Josh Cummings
6 years ago
3 changed files with 433 additions and 0 deletions
@ -0,0 +1,176 @@
@@ -0,0 +1,176 @@
|
||||
/* |
||||
* Copyright 2002-2020 the original author or authors. |
||||
* |
||||
* Licensed under the Apache License, Version 2.0 (the "License"); |
||||
* you may not use this file except in compliance with the License. |
||||
* You may obtain a copy of the License at |
||||
* |
||||
* https://www.apache.org/licenses/LICENSE-2.0
|
||||
* |
||||
* Unless required by applicable law or agreed to in writing, software |
||||
* distributed under the License is distributed on an "AS IS" BASIS, |
||||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
||||
* See the License for the specific language governing permissions and |
||||
* limitations under the License. |
||||
*/ |
||||
|
||||
package org.springframework.security.oauth2.server.resource.authentication; |
||||
|
||||
import java.util.Arrays; |
||||
import java.util.Collection; |
||||
import java.util.Collections; |
||||
import java.util.Map; |
||||
import java.util.concurrent.ConcurrentHashMap; |
||||
import java.util.function.Predicate; |
||||
|
||||
import com.nimbusds.jwt.JWTParser; |
||||
import reactor.core.publisher.Mono; |
||||
import reactor.core.scheduler.Schedulers; |
||||
|
||||
import org.springframework.core.convert.converter.Converter; |
||||
import org.springframework.lang.NonNull; |
||||
import org.springframework.security.authentication.AuthenticationManager; |
||||
import org.springframework.security.authentication.ReactiveAuthenticationManager; |
||||
import org.springframework.security.authentication.ReactiveAuthenticationManagerResolver; |
||||
import org.springframework.security.oauth2.core.OAuth2AuthenticationException; |
||||
import org.springframework.security.oauth2.jwt.ReactiveJwtDecoders; |
||||
import org.springframework.security.oauth2.server.resource.BearerTokenAuthenticationToken; |
||||
import org.springframework.security.oauth2.server.resource.InvalidBearerTokenException; |
||||
import org.springframework.security.oauth2.server.resource.web.server.ServerBearerTokenAuthenticationConverter; |
||||
import org.springframework.util.Assert; |
||||
import org.springframework.web.server.ServerWebExchange; |
||||
|
||||
/** |
||||
* An implementation of {@link ReactiveAuthenticationManagerResolver} that resolves a JWT-based |
||||
* {@link ReactiveAuthenticationManager} based on the |
||||
* <a href="https://openid.net/specs/openid-connect-core-1_0.html#IssuerIdentifier">Issuer</a> in a |
||||
* signed JWT (JWS). |
||||
* |
||||
* To use, this class must be able to determine whether or not the `iss` claim is trusted. Recall that |
||||
* anyone can stand up an authorization server and issue valid tokens to a resource server. The simplest way |
||||
* to achieve this is to supply a whitelist of trusted issuers in the constructor. |
||||
* |
||||
* This class derives the Issuer from the `iss` claim found in the {@link ServerWebExchange}'s |
||||
* <a href="https://tools.ietf.org/html/rfc6750#section-1.2" target="_blank">Bearer Token</a>. |
||||
* |
||||
* @author Josh Cummings |
||||
* @since 5.3 |
||||
*/ |
||||
public final class JwtIssuerReactiveAuthenticationManagerResolver |
||||
implements ReactiveAuthenticationManagerResolver<ServerWebExchange> { |
||||
|
||||
private final ReactiveAuthenticationManagerResolver<String> issuerAuthenticationManagerResolver; |
||||
private final Converter<ServerWebExchange, Mono<String>> issuerConverter = new JwtClaimIssuerConverter(); |
||||
