io.vertx.ext.auth.JWTOptions Java Examples

@Test
public void testBadAudience() {

  authProvider = JWTAuth.create(vertx, getConfig().setJWTOptions(
    new JWTOptions()
      .addAudience("e")
      .addAudience("d")));

  JsonObject payload = new JsonObject()
    .put("sub", "Paulo");

  final String token = authProvider.generateToken(payload,
    new JWTOptions().addAudience("a").addAudience("b").addAudience("c"));

  assertNotNull(token);

  TokenCredentials authInfo = new TokenCredentials(token);

  authProvider.authenticate(authInfo, onFailure(thr -> {
    assertNotNull(thr);
    testComplete();
  }));
  await();
}
 

@Test
public void testBadScopesFormat() {
  //JWT is not valid because the authProvider is expecting an array of scope while the JWT has a string scope.
  authProvider = JWTAuth.create(vertx, getConfig().setJWTOptions(
    new JWTOptions()
      .addScope("a")
      .addScope("b")));

  JsonObject payload = new JsonObject()
    .put("sub", "Paulo");

  final String token = authProvider.generateToken(payload,
    new JWTOptions().addScope("a").addScope("b").addScope("c").withScopeDelimiter(","));

  assertNotNull(token);

  TokenCredentials authInfo = new TokenCredentials(token);

  authProvider.authenticate(authInfo, onFailure(thr -> {
    assertNotNull(thr);
    testComplete();
  }));
  await();
}
 

@Test
public void testBadScopes() {
  //JWT is not valid because the required scopes "d" is not included in the access_token.
  authProvider = JWTAuth.create(vertx, getConfig().setJWTOptions(
    new JWTOptions()
      .addScope("b")
      .addScope("d")));

  JsonObject payload = new JsonObject()
    .put("sub", "Paulo");

  final String token = authProvider.generateToken(payload,
    new JWTOptions().addScope("a").addScope("b").addScope("c"));

  assertNotNull(token);

  TokenCredentials authInfo = new TokenCredentials(token);

  authProvider.authenticate(authInfo, onFailure(thr -> {
    assertNotNull(thr);
    testComplete();
  }));
  await();
}
 

public void example7(Vertx vertx, String username, String password) {

    JWTAuthOptions config = new JWTAuthOptions()
      .setKeyStore(new KeyStoreOptions()
        .setPath("keystore.jceks")
        .setPassword("secret"));

    JWTAuth provider = JWTAuth.create(vertx, config);

    // on the verify endpoint once you verify the identity
    // of the user by its username/password
    if ("paulo".equals(username) && "super_secret".equals(password)) {
      String token = provider.generateToken(
        new JsonObject().put("sub", "paulo"), new JWTOptions());

      // now for any request to protected resources you should
      // pass this string in the HTTP header Authorization as:
      // Authorization: Bearer <token>
    }
  }
 

@Test
public void testGoodScopesWithDefaultDelimiter() {
  //JWT is valid because required scopes "a" & "b" are well included in the access_token.
  authProvider = JWTAuth.create(vertx, getConfig().setJWTOptions(
    new JWTOptions()
      .addScope("a")
      .addScope("b")));

  JsonObject payload = new JsonObject()
    .put("sub", "Paulo");

  final String token = authProvider.generateToken(payload,
    new JWTOptions().addScope("a").addScope("b").addScope("c").withScopeDelimiter(" "));

  assertNotNull(token);

  TokenCredentials authInfo = new TokenCredentials(token);

  authProvider.authenticate(authInfo, onSuccess(res -> {
    assertNotNull(res);
    testComplete();
  }));
  await();
}
 

public void example17(Vertx vertx) {
  JWTAuth provider = JWTAuth.create(vertx, new JWTAuthOptions()
    .addPubSecKey(new PubSecKeyOptions()
      .setAlgorithm("ES256")
      .setBuffer(
        "-----BEGIN PRIVATE KEY-----\n" +
          "MIGHAgEAMBMGByqGSM49AgEGCCqGSM49AwEHBG0wawIBAQQgeRyEfU1NSHPTCuC9\n" +
          "rwLZMukaWCH2Fk6q5w+XBYrKtLihRANCAAStpUnwKmSvBM9EI+W5QN3ALpvz6bh0\n" +
          "SPCXyz5KfQZQuSj4f3l+xNERDUDaygIUdLjBXf/bc15ur2iZjcq4r0Mr\n" +
          "-----END PRIVATE KEY-----\n")
    ));

