToken = node.at("/access_token").asText();
- MultivaluedMap<String, String> form = new MultivaluedMapImpl();
- form.add("response_type", "code");
- form.add("client_id", confidentialClientId);
- form.add("client_secret", clientSecret);
-
- ClientResponse response = resource().path(API_VERSION).path("oauth2").path("authorize")
- .header(Attributes.AUTHORIZATION, "Bearer " + userAuthToken)
- .header(HttpHeaders.X_FORWARDED_FOR, "149.27.0.32")
- .header(HttpHeaders.CONTENT_TYPE,
- ContentType.APPLICATION_FORM_URLENCODED)
- .entity(form).post(ClientResponse.class);
+ ClientResponse response = requestAuthorizationCode("code",
+ confidentialClientId, "", "", "", "Bearer " + userAuthToken);
assertEquals(Status.UNAUTHORIZED.getStatusCode(), response.getStatus());
@@ -286,7 +287,7 @@
assertNotNull(node.at("/expires_in").asText());
String code = requestAuthorizationCode(superClientId,
- clientSecret, null, "Bearer " + userAuthToken);
+ "Bearer " + userAuthToken);
assertNotNull(code);
}
diff --git a/full/src/test/java/de/ids_mannheim/korap/web/controller/OAuth2AdminControllerTest.java b/full/src/test/java/de/ids_mannheim/korap/web/controller/OAuth2AdminControllerTest.java
index 435bf1b..b656b63 100644
--- a/full/src/test/java/de/ids_mannheim/korap/web/controller/OAuth2AdminControllerTest.java
+++ b/full/src/test/java/de/ids_mannheim/korap/web/controller/OAuth2AdminControllerTest.java
@@ -96,9 +96,7 @@
public void testCleanRevokedTokens () throws KustvaktException {
int accessTokensBefore = accessDao.retrieveInvalidAccessTokens().size();
-
- String code = requestAuthorizationCode(publicClientId, "", null,
- userAuthHeader);
+ String code = requestAuthorizationCode(publicClientId, userAuthHeader);
ClientResponse response = requestTokenWithAuthorizationCodeAndForm(
publicClientId, clientSecret, code);
@@ -129,8 +127,7 @@
// request an access token
String clientAuthHeader = HttpAuthorizationHandler
.createBasicAuthorizationHeaderValue(clientId, clientSecret);
- String code = requestAuthorizationCode(clientId, clientSecret, null,
- userAuthHeader);
+ String code = requestAuthorizationCode(clientId, userAuthHeader);
node = requestTokenWithAuthorizationCodeAndHeader(clientId, code,
clientAuthHeader);
String accessToken = node.at("/access_token").asText();
diff --git a/full/src/test/java/de/ids_mannheim/korap/web/controller/OAuth2AuthorizationPostTest.java b/full/src/test/java/de/ids_mannheim/korap/web/controller/OAuth2AuthorizationPostTest.java
new file mode 100644
index 0000000..7501798
--- /dev/null
+++ b/full/src/test/java/de/ids_mannheim/korap/web/controller/OAuth2AuthorizationPostTest.java
@@ -0,0 +1,97 @@
+package de.ids_mannheim.korap.web.controller;
+
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertNotNull;
+
+import java.net.URI;
+
+import javax.ws.rs.core.MultivaluedMap;
+
+import org.apache.http.entity.ContentType;
+import org.apache.oltu.oauth2.common.message.types.TokenType;
+import org.junit.Test;
+import org.springframework.util.MultiValueMap;
+import org.springframework.web.util.UriComponentsBuilder;
+
+import com.fasterxml.jackson.databind.JsonNode;
+import com.google.common.net.HttpHeaders;
+import com.sun.jersey.api.client.ClientResponse;
+import com.sun.jersey.api.client.ClientResponse.Status;
+import com.sun.jersey.api.uri.UriComponent;
+import com.sun.jersey.core.util.MultivaluedMapImpl;
+
+import de.ids_mannheim.korap.authentication.http.HttpAuthorizationHandler;
