You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@jclouds.apache.org by na...@apache.org on 2016/04/01 15:47:28 UTC
[2/2] jclouds git commit: Add support for Azure AD authentication
using Service Principal and Password
Add support for Azure AD authentication using Service Principal and Password
Project: http://git-wip-us.apache.org/repos/asf/jclouds/repo
Commit: http://git-wip-us.apache.org/repos/asf/jclouds/commit/04207416
Tree: http://git-wip-us.apache.org/repos/asf/jclouds/tree/04207416
Diff: http://git-wip-us.apache.org/repos/asf/jclouds/diff/04207416
Branch: refs/heads/master
Commit: 0420741690a484c5badc9fd7eb83d714e5edf2cc
Parents: 74a2a26
Author: Jim Spring <jm...@gmail.com>
Authored: Tue Mar 29 12:35:04 2016 -0700
Committer: Ignasi Barrera <na...@apache.org>
Committed: Fri Apr 1 14:50:09 2016 +0200
----------------------------------------------------------------------
apis/oauth/README | 34 +++++--
.../org/jclouds/oauth/v2/AuthorizationApi.java | 13 +++
.../jclouds/oauth/v2/config/CredentialType.java | 5 +-
.../jclouds/oauth/v2/config/OAuthModule.java | 6 +-
.../oauth/v2/config/OAuthProperties.java | 9 ++
.../jclouds/oauth/v2/domain/ClientSecret.java | 49 ++++++++++
.../v2/filters/ClientCredentialsSecretFlow.java | 99 ++++++++++++++++++++
.../oauth/v2/filters/JWTBearerTokenFlow.java | 11 ++-
.../oauth/v2/AuthorizationApiLiveTest.java | 71 ++++++++++++--
.../oauth/v2/AuthorizationApiMockTest.java | 45 ++++++++-
.../org/jclouds/oauth/v2/OAuthTestUtils.java | 3 +
11 files changed, 316 insertions(+), 29 deletions(-)
----------------------------------------------------------------------
http://git-wip-us.apache.org/repos/asf/jclouds/blob/04207416/apis/oauth/README
----------------------------------------------------------------------
diff --git a/apis/oauth/README b/apis/oauth/README
index 40b039d..7d039b1 100644
--- a/apis/oauth/README
+++ b/apis/oauth/README
@@ -1,16 +1,34 @@
In order to use oauth applications must specify the following properties:
-Mandatory:
+Mandatory, when using non-Azure Active Directory oauth:
<myprovider>.identity - the oauth identity (e.g., service account email in Google Api's)
<myprovider>.credential - the private key used to sign requests, in pem format
oauth.endpoint - the endpoint to use for authentication (e.g., "http://accounts.google.com/o/oauth2/token" in Google Api's)
oauth.audience - the "audience" of the token request (e.g., "http://accounts.google.com/o/oauth2/token" in Google Api's)
-Running the live test:
+Mandatory, when using oauth to authenticate against Azure Active Directory:
+<myprovider>.identity - the application GUID set up for as a Service Principal for your Azure account
+<myprovider>.credential - the password associated with the application GUID
+oauth.endpoint - the endpoint to use for Azure AD authentication (URL of the form the URL "https://login.microsoftonline.com/<Tenant ID>/oauth2/token")
+
+For Azure Active Directory, setting up a service principal to work with Azure Resource Manager and Azure AD as well as finding out the <Tenant ID> is described at https://azure.microsoft.com/en-us/documentation/articles/resource-group-authenticate-service-principal/
+
+Running the live test on for non client_credentials oauth grant type:
+
+mvn clean install -Plive \
+-Dtest.oauth.identity=<email addr> \
+-Dtest.oauth.credential=<private key> \
+-Dtest.oauth.endpoint=https://accounts.google.com/o/oauth2/token \
+-Dtest.jclouds.oauth.audience=https://accounts.google.com/o/oauth2/token \
+-Dtest.jclouds.oauth.scope=https://www.googleapis.com/auth/prediction \
+
+
+To Run the live test against Azure Active Directory which uses the client_credentials grant type:
+
+mvn clean install -Plive \
