Add oidcLogin MockMvc Test Support
Fixes gh-7618
This commit is contained in:
Josh Cummings
+201
@@ -25,7 +25,10 @@ import java.util.ArrayList;
|
||||
import java.util.Arrays;
|
||||
import java.util.Base64;
|
||||
import java.util.Collection;
|
||||
import java.util.Collections;
|
||||
import java.util.LinkedHashSet;
|
||||
import java.util.List;
|
||||
import java.util.Set;
|
||||
import java.util.function.Consumer;
|
||||
import javax.servlet.http.HttpServletRequest;
|
||||
import javax.servlet.http.HttpServletResponse;
|
||||
@@ -46,6 +49,19 @@ import org.springframework.security.core.context.SecurityContext;
|
||||
import org.springframework.security.core.context.SecurityContextHolder;
|
||||
import org.springframework.security.core.userdetails.User;
|
||||
import org.springframework.security.core.userdetails.UserDetails;
|
||||
import org.springframework.security.oauth2.client.OAuth2AuthorizedClient;
|
||||
import org.springframework.security.oauth2.client.authentication.OAuth2AuthenticationToken;
|
||||
import org.springframework.security.oauth2.client.registration.ClientRegistration;
|
||||
import org.springframework.security.oauth2.client.web.HttpSessionOAuth2AuthorizedClientRepository;
|
||||
import org.springframework.security.oauth2.client.web.OAuth2AuthorizedClientRepository;
|
||||
import org.springframework.security.oauth2.core.AuthorizationGrantType;
|
||||
import org.springframework.security.oauth2.core.OAuth2AccessToken;
|
||||
import org.springframework.security.oauth2.core.oidc.IdTokenClaimNames;
|
||||
import org.springframework.security.oauth2.core.oidc.OidcIdToken;
|
||||
import org.springframework.security.oauth2.core.oidc.OidcUserInfo;
|
||||
import org.springframework.security.oauth2.core.oidc.user.DefaultOidcUser;
|
||||
import org.springframework.security.oauth2.core.oidc.user.OidcUser;
|
||||
import org.springframework.security.oauth2.core.oidc.user.OidcUserAuthority;
|
||||
import org.springframework.security.oauth2.jwt.Jwt;
|
||||
import org.springframework.security.oauth2.server.resource.authentication.JwtAuthenticationToken;
|
||||
import org.springframework.security.oauth2.server.resource.authentication.JwtGrantedAuthoritiesConverter;
|
||||
@@ -314,6 +330,36 @@ public final class SecurityMockMvcRequestPostProcessors {
|
||||
return new HttpBasicRequestPostProcessor(username, password);
|
||||
}
|
||||
|
||||
/**
|
||||
* Establish a {@link SecurityContext} that has a
|
||||
* {@link OAuth2AuthenticationToken} for the
|
||||
* {@link Authentication} and a {@link OAuth2AuthorizedClient} in
|
||||
* the session. All details are
|
||||
* declarative and do not require associated tokens to be valid.
