You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@cxf.apache.org by co...@apache.org on 2019/09/16 13:30:36 UTC
[cxf] branch 3.2.x-fixes updated (636f38b -> e2451b3)
This is an automated email from the ASF dual-hosted git repository.
coheigea pushed a change to branch 3.2.x-fixes
in repository https://gitbox.apache.org/repos/asf/cxf.git.
from 636f38b Recording .gitmergeinfo Changes
new db60696 Make sure that the OAuth authenticate principal name matches the client_id (if specified)
new e286615 Fixing OAuth scope test
new e2451b3 Recording .gitmergeinfo Changes
The 3 revisions listed above as "new" are entirely new to this
repository and will be described in separate emails. The revisions
listed as "add" were already present in the repository and have only
been added to this reference.
Summary of changes:
.gitmergeinfo | 7 ++
.../oauth2/services/AbstractTokenService.java | 25 ++--
.../services/RedirectionBasedGrantService.java | 3 +-
.../grants/AuthorizationGrantNegativeTest.java | 127 ++++++++++++++++++++-
.../oauth2/grants/AuthorizationGrantTest.java | 4 +-
5 files changed, 148 insertions(+), 18 deletions(-)
[cxf] 01/03: Make sure that the OAuth authenticate principal name
matches the client_id (if specified)
Posted by co...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
coheigea pushed a commit to branch 3.2.x-fixes
in repository https://gitbox.apache.org/repos/asf/cxf.git
commit db6069667708a59c75a785f310d4a2df3698122c
Author: Colm O hEigeartaigh <co...@apache.org>
AuthorDate: Wed Sep 11 00:43:48 2019 +0100
Make sure that the OAuth authenticate principal name matches the client_id (if specified)
(cherry picked from commit 337609d81a9f53e7680cb79d9ab733a79f4cd769)
(cherry picked from commit 6bf89927d3e07197d49453b00d673eadce696cf9)
---
.../oauth2/services/AbstractTokenService.java | 25 +++--
.../grants/AuthorizationGrantNegativeTest.java | 123 +++++++++++++++++++++
.../oauth2/grants/AuthorizationGrantTest.java | 4 +-
3 files changed, 138 insertions(+), 14 deletions(-)
diff --git a/rt/rs/security/oauth-parent/oauth2/src/main/java/org/apache/cxf/rs/security/oauth2/services/AbstractTokenService.java b/rt/rs/security/oauth-parent/oauth2/src/main/java/org/apache/cxf/rs/security/oauth2/services/AbstractTokenService.java
index a5e82a2..8e32cca 100644
--- a/rt/rs/security/oauth-parent/oauth2/src/main/java/org/apache/cxf/rs/security/oauth2/services/AbstractTokenService.java
+++ b/rt/rs/security/oauth-parent/oauth2/src/main/java/org/apache/cxf/rs/security/oauth2/services/AbstractTokenService.java
@@ -56,8 +56,8 @@ public class AbstractTokenService extends AbstractOAuthService {
SecurityContext sc = getMessageContext().getSecurityContext();
Principal principal = sc.getUserPrincipal();
+ String clientId = retrieveClientId(params);
if (principal == null) {
- String clientId = retrieveClientId(params);
if (clientId != null) {
String clientSecret = params.getFirst(OAuthConstants.CLIENT_SECRET);
if (clientSecret != null) {
@@ -77,11 +77,12 @@ public class AbstractTokenService extends AbstractOAuthService {
}
}
} else {
- String clientId = retrieveClientId(params);
if (clientId != null) {
- if (clientId.equals(principal.getName())) {
- client = (Client)getMessageContext().get(Client.class.getName());
+ if (!clientId.equals(principal.getName())) {
+ reportInvalidClient();
}
+
+ client = (Client)getMessageContext().get(Client.class.getName());
if (client == null) {
client = getClient(clientId, params);
}
@@ -108,7 +109,7 @@ public class AbstractTokenService extends AbstractOAuthService {
reportInvalidClient(new OAuthError(OAuthConstants.UNAUTHORIZED_CLIENT));
}
}
-
+
protected String retrieveClientId(MultivaluedMap<String, String> params) {
String clientId = params.getFirst(OAuthConstants.CLIENT_ID);
if (clientId == null) {
@@ -164,14 +165,14 @@ public class AbstractTokenService extends AbstractOAuthService {
reportInvalidClient();
}
X509Certificate cert = OAuthUtils.getRootTLSCertificate(tlsSessionInfo);
-
- if (subjectDn != null
+
+ if (subjectDn != null
&& !subjectDn.equals(OAuthUtils.getSubjectDnFromTLSCertificates(cert))) {
LOG.warning("Client \"" + client.getClientId() + "\" can not be bound to the TLS certificate");