  String token = provider.generateToken(
    new JsonObject(),
    new JWTOptions().setAlgorithm("ES256"));
}
 

public void example18(Vertx vertx) {
  JWTAuth provider = JWTAuth.create(vertx, new JWTAuthOptions()
    .addPubSecKey(new PubSecKeyOptions()
      .setAlgorithm("ES256")
      .setBuffer(
        "-----BEGIN PUBLIC KEY-----\n" +
          "MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEraVJ8CpkrwTPRCPluUDdwC6b8+m4\n" +
          "dEjwl8s+Sn0GULko+H95fsTREQ1A2soCFHS4wV3/23Nebq9omY3KuK9DKw==\n" +
          "-----END PUBLIC KEY-----"))
    .addPubSecKey(new PubSecKeyOptions()
      .setAlgorithm("RS256")
      .setBuffer(
        "-----BEGIN PRIVATE KEY-----\n" +
          "MIGHAgEAMBMGByqGSM49AgEGCCqGSM49AwEHBG0wawIBAQQgeRyEfU1NSHPTCuC9\n" +
          "rwLZMukaWCH2Fk6q5w+XBYrKtLihRANCAAStpUnwKmSvBM9EI+W5QN3ALpvz6bh0\n" +
          "SPCXyz5KfQZQuSj4f3l+xNERDUDaygIUdLjBXf/bc15ur2iZjcq4r0Mr")
    ));

  String token = provider.generateToken(
    new JsonObject(),
    new JWTOptions().setAlgorithm("ES256"));
}
 

@Test
public void testGoodScopesWithDelimiter() {
  //JWT is valid because required scopes "a" & "b" are well included in the access_token.
  authProvider = JWTAuth.create(vertx, getConfig().setJWTOptions(
    new JWTOptions()
      .addScope("a")
      .addScope("b")
      .withScopeDelimiter(",")));

  JsonObject payload = new JsonObject()
    .put("sub", "Paulo");

  final String token = authProvider.generateToken(payload,
    new JWTOptions().addScope("a").addScope("b").addScope("c").withScopeDelimiter(","));

  assertNotNull(token);

  TokenCredentials authInfo = new TokenCredentials(token);

  authProvider.authenticate(authInfo, onSuccess(res -> {
    assertNotNull(res);
    testComplete();
  }));
  await();
}
 

@Test
public void testGoodScopes() {
  //JWT is valid because required scopes "a" & "b" are well included in the access_token.
  authProvider = JWTAuth.create(vertx, getConfig().setJWTOptions(
    new JWTOptions()
      .addScope("a")
      .addScope("b")));

  JsonObject payload = new JsonObject()
    .put("sub", "Paulo");

  final String token = authProvider.generateToken(payload,
    new JWTOptions().addScope("a").addScope("b").addScope("c"));

  assertNotNull(token);

  TokenCredentials authInfo = new TokenCredentials(token);

  authProvider.authenticate(authInfo, onSuccess(res -> {
    assertNotNull(res);
    testComplete();
  }));
  await();
}
 

@Test
public void testGenerateNewTokenES256() {
  authProvider = JWTAuth.create(vertx, new JWTAuthOptions()
    .setKeyStore(new KeyStoreOptions()
      .setPath("es256-keystore.jceks")
      .setType("jceks")
      .setPassword("secret")));

  String token = authProvider.generateToken(new JsonObject().put("sub", "paulo"), new JWTOptions().setAlgorithm("ES256"));
  assertNotNull(token);

  TokenCredentials authInfo = new TokenCredentials(token);

  authProvider.authenticate(authInfo, res -> {
    if (res.failed()) {
      res.cause().printStackTrace();
      fail();
    }

    assertNotNull(res.result());
    testComplete();
  });
  await();
}
 

@Test
public void testGoodAudience() {

  authProvider = JWTAuth.create(vertx, getConfig().setJWTOptions(
    new JWTOptions()
      .addAudience("b")
      .addAudience("d")));

  JsonObject payload = new JsonObject()
    .put("sub", "Paulo");

  final String token = authProvider.generateToken(payload,
    new JWTOptions().addAudience("a").addAudience("b").addAudience("c"));

  assertNotNull(token);

  TokenCredentials authInfo = new TokenCredentials(token);

  authProvider.authenticate(authInfo, onSuccess(res -> {
    assertNotNull(res);
    testComplete();
  }));
  await();
}
 

@Test
public void testBadIssuer() {

  authProvider = JWTAuth.create(vertx, getConfig().setJWTOptions(new JWTOptions().setIssuer("https://vertx.io")));

