diff --git a/oauth2/oauth2-client/src/main/java/org/springframework/security/oauth2/client/ClientCredentialsOAuth2AuthorizedClientProvider.java b/oauth2/oauth2-client/src/main/java/org/springframework/security/oauth2/client/ClientCredentialsOAuth2AuthorizedClientProvider.java index ef6396435c..a1e8d97bdb 100644 --- a/oauth2/oauth2-client/src/main/java/org/springframework/security/oauth2/client/ClientCredentialsOAuth2AuthorizedClientProvider.java +++ b/oauth2/oauth2-client/src/main/java/org/springframework/security/oauth2/client/ClientCredentialsOAuth2AuthorizedClientProvider.java @@ -86,7 +86,7 @@ public final class ClientCredentialsOAuth2AuthorizedClientProvider implements OA } private boolean hasTokenExpired(AbstractOAuth2Token token) { - return token.getExpiresAt().isBefore(Instant.now(this.clock).minus(this.clockSkew)); + return this.clock.instant().isAfter(token.getExpiresAt().minus(this.clockSkew)); } /** diff --git a/oauth2/oauth2-client/src/main/java/org/springframework/security/oauth2/client/ClientCredentialsReactiveOAuth2AuthorizedClientProvider.java b/oauth2/oauth2-client/src/main/java/org/springframework/security/oauth2/client/ClientCredentialsReactiveOAuth2AuthorizedClientProvider.java index c219a0f376..67343b2095 100644 --- a/oauth2/oauth2-client/src/main/java/org/springframework/security/oauth2/client/ClientCredentialsReactiveOAuth2AuthorizedClientProvider.java +++ b/oauth2/oauth2-client/src/main/java/org/springframework/security/oauth2/client/ClientCredentialsReactiveOAuth2AuthorizedClientProvider.java @@ -82,7 +82,7 @@ public final class ClientCredentialsReactiveOAuth2AuthorizedClientProvider imple } private boolean hasTokenExpired(AbstractOAuth2Token token) { - return token.getExpiresAt().isBefore(Instant.now(this.clock).minus(this.clockSkew)); + return this.clock.instant().isAfter(token.getExpiresAt().minus(this.clockSkew)); } /** diff --git a/oauth2/oauth2-client/src/main/java/org/springframework/security/oauth2/client/PasswordOAuth2AuthorizedClientProvider.java b/oauth2/oauth2-client/src/main/java/org/springframework/security/oauth2/client/PasswordOAuth2AuthorizedClientProvider.java index c4c80fd8d9..67e34e29a5 100644 --- a/oauth2/oauth2-client/src/main/java/org/springframework/security/oauth2/client/PasswordOAuth2AuthorizedClientProvider.java +++ b/oauth2/oauth2-client/src/main/java/org/springframework/security/oauth2/client/PasswordOAuth2AuthorizedClientProvider.java @@ -104,7 +104,7 @@ public final class PasswordOAuth2AuthorizedClientProvider implements OAuth2Autho } private boolean hasTokenExpired(AbstractOAuth2Token token) { - return token.getExpiresAt().isBefore(Instant.now(this.clock).minus(this.clockSkew)); + return this.clock.instant().isAfter(token.getExpiresAt().minus(this.clockSkew)); } /** diff --git a/oauth2/oauth2-client/src/main/java/org/springframework/security/oauth2/client/PasswordReactiveOAuth2AuthorizedClientProvider.java b/oauth2/oauth2-client/src/main/java/org/springframework/security/oauth2/client/PasswordReactiveOAuth2AuthorizedClientProvider.java index 12383d2631..7190d60f10 100644 --- a/oauth2/oauth2-client/src/main/java/org/springframework/security/oauth2/client/PasswordReactiveOAuth2AuthorizedClientProvider.java +++ b/oauth2/oauth2-client/src/main/java/org/springframework/security/oauth2/client/PasswordReactiveOAuth2AuthorizedClientProvider.java @@ -102,7 +102,7 @@ public final class PasswordReactiveOAuth2AuthorizedClientProvider implements Rea } private boolean hasTokenExpired(AbstractOAuth2Token token) { - return token.getExpiresAt().isBefore(Instant.now(this.clock).minus(this.clockSkew)); + return this.clock.instant().isAfter(token.getExpiresAt().minus(this.clockSkew)); } /** diff --git