reportInvalidClient();
}
String issuerDn = client.getProperties().get(OAuthConstants.TLS_CLIENT_AUTH_ISSUER_DN);
- if (issuerDn != null
+ if (issuerDn != null
&& !issuerDn.equals(OAuthUtils.getIssuerDnFromTLSCertificates(cert))) {
LOG.warning("Client \"" + client.getClientId() + "\" can not be bound to the TLS certificate");
reportInvalidClient();
@@ -187,7 +188,7 @@ public class AbstractTokenService extends AbstractOAuthService {
return (TLSSessionInfo)getMessageContext().get(TLSSessionInfo.class.getName());
}
-
+
protected Client getClientFromTLSCertificates(SecurityContext sc,
TLSSessionInfo tlsSessionInfo,
MultivaluedMap<String, String> params) {
@@ -206,11 +207,11 @@ public class AbstractTokenService extends AbstractOAuthService {
}
return client;
}
-
+
protected void compareTlsCertificates(TLSSessionInfo tlsInfo,
List<String> base64EncodedCerts) {
if (!OAuthUtils.compareTlsCertificates(tlsInfo, base64EncodedCerts)) {
- reportInvalidClient();
+ reportInvalidClient();
}
}
@@ -244,7 +245,7 @@ public class AbstractTokenService extends AbstractOAuthService {
protected Client getClient(String clientId, MultivaluedMap<String, String> params) {
return getClient(clientId, params.getFirst(OAuthConstants.CLIENT_SECRET), params);
}
-
+
protected Client getClient(String clientId, String clientSecret, MultivaluedMap<String, String> params) {
if (clientId == null) {
reportInvalidRequestError("Client ID is null");
diff --git a/systests/rs-security/src/test/java/org/apache/cxf/systest/jaxrs/security/oauth2/grants/AuthorizationGrantNegativeTest.java b/systests/rs-security/src/test/java/org/apache/cxf/systest/jaxrs/security/oauth2/grants/AuthorizationGrantNegativeTest.java
index 66e8739..752071e 100644
--- a/systests/rs-security/src/test/java/org/apache/cxf/systest/jaxrs/security/oauth2/grants/AuthorizationGrantNegativeTest.java
+++ b/systests/rs-security/src/test/java/org/apache/cxf/systest/jaxrs/security/oauth2/grants/AuthorizationGrantNegativeTest.java
@@ -555,6 +555,129 @@ public class AuthorizationGrantNegativeTest extends AbstractBusClientServerTestB
}
}
+ // Here we are sending a different client Id in both the authz + token requests
+ @org.junit.Test
+ public void testNonMatchingClientId() throws Exception {
+ URL busFile = AuthorizationGrantTest.class.getResource("client.xml");
+
+ String address = "https://localhost:" + port + "/services/";
+ WebClient client = WebClient.create(address, OAuth2TestUtils.setupProviders(),
+ "alice", "security", busFile.toString());
+ // Save the Cookie for the second request...
+ WebClient.getConfig(client).getRequestContext().put(
+ org.apache.cxf.message.Message.MAINTAIN_SESSION, Boolean.TRUE);
+
+ // Get Authorization Code
+ String code = OAuth2TestUtils.getAuthorizationCode(client);
+ assertNotNull(code);
+
+ // Now get the access token using a different client id
+ client = WebClient.create(address, OAuth2TestUtils.setupProviders(),
+ "consumer-id-aud", "this-is-a-secret", busFile.toString());
+ // Save the Cookie for the second request...
+ WebClient.getConfig(client).getRequestContext().put(
+ org.apache.cxf.message.Message.MAINTAIN_SESSION, Boolean.TRUE);
+
+ client.type("application/x-www-form-urlencoded").accept("application/json");
+ client.path("token");
+
+ Form form = new Form();
+ form.param("grant_type", "authorization_code");
+ form.param("code", code);
+ form.param("client_id", "consumer-id-aud");
+
+ // Now try to get a token
+ Response response = client.post(form);
+ try {
+ response.readEntity(ClientAccessToken.class);
+ fail("Failure expected on trying to get a token");
+ } catch (ResponseProcessingException ex) {
+ //expected
+ }
+ }
+
+ // Here we are sending a different client Id in both the authz + token requests
+ @org.junit.Test
+ public void testNonMatchingClientIdBasicAuth() throws Exception {
+ URL busFile = AuthorizationGrantTest.class.getResource("client.xml");
+
+ String address = "https://localhost:" + port + "/services/";
+ WebClient client = WebClient.create(address, OAuth2TestUtils.setupProviders(),
+ "alice", "security", busFile.toString());
+ // Save the Cookie for the second request...