|
||||
/** |
||||
* Construct a {@link JwtIssuerReactiveAuthenticationManagerResolver} using the provided parameters |
||||
* |
||||
* @param trustedIssuers a whitelist of trusted issuers |
||||
*/ |
||||
public JwtIssuerReactiveAuthenticationManagerResolver(String... trustedIssuers) { |
||||
this(Arrays.asList(trustedIssuers)); |
||||
} |
||||
|
||||
/** |
||||
* Construct a {@link JwtIssuerReactiveAuthenticationManagerResolver} using the provided parameters |
||||
* |
||||
* @param trustedIssuers a whitelist of trusted issuers |
||||
*/ |
||||
public JwtIssuerReactiveAuthenticationManagerResolver(Collection<String> trustedIssuers) { |
||||
Assert.notEmpty(trustedIssuers, "trustedIssuers cannot be empty"); |
||||
this.issuerAuthenticationManagerResolver = |
||||
new TrustedIssuerJwtAuthenticationManagerResolver |
||||
(Collections.unmodifiableCollection(trustedIssuers)::contains); |
||||
} |
||||
|
||||
/** |
||||
* Construct a {@link JwtIssuerReactiveAuthenticationManagerResolver} using the provided parameters |
||||
* |
||||
* Note that the {@link ReactiveAuthenticationManagerResolver} provided in this constructor will need to |
||||
* verify that the issuer is trusted. This should be done via a whitelist. |
||||
* |
||||
* One way to achieve this is with a {@link Map} where the keys are the known issuers: |
||||
* <pre> |
||||
* Map<String, ReactiveAuthenticationManager> authenticationManagers = new HashMap<>(); |
||||
* authenticationManagers.put("https://issuerOne.example.org", managerOne); |
||||
* authenticationManagers.put("https://issuerTwo.example.org", managerTwo); |
||||
* JwtIssuerReactiveAuthenticationManagerResolver resolver = new JwtIssuerReactiveAuthenticationManagerResolver |
||||
* (issuer -> Mono.justOrEmpty(authenticationManagers.get(issuer)); |
||||
* </pre> |
||||
* |
||||
* The keys in the {@link Map} are the whitelist. |
||||
* |
||||
* @param issuerAuthenticationManagerResolver a strategy for resolving the {@link ReactiveAuthenticationManager} |
||||
* by the issuer |
||||
*/ |
||||
public JwtIssuerReactiveAuthenticationManagerResolver |
||||
(ReactiveAuthenticationManagerResolver<String> issuerAuthenticationManagerResolver) { |
||||
|
||||
Assert.notNull(issuerAuthenticationManagerResolver, "issuerAuthenticationManagerResolver cannot be null"); |
||||
this.issuerAuthenticationManagerResolver = issuerAuthenticationManagerResolver; |
||||
} |
||||
|
||||
/** |
||||
* Return an {@link AuthenticationManager} based off of the `iss` claim found in the request's bearer token |
||||
* |
||||
* @throws OAuth2AuthenticationException if the bearer token is malformed or an {@link ReactiveAuthenticationManager} |
||||
* can't be derived from the issuer |
||||
*/ |
||||
@Override |
||||
public Mono<ReactiveAuthenticationManager> resolve(ServerWebExchange exchange) { |
||||
return this.issuerConverter.convert(exchange) |
||||
.flatMap(issuer -> |
||||
this.issuerAuthenticationManagerResolver.resolve(issuer).switchIfEmpty( |
||||
Mono.error(new InvalidBearerTokenException("Invalid issuer " + issuer))) |
||||
); |
||||
} |
||||
|
||||
private static class JwtClaimIssuerConverter |
||||
implements Converter<ServerWebExchange, Mono<String>> { |
||||
|
||||
private final ServerBearerTokenAuthenticationConverter converter = |
||||
new ServerBearerTokenAuthenticationConverter(); |
||||
|
||||
@Override |
||||
public Mono<String> convert(@NonNull ServerWebExchange exchange) { |
||||
return this.converter.convert(exchange) |
||||
.cast(BearerTokenAuthenticationToken.class) |
