Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Modify JWT test case to also validate the kid claim using JWKS endpoint #13268

Merged
merged 8 commits into from
Sep 13, 2023
Merged

Modify JWT test case to also validate the kid claim using JWKS endpoint #13268

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
8 commits
Select commit Hold shift + click to select a range
7d65eef
Add support to include kid claim to backend JWT header
ashera96 May 22, 2023
1dc4c02
Change the default to true
ashera96 Jul 20, 2023
c4bedc7
Bump carbon.apimgt.version
ashera96 Jul 28, 2023
ef5d9f3
Fix JWTTestCase failure due to kid claim addition to backend JWT header
ashera96 Jul 28, 2023
155b1dc
Add integration test for JWKS endpoint support
ashera96 Sep 11, 2023
795bcd6
Fix URLSafeJWTTestCase
ashera96 Sep 11, 2023
25fb718
Fix URLSafeJWTTestCase
ashera96 Sep 12, 2023
9b6789b
Bump carbon.apimgt.version
ashera96 Sep 13, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 2 additions & 1 deletion modules/distribution/product/src/main/resources/conf/default.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -458,5 +458,6 @@
"apim.analytics.properties.keystore_password": "$ref{keystore.primary.password}",
"apim.analytics.properties.truststore_location": "${carbon.home}/repository/resources/security/$ref{truststore.file_name}",
"apim.analytics.properties.truststore_password": "$ref{truststore.password}",
"tenant_mgt.disable_email_domain_validation": true
"tenant_mgt.disable_email_domain_validation": true,
"apim.jwt.use_kid_property": true
}
11 changes: 9 additions & 2 deletions ...gration/tests-backend/src/test/java/org/wso2/am/integration/tests/jwt/BackendJWTUtil.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -49,13 +49,20 @@ public static void verifySignature(Header jwtheader) throws UnsupportedEncodingE
* verify JWT Header
*
* @param decodedJWTHeaderString decoded JWT Header value
* @param jwksKidClaim kid claim in JWKS endpoint
* @throws JSONException if JSON payload is malformed
*/
public static void verifyJWTHeader(String decodedJWTHeaderString) throws JSONException {
public static void verifyJWTHeader(String decodedJWTHeaderString, String jwksKidClaim) throws JSONException {
JSONObject jsonHeaderObject = new JSONObject(decodedJWTHeaderString);
Assert.assertEquals(jsonHeaderObject.getString("typ"), "JWT");
Assert.assertEquals(jsonHeaderObject.getString("alg"), "RS256");
Assert.assertFalse(jsonHeaderObject.has("kid"));

// Verify kid claim: check if kid claim in JWT header match with that of JWKS endpoint
Assert.assertTrue(jsonHeaderObject.has("kid"));
if (jwksKidClaim != null) {
Assert.assertEquals(jsonHeaderObject.getString("kid"), jwksKidClaim, "kid claim in JWT header " +
"does not match with that of JWKS endpoint");
}
}

/**
Expand Down
23 changes: 18 additions & 5 deletions ...ntegration/tests-backend/src/test/java/org/wso2/am/integration/tests/jwt/JWTTestCase.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -28,6 +28,7 @@
import org.apache.http.client.methods.HttpGet;
import org.apache.http.impl.client.HttpClientBuilder;
import org.apache.http.message.BasicNameValuePair;
import org.apache.http.util.EntityUtils;
import org.json.JSONException;
import org.json.JSONObject;
import org.testng.Assert;
Expand Down Expand Up @@ -76,6 +77,7 @@

import javax.ws.rs.core.Response;

import static org.testng.Assert.assertEquals;
import static org.testng.Assert.assertNotNull;
import static org.testng.AssertJUnit.assertTrue;

Expand Down Expand Up @@ -107,6 +109,7 @@ public class JWTTestCase extends APIManagerLifecycleBaseTest {
URL tokenEndpointURL;
private String tokenURL;
private String identityLoginURL;
private String jwksKidClaim;
private final String CALLBACK_URL = "https://localhost:9443/store/";

@BeforeClass(alwaysRun = true)
Expand Down Expand Up @@ -191,6 +194,16 @@ public void setEnvironment() throws Exception {
APIMIntegrationConstants.IS_API_EXISTS);
waitForAPIDeploymentSync(user.getUserName(), api2Request.getName(), api2Request.getVersion(),
APIMIntegrationConstants.IS_API_EXISTS);

// Invoke JWKS endpoint and retrieve kid claim to validate backend JWT
HttpClient httpclient = HttpClientBuilder.create().build();
HttpGet jwksGet = new HttpGet(getAPIInvocationURLHttp("jwks"));
HttpResponse jwksResponse = httpclient.execute(jwksGet);
assertEquals(jwksResponse.getStatusLine().getStatusCode(), HTTP_RESPONSE_CODE_OK,
"Invocation fails for JWKS GET request");
String jwksResponseString = EntityUtils.toString(jwksResponse.getEntity(), "UTF-8");
JSONObject jwksResponseObject = new JSONObject(jwksResponseString);
jwksKidClaim = jwksResponseObject.getJSONArray("keys").getJSONObject(0).getString("kid");
}