  JsonObject payload = new JsonObject().put("sub", "Paulo");

  final String token = authProvider.generateToken(payload, new JWTOptions().setIssuer("https://auth0.io"));
  assertNotNull(token);

  TokenCredentials authInfo = new TokenCredentials(token);

  authProvider.authenticate(authInfo, onFailure(thr -> {
    assertNotNull(thr);
    testComplete();
  }));
  await();
}
 

@Test
public void testGenerateNewToken() {

  JsonObject payload = new JsonObject()
    .put("sub", "Paulo")
    .put("exp", 1747055313)
    .put("iat", 1431695313)
    .put("permissions", new JsonArray()
      .add("read")
      .add("write")
      .add("execute"))
    .put("roles", new JsonArray()
      .add("admin")
      .add("developer")
      .add("user"));

  String token = authProvider.generateToken(payload, new JWTOptions().setSubject("Paulo"));
  assertNotNull(token);
  assertEquals(JWT_VALID, token);
}
 

@Test
public void testGoodIssuer() {
  JsonObject payload = new JsonObject()
    .put("sub", "Paulo");

  final String token = authProvider.generateToken(payload, new JWTOptions().setIssuer("https://vertx.io"));
  assertNotNull(token);

  TokenCredentials authInfo = new TokenCredentials(token);

  authProvider.authenticate(authInfo, onSuccess(res -> {
    assertNotNull(res);
    testComplete();
  }));
  await();
}
 

@Test
public void testTokenWithoutTimestamp() {
  JsonObject payload = new JsonObject()
    .put("sub", "Paulo");

  final String token = authProvider.generateToken(payload,
    new JWTOptions().setExpiresInMinutes(5).setNoTimestamp(true));

  assertNotNull(token);

  TokenCredentials authInfo = new TokenCredentials(token);

  authProvider.authenticate(authInfo, onSuccess(res -> {
    assertNotNull(res);
    assertTrue(res.principal().containsKey("exp"));
    assertFalse(res.principal().containsKey("iat"));
    testComplete();
  }));

  await();
}
 

@Test
public void testTokenWithTimestamp() {
  JsonObject payload = new JsonObject()
    .put("sub", "Paulo");

  final String token = authProvider.generateToken(payload, new JWTOptions());
  assertNotNull(token);

  TokenCredentials authInfo = new TokenCredentials(token);
  authProvider.authenticate(authInfo, onSuccess(res -> {
    assertNotNull(res);
    assertTrue(res.principal().containsKey("iat"));
    testComplete();
  }));
  await();
}
 

@Test
public void testExpiration() {
  JsonObject payload = new JsonObject()
    .put("sub", "Paulo");

  final String token = authProvider.generateToken(payload,
    new JWTOptions().setExpiresInSeconds(1).setNoTimestamp(true));

  assertNotNull(token);

  vertx.setTimer(2000L, t -> {
    TokenCredentials authInfo = new TokenCredentials(token);
    authProvider.authenticate(authInfo, onFailure(thr -> {
      assertNotNull(thr);
      testComplete();
    }));
  });

  await();
}
 

@Test
public void testGenerateNewTokenWithMacSecret() {
  authProvider = JWTAuth.create(vertx, new JWTAuthOptions()
    .addJwk(new JsonObject()
      .put("kty", "oct")
      .put("k", "notasecret"))
  );

  String token = authProvider.generateToken(new JsonObject(), new JWTOptions().setAlgorithm("HS256"));
  assertNotNull(token);

  // reverse
  TokenCredentials authInfo = new TokenCredentials(token);
  authProvider.authenticate(authInfo, onSuccess(res -> {
    assertNotNull(res);
    testComplete();
  }));
  await();
}
 

/**
 * Token scopes are checked and scopeX is missing.
 * Scopes are retrieved from the JWT itself.
 * JWT generated in HS256 with vertx as shared secret.
 */
@Test
public void tokenIsNotValid() {
  config = new JsonObject()
    .put("token_type", "Bearer")
    .put("access_token", JWT)
    .put("token", JWT);

  oauthConfig
    .addPubSecKey(new PubSecKeyOptions().setAlgorithm("HS256").setBuffer("vertx").setSymmetric(true))
    .setJWTOptions(new JWTOptions().addScope("scopeX").addScope("scopeB"));

  oauth2 = OAuth2Auth.create(vertx, oauthConfig);

  oauth2.authenticate(config, res -> {
    assertTrue(res.succeeded());
    ScopeAuthorization.create(" ").getAuthorizations(res.result(), call -> {
      assertTrue(call.succeeded());
      // the scopes are missing
      assertFalse(PermissionBasedAuthorization.create("scopeX").match(res.result()));
      assertFalse(PermissionBasedAuthorization.create("scopeB").match(res.result()));
      testComplete();
    });
  });
  await();
}
 