+-Dtest.oauth.identity=<azure app id> \
+-Dtest.oauth.credential=<azure app password> \
+-Dtest.oauth.endpoint=https://login.microsoftonline.com/<tenant id>/oauth2/token \
+-Dtest.jclouds.oauth.resource=https://management.azure.com/ \
+-Dtest.jclouds.oauth.credential-type=clientCredentialsSecret
-mvn clean install -Plive\
- -Dtest.oauth.identity=<accout email>\
- -Dtest.oauth.credential=<accout pk in pem format>\
- -Dtest.oauth.endpoint=https://accounts.google.com/o/oauth2/token\
- -Dtest.jclouds.oauth.audience=https://accounts.google.com/o/oauth2/token\
- -Dtest.jclouds.oauth.scope=https://www.googleapis.com/auth/prediction
\ No newline at end of file
http://git-wip-us.apache.org/repos/asf/jclouds/blob/04207416/apis/oauth/src/main/java/org/jclouds/oauth/v2/AuthorizationApi.java
----------------------------------------------------------------------
diff --git a/apis/oauth/src/main/java/org/jclouds/oauth/v2/AuthorizationApi.java b/apis/oauth/src/main/java/org/jclouds/oauth/v2/AuthorizationApi.java
index fae1761..b77a8de 100644
--- a/apis/oauth/src/main/java/org/jclouds/oauth/v2/AuthorizationApi.java
+++ b/apis/oauth/src/main/java/org/jclouds/oauth/v2/AuthorizationApi.java
@@ -25,6 +25,7 @@ import javax.ws.rs.Consumes;
import javax.ws.rs.FormParam;
import javax.ws.rs.POST;
+import org.jclouds.javax.annotation.Nullable;
import org.jclouds.oauth.v2.OAuthFallbacks.AuthorizationExceptionOn4xx;
import org.jclouds.oauth.v2.config.Authorization;
import org.jclouds.oauth.v2.domain.Claims;
@@ -46,4 +47,16 @@ public interface AuthorizationApi extends Closeable {
@Consumes(APPLICATION_JSON)
@Fallback(AuthorizationExceptionOn4xx.class)
Token authorize(@FormParam("assertion") @ParamParser(ClaimsToAssertion.class) Claims claims);
+
+ @Named("oauth2:authorize_client_secret")
+ @POST
+ @FormParams(keys = "grant_type", values = "client_credentials")
+ @Consumes(APPLICATION_JSON)
+ @Fallback(AuthorizationExceptionOn4xx.class)
+ Token authorizeClientSecret(
+ @FormParam("client_id") String client_id,
+ @FormParam("client_secret") String client_secret,
+ @FormParam("resource") String resource,
+ @FormParam("scope") @Nullable String scope
+ );
}
http://git-wip-us.apache.org/repos/asf/jclouds/blob/04207416/apis/oauth/src/main/java/org/jclouds/oauth/v2/config/CredentialType.java
----------------------------------------------------------------------
diff --git a/apis/oauth/src/main/java/org/jclouds/oauth/v2/config/CredentialType.java b/apis/oauth/src/main/java/org/jclouds/oauth/v2/config/CredentialType.java
index 141564b..b80f4c4 100644
--- a/apis/oauth/src/main/java/org/jclouds/oauth/v2/config/CredentialType.java
+++ b/apis/oauth/src/main/java/org/jclouds/oauth/v2/config/CredentialType.java
@@ -26,7 +26,10 @@ public enum CredentialType {
BEARER_TOKEN_CREDENTIALS,
/** Contents are a PEM-encoded P12 Private Key. */
- P12_PRIVATE_KEY_CREDENTIALS;
+ P12_PRIVATE_KEY_CREDENTIALS,
+
+ /** Contents are an ID and Secret */
+ CLIENT_CREDENTIALS_SECRET;
@Override public String toString() {
return UPPER_UNDERSCORE.to(LOWER_CAMEL, name());
http://git-wip-us.apache.org/repos/asf/jclouds/blob/04207416/apis/oauth/src/main/java/org/jclouds/oauth/v2/config/OAuthModule.java
----------------------------------------------------------------------
diff --git a/apis/oauth/src/main/java/org/jclouds/oauth/v2/config/OAuthModule.java b/apis/oauth/src/main/java/org/jclouds/oauth/v2/config/OAuthModule.java
index 8a3568c..dc18c5d 100644
--- a/apis/oauth/src/main/java/org/jclouds/oauth/v2/config/OAuthModule.java
+++ b/apis/oauth/src/main/java/org/jclouds/oauth/v2/config/OAuthModule.java
@@ -28,6 +28,7 @@ import javax.inject.Singleton;
import org.jclouds.oauth.v2.AuthorizationApi;
