[GitHub] [kafka] junrao commented on a change in pull request #11487: KAFKA-13445: Add ECDSA test for JWT validation

[GitBox <gi...@apache.org>]

junrao commented on a change in pull request #11487:
URL: https://github.com/apache/kafka/pull/11487#discussion_r749554644



##########
File path: clients/src/test/java/org/apache/kafka/common/security/oauthbearer/secured/AccessTokenBuilder.java
##########
@@ -49,22 +49,24 @@
 
     private Long expirationSeconds;
 
-    private RsaJsonWebKey jwk;
+    private PublicJsonWebKey jwk;
 
-    public AccessTokenBuilder() throws JoseException {
+    public AccessTokenBuilder() {
         this(new MockTime());
     }
 
-    public AccessTokenBuilder(Time time) throws JoseException {
+    public AccessTokenBuilder(Time time) {
         this.issuedAtSeconds = time.milliseconds() / 1000;
         this.expirationSeconds = this.issuedAtSeconds + 60;
-        this.jwk = createJwk();
     }
 
-    public static RsaJsonWebKey createJwk() throws JoseException {
-        RsaJsonWebKey jwk = RsaJwkGenerator.generateJwk(2048);
-        jwk.setKeyId("key-1");
-        return jwk;
+    public String alg() {
+        return alg;
+    }
+
+    public AccessTokenBuilder alg(String alg) {

Review comment:
       While you are at this, a few other methods like audience() and subjectClaimName seem never used. Is that expected?

##########
File path: clients/src/test/java/org/apache/kafka/common/security/oauthbearer/secured/ValidatorAccessTokenValidatorTest.java
##########
@@ -38,14 +40,35 @@ protected AccessTokenValidator createAccessTokenValidator(AccessTokenBuilder bui
     }
 
     @Test
-    public void testBasicEncryption() throws Exception {
-        AccessTokenBuilder builder = new AccessTokenBuilder();
+    public void testRsaEncryptionAlgorithm() throws Exception {
+        PublicJsonWebKey jwk = createRsaJwk();
+        testEncryptionAlgorithm(jwk, AlgorithmIdentifiers.RSA_USING_SHA256);
+    }
+
+    @Test
+    public void testEcdsaEncryptionAlgorithm() throws Exception {
+        PublicJsonWebKey jwk = createEcJwk();
+        testEncryptionAlgorithm(jwk, AlgorithmIdentifiers.ECDSA_USING_P256_CURVE_AND_SHA256);
+    }
+
+    @Test
+    public void testInvalidEncryptionAlgorithm() throws Exception {
+        PublicJsonWebKey jwk = createRsaJwk();
+
+        assertThrowsWithMessage(InvalidAlgorithmException.class,
+            () -> testEncryptionAlgorithm(jwk, "fake"),
+            "fake is an unknown, unsupported or unavailable alg algorithm");
+    }
+
+    private void testEncryptionAlgorithm(PublicJsonWebKey jwk, String alg) throws Exception {
+        AccessTokenBuilder builder = new AccessTokenBuilder().jwk(jwk).alg(alg);
         AccessTokenValidator validator = createAccessTokenValidator(builder);
 
         JsonWebSignature jws = new JsonWebSignature();
         jws.setKey(builder.jwk().getPrivateKey());
         jws.setKeyIdHeaderValue(builder.jwk().getKeyId());
-        jws.setAlgorithmHeaderValue(AlgorithmIdentifiers.RSA_USING_SHA256);
+        jws.setAlgorithmHeaderValue(alg);
+        jws.setPayload("{}");

Review comment:
       Hmm, how is jws being used?




-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: jira-unsubscribe@kafka.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org