+ WebClient.getConfig(client).getRequestContext().put(
+ org.apache.cxf.message.Message.MAINTAIN_SESSION, Boolean.TRUE);
+
+ // Get Authorization Code
+ String code = OAuth2TestUtils.getAuthorizationCode(client);
+ assertNotNull(code);
+
+ // Now get the access token using a different client id
+ client = WebClient.create(address, OAuth2TestUtils.setupProviders(),
+ "consumer-id-aud", "this-is-a-secret", busFile.toString());
+ // Save the Cookie for the second request...
+ WebClient.getConfig(client).getRequestContext().put(
+ org.apache.cxf.message.Message.MAINTAIN_SESSION, Boolean.TRUE);
+
+ client.type("application/x-www-form-urlencoded").accept("application/json");
+ client.path("token");
+
+ Form form = new Form();
+ form.param("grant_type", "authorization_code");
+ form.param("code", code);
+
+ // Now try to get a token
+ Response response = client.post(form);
+ try {
+ response.readEntity(ClientAccessToken.class);
+ fail("Failure expected on trying to get a token");
+ } catch (ResponseProcessingException ex) {
+ //expected
+ }
+ }
+
+ // Here we are sending a different client Id in both the authz + token requests, where in the
+ // token request we authenticate using a different clientId
+ @org.junit.Test
+ public void testNonMatchingClientDifferentClientIds() throws Exception {
+ URL busFile = AuthorizationGrantTest.class.getResource("client.xml");
+
+ String address = "https://localhost:" + port + "/services/";
+ WebClient client = WebClient.create(address, OAuth2TestUtils.setupProviders(),
+ "alice", "security", busFile.toString());
+ // Save the Cookie for the second request...
+ WebClient.getConfig(client).getRequestContext().put(
+ org.apache.cxf.message.Message.MAINTAIN_SESSION, Boolean.TRUE);
+
+ // Get Authorization Code
+ String code = OAuth2TestUtils.getAuthorizationCode(client);
+ assertNotNull(code);
+
+ // Now get the access token using a different client id
+ client = WebClient.create(address, OAuth2TestUtils.setupProviders(),
+ "consumer-id-aud", "this-is-a-secret", busFile.toString());
+ // Save the Cookie for the second request...
+ WebClient.getConfig(client).getRequestContext().put(
+ org.apache.cxf.message.Message.MAINTAIN_SESSION, Boolean.TRUE);
+
+ client.type("application/x-www-form-urlencoded").accept("application/json");
+ client.path("token");
+
+ Form form = new Form();
+ form.param("grant_type", "authorization_code");
+ form.param("code", code);
+ form.param("client_id", "consumer-id");
+
+ // Now try to get a token
+ Response response = client.post(form);
+ try {
+ response.readEntity(ClientAccessToken.class);
+ fail("Failure expected on trying to get a token");
+ } catch (ResponseProcessingException ex) {
+ //expected
+ }
+ }
+
//
// SAML Authorization grants
//
diff --git a/systests/rs-security/src/test/java/org/apache/cxf/systest/jaxrs/security/oauth2/grants/AuthorizationGrantTest.java b/systests/rs-security/src/test/java/org/apache/cxf/systest/jaxrs/security/oauth2/grants/AuthorizationGrantTest.java
index a8c06ed..f59a15b 100644
--- a/systests/rs-security/src/test/java/org/apache/cxf/systest/jaxrs/security/oauth2/grants/AuthorizationGrantTest.java
+++ b/systests/rs-security/src/test/java/org/apache/cxf/systest/jaxrs/security/oauth2/grants/AuthorizationGrantTest.java
@@ -495,7 +495,7 @@ public class AuthorizationGrantTest extends AbstractBusClientServerTestBase {