||||
.flatMap(this::issuer); |
||||
} |
||||
|
||||
private Mono<String> issuer(BearerTokenAuthenticationToken token) { |
||||
try { |
||||
String issuer = JWTParser.parse(token.getToken()).getJWTClaimsSet().getIssuer(); |
||||
return Mono.justOrEmpty(issuer).switchIfEmpty( |
||||
Mono.error(new InvalidBearerTokenException("Missing issuer"))); |
||||
} catch (Exception e) { |
||||
return Mono.error(new InvalidBearerTokenException(e.getMessage())); |
||||
} |
||||
} |
||||
} |
||||
|
||||
private static class TrustedIssuerJwtAuthenticationManagerResolver |
||||
implements ReactiveAuthenticationManagerResolver<String> { |
||||
|
||||
private final Map<String, Mono<? extends ReactiveAuthenticationManager>> authenticationManagers = |
||||
new ConcurrentHashMap<>(); |
||||
private final Predicate<String> trustedIssuer; |
||||
|
||||
TrustedIssuerJwtAuthenticationManagerResolver(Predicate<String> trustedIssuer) { |
||||
this.trustedIssuer = trustedIssuer; |
||||
} |
||||
|
||||
@Override |
||||
public Mono<ReactiveAuthenticationManager> resolve(String issuer) { |
||||
return Mono.just(issuer) |
||||
.filter(this.trustedIssuer) |
||||
.flatMap(iss -> |
||||
this.authenticationManagers.computeIfAbsent(iss, k -> |
||||
Mono.fromCallable(() -> ReactiveJwtDecoders.fromIssuerLocation(iss)) |
||||
.subscribeOn(Schedulers.boundedElastic()) |
||||
.map(JwtReactiveAuthenticationManager::new) |
||||
.cache()) |
||||
); |
||||
} |
||||
} |
||||
} |
||||
@ -0,0 +1,186 @@
@@ -0,0 +1,186 @@
|
||||
/* |
||||
* Copyright 2002-2020 the original author or authors. |
||||
* |
||||
* Licensed under the Apache License, Version 2.0 (the "License"); |
||||
* you may not use this file except in compliance with the License. |
||||
* You may obtain a copy of the License at |
||||
* |
||||
* https://www.apache.org/licenses/LICENSE-2.0
|
||||
* |
||||
* Unless required by applicable law or agreed to in writing, software |
||||
* distributed under the License is distributed on an "AS IS" BASIS, |
||||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
||||
* See the License for the specific language governing permissions and |
||||
* limitations under the License. |
||||
*/ |
||||
|
||||
package org.springframework.security.oauth2.server.resource.authentication; |
||||
|
||||
import java.util.Collection; |
||||
import java.util.Collections; |
||||
import java.util.HashMap; |
||||
import java.util.Map; |
||||
|
||||
import com.nimbusds.jose.JWSAlgorithm; |
||||
import com.nimbusds.jose.JWSHeader; |
||||
import com.nimbusds.jose.JWSObject; |
||||
import com.nimbusds.jose.Payload; |
||||
import com.nimbusds.jose.crypto.RSASSASigner; |
||||
import com.nimbusds.jwt.JWTClaimsSet; |
||||
import com.nimbusds.jwt.PlainJWT; |
||||
import net.minidev.json.JSONObject; |
||||
import okhttp3.mockwebserver.MockResponse; |
||||
import okhttp3.mockwebserver.MockWebServer; |
||||
import org.junit.Test; |
||||
import reactor.core.publisher.Mono; |
||||
|
||||
import org.springframework.mock.http.server.reactive.MockServerHttpRequest; |
||||
import org.springframework.mock.web.server.MockServerWebExchange; |
||||
import org.springframework.security.authentication.ReactiveAuthenticationManager; |
||||
import org.springframework.security.authentication.ReactiveAuthenticationManagerResolver; |
||||
import org.springframework.security.oauth2.core.OAuth2AuthenticationException; |
||||
import org.springframework.security.oauth2.jose.TestKeys; |
||||
|
||||
import static org.assertj.core.api.Assertions.assertThat; |
||||