a/oauth2/oauth2-client/src/main/java/org/springframework/security/oauth2/client/RefreshTokenOAuth2AuthorizedClientProvider.java b/oauth2/oauth2-client/src/main/java/org/springframework/security/oauth2/client/RefreshTokenOAuth2AuthorizedClientProvider.java index 10ba0bfbbe..08f3a9bc01 100644 --- a/oauth2/oauth2-client/src/main/java/org/springframework/security/oauth2/client/RefreshTokenOAuth2AuthorizedClientProvider.java +++ b/oauth2/oauth2-client/src/main/java/org/springframework/security/oauth2/client/RefreshTokenOAuth2AuthorizedClientProvider.java @@ -94,7 +94,7 @@ public final class RefreshTokenOAuth2AuthorizedClientProvider implements OAuth2A } private boolean hasTokenExpired(AbstractOAuth2Token token) { - return token.getExpiresAt().isBefore(Instant.now(this.clock).minus(this.clockSkew)); + return this.clock.instant().isAfter(token.getExpiresAt().minus(this.clockSkew)); } /** diff --git a/oauth2/oauth2-client/src/main/java/org/springframework/security/oauth2/client/RefreshTokenReactiveOAuth2AuthorizedClientProvider.java b/oauth2/oauth2-client/src/main/java/org/springframework/security/oauth2/client/RefreshTokenReactiveOAuth2AuthorizedClientProvider.java index d8abe492aa..145a637a0b 100644 --- a/oauth2/oauth2-client/src/main/java/org/springframework/security/oauth2/client/RefreshTokenReactiveOAuth2AuthorizedClientProvider.java +++ b/oauth2/oauth2-client/src/main/java/org/springframework/security/oauth2/client/RefreshTokenReactiveOAuth2AuthorizedClientProvider.java @@ -93,7 +93,7 @@ public final class RefreshTokenReactiveOAuth2AuthorizedClientProvider implements } private boolean hasTokenExpired(AbstractOAuth2Token token) { - return token.getExpiresAt().isBefore(Instant.now(this.clock).minus(this.clockSkew)); + return this.clock.instant().isAfter(token.getExpiresAt().minus(this.clockSkew)); } /** diff --git a/oauth2/oauth2-client/src/test/java/org/springframework/security/oauth2/client/ClientCredentialsOAuth2AuthorizedClientProviderTests.java b/oauth2/oauth2-client/src/test/java/org/springframework/security/oauth2/client/ClientCredentialsOAuth2AuthorizedClientProviderTests.java index 4aefd63192..c2b85c7a30 100644 --- a/oauth2/oauth2-client/src/test/java/org/springframework/security/oauth2/client/ClientCredentialsOAuth2AuthorizedClientProviderTests.java +++ b/oauth2/oauth2-client/src/test/java/org/springframework/security/oauth2/client/ClientCredentialsOAuth2AuthorizedClientProviderTests.java @@ -154,21 +154,32 @@ public class ClientCredentialsOAuth2AuthorizedClientProviderTests { assertThat(this.authorizedClientProvider.authorize(authorizationContext)).isNull(); } + // gh-7511 @Test - public void authorizeWhenClientCredentialsAndTokenNotExpiredByClockSkewThenNotReauthorize() { - ClientCredentialsOAuth2AuthorizedClientProvider authorizedClientProvider = - new ClientCredentialsOAuth2AuthorizedClientProvider(); - authorizedClientProvider.setClockSkew(Duration.ofHours(24)); - Instant issuedAt = Instant.now().minus(Duration.ofDays(1)); - OAuth2AccessToken expiredToken = new OAuth2AccessToken(OAuth2AccessToken.TokenType.BEARER, "token", - issuedAt, issuedAt.plus(Duration.ofHours(1))); + public void authorizeWhenClientCredentialsAndTokenNotExpiredButClockSkewForcesExpiryThenReauthorize() { + Instant now = Instant.now(); + Instant issuedAt = now.minus(Duration.ofMinutes(60)); + Instant expiresAt = now.minus(Duration.ofMinutes(1)); + OAuth2AccessToken expiresInOneMinAccessToken = new OAuth2AccessToken( + OAuth2AccessToken.TokenType.BEARER, "access-token-1234", issuedAt, expiresAt); OAuth2AuthorizedClient authorizedClient = new OAuth2AuthorizedClient( - this.clientRegistration, this.principal.getName(), expiredToken); + this.clientRegistration, this.principal.getName(), expiresInOneMinAccessToken); + + // Shorten