+import de.ids_mannheim.korap.config.Attributes;
+import de.ids_mannheim.korap.exceptions.KustvaktException;
+import de.ids_mannheim.korap.utils.JsonUtils;
+
+public class OAuth2AuthorizationPostTest extends OAuth2TestBase {
+
+ public String userAuthHeader;
+
+ public OAuth2AuthorizationPostTest () throws KustvaktException {
+ userAuthHeader = HttpAuthorizationHandler
+ .createBasicAuthorizationHeaderValue("dory", "password");
+ }
+
+ private ClientResponse requestAuthorizationCode (
+ MultivaluedMap<String, String> form, String authHeader)
+ throws KustvaktException {
+
+ return resource().path(API_VERSION).path("oauth2").path("authorize")
+ .header(Attributes.AUTHORIZATION, authHeader)
+ .header(HttpHeaders.X_FORWARDED_FOR, "149.27.0.32")
+ .header(HttpHeaders.CONTENT_TYPE,
+ ContentType.APPLICATION_FORM_URLENCODED)
+ .entity(form).post(ClientResponse.class);
+ }
+
+ @Test
+ public void testAuthorizeConfidentialClient () throws KustvaktException {
+ MultivaluedMap<String, String> form = new MultivaluedMapImpl();
+ form.add("response_type", "code");
+ form.add("client_id", confidentialClientId);
+ form.add("state", "thisIsMyState");
+
+ ClientResponse response =
+ requestAuthorizationCode(form, userAuthHeader);
+
+ assertEquals(Status.TEMPORARY_REDIRECT.getStatusCode(),
+ response.getStatus());
+ URI redirectUri = response.getLocation();
+ MultiValueMap<String, String> params = UriComponentsBuilder
+ .fromUri(redirectUri).build().getQueryParams();
+ assertNotNull(params.getFirst("code"));
+ assertEquals("thisIsMyState", params.getFirst("state"));
+ }
+
+ @Test
+ public void testRequestTokenAuthorizationConfidential ()
+ throws KustvaktException {
+
+ MultivaluedMap<String, String> authForm = new MultivaluedMapImpl();
+ authForm.add("response_type", "code");
+ authForm.add("client_id", confidentialClientId);
+ authForm.add("scope", "search");
+
+ ClientResponse response =
+ requestAuthorizationCode(authForm, userAuthHeader);
+ URI redirectUri = response.getLocation();
+ MultivaluedMap<String, String> params =
+ UriComponent.decodeQuery(redirectUri, true);
+ String code = params.get("code").get(0);
+ String scopes = params.get("scope").get(0);
+
+ assertEquals(scopes, "search");
+
+ response = requestTokenWithAuthorizationCodeAndForm(
+ confidentialClientId, clientSecret, code);
+ String entity = response.getEntity(String.class);
+ JsonNode node = JsonUtils.readTree(entity);
+ assertNotNull(node.at("/access_token").asText());
+ assertNotNull(node.at("/refresh_token").asText());
+ assertEquals(TokenType.BEARER.toString(),
+ node.at("/token_type").asText());
+ assertNotNull(node.at("/expires_in").asText());
+ }
+}
diff --git a/full/src/test/java/de/ids_mannheim/korap/web/controller/OAuth2ClientControllerTest.java b/full/src/test/java/de/ids_mannheim/korap/web/controller/OAuth2ClientControllerTest.java
index ec73796..1cf6c9c 100644
--- a/full/src/test/java/de/ids_mannheim/korap/web/controller/OAuth2ClientControllerTest.java
+++ b/full/src/test/java/de/ids_mannheim/korap/web/controller/OAuth2ClientControllerTest.java
@@ -119,7 +119,7 @@
assertNotNull(clientId);
assertNotNull(clientSecret);
assertFalse(clientId.contains("a"));
-
+
testConfidentialClientInfo(clientId, username);
testResetConfidentialClientSecret(clientId, clientSecret);
deregisterConfidentialClient(username, clientId);
@@ -238,11 +238,12 @@
@Test
public void testRegisterPublicClient () throws UniformInterfaceException,
ClientHandlerException, KustvaktException {
