Skip to content

Commit 8c32d5f

Browse files
jzheauxjzheaux
committed
Add oidcLogin WebFlux Test Support
Fixes: gh-7680
1 parent bb87069 commit 8c32d5f

File tree

4 files changed

+528
-0
lines changed

4 files changed

+528
-0
lines changed

‎samples/boot/oauth2login-webflux/src/integration-test/java/sample/OAuth2LoginApplicationTests.java

Lines changed: 67 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,67 @@
1+
/*
2+
* Copyright 2002-2019 the original author or authors.
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* https://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*/
16+
package sample;
17+
18+
import org.junit.Test;
19+
import org.junit.runner.RunWith;
20+
21+
import org.springframework.beans.factory.annotation.Autowired;
22+
import org.springframework.boot.test.autoconfigure.web.reactive.AutoConfigureWebTestClient;
23+
import org.springframework.boot.test.context.SpringBootTest;
24+
import org.springframework.boot.test.context.TestConfiguration;
25+
import org.springframework.context.annotation.Bean;
26+
import org.springframework.security.oauth2.client.registration.ReactiveClientRegistrationRepository;
27+
import org.springframework.security.oauth2.client.web.server.ServerOAuth2AuthorizedClientRepository;
28+
import org.springframework.security.oauth2.client.web.server.WebSessionServerOAuth2AuthorizedClientRepository;
29+
import org.springframework.test.context.junit4.SpringRunner;
30+
import org.springframework.test.web.reactive.server.WebTestClient;
31+
32+
import static org.hamcrest.core.StringContains.containsString;
33+
import static org.springframework.security.test.web.reactive.server.SecurityMockServerConfigurers.mockOidcLogin;
34+
35+
/**
36+
* Tests for {@link ReactiveOAuth2LoginApplication}
37+
*/
38+
@RunWith(SpringRunner.class)
39+
@SpringBootTest
40+
@AutoConfigureWebTestClient
41+
public class OAuth2LoginApplicationTests {
42+
43+
@Autowired
44+
WebTestClient test;
45+
46+
@Autowired
47+
ReactiveClientRegistrationRepository clientRegistrationRepository;
48+
49+
@TestConfiguration
50+
static class AuthorizedClient {
51+
@Bean
52+
ServerOAuth2AuthorizedClientRepository authorizedClientRepository() {
53+
return new WebSessionServerOAuth2AuthorizedClientRepository();
54+
}
55+
}
56+
57+
@Test
58+
public void requestWhenMockOidcLoginThenIndex() {
59+
this.clientRegistrationRepository.findByRegistrationId("github")
60+
.map(clientRegistration ->
61+
this.test.mutateWith(mockOidcLogin().clientRegistration(clientRegistration))
62+
.get().uri("/")
63+
.exchange()
64+
.expectBody(String.class).value(containsString("GitHub"))
65+
).block();
66+
}
67+
}

‎samples/boot/oauth2login-webflux/src/test/java/sample/OAuth2LoginControllerTests.java

Lines changed: 84 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,84 @@
1+
/*
2+
* Copyright 2002-2019 the original author or authors.
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* https://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*/
16+
17+
package sample;
18+
19+
import org.junit.Before;
20+
import org.junit.Test;
21+
import org.junit.runner.RunWith;
22+
import org.mockito.Mock;
23+
import sample.web.OAuth2LoginController;
24+
25+
import org.springframework.beans.factory.annotation.Autowired;
26+
import org.springframework.boot.test.autoconfigure.web.reactive.WebFluxTest;
27+
import org.springframework.core.ReactiveAdapterRegistry;
28+
import org.springframework.security.oauth2.client.registration.ReactiveClientRegistrationRepository;
29+
import org.springframework.security.oauth2.client.web.reactive.result.method.annotation.OAuth2AuthorizedClientArgumentResolver;
30+
import org.springframework.security.oauth2.client.web.server.ServerOAuth2AuthorizedClientRepository;
31+
import org.springframework.security.oauth2.client.web.server.WebSessionServerOAuth2AuthorizedClientRepository;
32+
import org.springframework.security.web.reactive.result.method.annotation.AuthenticationPrincipalArgumentResolver;
33+
import org.springframework.security.web.server.context.SecurityContextServerWebExchangeWebFilter;
34+
import org.springframework.test.context.junit4.SpringRunner;
35+
import org.springframework.test.web.reactive.server.WebTestClient;
36+
import org.springframework.web.reactive.result.view.ViewResolver;
37+
38+
import static org.hamcrest.Matchers.containsString;
39+
import static org.springframework.security.test.web.reactive.server.SecurityMockServerConfigurers.mockOidcLogin;
40+
import static org.springframework.security.test.web.reactive.server.SecurityMockServerConfigurers.springSecurity;
41+
42+
/**
43+
* @author Josh Cummings
44+
*/
45+
@RunWith(SpringRunner.class)
46+
@WebFluxTest(OAuth2LoginController.class)
47+
public class OAuth2LoginControllerTests {
48+
49+
@Autowired
50+
OAuth2LoginController controller;
51+
52+
@Autowired
53+
ViewResolver viewResolver;
54+
55+
@Mock
56+
ReactiveClientRegistrationRepository clientRegistrationRepository;
57+
58+
WebTestClient rest;
59+
60+
@Before
61+
public void setup() {
62+
ServerOAuth2AuthorizedClientRepository authorizedClientRepository =
63+
new WebSessionServerOAuth2AuthorizedClientRepository();
64+
65+
this.rest = WebTestClient
66+
.bindToController(this.controller)
67+
.apply(springSecurity())
68+
.webFilter(new SecurityContextServerWebExchangeWebFilter())
69+
.argumentResolvers(c -> {
70+
c.addCustomResolver(new AuthenticationPrincipalArgumentResolver(new ReactiveAdapterRegistry()));
71+
c.addCustomResolver(new OAuth2AuthorizedClientArgumentResolver
72+
(this.clientRegistrationRepository, authorizedClientRepository));
73+
})
74+
.viewResolvers(c -> c.viewResolver(this.viewResolver))
75+
.build();
76+
}
77+
78+
@Test
79+
public void indexGreetsAuthenticatedUser() {
80+
this.rest.mutateWith(mockOidcLogin())
81+
.get().uri("/").exchange()
82+
.expectBody(String.class).value(containsString("test-subject"));
83+
}
84+
}