import org.jclouds.oauth.v2.filters.BearerTokenFromCredentials;
+import org.jclouds.oauth.v2.filters.ClientCredentialsSecretFlow;
import org.jclouds.oauth.v2.filters.JWTBearerTokenFlow;
import org.jclouds.oauth.v2.filters.OAuthFilter;
@@ -69,12 +70,15 @@ public final class OAuthModule extends AbstractModule {
@Singleton
protected OAuthFilter authenticationFilterForCredentialType(CredentialType credentialType,
JWTBearerTokenFlow serviceAccountAuth,
- BearerTokenFromCredentials bearerTokenAuth) {
+ BearerTokenFromCredentials bearerTokenAuth,
+ ClientCredentialsSecretFlow clientCredentialAuth) {
switch (credentialType) {
case P12_PRIVATE_KEY_CREDENTIALS:
return serviceAccountAuth;
case BEARER_TOKEN_CREDENTIALS:
return bearerTokenAuth;
+ case CLIENT_CREDENTIALS_SECRET:
+ return clientCredentialAuth;
default:
throw new IllegalArgumentException("Unsupported credential type: " + credentialType);
}
http://git-wip-us.apache.org/repos/asf/jclouds/blob/04207416/apis/oauth/src/main/java/org/jclouds/oauth/v2/config/OAuthProperties.java
----------------------------------------------------------------------
diff --git a/apis/oauth/src/main/java/org/jclouds/oauth/v2/config/OAuthProperties.java b/apis/oauth/src/main/java/org/jclouds/oauth/v2/config/OAuthProperties.java
index 7faed0c..87b5ca9 100644
--- a/apis/oauth/src/main/java/org/jclouds/oauth/v2/config/OAuthProperties.java
+++ b/apis/oauth/src/main/java/org/jclouds/oauth/v2/config/OAuthProperties.java
@@ -36,6 +36,15 @@ public final class OAuthProperties {
*/
public static final String CREDENTIAL_TYPE = "jclouds.oauth.credential-type";
+ /**
+ * When using oauth with Azure Active Direction and Client Credentials, a "resource" must
+ * be specified as part of the request.
+ *
+ * @see <a href="https://msdn.microsoft.com/en-us/library/azure/dn645543.aspx">doc</a>
+ */
+ public static final String RESOURCE = "jclouds.oauth.resource";
+
private OAuthProperties() {
}
}
+
http://git-wip-us.apache.org/repos/asf/jclouds/blob/04207416/apis/oauth/src/main/java/org/jclouds/oauth/v2/domain/ClientSecret.java
----------------------------------------------------------------------
diff --git a/apis/oauth/src/main/java/org/jclouds/oauth/v2/domain/ClientSecret.java b/apis/oauth/src/main/java/org/jclouds/oauth/v2/domain/ClientSecret.java
new file mode 100644
index 0000000..d664695
--- /dev/null
+++ b/apis/oauth/src/main/java/org/jclouds/oauth/v2/domain/ClientSecret.java
@@ -0,0 +1,49 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.jclouds.oauth.v2.domain;
+
+import org.jclouds.json.SerializedNames;
+import com.google.auto.value.AutoValue;
+
+/**
+ * Details corresponding the a client_credential Azure AD Oauth request
+ */
+@AutoValue
+public abstract class ClientSecret {
+ /** The ID of the client. **/
+ public abstract String clientId();
+
+ /** The secret of the client. **/
+ public abstract String clientSecret();
+
+ /** The resource to authorize against. **/
+ public abstract String resource();
+
+ /** The scope(s) to authorize against. **/
+ public abstract String scope();
+
+ /** When does the token expire. **/
+ public abstract long expire();
+
+ @SerializedNames({ "client_id", "client_secret", "resource", "scope", "expire" })
+ public static ClientSecret create(String clientId, String clientSecret, String resource, String scope, long expire) {
+ return new AutoValue_ClientSecret(clientId, clientSecret, resource, scope, expire);
+ }
+
+ ClientSecret() {
+ }
+}
http://git-wip-us.apache.org/repos/asf/jclouds/blob/04207416/apis/oauth/src/main/java/org/jclouds/oauth/v2/filters/ClientCredentialsSecretFlow.java
----------------------------------------------------------------------