+ String redirectUri = "https://test.public.client.com/redirect";
OAuth2ClientJson clientJson =
createOAuth2ClientJson("OAuth2PublicClient",
OAuth2ClientType.PUBLIC, "A public test client.");
clientJson.setUrl("http://test.public.client.com");
- clientJson.setRedirectURI("https://test.public.client.com/redirect");
+ clientJson.setRedirectURI(redirectUri);
ClientResponse response = registerClient(username, clientJson);
@@ -255,7 +256,7 @@
testRegisterClientUnauthorizedScope(clientId);
testResetPublicClientSecret(clientId);
- testAccessTokenAfterDeregistration(clientId, null, null);
+ testAccessTokenAfterDeregistration(clientId, null, "");
}
private void testRegisterClientUnauthorizedScope (String clientId)
@@ -264,10 +265,9 @@
String userAuthHeader = HttpAuthorizationHandler
.createBasicAuthorizationHeaderValue("dory", "password");
- String code = requestAuthorizationCode(clientId, "", null,
- userAuthHeader, null);
+ String code = requestAuthorizationCode(clientId, userAuthHeader);
ClientResponse response = requestTokenWithAuthorizationCodeAndForm(
- clientId, clientSecret, code, null);
+ clientId, clientSecret, code);
JsonNode node = JsonUtils.readTree(response.getEntity(String.class));
assertEquals("match_info search", node.at("/scope").asText());
@@ -318,7 +318,7 @@
assertTrue(node.at("/client_secret").isMissingNode());
testResetPublicClientSecret(clientId);
- testAccessTokenAfterDeregistration(clientId, null, null);
+ testAccessTokenAfterDeregistration(clientId, null, "");
}
@Test
@@ -387,8 +387,8 @@
String userAuthHeader = HttpAuthorizationHandler
.createBasicAuthorizationHeaderValue("dory", "password");
- String code = requestAuthorizationCode(clientId, "", null,
- userAuthHeader, redirectUri);
+ String code = requestAuthorizationCode(clientId, redirectUri, userAuthHeader);
+
ClientResponse response = requestTokenWithAuthorizationCodeAndForm(
clientId, clientSecret, code, redirectUri);
JsonNode node = JsonUtils.readTree(response.getEntity(String.class));
@@ -397,8 +397,7 @@
response = searchWithAccessToken(accessToken);
assertEquals(Status.OK.getStatusCode(), response.getStatus());
- code = requestAuthorizationCode(clientId, "", null, userAuthHeader,
- redirectUri);
+ code = requestAuthorizationCode(clientId, redirectUri, userAuthHeader);
testDeregisterPublicClient(clientId, username);
response = requestTokenWithAuthorizationCodeAndForm(clientId,
@@ -552,8 +551,7 @@
assertEquals(Status.OK.getStatusCode(), response.getStatus());
// client 1
- String code = requestAuthorizationCode(publicClientId, "", null,
- userAuthHeader);
+ String code = requestAuthorizationCode(publicClientId, userAuthHeader);
response = requestTokenWithAuthorizationCodeAndForm(publicClientId, "",
code);
assertEquals(Status.OK.getStatusCode(), response.getStatus());
@@ -562,8 +560,7 @@
String accessToken = node.at("/access_token").asText();
// client 2
- code = requestAuthorizationCode(confidentialClientId, clientSecret,
- null, userAuthHeader);
+ code = requestAuthorizationCode(confidentialClientId, userAuthHeader);
response = requestTokenWithAuthorizationCodeAndForm(
confidentialClientId, clientSecret, code);
String refreshToken = node.at("/refresh_token").asText();
@@ -591,8 +588,8 @@
private void testListAuthorizedClientWithMultipleRefreshTokens (
String userAuthHeader) throws KustvaktException {
// client 2
- String code = requestAuthorizationCode(confidentialClientId,
- clientSecret, null, userAuthHeader);
+ String code =