import static org.assertj.core.api.Assertions.assertThatCode; |
||||
import static org.mockito.Mockito.mock; |
||||
import static org.springframework.security.oauth2.jwt.JwtClaimNames.ISS; |
||||
|
||||
/** |
||||
* Tests for {@link JwtIssuerReactiveAuthenticationManagerResolver} |
||||
*/ |
||||
public class JwtIssuerReactiveAuthenticationManagerResolverTests { |
||||
private static final String DEFAULT_RESPONSE_TEMPLATE = "{\n" |
||||
+ " \"issuer\": \"%s\", \n" |
||||
+ " \"jwks_uri\": \"%s/.well-known/jwks.json\" \n" |
||||
+ "}"; |
||||
|
||||
private String jwt = jwt("iss", "trusted"); |
||||
private String evil = jwt("iss", "\""); |
||||
private String noIssuer = jwt("sub", "sub"); |
||||
|
||||
@Test |
||||
public void resolveWhenUsingTrustedIssuerThenReturnsAuthenticationManager() throws Exception { |
||||
try (MockWebServer server = new MockWebServer()) { |
||||
String issuer = server.url("").toString(); |
||||
server.enqueue(new MockResponse() |
||||
.setResponseCode(200) |
||||
.setHeader("Content-Type", "application/json") |
||||
.setBody(String.format(DEFAULT_RESPONSE_TEMPLATE, issuer, issuer))); |
||||
JWSObject jws = new JWSObject(new JWSHeader(JWSAlgorithm.RS256), |
||||
new Payload(new JSONObject(Collections.singletonMap(ISS, issuer)))); |
||||
jws.sign(new RSASSASigner(TestKeys.DEFAULT_PRIVATE_KEY)); |
||||
|
||||
JwtIssuerReactiveAuthenticationManagerResolver authenticationManagerResolver = |
||||
new JwtIssuerReactiveAuthenticationManagerResolver(issuer); |
||||
MockServerWebExchange exchange = withBearerToken(jws.serialize()); |
||||
|
||||
ReactiveAuthenticationManager authenticationManager = |
||||
authenticationManagerResolver.resolve(exchange).block(); |
||||
assertThat(authenticationManager).isNotNull(); |
||||
|
||||
ReactiveAuthenticationManager cachedAuthenticationManager = |
||||
authenticationManagerResolver.resolve(exchange).block(); |
||||
assertThat(authenticationManager).isSameAs(cachedAuthenticationManager); |
||||
} |
||||
} |
||||
|
||||
@Test |
||||
public void resolveWhenUsingUntrustedIssuerThenException() { |
||||
JwtIssuerReactiveAuthenticationManagerResolver authenticationManagerResolver = |
||||
new JwtIssuerReactiveAuthenticationManagerResolver("other", "issuers"); |
||||
MockServerWebExchange exchange = withBearerToken(this.jwt); |
||||
|
||||
assertThatCode(() -> authenticationManagerResolver.resolve(exchange).block()) |
||||
.isInstanceOf(OAuth2AuthenticationException.class) |
||||
.hasMessageContaining("Invalid issuer"); |
||||
} |
||||
|
||||
@Test |
||||
public void resolveWhenUsingCustomIssuerAuthenticationManagerResolverThenUses() { |
||||
ReactiveAuthenticationManager authenticationManager = mock(ReactiveAuthenticationManager.class); |
||||
JwtIssuerReactiveAuthenticationManagerResolver authenticationManagerResolver = |
||||
new JwtIssuerReactiveAuthenticationManagerResolver(issuer -> Mono.just(authenticationManager)); |
||||
MockServerWebExchange exchange = withBearerToken(this.jwt); |
||||
|
||||
assertThat(authenticationManagerResolver.resolve(exchange).block()) |
||||
.isSameAs(authenticationManager); |
||||
} |
||||
|
||||
@Test |
||||
public void resolveWhenUsingExternalSourceThenRespondsToChanges() { |
||||
MockServerWebExchange exchange = withBearerToken(this.jwt); |
||||
|
||||
Map<String, ReactiveAuthenticationManager> authenticationManagers = new HashMap<>(); |
||||
JwtIssuerReactiveAuthenticationManagerResolver authenticationManagerResolver = |
||||