diff --git a/apis/oauth/src/main/java/org/jclouds/oauth/v2/filters/ClientCredentialsSecretFlow.java b/apis/oauth/src/main/java/org/jclouds/oauth/v2/filters/ClientCredentialsSecretFlow.java
new file mode 100644
index 0000000..562e6f0
--- /dev/null
+++ b/apis/oauth/src/main/java/org/jclouds/oauth/v2/filters/ClientCredentialsSecretFlow.java
@@ -0,0 +1,99 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.jclouds.oauth.v2.filters;
+
+import com.google.common.base.Joiner;
+import com.google.common.base.Supplier;
+import com.google.common.cache.CacheBuilder;
+import com.google.common.cache.CacheLoader;
+import com.google.common.cache.LoadingCache;
+import org.jclouds.oauth.v2.AuthorizationApi;
+import org.jclouds.oauth.v2.domain.ClientSecret;
+import org.jclouds.oauth.v2.config.OAuthScopes;
+import org.jclouds.oauth.v2.domain.Token;
+import org.jclouds.domain.Credentials;
+import org.jclouds.http.HttpException;
+import org.jclouds.http.HttpRequest;
+import org.jclouds.location.Provider;
+
+import javax.inject.Named;
+import com.google.inject.Inject;
+
+import static java.util.concurrent.TimeUnit.SECONDS;
+import static org.jclouds.Constants.PROPERTY_SESSION_INTERVAL;
+import static org.jclouds.oauth.v2.config.OAuthProperties.RESOURCE;
+
+/**
+ * Authorizes new Bearer Tokens at runtime by sending up for the http request.
+ *
+ * To retrieve the Bearer Token, a request of grant_type=client_credentials is
+ * used. The credential supplied is a password.
+ *
+ * <h3>Cache</h3>
+ * This maintains a time-based Bearer Token cache. By default expires after 59 minutes
+ * (the maximum time a token is valid is 60 minutes).
+ */
+public class ClientCredentialsSecretFlow implements OAuthFilter {
+ private static final Joiner ON_SPACE = Joiner.on(" ");
+
+ private final Supplier<Credentials> credentialsSupplier;
+ private final long tokenDuration;
+ private final LoadingCache<ClientSecret, Token> tokenCache;
+ @Inject(optional = true) @Named(RESOURCE) private String resource;
+ @Inject(optional = true) private OAuthScopes scopes;
+
+ @Inject
+ ClientCredentialsSecretFlow(AuthorizeToken loader, @Named(PROPERTY_SESSION_INTERVAL) long tokenDuration,
+ @Provider Supplier<Credentials> credentialsSupplier) {
+ this.credentialsSupplier = credentialsSupplier;
+ this.tokenDuration = tokenDuration;
+ // since the session interval is also the token expiration time requested to the server make the token expire a
+ // bit before the deadline to make sure there aren't session expiration exceptions
+ long cacheExpirationSeconds = tokenDuration > 30 ? tokenDuration - 30 : tokenDuration;
+ this.tokenCache = CacheBuilder.newBuilder().expireAfterWrite(cacheExpirationSeconds, SECONDS).build(loader);
+ }
+
+ static final class AuthorizeToken extends CacheLoader<ClientSecret, Token> {
+ private final AuthorizationApi api;
+
+ @Inject AuthorizeToken(AuthorizationApi api) {
+ this.api = api;
+ }
+
+ @Override public Token load(ClientSecret key) throws Exception {
+ return api.authorizeClientSecret(key.clientId(), key.clientSecret(), key.resource(), key.scope());
+ }
+ }
+
+ @Override public HttpRequest filter(HttpRequest request) throws HttpException {
+ long now = currentTimeSeconds();
+ ClientSecret client = ClientSecret.create(
+ credentialsSupplier.get().identity,
+ credentialsSupplier.get().credential,
+ resource == null ? "" : resource,
+ scopes == null ? null : ON_SPACE.join(scopes.forRequest(request)),
+ now + tokenDuration
+ );
+ Token token = tokenCache.getUnchecked(client);
+ String authorization = String.format("%s %s", token.tokenType(), token.accessToken());
+ return request.toBuilder().addHeader("Authorization", authorization).build();
+ }
+
+ long currentTimeSeconds() {
+ return System.currentTimeMillis() / 1000;
+ }
+}
