You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@tomee.apache.org by jl...@apache.org on 2018/04/26 15:13:37 UTC

[2/8] tomee git commit: Missing files from previous commit

http://git-wip-us.apache.org/repos/asf/tomee/blob/def443a4/mp-jwt/src/main/java/org/apache/tomee/microprofile/jwt/principal/DefaultJWTCallerPrincipalFactory.java
----------------------------------------------------------------------
diff --git a/mp-jwt/src/main/java/org/apache/tomee/microprofile/jwt/principal/DefaultJWTCallerPrincipalFactory.java b/mp-jwt/src/main/java/org/apache/tomee/microprofile/jwt/principal/DefaultJWTCallerPrincipalFactory.java
new file mode 100644
index 0000000..feb2008
--- /dev/null
+++ b/mp-jwt/src/main/java/org/apache/tomee/microprofile/jwt/principal/DefaultJWTCallerPrincipalFactory.java
@@ -0,0 +1,92 @@
+/*
+ *     Licensed to the Apache Software Foundation (ASF) under one or more
+ *     contributor license agreements.  See the NOTICE file distributed with
+ *     this work for additional information regarding copyright ownership.
+ *     The ASF licenses this file to You under the Apache License, Version 2.0
+ *     (the "License"); you may not use this file except in compliance with
+ *     the License.  You may obtain a copy of the License at
+ *
+ *        http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *     Unless required by applicable law or agreed to in writing, software
+ *     distributed under the License is distributed on an "AS IS" BASIS,
+ *     WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *     See the License for the specific language governing permissions and
+ *     limitations under the License.
+ */
+package org.apache.tomee.microprofile.jwt.principal;
+
+import org.apache.tomee.microprofile.jwt.ParseException;
+import org.apache.tomee.microprofile.jwt.config.JWTAuthContextInfo;
+import org.eclipse.microprofile.jwt.Claims;
+import org.jose4j.jwa.AlgorithmConstraints;
+import org.jose4j.jws.AlgorithmIdentifiers;
+import org.jose4j.jwt.JwtClaims;
+import org.jose4j.jwt.MalformedClaimException;
+import org.jose4j.jwt.NumericDate;
+import org.jose4j.jwt.consumer.InvalidJwtException;
+import org.jose4j.jwt.consumer.JwtConsumer;
+import org.jose4j.jwt.consumer.JwtConsumerBuilder;
+import org.jose4j.jwt.consumer.JwtContext;
+
+/**
+ * A default implementation of the abstract JWTCallerPrincipalFactory that uses the Keycloak token parsing classes.
+ */
+public class DefaultJWTCallerPrincipalFactory extends JWTCallerPrincipalFactory {
+
+    /**
+     * Tries to load the JWTAuthContextInfo from CDI if the class level authContextInfo has not been set.
+     */
+    public DefaultJWTCallerPrincipalFactory() {
+    }
+
+    @Override
+    public JWTCallerPrincipal parse(final String token, final JWTAuthContextInfo authContextInfo) throws ParseException {
+        JWTCallerPrincipal principal;
+
+        try {
+            final JwtConsumerBuilder builder = new JwtConsumerBuilder()
+                    .setRequireExpirationTime()
+                    .setRequireSubject()
+                    .setSkipDefaultAudienceValidation()
+                    .setExpectedIssuer(authContextInfo.getIssuedBy())
+                    .setVerificationKey(authContextInfo.getSignerKey())
+                    .setJwsAlgorithmConstraints(
+                            new AlgorithmConstraints(AlgorithmConstraints.ConstraintType.WHITELIST,
+                                    AlgorithmIdentifiers.RSA_USING_SHA256));
+
+            if (authContextInfo.getExpGracePeriodSecs() > 0) {
+                builder.setAllowedClockSkewInSeconds(authContextInfo.getExpGracePeriodSecs());
+
+            } else {
+                builder.setEvaluationTime(NumericDate.fromSeconds(0));
+            }
+
+            final JwtConsumer jwtConsumer = builder.build();
+            final JwtContext jwtContext = jwtConsumer.process(token);
+            final String type = jwtContext.getJoseObjects().get(0).getHeader("typ");
+            //  Validate the JWT and process it to the Claims
+            jwtConsumer.processContext(jwtContext);
+            JwtClaims claimsSet = jwtContext.getJwtClaims();
+
+            // We have to determine the unique name to use as the principal name. It comes from upn, preferred_username, sub in that order
+            String principalName = claimsSet.getClaimValue("upn", String.class);