@Test
public void testGenerateNewTokenForceAlgorithm() {
  authProvider = JWTAuth.create(vertx, new JWTAuthOptions()
    .setKeyStore(new KeyStoreOptions()
      .setPath("keystore.jceks")
      .setType("jceks")
      .setPassword("secret")));

  String token = authProvider.generateToken(new JsonObject(), new JWTOptions().setAlgorithm("RS256"));
  assertNotNull(token);

  // reverse
  TokenCredentials authInfo = new TokenCredentials(token);
  authProvider.authenticate(authInfo, onSuccess(res -> {
    assertNotNull(res);
    testComplete();
  }));
  await();
}
 

/**
 * Token scopes are checked and must be valid.
 * Scopes are retrieved from the JWT itself.
 * JWT generated in HS256 with vertx as shared secret.
 */
@Test
public void tokenIsValid() {
  config = new JsonObject()
    .put("token_type", "Bearer")
    .put("access_token", JWT)
    .put("token", JWT);

  oauthConfig
    .addPubSecKey(new PubSecKeyOptions().setAlgorithm("HS256").setBuffer("vertx").setSymmetric(true))
    .setJWTOptions(new JWTOptions().addScope("scopeA").addScope("scopeB"));

  oauth2 = OAuth2Auth.create(vertx, oauthConfig);

  oauth2.authenticate(config, res -> {
    if (res.failed()) {
      fail(res.cause());
    } else {
      User token = res.result();
      assertFalse(token.expired());
      testComplete();
    }
  });
  await();
}
 

@Test
public void testAlgNone() {

  JWTAuth authProvider = JWTAuth.create(vertx, new JWTAuthOptions());

  JsonObject payload = new JsonObject()
    .put("sub", "UserUnderTest")
    .put("aud", "OrganizationUnderTest")
    .put("iat", 1431695313)
    .put("exp", 1747055313)
    .put("roles", new JsonArray().add("admin").add("developer").add("user"))
    .put("permissions", new JsonArray().add("read").add("write").add("execute"));

  final String token = authProvider.generateToken(payload, new JWTOptions().setSubject("UserUnderTest").setAlgorithm("none"));
  assertNotNull(token);

  TokenCredentials authInfo = new TokenCredentials(token);

  authProvider.authenticate(authInfo, onSuccess(res -> {
    assertNotNull(res);
    testComplete();
  }));
  await();
}
 

@Test
public void testLeeway() {
  authProvider = JWTAuth.create(vertx, getConfig().setJWTOptions(new JWTOptions().setLeeway(0)));

  long now = System.currentTimeMillis() / 1000;

  JsonObject payload = new JsonObject()
    .put("sub", "Paulo")
    .put("exp", now);

  String token = authProvider.generateToken(payload);
  assertNotNull(token);

  TokenCredentials authInfo = new TokenCredentials(token);
  // fail because exp is <= to now
  authProvider.authenticate(authInfo, onFailure(t -> testComplete()));
  await();
}
 

@Test
public void testLeeway2() {
  authProvider = JWTAuth.create(vertx, getConfig().setJWTOptions(new JWTOptions().setLeeway(0)));

  long now = (System.currentTimeMillis() / 1000) + 2;

  JsonObject payload = new JsonObject()
    .put("sub", "Paulo")
    .put("iat", now);

  String token = authProvider.generateToken(payload);
  assertNotNull(token);

  TokenCredentials authInfo = new TokenCredentials(token);
  // fail because iat is > now (clock drifted 2 sec)
  authProvider.authenticate(authInfo, onFailure(t -> testComplete()));
  await();
}
 

/**
 * Create a OAuth2Auth provider for Google Service Account (Server to Server)
 *
 * @param serviceAccountJson the configuration json file from your Google API page
 * @param httpClientOptions  custom http client options
 */
static OAuth2Auth create(Vertx vertx, JsonObject serviceAccountJson, HttpClientOptions httpClientOptions) {
  return
    OAuth2Auth.create(vertx, new OAuth2Options()
      .setHttpClientOptions(httpClientOptions)
      .setFlow(OAuth2FlowType.AUTH_JWT)
      .setClientID(serviceAccountJson.getString("client_id"))
      .setSite("https://accounts.google.com")
      .setTokenPath(serviceAccountJson.getString("token_uri"))
      .addPubSecKey(new PubSecKeyOptions()
        .setAlgorithm("RS256")
        .setBuffer(serviceAccountJson.getString("private_key")))
      .setJWTOptions(new JWTOptions()
        .setAlgorithm("RS256")
        .setExpiresInMinutes(60)
        .addAudience(serviceAccountJson.getString("token_uri"))
        .setIssuer(serviceAccountJson.getString("client_email"))));
}
 