http://git-wip-us.apache.org/repos/asf/jclouds/blob/04207416/apis/oauth/src/main/java/org/jclouds/oauth/v2/filters/JWTBearerTokenFlow.java
----------------------------------------------------------------------
diff --git a/apis/oauth/src/main/java/org/jclouds/oauth/v2/filters/JWTBearerTokenFlow.java b/apis/oauth/src/main/java/org/jclouds/oauth/v2/filters/JWTBearerTokenFlow.java
index b862516..05ccf2a 100644
--- a/apis/oauth/src/main/java/org/jclouds/oauth/v2/filters/JWTBearerTokenFlow.java
+++ b/apis/oauth/src/main/java/org/jclouds/oauth/v2/filters/JWTBearerTokenFlow.java
@@ -19,6 +19,7 @@ package org.jclouds.oauth.v2.filters;
import static java.util.concurrent.TimeUnit.SECONDS;
import static org.jclouds.Constants.PROPERTY_SESSION_INTERVAL;
import static org.jclouds.oauth.v2.config.OAuthProperties.AUDIENCE;
+import static com.google.common.base.Preconditions.checkNotNull;
import javax.inject.Inject;
import javax.inject.Named;
@@ -50,7 +51,7 @@ import com.google.common.cache.LoadingCache;
public class JWTBearerTokenFlow implements OAuthFilter {
private static final Joiner ON_COMMA = Joiner.on(",");
- private final String audience;
+ @com.google.inject.Inject(optional = true) @Named(AUDIENCE) private String audience;
private final Supplier<Credentials> credentialsSupplier;
private final OAuthScopes scopes;
private final long tokenDuration;
@@ -59,8 +60,8 @@ public class JWTBearerTokenFlow implements OAuthFilter {
public static class TestJWTBearerTokenFlow extends JWTBearerTokenFlow {
@Inject TestJWTBearerTokenFlow(AuthorizeToken loader, @Named(PROPERTY_SESSION_INTERVAL) long tokenDuration,
- @Named(AUDIENCE) String audience, @Provider Supplier<Credentials> credentialsSupplier, OAuthScopes scopes) {
- super(loader, tokenDuration, audience, credentialsSupplier, scopes);
+ @Provider Supplier<Credentials> credentialsSupplier, OAuthScopes scopes) {
+ super(loader, tokenDuration, credentialsSupplier, scopes);
}
/** Constant time for testing. */
@@ -70,8 +71,7 @@ public class JWTBearerTokenFlow implements OAuthFilter {
}
@Inject JWTBearerTokenFlow(AuthorizeToken loader, @Named(PROPERTY_SESSION_INTERVAL) long tokenDuration,
- @Named(AUDIENCE) String audience, @Provider Supplier<Credentials> credentialsSupplier, OAuthScopes scopes) {
- this.audience = audience;
+ @Provider Supplier<Credentials> credentialsSupplier, OAuthScopes scopes) {
this.credentialsSupplier = credentialsSupplier;
this.scopes = scopes;
this.tokenDuration = tokenDuration;
@@ -94,6 +94,7 @@ public class JWTBearerTokenFlow implements OAuthFilter {
}
@Override public HttpRequest filter(HttpRequest request) throws HttpException {
+ checkNotNull(audience, AUDIENCE);
long now = currentTimeSeconds();
Claims claims = Claims.create( //
credentialsSupplier.get().identity, // iss
http://git-wip-us.apache.org/repos/asf/jclouds/blob/04207416/apis/oauth/src/test/java/org/jclouds/oauth/v2/AuthorizationApiLiveTest.java
----------------------------------------------------------------------
diff --git a/apis/oauth/src/test/java/org/jclouds/oauth/v2/AuthorizationApiLiveTest.java b/apis/oauth/src/test/java/org/jclouds/oauth/v2/AuthorizationApiLiveTest.java
index c78277f..1ded5dc 100644
--- a/apis/oauth/src/test/java/org/jclouds/oauth/v2/AuthorizationApiLiveTest.java
+++ b/apis/oauth/src/test/java/org/jclouds/oauth/v2/AuthorizationApiLiveTest.java
@@ -18,20 +18,24 @@ package org.jclouds.oauth.v2;
import static com.google.common.base.Preconditions.checkNotNull;
import static org.jclouds.oauth.v2.OAuthTestUtils.setCredential;
-import static org.jclouds.oauth.v2.config.OAuthProperties.AUDIENCE;
import static org.jclouds.oauth.v2.config.OAuthProperties.JWS_ALG;
+import static org.jclouds.oauth.v2.config.OAuthProperties.RESOURCE;