new JwtIssuerReactiveAuthenticationManagerResolver(issuer -> Mono.justOrEmpty(authenticationManagers.get(issuer))); |
||||
assertThatCode(() -> authenticationManagerResolver.resolve(exchange).block()) |
||||
.isInstanceOf(OAuth2AuthenticationException.class) |
||||
.hasMessageContaining("Invalid issuer"); |
||||
|
||||
ReactiveAuthenticationManager authenticationManager = mock(ReactiveAuthenticationManager.class); |
||||
authenticationManagers.put("trusted", authenticationManager); |
||||
assertThat(authenticationManagerResolver.resolve(exchange).block()) |
||||
.isSameAs(authenticationManager); |
||||
|
||||
authenticationManagers.clear(); |
||||
assertThatCode(() -> authenticationManagerResolver.resolve(exchange).block()) |
||||
.isInstanceOf(OAuth2AuthenticationException.class) |
||||
.hasMessageContaining("Invalid issuer"); |
||||
} |
||||
|
||||
@Test |
||||
public void resolveWhenBearerTokenMalformedThenException() { |
||||
JwtIssuerReactiveAuthenticationManagerResolver authenticationManagerResolver = |
||||
new JwtIssuerReactiveAuthenticationManagerResolver("trusted"); |
||||
MockServerWebExchange exchange = withBearerToken("jwt"); |
||||
assertThatCode(() -> authenticationManagerResolver.resolve(exchange).block()) |
||||
.isInstanceOf(OAuth2AuthenticationException.class) |
||||
.hasMessageNotContaining("Invalid issuer"); |
||||
} |
||||
|
||||
@Test |
||||
public void resolveWhenBearerTokenNoIssuerThenException() { |
||||
JwtIssuerReactiveAuthenticationManagerResolver authenticationManagerResolver = |
||||
new JwtIssuerReactiveAuthenticationManagerResolver("trusted"); |
||||
MockServerWebExchange exchange = withBearerToken(this.noIssuer); |
||||
assertThatCode(() -> authenticationManagerResolver.resolve(exchange).block()) |
||||
.isInstanceOf(OAuth2AuthenticationException.class) |
||||
.hasMessageContaining("Missing issuer"); |
||||
} |
||||
|
||||
@Test |
||||
public void resolveWhenBearerTokenEvilThenGenericException() { |
||||
JwtIssuerReactiveAuthenticationManagerResolver authenticationManagerResolver = |
||||
new JwtIssuerReactiveAuthenticationManagerResolver("trusted"); |
||||
MockServerWebExchange exchange = withBearerToken(this.evil); |
||||
assertThatCode(() -> authenticationManagerResolver.resolve(exchange).block()) |
||||
.isInstanceOf(OAuth2AuthenticationException.class) |
||||
.hasMessage("Invalid token"); |
||||
} |
||||
|
||||
@Test |
||||
public void constructorWhenNullOrEmptyIssuersThenException() { |
||||
assertThatCode(() -> new JwtIssuerReactiveAuthenticationManagerResolver((Collection) null)) |
||||
.isInstanceOf(IllegalArgumentException.class); |
||||
assertThatCode(() -> new JwtIssuerReactiveAuthenticationManagerResolver(Collections.emptyList())) |
||||
.isInstanceOf(IllegalArgumentException.class); |
||||
} |
||||
|
||||
@Test |
||||
public void constructorWhenNullAuthenticationManagerResolverThenException() { |
||||
assertThatCode(() -> new JwtIssuerReactiveAuthenticationManagerResolver((ReactiveAuthenticationManagerResolver) null)) |
||||
.isInstanceOf(IllegalArgumentException.class); |
||||
} |
||||
|
||||
private String jwt(String claim, String value) { |
||||
PlainJWT jwt = new PlainJWT(new JWTClaimsSet.Builder().claim(claim, value).build()); |
||||
return jwt.serialize(); |
||||
} |
||||
|
||||
private MockServerWebExchange withBearerToken(String token) { |
||||
MockServerHttpRequest request = MockServerHttpRequest.get("/") |
||||
.header("Authorization", "Bearer " + token).build(); |
||||
return MockServerWebExchange.from(request); |
||||
} |
||||
} |
||||
Loading…
Reference in new issue