|
||||
*
|
||||
* <p>
|
||||
* The support works by associating the authentication to the HttpServletRequest. To associate
|
||||
* the request to the SecurityContextHolder you need to ensure that the
|
||||
* SecurityContextPersistenceFilter is associated with the MockMvc instance. A few
|
||||
* ways to do this are:
|
||||
* </p>
|
||||
*
|
||||
* <ul>
|
||||
* <li>Invoking apply {@link SecurityMockMvcConfigurers#springSecurity()}</li>
|
||||
* <li>Adding Spring Security's FilterChainProxy to MockMvc</li>
|
||||
* <li>Manually adding {@link SecurityContextPersistenceFilter} to the MockMvc
|
||||
* instance may make sense when using MockMvcBuilders standaloneSetup</li>
|
||||
* </ul>
|
||||
*
|
||||
* @return the {@link OidcLoginRequestPostProcessor} for additional customization
|
||||
* @since 5.3
|
||||
*/
|
||||
public static OidcLoginRequestPostProcessor oidcLogin() {
|
||||
OAuth2AccessToken accessToken = new OAuth2AccessToken(OAuth2AccessToken.TokenType.BEARER, "access-token",
|
||||
null, null, Collections.singleton("user"));
|
||||
return new OidcLoginRequestPostProcessor(accessToken);
|
||||
}
|
||||
|
||||
/**
|
||||
* Populates the X509Certificate instances onto the request
|
||||
*/
|
||||
@@ -1024,6 +1070,161 @@ public final class SecurityMockMvcRequestPostProcessors {
|
||||
|
||||
}
|
||||
|
||||
/**
|
||||
* @author Josh Cummings
|
||||
* @since 5.3
|
||||
*/
|
||||
public final static class OidcLoginRequestPostProcessor implements RequestPostProcessor {
|
||||
private ClientRegistration clientRegistration;
|
||||
private OAuth2AccessToken accessToken;
|
||||
private OidcIdToken idToken;
|
||||
private OidcUserInfo userInfo;
|
||||
private OidcUser oidcUser;
|
||||
private Collection<GrantedAuthority> authorities;
|
||||
|
||||
private OidcLoginRequestPostProcessor(OAuth2AccessToken accessToken) {
|
||||
this.accessToken = accessToken;
|
||||
this.clientRegistration = clientRegistrationBuilder().build();
|
||||
}
|
||||
|
||||
/**
|
||||
* Use the provided authorities in the {@link Authentication}
|
||||
*
|
||||
* @param authorities the authorities to use
|
||||
* @return the {@link OidcLoginRequestPostProcessor} for further configuration
|
||||
*/
|
||||
public OidcLoginRequestPostProcessor authorities(Collection<GrantedAuthority> authorities) {
|
||||
Assert.notNull(authorities, "authorities cannot be null");
|
||||
this.authorities = authorities;
|
||||
return this;
|
||||
}
|
||||
|
||||
/**
|
||||
* Use the provided authorities in the {@link Authentication}
|
||||
*
|
||||
* @param authorities the authorities to use
|
||||
* @return the {@link OidcLoginRequestPostProcessor} for further configuration
|
||||
*/
|
||||
public OidcLoginRequestPostProcessor authorities(GrantedAuthority... authorities) {
|
||||
Assert.notNull(authorities, "authorities cannot be null");
|
||||
this.authorities = Arrays.asList(authorities);
|
||||
return this;
|
||||
}
|
||||
|
||||
/**
|
||||
* Use the provided {@link OidcIdToken} when constructing the authenticated user
|
||||
*
|
||||
* @param idTokenBuilderConsumer a {@link Consumer} of a {@link OidcIdToken.Builder}
|
||||
* @return the {@link OidcLoginRequestPostProcessor} for further configuration
|
||||
*/
|
||||
public OidcLoginRequestPostProcessor idToken(Consumer<OidcIdToken.Builder> idTokenBuilderConsumer) {
|
||||
OidcIdToken.Builder builder = OidcIdToken.withTokenValue("id-token");
|
||||
builder.subject("test-subject");
|
||||
idTokenBuilderConsumer.accept(builder);
|
||||
this.idToken = builder.build();
|
||||
return this;
|
||||
}
|
||||
|
||||
/**
|
||||
* Use the provided {@link OidcUserInfo} when constructing the authenticated user
|
||||
*
|
||||
* @param userInfoBuilderConsumer a {@link Consumer} of a {@link OidcUserInfo.Builder}
|
||||
* @return the {@link OidcLoginRequestPostProcessor} for further configuration
|
||||
*/
|
||||
public OidcLoginRequestPostProcessor userInfoToken(Consumer<OidcUserInfo.Builder> userInfoBuilderConsumer) {
|
||||
OidcUserInfo.Builder builder = OidcUserInfo.builder();
|
||||
userInfoBuilderConsumer.accept(builder);
|
||||
this.userInfo = builder.build();
|
||||
return this;
|
||||
}
|
||||
|
||||
/**
|
||||
* Use the provided {@link OidcUser} as the authenticated user.
|
||||
*
|
||||
* Supplying an {@link OidcUser} will take precedence over {@link #idToken}, {@link #userInfo},
|
||||
* and list of {@link GrantedAuthority}s to use.