+ requestAuthorizationCode(confidentialClientId, userAuthHeader);
ClientResponse response = requestTokenWithAuthorizationCodeAndForm(
confidentialClientId, clientSecret, code);
@@ -604,8 +601,7 @@
private void testListAuthorizedClientWithMultipleAccessTokens (
String userAuthHeader) throws KustvaktException {
// client 1
- String code = requestAuthorizationCode(publicClientId, "", null,
- userAuthHeader);
+ String code = requestAuthorizationCode(publicClientId, userAuthHeader);
ClientResponse response = requestTokenWithAuthorizationCodeAndForm(
publicClientId, "", code);
@@ -621,8 +617,7 @@
.createBasicAuthorizationHeaderValue("aaa", "pwd");
// client 1
- String code = requestAuthorizationCode(publicClientId, "", null,
- aaaAuthHeader);
+ String code = requestAuthorizationCode(publicClientId, aaaAuthHeader);
ClientResponse response = requestTokenWithAuthorizationCodeAndForm(
publicClientId, "", code);
@@ -630,8 +625,7 @@
String accessToken1 = node.at("/access_token").asText();
// client 2
- code = requestAuthorizationCode(confidentialClientId, clientSecret,
- null, aaaAuthHeader);
+ code = requestAuthorizationCode(confidentialClientId, aaaAuthHeader);
response = requestTokenWithAuthorizationCodeAndForm(
confidentialClientId, clientSecret, code);
diff --git a/full/src/test/java/de/ids_mannheim/korap/web/controller/OAuth2ControllerTest.java b/full/src/test/java/de/ids_mannheim/korap/web/controller/OAuth2ControllerTest.java
index b6cc9ef..b7911b3 100644
--- a/full/src/test/java/de/ids_mannheim/korap/web/controller/OAuth2ControllerTest.java
+++ b/full/src/test/java/de/ids_mannheim/korap/web/controller/OAuth2ControllerTest.java
@@ -47,13 +47,8 @@
@Test
public void testAuthorizeConfidentialClient () throws KustvaktException {
- MultivaluedMap<String, String> form = new MultivaluedMapImpl();
- form.add("response_type", "code");
- form.add("client_id", confidentialClientId);
- form.add("state", "thisIsMyState");
-
- ClientResponse response =
- requestAuthorizationCode(form, userAuthHeader);
+ ClientResponse response = requestAuthorizationCode("code",
+ confidentialClientId, "", "", state, userAuthHeader);
assertEquals(Status.TEMPORARY_REDIRECT.getStatusCode(),
response.getStatus());
@@ -66,22 +61,15 @@
@Test
public void testAuthorizePublicClient () throws KustvaktException {
- String code = requestAuthorizationCode(publicClientId, clientSecret,
- null, userAuthHeader);
+ String code = requestAuthorizationCode(publicClientId, userAuthHeader);
assertNotNull(code);
}
@Test
public void testAuthorizeInvalidRedirectUri () throws KustvaktException {
String redirectUri = "https://different.uri/redirect";
-
- MultivaluedMap<String, String> form = new MultivaluedMapImpl();
- form.add("response_type", "code");
- form.add("client_id", confidentialClientId);
- form.add("redirect_uri", redirectUri);
- form.add("state", "thisIsMyState");
- ClientResponse response =
- requestAuthorizationCode(form, userAuthHeader);
+ ClientResponse response = requestAuthorizationCode("code",
+ confidentialClientId, redirectUri, "", state, userAuthHeader);
assertEquals(Status.BAD_REQUEST.getStatusCode(), response.getStatus());
@@ -93,15 +81,23 @@
node.at("/error_description").asText());
assertEquals("thisIsMyState", node.at("/state").asText());
}
+
+// @Test
+// public void testAuthorizeRedirectUriLocalhost () throws KustvaktException {
+// String redirectUri = "http://localhost:1410/";
+// ClientResponse response =