+            if (principalName == null) {
+                principalName = claimsSet.getClaimValue("preferred_username", String.class);
+                if (principalName == null) {
+                    principalName = claimsSet.getSubject();
+                }
+            }
+            claimsSet.setClaim(Claims.raw_token.name(), token);
+            principal = new DefaultJWTCallerPrincipal(token, type, claimsSet, principalName);
+
+        } catch (final InvalidJwtException e) {
+            throw new ParseException("Failed to verify token", e);
+
+        } catch (final MalformedClaimException e) {
+            throw new ParseException("Failed to verify token claims", e);
+        }
+
+        return principal;
+    }
+}
\ No newline at end of file

http://git-wip-us.apache.org/repos/asf/tomee/blob/def443a4/mp-jwt/src/main/java/org/apache/tomee/microprofile/jwt/principal/JWTCallerPrincipal.java
----------------------------------------------------------------------
diff --git a/mp-jwt/src/main/java/org/apache/tomee/microprofile/jwt/principal/JWTCallerPrincipal.java b/mp-jwt/src/main/java/org/apache/tomee/microprofile/jwt/principal/JWTCallerPrincipal.java
new file mode 100644
index 0000000..d8e3c4c
--- /dev/null
+++ b/mp-jwt/src/main/java/org/apache/tomee/microprofile/jwt/principal/JWTCallerPrincipal.java
@@ -0,0 +1,59 @@
+/*
+ *     Licensed to the Apache Software Foundation (ASF) under one or more
+ *     contributor license agreements.  See the NOTICE file distributed with
+ *     this work for additional information regarding copyright ownership.
+ *     The ASF licenses this file to You under the Apache License, Version 2.0
+ *     (the "License"); you may not use this file except in compliance with
+ *     the License.  You may obtain a copy of the License at
+ *
+ *        http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *     Unless required by applicable law or agreed to in writing, software
+ *     distributed under the License is distributed on an "AS IS" BASIS,
+ *     WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *     See the License for the specific language governing permissions and
+ *     limitations under the License.
+ */
+package org.apache.tomee.microprofile.jwt.principal;
+
+
+import org.eclipse.microprofile.jwt.JsonWebToken;
+
+import java.util.Optional;
+
+/**
+ * An abstract CallerPrincipal implementation that provides access to the JWT claims that are required by
+ * the microprofile token.
+ */
+public abstract class JWTCallerPrincipal implements JsonWebToken {
+
+    private String name;
+
+    /**
+     * Create a JWTCallerPrincipal with the caller's name
+     *
+     * @param name - caller's name
+     */
+    public JWTCallerPrincipal(final String name) {
+        this.name = name;
+    }
+
+    @Override
+    public String getName() {
+        return name;
+    }
+
+    /**
+     * Generate a human readable version of the caller principal and associated JWT.
+     *
+     * @param showAll - should all claims associated with the JWT be displayed or should only those defined in the
+     *                JsonWebToken interface be displayed.
+     * @return human readable presentation of the caller principal and associated JWT.
+     */
+    public abstract String toString(final boolean showAll);
+
+    public <T> Optional<T> claim(final String claimName) {
+        final T claim = (T) getClaim(claimName);
+        return Optional.ofNullable(claim);
+    }
+}

http://git-wip-us.apache.org/repos/asf/tomee/blob/def443a4/mp-jwt/src/main/java/org/apache/tomee/microprofile/jwt/principal/JWTCallerPrincipalFactory.java
----------------------------------------------------------------------
diff --git a/mp-jwt/src/main/java/org/apache/tomee/microprofile/jwt/principal/JWTCallerPrincipalFactory.java b/mp-jwt/src/main/java/org/apache/tomee/microprofile/jwt/principal/JWTCallerPrincipalFactory.java
new file mode 100644
index 0000000..e7ebcd6
--- /dev/null
+++ b/mp-jwt/src/main/java/org/apache/tomee/microprofile/jwt/principal/JWTCallerPrincipalFactory.java
@@ -0,0 +1,129 @@
+/*
+ *     Licensed to the Apache Software Foundation (ASF) under one or more
+ *     contributor license agreements.  See the NOTICE file distributed with
+ *     this work for additional information regarding copyright ownership.