+import static org.jclouds.oauth.v2.config.OAuthProperties.AUDIENCE;
+import static org.jclouds.oauth.v2.config.OAuthProperties.CREDENTIAL_TYPE;
import static org.jclouds.providers.AnonymousProviderMetadata.forApiOnEndpoint;
import static org.testng.Assert.assertNotNull;
import java.util.Properties;
import org.jclouds.apis.BaseApiLiveTest;
+import org.jclouds.oauth.v2.config.CredentialType;
import org.jclouds.oauth.v2.config.OAuthModule;
import org.jclouds.oauth.v2.config.OAuthScopes;
import org.jclouds.oauth.v2.config.OAuthScopes.SingleScope;
import org.jclouds.oauth.v2.domain.Claims;
import org.jclouds.oauth.v2.domain.Token;
import org.jclouds.providers.ProviderMetadata;
+import org.testng.annotations.DataProvider;
import org.testng.annotations.Test;
import com.google.common.collect.ImmutableList;
@@ -45,19 +49,34 @@ public class AuthorizationApiLiveTest extends BaseApiLiveTest<AuthorizationApi>
private final String jwsAlg = "RS256";
private String scope;
private String audience;
+ private String credentialType;
+ private String resource;
public AuthorizationApiLiveTest() {
provider = "oauth";
}
- public void authenticateJWTToken() throws Exception {
+ @DataProvider
+ public Object[][] onlyRunForP12PrivateKeyCredentials() {
+ return (CredentialType.fromValue(credentialType) == CredentialType.P12_PRIVATE_KEY_CREDENTIALS) ?
+ OAuthTestUtils.SINGLE_NO_ARG_INVOCATION : OAuthTestUtils.NO_INVOCATIONS;
+ }
+
+ @DataProvider
+ public Object[][] onlyRunForClientCredentialsSecret() {
+ return (CredentialType.fromValue(credentialType) == CredentialType.CLIENT_CREDENTIALS_SECRET) ?
+ OAuthTestUtils.SINGLE_NO_ARG_INVOCATION : OAuthTestUtils.NO_INVOCATIONS;
+ }
+
+ @Test(dataProvider = "onlyRunForP12PrivateKeyCredentials")
+ public void authenticateP12PrivateKeyCredentialsTest() throws Exception {
long now = System.currentTimeMillis() / 1000;
Claims claims = Claims.create(
- identity, // iss
- scope, // scope
- audience, // aud
- now + 3600, // exp
- now // iat
+ identity, // iss
+ scope, // scope
+ audience, // aud
+ now + 3600, // exp
+ now // iat
);
Token token = api.authorize(claims);
@@ -65,6 +84,20 @@ public class AuthorizationApiLiveTest extends BaseApiLiveTest<AuthorizationApi>
assertNotNull(token, "no token when authorizing " + claims);
}
+ @Test(dataProvider = "onlyRunForClientCredentialsSecret")
+ public void authenticateClientCredentialsSecretTest() throws Exception {
+ Token token = api.authorizeClientSecret(identity, credential, resource, scope);
+
+ assertNotNull(token, "no token when authorizing " + identity);
+ }
+
+ @Test(dataProvider = "onlyRunForClientCredentialsSecret")
+ public void authenticateClientCredentialsSecretNullScopeTest() throws Exception {
+ Token token = api.authorizeClientSecret(identity, credential, resource, null);
+
+ assertNotNull(token, "no token when authorizing " + identity);
+ }
+
/** OAuth isn't registered as a provider intentionally, so we fake one. */
@Override protected ProviderMetadata createProviderMetadata() {
return forApiOnEndpoint(AuthorizationApi.class, endpoint).toBuilder().id("oauth").build();
@@ -73,9 +106,27 @@ public class AuthorizationApiLiveTest extends BaseApiLiveTest<AuthorizationApi>
@Override protected Properties setupProperties() {
Properties props = super.setupProperties();
props.setProperty(JWS_ALG, jwsAlg);
- credential = setCredential(props, "oauth.credential");
- audience = checkNotNull(setIfTestSystemPropertyPresent(props, AUDIENCE), "test.jclouds.oauth.audience");
- scope = checkNotNull(setIfTestSystemPropertyPresent(props, "jclouds.oauth.scope"), "test.jclouds.oauth.scope");
+
+ // scope is required for P12_PRIVATE_KEY_CREDENTIALS, optional for CLIENT_CREDENTIALS_SECRET.