+// requestAuthorizationCode("code", confidentialClientId2,
+// redirectUri, null, "myState", userAuthHeader);
+// System.out.println(response.getStatus());
+// System.out.println(response.getEntity(String.class));
+// }
@Test
public void testAuthorizeMissingRequiredParameters ()
throws KustvaktException {
- MultivaluedMap<String, String> form = new MultivaluedMapImpl();
- form.add("state", "thisIsMyState");
// missing response_type
- ClientResponse response =
- requestAuthorizationCode(form, userAuthHeader);
+ ClientResponse response = requestAuthorizationCode("",
+ confidentialClientId, "", "", state, userAuthHeader);
assertEquals(Status.BAD_REQUEST.getStatusCode(), response.getStatus());
@@ -114,8 +110,7 @@
assertEquals("thisIsMyState", node.at("/state").asText());
// missing client_id
- form.add("response_type", "code");
- response = requestAuthorizationCode(form, userAuthHeader);
+ response = requestAuthorizationCode("code","", "", "", "", userAuthHeader);
entity = response.getEntity(String.class);
node = JsonUtils.readTree(entity);
assertEquals("Missing parameters: client_id",
@@ -128,8 +123,8 @@
form.add("response_type", "string");
form.add("state", "thisIsMyState");
- ClientResponse response =
- requestAuthorizationCode(form, userAuthHeader);
+ ClientResponse response = requestAuthorizationCode("string",
+ confidentialClientId, "", "", state, userAuthHeader);
assertEquals(Status.BAD_REQUEST.getStatusCode(), response.getStatus());
String entity = response.getEntity(String.class);
@@ -143,14 +138,10 @@
@Test
public void testAuthorizeInvalidScope () throws KustvaktException {
- MultivaluedMap<String, String> form = new MultivaluedMapImpl();
- form.add("response_type", "code");
- form.add("client_id", confidentialClientId);
- form.add("scope", "read_address");
- form.add("state", "thisIsMyState");
+ String scope = "read_address";
- ClientResponse response =
- requestAuthorizationCode(form, userAuthHeader);
+ ClientResponse response = requestAuthorizationCode("code",
+ confidentialClientId, "", scope, state, userAuthHeader);
assertEquals(Status.BAD_REQUEST.getStatusCode(), response.getStatus());
URI location = response.getLocation();
@@ -165,8 +156,8 @@
@Test
public void testRequestTokenAuthorizationPublic ()
throws KustvaktException {
- String code = requestAuthorizationCode(publicClientId, "", null,
- userAuthHeader);
+ String code =
+ requestAuthorizationCode(publicClientId, userAuthHeader);
ClientResponse response = requestTokenWithAuthorizationCodeAndForm(
publicClientId, clientSecret, code);
@@ -188,13 +179,9 @@
public void testRequestTokenAuthorizationConfidential ()
throws KustvaktException {
- MultivaluedMap<String, String> authForm = new MultivaluedMapImpl();
- authForm.add("response_type", "code");
- authForm.add("client_id", confidentialClientId);
- authForm.add("scope", "search");
-
- ClientResponse response =
- requestAuthorizationCode(authForm, userAuthHeader);
+ String scope = "search";
+ ClientResponse response = requestAuthorizationCode("code",
+ confidentialClientId, "", scope, state, userAuthHeader);
URI redirectUri = response.getLocation();
MultivaluedMap<String, String> params =
UriComponent.decodeQuery(redirectUri, true);
@@ -256,15 +243,12 @@
@Test
public void testRequestTokenAuthorizationReplyAttack ()
throws KustvaktException {
- String uri = "https://third.party.com/confidential/redirect";
- MultivaluedMap<String, String> authForm = new MultivaluedMapImpl();
- authForm.add("response_type", "code");