String address = "https://localhost:" + port + "/services/";
WebClient client = WebClient.create(address, OAuth2TestUtils.setupProviders(),
- "alice", "security", busFile.toString());
+ "consumer-id", "this-is-a-secret", busFile.toString());
// Create the SAML Assertion
String assertion = OAuth2TestUtils.createToken(address + "token");
@@ -525,7 +525,7 @@ public class AuthorizationGrantTest extends AbstractBusClientServerTestBase {
String address = "https://localhost:" + port + "/services/";
WebClient client = WebClient.create(address, OAuth2TestUtils.setupProviders(),
- "alice", "security", busFile.toString());
+ "consumer-id", "this-is-a-secret", busFile.toString());
// Create the JWT Token
String token = OAuth2TestUtils.createToken("DoubleItSTSIssuer", "consumer-id",
[cxf] 03/03: Recording .gitmergeinfo Changes
Posted by co...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
coheigea pushed a commit to branch 3.2.x-fixes
in repository https://gitbox.apache.org/repos/asf/cxf.git
commit e2451b305944eafcdeb68a9fedd0dc52f6872610
Author: Colm O hEigeartaigh <co...@apache.org>
AuthorDate: Mon Sep 16 14:30:25 2019 +0100
Recording .gitmergeinfo Changes
---
.gitmergeinfo | 7 +++++++
1 file changed, 7 insertions(+)
diff --git a/.gitmergeinfo b/.gitmergeinfo
index 49dcc0d..375366a 100644
--- a/.gitmergeinfo
+++ b/.gitmergeinfo
@@ -54,6 +54,7 @@ B 1525974f5b6de5dc9a6c9a8ca81daa91317e19c3
B 16077ac65e46710865a883d1c60d87bcd422bb33
B 177ba3183df5c9bd55b6e91eb5823bc75e8a45ef
B 179bd2fb3c6e84ace75859cc6569b56d2aa3a9f1
+B 179cb7a84b82e297a4d43af9d7454340542ed7d7
B 180750ab68aeeae60731dbdfb943eca8608fe94a
B 187e7cb871d6c1821ca43039ebd4eaa53c26022a
B 189e23aa82a2a05d60396a8cdd6c8faef5be41b5
@@ -62,6 +63,7 @@ B 1a18c6e518790d60c7c7a9fbaa7bd3a371b8e324
B 1a1f76c5cfd7d9dfbb3334cd9ba2b4dbdf170ef7
B 1a321e2d766087025cabd339a4e13643833c1a56
B 1b46339f841756b35846c1389860ee615ba91ddf
+B 1cbe0268c1c428717ad8215363ec06c08ee462b7
B 1cfdb42724549fdef21a9d50d62cd9dbdc5d8dd3
B 1d1694a70c22d5dff10aebdae588d3dd1aff25e1
B 1e35c3ac012c3acda3b82f225bada42c883e4098
@@ -102,6 +104,7 @@ B 27ad1dc1b3bf1aea132729ad930a5338fae3b8f9
B 28a573c61367166ef250dece7b69b9370a089751
B 28dfeaacb1d6c584499c2303e8c4ff3158c1e0bf
B 29e5bb404e6b44a643e9228712f495244ea275e2
+B 2b85b8036385cb09e7694f5dee572ffecf34bf0a
B 2be435cd07059986f20430fd37790f411b8b3a5e
B 2c53a23f13a313d8a5447d5628cd3fcc937e57c2
B 2c7c05fc2009fa7c1449ed2d5fa6aa150bfba33a
@@ -415,6 +418,7 @@ B a6298c17fd3a7decaec32a8e3c24653248ec9075
B a64cd0582d788064b84343012510097566f26de9
B a6978c675d99ed3e317f37ea8f9885004369ff7a
B a6e9544bef6ec23083259b08bdc04e49b5f8f943
+B a6f0a9c970439c1514f65bfbd32f5a058a1beb48
B a70c45597c03a0d2365f9273a60fda5182c22457
B a75cc85a4e0a57ef0db15088a98779c9b7a23536
B a790e5a484fe549f89ed3897b598cd1cf9ebe5b2
@@ -479,6 +483,7 @@ B bc1a22503447649e7991f4b8f3368a90deb42a7d
B bc1a8f581a0cf3930db9086c6b6d8a795b44684b
B bc7d9c0b017be38c7aa066eaad179cb6df7ef4ab
B bca53bff89b0d18dea275847fcfa84b2a495acce
+B bcd823d25ef0aeb1014e9b7f7cbf03dde08ab13e
B bd528bf5f94cfcd9aea7f71117f535a2a343dc76
B bdae8a1b0237f2fb8bdee8c2f7548036b79930ec
B bdb110cb7aa2e86e0eb8c673b4d29de32e57c0ea
@@ -519,6 +524,7 @@ B cb0585be6862a919249639f7c15c81273e5ef6d7
B cb084ca830b19c1ddb0df459bc0c06cbc7ebb197
B cb0d65d853797d7302c9e600f8a12f54a36df1a8
B cb332a23ad51e738ae9a3d5fe9f39518e04194e9
+B cb4a9f4f0b7acc13c3a966b5990c3f3ae0415a5f