the lifespan of the access token by 90 seconds, which will ultimately force it to expire on the client + this.authorizedClientProvider.setClockSkew(Duration.ofSeconds(90)); + + OAuth2AccessTokenResponse accessTokenResponse = TestOAuth2AccessTokenResponses.accessTokenResponse().build(); + when(this.accessTokenResponseClient.getTokenResponse(any())).thenReturn(accessTokenResponse); OAuth2AuthorizationContext authorizationContext = OAuth2AuthorizationContext.withAuthorizedClient(authorizedClient) .principal(this.principal) .build(); - assertThat(authorizedClientProvider.authorize(authorizationContext)).isNull(); + + OAuth2AuthorizedClient reauthorizedClient = this.authorizedClientProvider.authorize(authorizationContext); + + assertThat(reauthorizedClient.getClientRegistration()).isSameAs(this.clientRegistration); + assertThat(reauthorizedClient.getPrincipalName()).isEqualTo(this.principal.getName()); + assertThat(reauthorizedClient.getAccessToken()).isEqualTo(accessTokenResponse.getAccessToken()); } } diff --git a/oauth2/oauth2-client/src/test/java/org/springframework/security/oauth2/client/ClientCredentialsReactiveOAuth2AuthorizedClientProviderTests.java b/oauth2/oauth2-client/src/test/java/org/springframework/security/oauth2/client/ClientCredentialsReactiveOAuth2AuthorizedClientProviderTests.java index 9426337877..af33a645ac 100644 --- a/oauth2/oauth2-client/src/test/java/org/springframework/security/oauth2/client/ClientCredentialsReactiveOAuth2AuthorizedClientProviderTests.java +++ b/oauth2/oauth2-client/src/test/java/org/springframework/security/oauth2/client/ClientCredentialsReactiveOAuth2AuthorizedClientProviderTests.java @@ -154,4 +154,33 @@ public class ClientCredentialsReactiveOAuth2AuthorizedClientProviderTests { .build(); assertThat(this.authorizedClientProvider.authorize(authorizationContext).block()).isNull(); } + + // gh-7511 + @Test + public void authorizeWhenClientCredentialsAndTokenNotExpiredButClockSkewForcesExpiryThenReauthorize() { + Instant now = Instant.now(); + Instant issuedAt = now.minus(Duration.ofMinutes(60)); + Instant expiresAt = now.minus(Duration.ofMinutes(1)); + OAuth2AccessToken expiresInOneMinAccessToken = new OAuth2AccessToken( + OAuth2AccessToken.TokenType.BEARER, "access-token-1234", issuedAt, expiresAt); + OAuth2AuthorizedClient authorizedClient = new OAuth2AuthorizedClient( + this.clientRegistration, this.principal.getName(), expiresInOneMinAccessToken); + + // Shorten the lifespan of the access token by 90 seconds, which will ultimately force it to expire on the client + this.authorizedClientProvider.setClockSkew(Duration.ofSeconds(90)); + + OAuth2AccessTokenResponse accessTokenResponse = TestOAuth2AccessTokenResponses.accessTokenResponse().build(); + when(this.accessTokenResponseClient.getTokenResponse(any())).thenReturn(Mono.just(accessTokenResponse)); + + OAuth2AuthorizationContext authorizationContext = + OAuth2AuthorizationContext.withAuthorizedClient(authorizedClient) + .principal(this.principal) + .build(); + + OAuth2AuthorizedClient reauthorizedClient = this.authorizedClientProvider.authorize(authorizationContext).block(); + + assertThat(reauthorizedClient.getClientRegistration()).isSameAs(this.clientRegistration); + assertThat(reauthorizedClient.getPrincipalName()).isEqualTo(this.principal.getName()); + assertThat(reauthorizedClient.getAccessToken()).isEqualTo(accessTokenResponse.getAccessToken()); + } } diff --git a/oauth2/oauth2-client/src/test/java/org/springframework/security/oauth2/client/PasswordOAuth2AuthorizedClientProviderTests.java b/oauth2/oauth2-client/src/test/java/org/springframework/security/oauth2/client/PasswordOAuth2AuthorizedClientProviderTests.java