+ *     The ASF licenses this file to You under the Apache License, Version 2.0
+ *     (the "License"); you may not use this file except in compliance with
+ *     the License.  You may obtain a copy of the License at
+ *
+ *        http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *     Unless required by applicable law or agreed to in writing, software
+ *     distributed under the License is distributed on an "AS IS" BASIS,
+ *     WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *     See the License for the specific language governing permissions and
+ *     limitations under the License.
+ */
+package org.apache.tomee.microprofile.jwt.principal;
+
+import org.apache.tomee.microprofile.jwt.ParseException;
+import org.apache.tomee.microprofile.jwt.config.JWTAuthContextInfo;
+
+import java.net.URL;
+import java.security.AccessController;
+import java.security.PrivilegedAction;
+import java.util.ServiceLoader;
+
+/**
+ * The factory class that provides the token string to JWTCallerPrincipal parsing for a given implementation.
+ */
+public abstract class JWTCallerPrincipalFactory {
+
+    private static JWTCallerPrincipalFactory instance;
+
+    /**
+     * Obtain the JWTCallerPrincipalFactory that has been set or by using the ServiceLoader pattern.
+     *
+     * @return the factory instance
+     * @see #setInstance(JWTCallerPrincipalFactory)
+     */
+    public static JWTCallerPrincipalFactory instance() {
+        if (instance == null) {
+            synchronized (JWTCallerPrincipalFactory.class) {
+                if (instance != null) {
+                    return instance;
+                }
+
+                ClassLoader cl = AccessController.doPrivileged(new PrivilegedAction<ClassLoader>() {
+                    @Override
+                    public ClassLoader run() {
+                        return Thread.currentThread().getContextClassLoader();
+                    }
+                });
+                if (cl == null) {
+                    cl = JWTCallerPrincipalFactory.class.getClassLoader();
+                }
+
+                JWTCallerPrincipalFactory newInstance = loadSpi(cl);
+
+                if (newInstance == null && cl != JWTCallerPrincipalFactory.class.getClassLoader()) {
+                    cl = JWTCallerPrincipalFactory.class.getClassLoader();
+                    newInstance = loadSpi(cl);
+                }
+                if (newInstance == null) {
+                    throw new IllegalStateException("No JWTCallerPrincipalFactory implementation found!");
+                }
+
+                instance = newInstance;
+            }
+        }
+
+        return instance;
+    }
+
+    /**
+     * Look for a JWTCallerPrincipalFactory service implementation using the ServiceLoader.
+     *
+     * @param cl - the ClassLoader to pass into the {@link ServiceLoader#load(Class, ClassLoader)} method.
+     * @return the JWTCallerPrincipalFactory if found, null otherwise
+     */
+    private static JWTCallerPrincipalFactory loadSpi(ClassLoader cl) {
+        if (cl == null) {
+            return null;
+        }
+
+        // start from the root CL and go back down to the TCCL
+        JWTCallerPrincipalFactory instance = loadSpi(cl.getParent());
+
+        if (instance == null) {
+            ServiceLoader<JWTCallerPrincipalFactory> sl = ServiceLoader.load(JWTCallerPrincipalFactory.class, cl);
+            URL u = cl.getResource("/META-INF/services/org.apache.tomee.microprofile.jwt.JWTCallerPrincipalFactory");
+            System.out.printf("JWTCallerPrincipalFactory, cl=%s, u=%s, sl=%s\n", cl, u, sl);
+            try {
+                for (JWTCallerPrincipalFactory spi : sl) {
+                    if (instance != null) {
+                        throw new IllegalStateException(
+                                "Multiple JWTCallerPrincipalFactory implementations found: "
+                                        + spi.getClass().getName() + " and "
+                                        + instance.getClass().getName());
+                    } else {
+                        System.out.printf("sl=%s, loaded=%s\n", sl, spi);
+                        instance = spi;
+                    }
+                }
+
+            } catch (final Throwable e) {
+                System.err.printf("Warning: %s\n", e.getMessage());
+            }
+        }
+        return instance;
+    }
+
+    /**
+     * Set the instance. It is used by OSGi environment where service loader pattern is not supported.
+     *
+     * @param resolver the instance to use.
+     */
+    public static void setInstance(final JWTCallerPrincipalFactory resolver) {
+        instance = resolver;
+    }
+
+    /**
+     * Parse the given bearer token string into a JWTCallerPrincipal instance.
+     *
+     * @param token - the bearer token provided for authorization
+     * @return A JWTCallerPrincipal representation for the token.
+     * @throws ParseException on parse or verification failure.