- authForm.add("client_id", confidentialClientId);
- authForm.add("scope", "search");
- authForm.add("redirect_uri", uri);
+ String redirect_uri = "https://third.party.com/confidential/redirect";
+ String scope = "search";
ClientResponse response =
- requestAuthorizationCode(authForm, userAuthHeader);
+ requestAuthorizationCode("code", confidentialClientId,
+ redirect_uri, scope, state, userAuthHeader);
URI redirectUri = response.getLocation();
MultivaluedMap<String, String> params =
UriComponent.decodeQuery(redirectUri, true);
@@ -272,7 +256,7 @@
testRequestTokenAuthorizationInvalidClient(code);
testRequestTokenAuthorizationInvalidRedirectUri(code);
- testRequestTokenAuthorizationRevoked(code, uri);
+ testRequestTokenAuthorizationRevoked(code, redirect_uri);
}
private void testRequestTokenAuthorizationInvalidClient (String code)
@@ -701,17 +685,17 @@
String refreshToken1 = node.at("/refresh_token").asText();
// client 1
- String code = requestAuthorizationCode(confidentialClientId,
- clientSecret, null, userAuthHeader);
+ String code =
+ requestAuthorizationCode(confidentialClientId, userAuthHeader);
response = requestTokenWithAuthorizationCodeAndForm(
confidentialClientId, clientSecret, code);
assertEquals(Status.OK.getStatusCode(), response.getStatus());
// client 2
- code = requestAuthorizationCode(confidentialClientId2, clientSecret,
- null, userAuthHeader);
+ code = requestAuthorizationCode(confidentialClientId2,
+ clientRedirectUri, userAuthHeader);
response = requestTokenWithAuthorizationCodeAndForm(
- confidentialClientId2, clientSecret, code);
+ confidentialClientId2, clientSecret, code, clientRedirectUri);
assertEquals(Status.OK.getStatusCode(), response.getStatus());
// list
@@ -721,8 +705,7 @@
assertEquals(confidentialClientId2, node.at("/1/client_id").asText());
// client 1
- code = requestAuthorizationCode(confidentialClientId, clientSecret,
- null, userAuthHeader);
+ code = requestAuthorizationCode(confidentialClientId, userAuthHeader);
response = requestTokenWithAuthorizationCodeAndForm(
confidentialClientId, clientSecret, code);
assertEquals(Status.OK.getStatusCode(), response.getStatus());
@@ -736,8 +719,7 @@
assertEquals(0, node.size());
// client 1
- code = requestAuthorizationCode(confidentialClientId, clientSecret,
- null, darlaAuthHeader);
+ code = requestAuthorizationCode(confidentialClientId, darlaAuthHeader);
assertEquals(Status.OK.getStatusCode(), response.getStatus());
response = requestTokenWithAuthorizationCodeAndForm(
confidentialClientId, clientSecret, code);
@@ -788,8 +770,7 @@
.createBasicAuthorizationHeaderValue(username, password);
// access token 1
- String code = requestAuthorizationCode(publicClientId, clientSecret,
- null, userAuthHeader);
+ String code = requestAuthorizationCode(publicClientId, userAuthHeader);
ClientResponse response = requestTokenWithAuthorizationCodeAndForm(publicClientId, "",
code);
assertEquals(Status.OK.getStatusCode(), response.getStatus());
@@ -797,8 +778,7 @@
String accessToken1 = node.at("/access_token").asText();
// access token 2
- code = requestAuthorizationCode(publicClientId, clientSecret, null,
- userAuthHeader);
+ code = requestAuthorizationCode(publicClientId, userAuthHeader);
response = requestTokenWithAuthorizationCodeAndForm(publicClientId, "",
code);
assertEquals(Status.OK.getStatusCode(), response.getStatus());
diff --git a/full/src/test/java/de/ids_mannheim/korap/web/controller/OAuth2TestBase.java b/full/src/test/java/de/ids_mannheim/korap/web/controller/OAuth2TestBase.java