+ // Moved the not-NULL check to P12_PRIVATE_KEY_CREDENTIALS specific parameters.
+ scope = setIfTestSystemPropertyPresent(props, "jclouds.oauth.scope");
+
+ // Determine which type of Credential to use, default to P12_PRIVATE_KEY_CREDENTIALS
+ credentialType = setIfTestSystemPropertyPresent(props, CREDENTIAL_TYPE);
+ if (credentialType == null) {
+ credentialType = CredentialType.P12_PRIVATE_KEY_CREDENTIALS.toString();
+ props.setProperty(CREDENTIAL_TYPE, credentialType);
+ }
+
+ // Set the credential specific properties.
+ if (CredentialType.fromValue(credentialType) == CredentialType.CLIENT_CREDENTIALS_SECRET) {
+ resource = checkNotNull(setIfTestSystemPropertyPresent(props, RESOURCE), "test." + RESOURCE);
+ } else if (CredentialType.fromValue(credentialType) == CredentialType.P12_PRIVATE_KEY_CREDENTIALS) {
+ audience = checkNotNull(setIfTestSystemPropertyPresent(props, AUDIENCE), "test.jclouds.oauth.audience");
+ credential = setCredential(props, "oauth.credential");
+ checkNotNull(scope, "test.jclouds.oauth.scope");
+ }
+
return props;
}
http://git-wip-us.apache.org/repos/asf/jclouds/blob/04207416/apis/oauth/src/test/java/org/jclouds/oauth/v2/AuthorizationApiMockTest.java
----------------------------------------------------------------------
diff --git a/apis/oauth/src/test/java/org/jclouds/oauth/v2/AuthorizationApiMockTest.java b/apis/oauth/src/test/java/org/jclouds/oauth/v2/AuthorizationApiMockTest.java
index 7e30121..adc7585 100644
--- a/apis/oauth/src/test/java/org/jclouds/oauth/v2/AuthorizationApiMockTest.java
+++ b/apis/oauth/src/test/java/org/jclouds/oauth/v2/AuthorizationApiMockTest.java
@@ -22,7 +22,9 @@ import static com.google.common.util.concurrent.MoreExecutors.sameThreadExecutor
import static javax.ws.rs.core.MediaType.APPLICATION_JSON;
import static org.jclouds.Constants.PROPERTY_MAX_RETRIES;
import static org.jclouds.oauth.v2.config.CredentialType.P12_PRIVATE_KEY_CREDENTIALS;
+import static org.jclouds.oauth.v2.config.CredentialType.CLIENT_CREDENTIALS_SECRET;
import static org.jclouds.oauth.v2.config.OAuthProperties.AUDIENCE;
+import static org.jclouds.oauth.v2.config.OAuthProperties.RESOURCE;
import static org.jclouds.oauth.v2.config.OAuthProperties.CREDENTIAL_TYPE;
import static org.jclouds.oauth.v2.config.OAuthProperties.JWS_ALG;
import static org.jclouds.util.Strings2.toStringAndClose;
@@ -35,6 +37,7 @@ import java.util.Properties;
import org.jclouds.ContextBuilder;
import org.jclouds.concurrent.config.ExecutorServiceModule;
+import org.jclouds.oauth.v2.config.CredentialType;
import org.jclouds.oauth.v2.config.OAuthModule;
import org.jclouds.oauth.v2.config.OAuthScopes;
import org.jclouds.oauth.v2.config.OAuthScopes.SingleScope;
@@ -82,7 +85,7 @@ public class AuthorizationApiMockTest {
+ " \"token_type\" : \"Bearer\",\n" + " \"expires_in\" : 3600\n" + "}"));
server.play();
- AuthorizationApi api = api(server.getUrl("/"));
+ AuthorizationApi api = api(server.getUrl("/"), P12_PRIVATE_KEY_CREDENTIALS);
assertEquals(api.authorize(CLAIMS), TOKEN);
@@ -115,7 +118,7 @@ public class AuthorizationApiMockTest {
server.enqueue(new MockResponse().setResponseCode(400));
server.play();