B cb6b19c7ce86ee4e7e7559502f6fe4b940968c0b
B cbe9b58888d2270bdc2b9cb6d97e4d834bcebc10
B cbf2d261ac21657a9b1d6dc233e881d2ec71f442
@@ -619,6 +625,7 @@ B f2433027ba4e5f189abb6d40a1f182d7c07c9328
B f29e60b167440662b1406693cda4c44c06df78e7
B f2c6f57bb73ef435b6c4965766551fd452110677
B f2ff0f6c70c33966219649181e8cef57d2e4c327
+B f366b942b64c427ebfaacc79b0229ddb7a481237
B f518006392fbe8f740fce10c03a01995b3cb5f54
B f627e44aafed24f075f48052f782925f2c0bfc06
B f64fa00245bf0749ddb807df3a0292ab46900976
[cxf] 02/03: Fixing OAuth scope test
Posted by co...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
coheigea pushed a commit to branch 3.2.x-fixes
in repository https://gitbox.apache.org/repos/asf/cxf.git
commit e286615b8caa4778609746f930c033ec2a270f0b
Author: Colm O hEigeartaigh <co...@apache.org>
AuthorDate: Wed Sep 11 01:08:19 2019 +0100
Fixing OAuth scope test
(cherry picked from commit 39e32c4a3cf4b6dd35dae7cfccf47e2f23b8d253)
(cherry picked from commit df2f56d8a5d962ec921fe978a46a0314a05c8876)
---
.../cxf/rs/security/oauth2/services/RedirectionBasedGrantService.java | 3 +--
.../jaxrs/security/oauth2/grants/AuthorizationGrantNegativeTest.java | 4 ++--
2 files changed, 3 insertions(+), 4 deletions(-)
diff --git a/rt/rs/security/oauth-parent/oauth2/src/main/java/org/apache/cxf/rs/security/oauth2/services/RedirectionBasedGrantService.java b/rt/rs/security/oauth-parent/oauth2/src/main/java/org/apache/cxf/rs/security/oauth2/services/RedirectionBasedGrantService.java
index 90c3285..0aa14b7 100644
--- a/rt/rs/security/oauth-parent/oauth2/src/main/java/org/apache/cxf/rs/security/oauth2/services/RedirectionBasedGrantService.java
+++ b/rt/rs/security/oauth-parent/oauth2/src/main/java/org/apache/cxf/rs/security/oauth2/services/RedirectionBasedGrantService.java
@@ -396,8 +396,7 @@ public abstract class RedirectionBasedGrantService extends AbstractOAuthService
approvedScope.add(rScope);
}
}
- if (!requestedScope.containsAll(approvedScope)
- || !OAuthUtils.validateScopes(requestedScope, client.getRegisteredScopes(),
+ if (!OAuthUtils.validateScopes(requestedScope, client.getRegisteredScopes(),
partialMatchScopeValidation)) {
return createErrorResponse(params, redirectUri, OAuthConstants.INVALID_SCOPE);
}
diff --git a/systests/rs-security/src/test/java/org/apache/cxf/systest/jaxrs/security/oauth2/grants/AuthorizationGrantNegativeTest.java b/systests/rs-security/src/test/java/org/apache/cxf/systest/jaxrs/security/oauth2/grants/AuthorizationGrantNegativeTest.java
index 752071e..d95dffe 100644
--- a/systests/rs-security/src/test/java/org/apache/cxf/systest/jaxrs/security/oauth2/grants/AuthorizationGrantNegativeTest.java
+++ b/systests/rs-security/src/test/java/org/apache/cxf/systest/jaxrs/security/oauth2/grants/AuthorizationGrantNegativeTest.java
@@ -217,13 +217,13 @@ public class AuthorizationGrantNegativeTest extends AbstractBusClientServerTestB
client.type("application/json").accept("application/json");
client.query("client_id", "consumer-id");
client.query("response_type", "code");
- client.query("redirect_uri", "http://www.blah.bad.apache.org");
+ client.query("redirect_uri", "http://www.blah.apache.org");
client.query("scope", "unknown-scope");
client.path("authorize/");
// No redirect URI
Response response = client.get();
- assertEquals(400, response.getStatus());
+ assertEquals(303, response.getStatus());
}
// Send the authorization code twice to get an access token