+     */
+    public abstract JWTCallerPrincipal parse(final String token, final JWTAuthContextInfo authContextInfo) throws ParseException;
+}
\ No newline at end of file

http://git-wip-us.apache.org/repos/asf/tomee/blob/def443a4/mp-jwt/src/main/resources/META-INF/org.apache.openejb.extension
----------------------------------------------------------------------
diff --git a/mp-jwt/src/main/resources/META-INF/org.apache.openejb.extension b/mp-jwt/src/main/resources/META-INF/org.apache.openejb.extension
new file mode 100644
index 0000000..9734019
--- /dev/null
+++ b/mp-jwt/src/main/resources/META-INF/org.apache.openejb.extension
@@ -0,0 +1 @@
+org.apache.tomee.microprofile.jwt.jaxrs.MPJWPProviderRegistration
\ No newline at end of file

http://git-wip-us.apache.org/repos/asf/tomee/blob/def443a4/mp-jwt/src/main/resources/META-INF/services/javax.enterprise.inject.spi.Extension
----------------------------------------------------------------------
diff --git a/mp-jwt/src/main/resources/META-INF/services/javax.enterprise.inject.spi.Extension b/mp-jwt/src/main/resources/META-INF/services/javax.enterprise.inject.spi.Extension
new file mode 100644
index 0000000..d5eea47
--- /dev/null
+++ b/mp-jwt/src/main/resources/META-INF/services/javax.enterprise.inject.spi.Extension
@@ -0,0 +1 @@
+org.apache.tomee.microprofile.jwt.cdi.MPJWTCDIExtension
\ No newline at end of file

http://git-wip-us.apache.org/repos/asf/tomee/blob/def443a4/mp-jwt/src/main/resources/META-INF/services/javax.servlet.ServletContainerInitializer
----------------------------------------------------------------------
diff --git a/mp-jwt/src/main/resources/META-INF/services/javax.servlet.ServletContainerInitializer b/mp-jwt/src/main/resources/META-INF/services/javax.servlet.ServletContainerInitializer
new file mode 100644
index 0000000..100e625
--- /dev/null
+++ b/mp-jwt/src/main/resources/META-INF/services/javax.servlet.ServletContainerInitializer
@@ -0,0 +1 @@
+org.apache.tomee.microprofile.jwt.MPJWTInitializer
\ No newline at end of file

http://git-wip-us.apache.org/repos/asf/tomee/blob/def443a4/mp-jwt/src/main/resources/META-INF/services/org.apache.tomee.microprofile.jwt.principal.JWTCallerPrincipalFactory
----------------------------------------------------------------------
diff --git a/mp-jwt/src/main/resources/META-INF/services/org.apache.tomee.microprofile.jwt.principal.JWTCallerPrincipalFactory b/mp-jwt/src/main/resources/META-INF/services/org.apache.tomee.microprofile.jwt.principal.JWTCallerPrincipalFactory
new file mode 100644
index 0000000..21c9831
--- /dev/null
+++ b/mp-jwt/src/main/resources/META-INF/services/org.apache.tomee.microprofile.jwt.principal.JWTCallerPrincipalFactory
@@ -0,0 +1 @@
+org.apache.tomee.microprofile.jwt.principal.DefaultJWTCallerPrincipalFactory
\ No newline at end of file

http://git-wip-us.apache.org/repos/asf/tomee/blob/def443a4/tck/microprofile-tck/jwt/pom.xml
----------------------------------------------------------------------
diff --git a/tck/microprofile-tck/jwt/pom.xml b/tck/microprofile-tck/jwt/pom.xml
new file mode 100644
index 0000000..923c386
--- /dev/null
+++ b/tck/microprofile-tck/jwt/pom.xml
@@ -0,0 +1,197 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!--
+  Licensed to the Apache Software Foundation (ASF) under one or more
+  contributor license agreements.  See the NOTICE file distributed with
+  this work for additional information regarding copyright ownership.