- AuthorizationApi api = api(server.getUrl("/"));
+ AuthorizationApi api = api(server.getUrl("/"), P12_PRIVATE_KEY_CREDENTIALS);
api.authorize(CLAIMS);
fail("An AuthorizationException should have been raised");
} catch (AuthorizationException ex) {
@@ -125,14 +128,48 @@ public class AuthorizationApiMockTest {
}
}
+ public void testGenerateClientSecretRequest() throws Exception {
+ MockWebServer server = new MockWebServer();
+
+ String credential = "password";
+ String identity = "user";
+ String resource = "http://management.azure.com/";
+ String encoded_resource = "http%3A//management.azure.com/";
+
+ try {
+ server.enqueue(new MockResponse().setBody("{\n"
+ + " \"access_token\" : \"1/8xbJqaOZXSUZbHLl5EOtu1pxz3fmmetKx9W8CV4t79M\",\n"
+ + " \"token_type\" : \"Bearer\",\n" + " \"expires_in\" : 3600\n" + "}"));
+ server.play();
+
+ AuthorizationApi api = api(server.getUrl("/"), CLIENT_CREDENTIALS_SECRET);
+
+ assertEquals(api.authorizeClientSecret(identity, credential, resource, null), TOKEN);
+
+ RecordedRequest request = server.takeRequest();
+ assertEquals(request.getMethod(), "POST");
+ assertEquals(request.getHeader("Accept"), APPLICATION_JSON);
+ assertEquals(request.getHeader("Content-Type"), "application/x-www-form-urlencoded");
+
+ assertEquals(
+ new String(request.getBody(), UTF_8), //
+ "grant_type=client_credentials&client_id=" + identity
+ + "&client_secret=" + credential
+ + "&resource=" + encoded_resource);
+ } finally {
+ server.shutdown();
+ }
+ }
+
private final BaseEncoding encoding = base64Url().omitPadding();
- private AuthorizationApi api(URL url) throws IOException {
+ private AuthorizationApi api(URL url, CredentialType credentialType) throws IOException {
Properties overrides = new Properties();
overrides.setProperty("oauth.endpoint", url.toString());
overrides.setProperty(JWS_ALG, "RS256");
- overrides.setProperty(CREDENTIAL_TYPE, P12_PRIVATE_KEY_CREDENTIALS.toString());
+ overrides.setProperty(CREDENTIAL_TYPE, credentialType.toString());
overrides.setProperty(AUDIENCE, "https://accounts.google.com/o/oauth2/token");
+ overrides.setProperty(RESOURCE, "https://management.azure.com/");
overrides.setProperty(PROPERTY_MAX_RETRIES, "1");
return ContextBuilder.newBuilder(AnonymousHttpApiMetadata.forApi(AuthorizationApi.class))
http://git-wip-us.apache.org/repos/asf/jclouds/blob/04207416/apis/oauth/src/test/java/org/jclouds/oauth/v2/OAuthTestUtils.java
----------------------------------------------------------------------
diff --git a/apis/oauth/src/test/java/org/jclouds/oauth/v2/OAuthTestUtils.java b/apis/oauth/src/test/java/org/jclouds/oauth/v2/OAuthTestUtils.java
index e5ec5ec..e2ac660 100644
--- a/apis/oauth/src/test/java/org/jclouds/oauth/v2/OAuthTestUtils.java
+++ b/apis/oauth/src/test/java/org/jclouds/oauth/v2/OAuthTestUtils.java
@@ -32,6 +32,9 @@ import com.google.common.io.Files;
public class OAuthTestUtils {
+ public static final Object[][] NO_INVOCATIONS = new Object[0][0];
+ public static final Object[][] SINGLE_NO_ARG_INVOCATION = { new Object[0] };
+
public static Properties defaultProperties(Properties properties) {
try {
properties = properties == null ? new Properties() : properties;