@Test(groups = {"wso2.am"}, description = "Backend JWT Token Generation for Oauth Based App")
Expand Down Expand Up @@ -225,7 +238,7 @@ public void testEnableJWTAndClaimsForOauthApp() throws Exception {
//Do the signature verification for super tenant as tenant key store not there accessible
BackendJWTUtil.verifySignature(jwtheader);
log.debug("Decoded JWT header String = " + decodedJWTHeaderString);
BackendJWTUtil.verifyJWTHeader(decodedJWTHeaderString);
BackendJWTUtil.verifyJWTHeader(decodedJWTHeaderString, jwksKidClaim);
JSONObject jsonObject = new JSONObject(decodedJWTString);
log.info("JWT Received ==" + jsonObject.toString());
//Validate expiry time
Expand Down Expand Up @@ -273,7 +286,7 @@ public void testEnableJWTAndClaimsForJWTApp() throws Exception {
//Do the signature verification
BackendJWTUtil.verifySignature(jwtheader);
log.debug("Decoded JWT header String = " + decodedJWTHeaderString);
BackendJWTUtil.verifyJWTHeader(decodedJWTHeaderString);
BackendJWTUtil.verifyJWTHeader(decodedJWTHeaderString, jwksKidClaim);
JSONObject jsonObject = new JSONObject(decodedJWTString);

// check default claims
Expand Down Expand Up @@ -341,7 +354,7 @@ public void testEnableJWTAndClaimsForAPIKeyApp() throws Exception {
//Do the signature verification
BackendJWTUtil.verifySignature(jwtheader);
log.debug("Decoded JWT header String = " + decodedJWTHeaderString);
BackendJWTUtil.verifyJWTHeader(decodedJWTHeaderString);
BackendJWTUtil.verifyJWTHeader(decodedJWTHeaderString, jwksKidClaim);
JSONObject jsonObject = new JSONObject(decodedJWTString);

// check default claims
Expand Down Expand Up @@ -386,7 +399,7 @@ public void testBackendJWTWithClientCredentialsGrant() throws Exception {
//Do the signature verification
BackendJWTUtil.verifySignature(jwtheader);
log.debug("Decoded JWT header String = " + decodedJWTHeaderString);
BackendJWTUtil.verifyJWTHeader(decodedJWTHeaderString);
BackendJWTUtil.verifyJWTHeader(decodedJWTHeaderString, jwksKidClaim);
JSONObject jsonObject = new JSONObject(decodedJWTString);

// check default claims
Expand Down Expand Up @@ -434,7 +447,7 @@ public void testBackendJWTWithAuthCodeGrant() throws Exception {
//Do the signature verification
BackendJWTUtil.verifySignature(jwtheader);
log.debug("Decoded JWT header String = " + decodedJWTHeaderString);
BackendJWTUtil.verifyJWTHeader(decodedJWTHeaderString);
BackendJWTUtil.verifyJWTHeader(decodedJWTHeaderString, jwksKidClaim);
JSONObject jsonObject = new JSONObject(decodedJWTString);

// check default claims
Expand Down
4 changes: 2 additions & 2 deletions ...s-backend/src/test/java/org/wso2/am/integration/tests/jwt/urlsafe/URLSafeJWTTestCase.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -156,7 +156,7 @@ public void testEnableJWTAndClaimsForOauthApp() throws Exception {
JSONObject jsonHeaderObject = new JSONObject(decodedJWTHeaderString);
Assert.assertEquals(jsonHeaderObject.getString("typ"), "JWT");
Assert.assertEquals(jsonHeaderObject.getString("alg"), "RS256");
Assert.assertFalse(jsonHeaderObject.has("kid"));
Assert.assertTrue(jsonHeaderObject.has("kid"));
JSONObject jsonObject = new JSONObject(decodedJWTString);
log.info("JWT Received ==" + jsonObject.toString());
// check default claims
Expand Down Expand Up @@ -212,7 +212,7 @@ public void testEnableJWTAndClaimsForJWTApp() throws Exception {
JSONObject jsonHeaderObject = new JSONObject(decodedJWTHeaderString);
Assert.assertEquals(jsonHeaderObject.getString("typ"), "JWT");
Assert.assertEquals(jsonHeaderObject.getString("alg"), "RS256");
Assert.assertFalse(jsonHeaderObject.has("kid"));
Assert.assertTrue(jsonHeaderObject.has("kid"));
JSONObject jsonObject = new JSONObject(decodedJWTString);

// check default claims
Expand Down
2 changes: 1 addition & 1 deletion pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1280,7 +1280,7 @@
<carbon.apimgt.ui.version>9.0.453</carbon.apimgt.ui.version>

<!-- APIM Component Version -->
<carbon.apimgt.version>9.28.160</carbon.apimgt.version>
<carbon.apimgt.version>9.28.161</carbon.apimgt.version>

<carbon.apimgt.imp.pkg.version>[9.0.0, 10.0.0)</carbon.apimgt.imp.pkg.version>

Expand Down
Loading