index 1574505..bcdcee7 100644
--- a/full/src/test/java/de/ids_mannheim/korap/web/controller/OAuth2TestBase.java
+++ b/full/src/test/java/de/ids_mannheim/korap/web/controller/OAuth2TestBase.java
@@ -49,38 +49,33 @@
protected String confidentialClientId2 = "52atrL0ajex_3_5imd9Mgw";
protected String superClientId = "fCBbQkAyYzI4NzUxMg";
protected String clientSecret = "secret";
+ protected String state = "thisIsMyState";
public static String ACCESS_TOKEN_TYPE = "access_token";
public static String REFRESH_TOKEN_TYPE = "refresh_token";
- private String clientURL = "http://example.client.com";
- private String clientRedirectUri = "https://example.client.com/redirect";
+ protected String clientURL = "http://example.client.com";
+ protected String clientRedirectUri = "https://example.client.com/redirect";
- protected ClientResponse requestAuthorizationCode (
- MultivaluedMap<String, String> form, String authHeader)
- throws KustvaktException {
+ protected ClientResponse requestAuthorizationCode (String responseType,
+ String clientId, String redirectUri, String scope, String state,
+ String authHeader) throws KustvaktException {
return resource().path(API_VERSION).path("oauth2").path("authorize")
+ .queryParam("response_type", responseType)
+ .queryParam("client_id", clientId)
+ .queryParam("redirect_uri", redirectUri)
+ .queryParam("scope", scope)
+ .queryParam("state", state)
.header(Attributes.AUTHORIZATION, authHeader)
- .header(HttpHeaders.X_FORWARDED_FOR, "149.27.0.32")
- .header(HttpHeaders.CONTENT_TYPE,
- ContentType.APPLICATION_FORM_URLENCODED)
- .entity(form).post(ClientResponse.class);
+ .get(ClientResponse.class);
}
- protected String requestAuthorizationCode (String clientId,
- String clientSecret, String scope, String authHeader)
- throws KustvaktException {
+ protected String requestAuthorizationCode (String clientId,
+ String authHeader) throws KustvaktException {
- MultivaluedMap<String, String> form = new MultivaluedMapImpl();
- form.add("response_type", "code");
- form.add("client_id", clientId);
- form.add("client_secret", clientSecret);
- if (scope != null) {
- form.add("scope", scope);
- }
-
- ClientResponse response = requestAuthorizationCode(form, authHeader);
+ ClientResponse response = requestAuthorizationCode("code", clientId,
+ "", "", "", authHeader);
assertEquals(Status.TEMPORARY_REDIRECT.getStatusCode(),
response.getStatus());
URI redirectUri = response.getLocation();
@@ -90,22 +85,10 @@
return params.getFirst("code");
}
- protected String requestAuthorizationCode (String clientId,
- String clientSecret, String scope, String authHeader,
- String redirect_uri) throws KustvaktException {
-
- MultivaluedMap<String, String> form = new MultivaluedMapImpl();
- form.add("response_type", "code");
- form.add("client_id", clientId);
- form.add("client_secret", clientSecret);
- if (scope != null) {
- form.add("scope", scope);
- }
- if (redirect_uri!=null){
- form.add("redirect_uri", redirect_uri);
- }
-
- ClientResponse response = requestAuthorizationCode(form, authHeader);
+ protected String requestAuthorizationCode (String clientId, String redirect_uri,
+ String authHeader) throws KustvaktException {
+ ClientResponse response = requestAuthorizationCode("code", clientId,
+ redirect_uri, "", "", authHeader);
assertEquals(Status.TEMPORARY_REDIRECT.getStatusCode(),
response.getStatus());
URI redirectUri = response.getLocation();