+  The ASF licenses this file to You under the Apache License, Version 2.0
+  (the "License"); you may not use this file except in compliance with
+  the License.  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+  -->
+<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">
+  <parent>
+    <groupId>org.apache.tomee</groupId>
+    <artifactId>microprofile-tck</artifactId>
+    <version>8.0.0-SNAPSHOT</version>
+  </parent>
+  <modelVersion>4.0.0</modelVersion>
+  <artifactId>microprofile-jwt-tck</artifactId>
+  <name>OpenEJB :: TCK :: MicroProfile JWT TCK</name>
+
+
+  <properties>
+    <tck.version>1.1-SNAPSHOT</tck.version>
+  </properties>
+
+  <dependencies>
+
+    <dependency>
+      <groupId>${project.groupId}</groupId>
+      <artifactId>mp-jwt</artifactId>
+      <version>${project.version}</version>
+    </dependency>
+    <dependency>
+      <groupId>org.slf4j</groupId>
+      <artifactId>slf4j-jdk14</artifactId>
+      <version>${slf4j.version}</version>
+      <scope>test</scope>
+    </dependency>
+
+    <dependency>
+      <groupId>org.apache.tomee</groupId>
+      <artifactId>tomee-catalina</artifactId>
+      <version>${project.version}</version>
+      <scope>provided</scope>
+    </dependency>
+
+    <!-- distro -->
+    <dependency>
+      <groupId>${project.groupId}</groupId>
+      <artifactId>apache-tomee</artifactId>
+      <version>${project.version}</version>
+      <type>zip</type>
+      <classifier>microprofile</classifier>
+      <scope>test</scope>
+    </dependency>
+
+    <!-- This is the MP-JWT TCK base extension and utility classes -->
+    <dependency>
+      <groupId>org.eclipse.microprofile.jwt</groupId>
+      <artifactId>microprofile-jwt-auth-tck</artifactId>
+      <version>${tck.version}</version>
+    </dependency>
+
+    <!-- This is the actual MP-JWT TCK test classes -->
+    <dependency>
+      <groupId>org.eclipse.microprofile.jwt</groupId>
+      <artifactId>microprofile-jwt-auth-tck</artifactId>
+      <version>${tck.version}</version>
+      <type>test-jar</type>
+      <scope>test</scope>
+    </dependency>
+
+    <dependency>
+      <groupId>org.testng</groupId>
+      <artifactId>testng</artifactId>
+      <version>6.9.9</version>
+      <scope>test</scope>
+    </dependency>
+
+    <dependency>
+      <groupId>${project.groupId}</groupId>
+      <artifactId>arquillian-tomee-remote</artifactId>
+      <version>${project.version}</version>
+      <scope>test</scope>
+    </dependency>
+
+    <dependency>
+      <groupId>org.jboss.arquillian.testng</groupId>
+      <artifactId>arquillian-testng-core</artifactId>
+      <version>${version.arquillian}</version>
+      <scope>test</scope>
+    </dependency>
+
+    <dependency>
+      <groupId>org.jboss.shrinkwrap.resolver</groupId>
+      <artifactId>shrinkwrap-resolver-api-maven</artifactId>
+      <version>2.2.2</version>
+      <scope>test</scope>
+    </dependency>
+
+    <dependency>
+      <groupId>org.jboss.shrinkwrap.resolver</groupId>
+      <artifactId>shrinkwrap-resolver-impl-maven</artifactId>
+      <version>2.2.2</version>
+      <scope>test</scope>
+    </dependency>
+
+    <dependency>
+      <groupId>org.jboss.shrinkwrap.resolver</groupId>
+      <artifactId>shrinkwrap-resolver-spi</artifactId>
+      <version>2.2.2</version>
+      <scope>test</scope>
+    </dependency>
+
+    <dependency>
+      <groupId>org.apache.cxf</groupId>
+      <artifactId>cxf-rt-rs-client</artifactId>
+      <version>${cxf.version}</version>
+      <scope>test</scope>
+    </dependency>
+
+  </dependencies>
+
+  <build>
+    <plugins>
+      <plugin>
+        <groupId>org.apache.maven.plugins</groupId>
+        <artifactId>maven-dependency-plugin</artifactId>
+        <version>2.10</version>
+        <executions>
+          <execution>
+            <id>copy-tck-test-suite-file</id>
+            <phase>generate-test-sources</phase>
+            <goals>
+              <goal>unpack</goal>
+            </goals>
+            <configuration>
+              <artifactItems>
+                <artifactItem>
+                  <groupId>org.eclipse.microprofile.jwt</groupId>
+                  <artifactId>microprofile-jwt-auth-tck</artifactId>
+                  <type>test-jar</type>
+                  <overWrite>true</overWrite>
+                </artifactItem>
+              </artifactItems>
+            </configuration>
+          </execution>
+        </executions>
+      </plugin>
+      <plugin>
+        <groupId>org.apache.maven.plugins</groupId>
+        <artifactId>maven-surefire-plugin</artifactId>