index d0faf23422..8e2dcb1182 100644 --- a/oauth2/oauth2-client/src/test/java/org/springframework/security/oauth2/client/PasswordOAuth2AuthorizedClientProviderTests.java +++ b/oauth2/oauth2-client/src/test/java/org/springframework/security/oauth2/client/PasswordOAuth2AuthorizedClientProviderTests.java @@ -188,17 +188,22 @@ public class PasswordOAuth2AuthorizedClientProviderTests { assertThat(this.authorizedClientProvider.authorize(authorizationContext)).isNull(); } + // gh-7511 @Test - public void authorizeWhenPasswordAndAuthorizedWithoutRefreshTokenAndTokenNotExpiredByClockSkewThenNotReauthorize() { - PasswordOAuth2AuthorizedClientProvider authorizedClientProvider = - new PasswordOAuth2AuthorizedClientProvider(); - authorizedClientProvider.setClockSkew(Duration.ofHours(24)); - Instant issuedAt = Instant.now().minus(Duration.ofDays(1)); - Instant expiresAt = issuedAt.plus(Duration.ofMinutes(60)); - OAuth2AccessToken accessToken = new OAuth2AccessToken( - OAuth2AccessToken.TokenType.BEARER, "access-token-expired", issuedAt, expiresAt); + public void authorizeWhenPasswordAndAuthorizedAndTokenNotExpiredButClockSkewForcesExpiryThenReauthorize() { + Instant now = Instant.now(); + Instant issuedAt = now.minus(Duration.ofMinutes(60)); + Instant expiresAt = now.minus(Duration.ofMinutes(1)); + OAuth2AccessToken expiresInOneMinAccessToken = new OAuth2AccessToken( + OAuth2AccessToken.TokenType.BEARER, "access-token-1234", issuedAt, expiresAt); OAuth2AuthorizedClient authorizedClient = new OAuth2AuthorizedClient( - this.clientRegistration, this.principal.getName(), accessToken); // without refresh token + this.clientRegistration, this.principal.getName(), expiresInOneMinAccessToken); // without refresh token + + // Shorten the lifespan of the access token by 90 seconds, which will ultimately force it to expire on the client + this.authorizedClientProvider.setClockSkew(Duration.ofSeconds(90)); + + OAuth2AccessTokenResponse accessTokenResponse = TestOAuth2AccessTokenResponses.accessTokenResponse().build(); + when(this.accessTokenResponseClient.getTokenResponse(any())).thenReturn(accessTokenResponse); OAuth2AuthorizationContext authorizationContext = OAuth2AuthorizationContext.withAuthorizedClient(authorizedClient) @@ -206,6 +211,11 @@ public class PasswordOAuth2AuthorizedClientProviderTests { .attribute(OAuth2AuthorizationContext.PASSWORD_ATTRIBUTE_NAME, "password") .principal(this.principal) .build(); - assertThat(authorizedClientProvider.authorize(authorizationContext)).isNull(); + + OAuth2AuthorizedClient reauthorizedClient = this.authorizedClientProvider.authorize(authorizationContext); + + assertThat(reauthorizedClient.getClientRegistration()).isSameAs(this.clientRegistration); + assertThat(reauthorizedClient.getPrincipalName()).isEqualTo(this.principal.getName()); + assertThat(reauthorizedClient.getAccessToken()).isEqualTo(accessTokenResponse.getAccessToken()); } } diff --git a/oauth2/oauth2-client/src/test/java/org/springframework/security/oauth2/client/PasswordReactiveOAuth2AuthorizedClientProviderTests.java b/oauth2/oauth2-client/src/test/java/org/springframework/security/oauth2/client/PasswordReactiveOAuth2AuthorizedClientProviderTests.java index 2e91460f30..9fefec4b1f 100644 --- a/oauth2/oauth2-client/src/test/java/org/springframework/security/oauth2/client/PasswordReactiveOAuth2AuthorizedClientProviderTests.java +++ b/oauth2/oauth2-client/src/test/java/org/springframework/security/oauth2/client/PasswordReactiveOAuth2AuthorizedClientProviderTests.java @@ -188,4 +188,35 @@ public class PasswordReactiveOAuth2AuthorizedClientProviderTests { .build(); assertThat(this.authorizedClientProvider.authorize(authorizationContext).block()).isNull(); } + + // gh-7511 + @Test + public void authorizeWhenPasswordAndAuthorizedAndTokenNotExpiredButClockSkewForcesExpiryThenReauthorize() { + Instant now = Instant.now(); + Instant issuedAt = now.minus(Duration.ofMinutes(60)); + Instant expiresAt = now.minus(Duration.ofMinutes(1)); + OAuth2AccessToken expiresInOneMinAccessToken = new OAuth2AccessToken( + OAuth2AccessToken.TokenType.BEARER, "access-token-1234", issuedAt, expiresAt); + OAuth2AuthorizedClient authorizedClient = new OAuth2AuthorizedClient( + this.clientRegistration, this.principal.getName(), expiresInOneMinAccessToken); // without refresh token + + // Shorten the lifespan of the access token by 90 seconds, which will ultimately force it to expire on the client + this.authorizedClientProvider.setClockSkew(Duration.ofSeconds(90)); + + OAuth2AccessTokenResponse accessTokenResponse = TestOAuth2AccessTokenResponses.accessTokenResponse().build(); + when(this.accessTokenResponseClient.getTokenResponse(any())).thenReturn(Mono.just(accessTokenResponse)); + + OAuth2AuthorizationContext authorizationContext = + OAuth2AuthorizationContext.withAuthorizedClient(authorizedClient) + .attribute(OAuth2AuthorizationContext.USERNAME_ATTRIBUTE_NAME, "username") + .attribute(OAuth2AuthorizationContext.PASSWORD_ATTRIBUTE_NAME, "password") + .principal(this.principal) + .build(); + + OAuth2AuthorizedClient reauthorizedClient = this.authorizedClientProvider.authorize(authorizationContext).block(); + + assertThat(reauthorizedClient.getClientRegistration()).isSameAs(this.clientRegistration); + assertThat(reauthorizedClient.getPrincipalName()).isEqualTo(this.principal.getName()); + assertThat(reauthorizedClient.getAccessToken()).isEqualTo(accessTokenResponse.getAccessToken()); + } } diff --git a/oauth2/oauth2-client/src/test/java/org/springframework/security/oauth2/client/RefreshTokenOAuth2AuthorizedClientProviderTests.java b/oauth2/oauth2-client/src/test/java/org/springframework/security/oauth2/client/RefreshTokenOAuth2AuthorizedClientProviderTests.java index 72cc9c16d1..3b373000b3 100644 --- a/oauth2/oauth2-client/src/test/java/org/springframework/security/oauth2/client/RefreshTokenOAuth2AuthorizedClientProviderTests.java +++ b/oauth2/oauth2-client/src/test/java/org/springframework/security/oauth2/client/RefreshTokenOAuth2AuthorizedClientProviderTests.java @@ -134,6 +134,38 @@ public class RefreshTokenOAuth2AuthorizedClientProviderTests { assertThat(this.authorizedClientProvider.authorize(authorizationContext)).isNull(); } + // gh-7511 + @Test + public void authorizeWhenAuthorizedAndAccessTokenNotExpiredButClockSkewForcesExpiryThenReauthorize() { + OAuth2AccessTokenResponse accessTokenResponse = TestOAuth2AccessTokenResponses.accessTokenResponse() + .refreshToken("new-refresh-token") + .build(); + when(this.accessTokenResponseClient.getTokenResponse(any())).thenReturn(accessTokenResponse); + + Instant now = Instant.now(); + Instant issuedAt = now.minus(Duration.ofMinutes(60)); + Instant expiresAt = now.minus(Duration.ofMinutes(1)); + OAuth2AccessToken expiresInOneMinAccessToken = new OAuth2AccessToken( + OAuth2AccessToken.TokenType.BEARER, "access-token-1234", issuedAt, expiresAt); + OAuth2AuthorizedClient authorizedClient = new OAuth2AuthorizedClient(this.clientRegistration, this.principal.getName(), + expiresInOneMinAccessToken, this.authorizedClient.getRefreshToken()); + + // Shorten the lifespan of the access token by 90 seconds, which will ultimately force it to expire on the client + this.authorizedClientProvider.setClockSkew(Duration.ofSeconds(90)); + + OAuth2AuthorizationContext authorizationContext = + OAuth2AuthorizationContext.withAuthorizedClient(authorizedClient) + .principal(this.principal) + .build(); + + OAuth2AuthorizedClient