|
||||
*
|
||||
* @param oidcUser the {@link OidcUser} to use
|
||||
* @return the {@link OidcLoginRequestPostProcessor} for further configuration
|
||||
*/
|
||||
public OidcLoginRequestPostProcessor oidcUser(OidcUser oidcUser) {
|
||||
this.oidcUser = oidcUser;
|
||||
return this;
|
||||
}
|
||||
|
||||
/**
|
||||
* Use the provided {@link ClientRegistration} as the client to authorize.
|
||||
*
|
||||
* The supplied {@link ClientRegistration} will be registered into an
|
||||
* {@link HttpSessionOAuth2AuthorizedClientRepository}. Tests relying on
|
||||
* {@link org.springframework.security.oauth2.client.annotation.RegisteredOAuth2AuthorizedClient}
|
||||
* annotations should register an {@link HttpSessionOAuth2AuthorizedClientRepository} bean
|
||||
* to the application context.
|
||||
*
|
||||
* The client registration must be a valid {@link ClientRegistration} from the
|
||||
* {@link org.springframework.security.oauth2.client.registration.ClientRegistrationRepository}
|
||||
* in the application context.
|
||||
*
|
||||
* @param clientRegistration the {@link ClientRegistration} to use
|
||||
* @return the {@link OidcLoginRequestPostProcessor} for further configuration
|
||||
*/
|
||||
public OidcLoginRequestPostProcessor clientRegistration(ClientRegistration clientRegistration) {
|
||||
this.clientRegistration = clientRegistration;
|
||||
return this;
|
||||
}
|
||||
|
||||
@Override
|
||||
public MockHttpServletRequest postProcessRequest(MockHttpServletRequest request) {
|
||||
OidcUser oidcUser = getOidcUser();
|
||||
OAuth2AuthenticationToken token = new OAuth2AuthenticationToken(oidcUser, oidcUser.getAuthorities(), this.clientRegistration.getRegistrationId());
|
||||
OAuth2AuthorizedClient client = new OAuth2AuthorizedClient(this.clientRegistration, token.getName(), this.accessToken);
|
||||
OAuth2AuthorizedClientRepository authorizedClientRepository = new HttpSessionOAuth2AuthorizedClientRepository();
|
||||
authorizedClientRepository.saveAuthorizedClient(client, token, request, new MockHttpServletResponse());
|
||||
|
||||
return new AuthenticationRequestPostProcessor(token).postProcessRequest(request);
|
||||
}
|
||||
|
||||
private ClientRegistration.Builder clientRegistrationBuilder() {
|
||||
return ClientRegistration.withRegistrationId("test")
|
||||
.authorizationGrantType(AuthorizationGrantType.PASSWORD)
|
||||
.clientId("test-client")
|
||||
.tokenUri("https://token-uri.example.org");
|
||||
}
|
||||
|
||||
private Collection<GrantedAuthority> getAuthorities() {
|
||||
if (this.authorities == null) {
|
||||
Set<GrantedAuthority> authorities = new LinkedHashSet<>();
|
||||
authorities.add(new OidcUserAuthority(getOidcIdToken(), getOidcUserInfo()));
|
||||
for (String authority : this.accessToken.getScopes()) {
|
||||
authorities.add(new SimpleGrantedAuthority("SCOPE_" + authority));
|
||||
}
|
||||
return authorities;
|
||||
} else {
|
||||
return this.authorities;
|
||||
}
|
||||
}
|
||||
|
||||
private OidcIdToken getOidcIdToken() {
|
||||
if (this.idToken == null) {
|
||||
return new OidcIdToken("id-token", null, null, Collections.singletonMap(IdTokenClaimNames.SUB, "test-subject"));
|
||||
} else {
|
||||
return this.idToken;
|
||||
}
|
||||
}
|
||||
|
||||
private OidcUserInfo getOidcUserInfo() {
|
||||
return this.userInfo;
|
||||
}
|
||||
|
||||
private OidcUser getOidcUser() {
|
||||
if (this.oidcUser == null) {
|
||||
return new DefaultOidcUser(getAuthorities(), getOidcIdToken(), this.userInfo);
|
||||
} else {
|
||||
return this.oidcUser;
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
private SecurityMockMvcRequestPostProcessors() {
|
||||
}
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user