+        <version>2.17</version>
+        <configuration>
+          <suiteXmlFiles>
+            <!-- TCK does not deliver the xml file for the moment -->
+            <suiteXmlFile>${project.build.directory}/test-classes/dev.xml</suiteXmlFile>
+          </suiteXmlFiles>
+          <systemProperties>
+            <!--<property>-->
+              <!--<name>validation.provider</name>-->
+              <!--<value>${validation.provider}</value>-->
+            <!--</property>-->
+          </systemProperties>
+          <parallel>methods</parallel>
+          <threadCount>4</threadCount>
+        </configuration>
+      </plugin>
+      <plugin>
+        <groupId>org.apache.maven.plugins</groupId>
+        <artifactId>maven-surefire-report-plugin</artifactId>
+        <version>2.17</version>
+        <executions>
+          <execution>
+            <id>generate-test-report</id>
+            <phase>test</phase>
+            <goals>
+              <goal>report-only</goal>
+            </goals>
+          </execution>
+        </executions>
+        <configuration>
+          <outputDirectory>${project.build.directory}/surefire-reports</outputDirectory>
+          <outputName>test-report</outputName>
+        </configuration>
+      </plugin>
+    </plugins>
+  </build>
+</project>

http://git-wip-us.apache.org/repos/asf/tomee/blob/def443a4/tck/microprofile-tck/jwt/src/test/java/org/apache/tomee/microprofile/jwt/AppDeploymentExtension.java
----------------------------------------------------------------------
diff --git a/tck/microprofile-tck/jwt/src/test/java/org/apache/tomee/microprofile/jwt/AppDeploymentExtension.java b/tck/microprofile-tck/jwt/src/test/java/org/apache/tomee/microprofile/jwt/AppDeploymentExtension.java
new file mode 100644
index 0000000..cf4e837
--- /dev/null
+++ b/tck/microprofile-tck/jwt/src/test/java/org/apache/tomee/microprofile/jwt/AppDeploymentExtension.java
@@ -0,0 +1,76 @@
+package org.apache.tomee.microprofile.jwt;
+
+import com.nimbusds.jose.JWSSigner;
+import org.apache.openejb.loader.JarLocation;
+import org.eclipse.microprofile.jwt.tck.TCKConstants;
+import org.eclipse.microprofile.jwt.tck.util.TokenUtils;
+import org.jboss.arquillian.container.spi.client.deployment.DeploymentDescription;
+import org.jboss.arquillian.container.test.impl.client.deployment.AnnotationDeploymentScenarioGenerator;
+import org.jboss.arquillian.container.test.spi.client.deployment.ApplicationArchiveProcessor;
+import org.jboss.arquillian.container.test.spi.client.deployment.DeploymentScenarioGenerator;
+import org.jboss.arquillian.core.spi.LoadableExtension;
+import org.jboss.arquillian.test.spi.TestClass;
+import org.jboss.shrinkwrap.api.Archive;
+import org.jboss.shrinkwrap.api.Node;
+import org.jboss.shrinkwrap.api.ShrinkWrap;
+import org.jboss.shrinkwrap.api.asset.EmptyAsset;
+import org.jboss.shrinkwrap.api.spec.WebArchive;
+
+import java.net.URL;
+import java.util.Collections;
+import java.util.List;
+import java.util.logging.Logger;
+
+public class AppDeploymentExtension implements LoadableExtension {
+    @Override
+    public void register(final ExtensionBuilder extensionBuilder) {
+        extensionBuilder.service(DeploymentScenarioGenerator.class, SimpleDeploymentScenarioGenerator.class);
+        extensionBuilder.service(ApplicationArchiveProcessor.class, MPJWTTCKArchiveProcess.class);
+    }
+
+    public static class SimpleDeploymentScenarioGenerator implements DeploymentScenarioGenerator {
+
+        private final DeploymentScenarioGenerator standard = new AnnotationDeploymentScenarioGenerator();
+        private final DeploymentDescription emptyTestWebApp;
+
+        public SimpleDeploymentScenarioGenerator() {
+            emptyTestWebApp = new DeploymentDescription("mp-jwt-tck.war",
+                    ShrinkWrap
+                            .create(WebArchive.class, "mp-jwt-tck.war")
+                            .addAsLibrary(JarLocation.jarLocation(TokenUtils.class))
+                            .addAsLibrary(JarLocation.jarLocation(JWSSigner.class))
+                            .addAsLibrary(JarLocation.jarLocation(TCKConstants.class).getAbsolutePath().replace("-tests.jar", "-test-sources.jar"))
+                            .add(EmptyAsset.INSTANCE, "WEB-INF/beans.xml"));
+        }
+
+
+        @Override
+        public List<DeploymentDescription> generate(final TestClass testClass) {
+            final List<DeploymentDescription> stdDeploymentDescriptions = standard.generate(testClass);
+