reauthorizedClient = this.authorizedClientProvider.authorize(authorizationContext); + + assertThat(reauthorizedClient.getClientRegistration()).isSameAs(this.clientRegistration); + assertThat(reauthorizedClient.getPrincipalName()).isEqualTo(this.principal.getName()); + assertThat(reauthorizedClient.getAccessToken()).isEqualTo(accessTokenResponse.getAccessToken()); + assertThat(reauthorizedClient.getRefreshToken()).isEqualTo(accessTokenResponse.getRefreshToken()); + } + @Test public void authorizeWhenAuthorizedAndAccessTokenExpiredThenReauthorize() { OAuth2AccessTokenResponse accessTokenResponse = TestOAuth2AccessTokenResponses.accessTokenResponse() diff --git a/oauth2/oauth2-client/src/test/java/org/springframework/security/oauth2/client/RefreshTokenReactiveOAuth2AuthorizedClientProviderTests.java b/oauth2/oauth2-client/src/test/java/org/springframework/security/oauth2/client/RefreshTokenReactiveOAuth2AuthorizedClientProviderTests.java index 4f90969b72..6ba450f15c 100644 --- a/oauth2/oauth2-client/src/test/java/org/springframework/security/oauth2/client/RefreshTokenReactiveOAuth2AuthorizedClientProviderTests.java +++ b/oauth2/oauth2-client/src/test/java/org/springframework/security/oauth2/client/RefreshTokenReactiveOAuth2AuthorizedClientProviderTests.java @@ -135,19 +135,36 @@ public class RefreshTokenReactiveOAuth2AuthorizedClientProviderTests { assertThat(this.authorizedClientProvider.authorize(authorizationContext).block()).isNull(); } + // gh-7511 @Test - public void authorizeWhenAuthorizedAndAccessTokenNotExpiredByClockSkewThenNotReauthorize() { - RefreshTokenReactiveOAuth2AuthorizedClientProvider authorizedClientProvider - = new RefreshTokenReactiveOAuth2AuthorizedClientProvider(); - authorizedClientProvider.setClockSkew(Duration.ofHours(24)); + public void authorizeWhenAuthorizedAndAccessTokenNotExpiredButClockSkewForcesExpiryThenReauthorize() { + OAuth2AccessTokenResponse accessTokenResponse = TestOAuth2AccessTokenResponses.accessTokenResponse() + .refreshToken("new-refresh-token") + .build(); + when(this.accessTokenResponseClient.getTokenResponse(any())).thenReturn(Mono.just(accessTokenResponse)); + + Instant now = Instant.now(); + Instant issuedAt = now.minus(Duration.ofMinutes(60)); + Instant expiresAt = now.minus(Duration.ofMinutes(1)); + OAuth2AccessToken expiresInOneMinAccessToken = new OAuth2AccessToken( + OAuth2AccessToken.TokenType.BEARER, "access-token-1234", issuedAt, expiresAt); OAuth2AuthorizedClient authorizedClient = new OAuth2AuthorizedClient(this.clientRegistration, this.principal.getName(), - this.authorizedClient.getAccessToken(), this.authorizedClient.getRefreshToken()); + expiresInOneMinAccessToken, this.authorizedClient.getRefreshToken()); + + // Shorten the lifespan of the access token by 90 seconds, which will ultimately force it to expire on the client + this.authorizedClientProvider.setClockSkew(Duration.ofSeconds(90)); OAuth2AuthorizationContext authorizationContext = OAuth2AuthorizationContext.withAuthorizedClient(authorizedClient) .principal(this.principal) .build(); - assertThat(authorizedClientProvider.authorize(authorizationContext).block()).isNull(); + + OAuth2AuthorizedClient reauthorizedClient = this.authorizedClientProvider.authorize(authorizationContext).block(); + + assertThat(reauthorizedClient.getClientRegistration()).isSameAs(this.clientRegistration); + assertThat(reauthorizedClient.getPrincipalName()).isEqualTo(this.principal.getName()); + assertThat(reauthorizedClient.getAccessToken()).isEqualTo(accessTokenResponse.getAccessToken()); + assertThat(reauthorizedClient.getRefreshToken()).isEqualTo(accessTokenResponse.getRefreshToken()); } @Test