@Test
public void testLeeway3() {
  authProvider = JWTAuth.create(vertx, getConfig().setJWTOptions(new JWTOptions().setLeeway(5)));

  long now = System.currentTimeMillis() / 1000;

  JsonObject payload = new JsonObject()
    .put("sub", "Paulo")
    .put("exp", now)
    .put("iat", now);

  String token = authProvider.generateToken(payload);
  assertNotNull(token);

  TokenCredentials authInfo = new TokenCredentials(token);
  // fail because exp is <= to now
  authProvider.authenticate(authInfo, onSuccess(t -> testComplete()));
  await();
}
 

@Test
public void testLeeway4() {
  authProvider = JWTAuth.create(vertx, getConfig().setJWTOptions(new JWTOptions().setLeeway(5)));

  long now = (System.currentTimeMillis() / 1000) + 2;

  JsonObject payload = new JsonObject()
    .put("sub", "Paulo")
    .put("iat", now);

  String token = authProvider.generateToken(payload);
  assertNotNull(token);

  TokenCredentials authInfo = new TokenCredentials(token);
  // pass because iat is > now (clock drifted 2 sec) and we have a leeway of 5sec
  authProvider.authenticate(authInfo, onSuccess(t -> testComplete()));
  await();
}
 

@Test
public void testJWTAuthenticationWithAuthorization2() throws Exception {
  // we are testing the following:
  // authentication via jwt
  // one authorization provider is registered
  // an authorization is required on the path
  // => the test should succeed
  router.route("/protected/*").handler(JWTAuthHandler.create(authProvider));
  router.route("/protected/*")
      .handler(
          AuthorizationHandler.create(RoleBasedAuthorization.create("role1"))
          .addAuthorizationProvider(createProvider("authzProvider1", RoleBasedAuthorization.create("role1")))
      );

  router.route("/protected/page1").handler(rc -> {
    assertNotNull(rc.user());
    assertEquals("paulo", rc.user().principal().getString("sub"));
    rc.response().end("Welcome");
  });

  // login with correct credentials
  testRequest(HttpMethod.GET, "/protected/page1",
      req -> req.putHeader("Authorization",
          "Bearer " + authProvider.generateToken(new JsonObject().put("sub", "paulo"), new JWTOptions())),
      200, "OK", "Welcome");
}
 

@Test
public void testJWTAuthenticationWithAuthorization1() throws Exception {
  // we are testing the following:
  // authentication via jwt
  // no authorization provider is registered
  // an authorization is required on the path
  // => the test should fail
  router.route("/protected/*").handler(JWTAuthHandler.create(authProvider));
  router.route("/protected/*").handler(AuthorizationHandler.create(RoleBasedAuthorization.create("role1")));

  router.route("/protected/page1").handler(rc -> {
    assertNotNull(rc.user());
    assertEquals("paulo", rc.user().principal().getString("sub"));
    rc.response().end("Welcome");
  });

  // login with correct credentials
  testRequest(HttpMethod.GET, "/protected/page1",
      req -> req.putHeader("Authorization",
          "Bearer " + authProvider.generateToken(new JsonObject().put("sub", "paulo"), new JWTOptions())),
      403, "Forbidden", "Forbidden");
}
 

@Test
public void testJWTAuthenticationNoAuthorization() throws Exception {
  // we are testing the following:
  // authentication via jwt
  // no authorization provider is registered
  // no authorization is required on the path
  // => the test should succeed
  router.route("/protected/*").handler(JWTAuthHandler.create(authProvider));

  router.route("/protected/page1").handler(rc -> {
    assertNotNull(rc.user());
    assertEquals("paulo", rc.user().principal().getString("sub"));
    rc.response().end("Welcome");
  });

  // login with correct credentials
  testRequest(HttpMethod.GET, "/protected/page1",
      req -> req.putHeader("Authorization",
          "Bearer " + authProvider.generateToken(new JsonObject().put("sub", "paulo"), new JWTOptions())),
      200, "OK", "Welcome");
}