+            if (stdDeploymentDescriptions != null && !stdDeploymentDescriptions.isEmpty()) {
+                return stdDeploymentDescriptions;
+            }
+
+            return Collections.singletonList(emptyTestWebApp);
+        }
+    }
+
+    /**
+     * An ApplicationArchiveProcessor for the MP-JWT TCK if needed
+     * With the current implementation we don't need to do anything
+     */
+    public static class MPJWTTCKArchiveProcess implements ApplicationArchiveProcessor {
+        private static Logger log = Logger.getLogger(MPJWTTCKArchiveProcess.class.getName());
+
+        @Override
+        public void process(final Archive<?> appArchive, final TestClass testClass) {
+            if (!(appArchive instanceof WebArchive)) {
+                return;
+            }
+            WebArchive war = WebArchive.class.cast(appArchive);
+
+            log.info("Augmented war: \n"+war.toString(true));
+        }
+    }
+}
\ No newline at end of file

http://git-wip-us.apache.org/repos/asf/tomee/blob/def443a4/tck/microprofile-tck/jwt/src/test/resources/META-INF/services/org.jboss.arquillian.core.spi.LoadableExtension
----------------------------------------------------------------------
diff --git a/tck/microprofile-tck/jwt/src/test/resources/META-INF/services/org.jboss.arquillian.core.spi.LoadableExtension b/tck/microprofile-tck/jwt/src/test/resources/META-INF/services/org.jboss.arquillian.core.spi.LoadableExtension
new file mode 100644
index 0000000..98a4867
--- /dev/null
+++ b/tck/microprofile-tck/jwt/src/test/resources/META-INF/services/org.jboss.arquillian.core.spi.LoadableExtension
@@ -0,0 +1 @@
+org.apache.tomee.microprofile.jwt.AppDeploymentExtension
\ No newline at end of file

http://git-wip-us.apache.org/repos/asf/tomee/blob/def443a4/tck/microprofile-tck/jwt/src/test/resources/arquillian.xml
----------------------------------------------------------------------
diff --git a/tck/microprofile-tck/jwt/src/test/resources/arquillian.xml b/tck/microprofile-tck/jwt/src/test/resources/arquillian.xml
new file mode 100644
index 0000000..8e7a66b
--- /dev/null
+++ b/tck/microprofile-tck/jwt/src/test/resources/arquillian.xml
@@ -0,0 +1,39 @@
+<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
+<!--
+
+    Licensed to the Apache Software Foundation (ASF) under one or more
+    contributor license agreements.  See the NOTICE file distributed with
+    this work for additional information regarding copyright ownership.
+    The ASF licenses this file to You under the Apache License, Version 2.0
+    (the "License"); you may not use this file except in compliance with
+    the License.  You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+    Unless required by applicable law or agreed to in writing, software
+    distributed under the License is distributed on an "AS IS" BASIS,
+    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+    See the License for the specific language governing permissions and
+    limitations under the License.
+-->
+<arquillian
+    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+    xsi:schemaLocation="
+      http://jboss.org/schema/arquillian
+      http://jboss.org/schema/arquillian/arquillian_1_0.xsd">
+
+  <container qualifier="tomee" default="true">
+    <configuration>
+      <property name="catalina_opts">-Xmx512m -XX:MaxPermSize=512m</property>
+      <property name="httpPort">-1</property>
+      <property name="stopPort">-1</property>
+      <property name="ajpPort">-1</property>
+      <property name="classifier">microprofile</property>
+      <property name="debug">false</property>
+      <property name="dir">target/tomee-tck</property>
+      <property name="appWorkingDir">target/tck-workdir</property>
+      <property name="simpleLog">true</property>
+      <property name="properties"></property>
+    </configuration>
+  </container>
+</arquillian>

http://git-wip-us.apache.org/repos/asf/tomee/blob/def443a4/tck/microprofile-tck/jwt/src/test/resources/dev.xml
----------------------------------------------------------------------
diff --git a/tck/microprofile-tck/jwt/src/test/resources/dev.xml b/tck/microprofile-tck/jwt/src/test/resources/dev.xml
new file mode 100644
index 0000000..00741d1
--- /dev/null
+++ b/tck/microprofile-tck/jwt/src/test/resources/dev.xml
@@ -0,0 +1,93 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!--
+  Licensed to the Apache Software Foundation (ASF) under one or more
+  contributor license agreements.  See the NOTICE file distributed with
+  this work for additional information regarding copyright ownership.
+  The ASF licenses this file to You under the Apache License, Version 2.0
+  (the "License"); you may not use this file except in compliance with
+  the License.  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+  -->
+<!DOCTYPE suite SYSTEM "http://testng.org/testng-1.0.dtd" >
+<suite name="microprofile-jwt-auth-FullTCK" verbose="1" preserve-order="true" configfailurepolicy="continue" >
+
+  <!-- The required base JAX-RS and CDI based tests that all MP-JWT implementations
+  must pass.
+  -->
+
+  <test name="base-tests" verbose="10">
+    <groups>
+      <define name="base-groups">
+        <include name="arquillian" description="Arquillian internal"/>
+        <include name="utils" description="Utility tests"/>
+        <include name="jwt" description="Base JsonWebToken tests"/>
+        <include name="jaxrs" description="JAX-RS invocation tests"/>
+        <include name="cdi" description="Base CDI injection of ClaimValues"/>
+        <include name="cdi-json" description="CDI injection of JSON-P values"/>
+        <include name="cdi-provider" description="CDI injection of javax.inject.Provider values"/>
+      </define>
+      <define name="excludes">
+        <include name="debug" description="Internal debugging tests" />
+      </define>
+      <run>
+        <include name="base-groups" />
+        <exclude name="excludes" />
+      </run>
+    </groups>
+    <classes>
+      <class name="org.eclipse.microprofile.jwt.tck.parsing.TokenValidationTest" />
+      <class name="org.eclipse.microprofile.jwt.tck.util.TokenUtilsTest" />
+      <class name="org.eclipse.microprofile.jwt.tck.parsing.TestTokenClaimTypesTest" />
+      <class name="org.eclipse.microprofile.jwt.tck.container.jaxrs.UnsecuredPingTest" />
+      <class name="org.eclipse.microprofile.jwt.tck.container.jaxrs.RequiredClaimsTest" />
+      <class name="org.eclipse.microprofile.jwt.tck.container.jaxrs.PrimitiveInjectionTest" />
+      <class name="org.eclipse.microprofile.jwt.tck.container.jaxrs.ClaimValueInjectionTest" />
+      <class name="org.eclipse.microprofile.jwt.tck.container.jaxrs.JsonValueInjectionTest" />
+      <class name="org.eclipse.microprofile.jwt.tck.container.jaxrs.ProviderInjectionTest" />
+      <class name="org.eclipse.microprofile.jwt.tck.container.jaxrs.InvalidTokenTest" />
+      <class name="org.eclipse.microprofile.jwt.tck.container.jaxrs.RolesAllowedTest" />
+      <class name="org.eclipse.microprofile.jwt.tck.container.jaxrs.RolesAllowedTest" />
+      <!--
+      -->
+    </classes>
+  </test>
+
+  <test name="extended-tests" verbose="10">
+    <groups>
+      <define name="extended-groups">
+        <include name="arquillian" description="Arquillian internal"/>
+        <include name="ejb-optional" description="EJB container integration tests"/>
+        <include name="jacc-optional" description="JACC API integration tests"/>
+        <include name="servlet-optional" description="Servlet container integration tests"/>
+        <include name="ee-security-optional" description="Java EE security feature tests"/>
+      </define>
+      <define name="excludes">
+        <include name="debug" description="Internal debugging tests" />
+      </define>
+      <run>
+        <include name="extended-groups" />
+        <exclude name="excludes" />
+      </run>
+    </groups>
+    <classes>
+      <class name="org.eclipse.microprofile.jwt.tck.container.ejb.EjbTest" >
+        <methods>
+          <!-- Excluded cause we never really enforce ACC context for EJB Calls in TomEE -->
+          <exclude name="getSubjectClass"/>
+        </methods>
+      </class>
+
+      <class name="org.eclipse.microprofile.jwt.tck.container.servlet.ServletTest" />
+      <class name="org.eclipse.microprofile.jwt.tck.container.jacc.SubjectTest" />
+      <!--
+      -->
+    </classes>
+  </test>
+</suite>