‎test/src/main/java/org/springframework/security/test/web/reactive/server/SecurityMockServerConfigurers.java

Lines changed: 213 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,10 @@
1818

1919
import java.util.Arrays;
2020
import java.util.Collection;
21+
import java.util.Collections;
22+
import java.util.LinkedHashSet;
2123
import java.util.List;
24+
import java.util.Set;
2225
import java.util.function.Consumer;
2326
import java.util.function.Supplier;
2427

@@ -30,11 +33,25 @@
3033
import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
3134
import org.springframework.security.core.Authentication;
3235
import org.springframework.security.core.GrantedAuthority;
36+
import org.springframework.security.core.authority.SimpleGrantedAuthority;
3337
import org.springframework.security.core.context.ReactiveSecurityContextHolder;
3438
import org.springframework.security.core.context.SecurityContext;
3539
import org.springframework.security.core.context.SecurityContextImpl;
3640
import org.springframework.security.core.userdetails.User;
3741
import org.springframework.security.core.userdetails.UserDetails;
42+
import org.springframework.security.oauth2.client.OAuth2AuthorizedClient;
43+
import org.springframework.security.oauth2.client.authentication.OAuth2AuthenticationToken;
44+
import org.springframework.security.oauth2.client.registration.ClientRegistration;
45+
import org.springframework.security.oauth2.client.web.server.ServerOAuth2AuthorizedClientRepository;
46+
import org.springframework.security.oauth2.client.web.server.WebSessionServerOAuth2AuthorizedClientRepository;
47+
import org.springframework.security.oauth2.core.AuthorizationGrantType;
48+
import org.springframework.security.oauth2.core.OAuth2AccessToken;
49+
import org.springframework.security.oauth2.core.oidc.IdTokenClaimNames;
50+
import org.springframework.security.oauth2.core.oidc.OidcIdToken;
51+
import org.springframework.security.oauth2.core.oidc.OidcUserInfo;
52+
import org.springframework.security.oauth2.core.oidc.user.DefaultOidcUser;
53+
import org.springframework.security.oauth2.core.oidc.user.OidcUser;
54+
import org.springframework.security.oauth2.core.oidc.user.OidcUserAuthority;
3855
import org.springframework.security.oauth2.jwt.Jwt;
3956
import org.springframework.security.oauth2.server.resource.authentication.JwtAuthenticationToken;
4057
import org.springframework.security.oauth2.server.resource.authentication.JwtGrantedAuthoritiesConverter;
@@ -130,6 +147,21 @@ public static JwtMutator mockJwt() {
130147
return new JwtMutator();
131148
}
132149

150+
/**
151+
* Updates the ServerWebExchange to establish a {@link SecurityContext} that has a
152+
* {@link OAuth2AuthenticationToken} for the
153+
* {@link Authentication}. All details are
154+
* declarative and do not require the corresponding OAuth 2.0 tokens to be valid.
155+
*
156+
* @return the {@link OidcLoginMutator} to further configure or use
157+
* @since 5.3
158+
*/
159+
public static OidcLoginMutator mockOidcLogin() {
160+
OAuth2AccessToken accessToken = new OAuth2AccessToken(OAuth2AccessToken.TokenType.BEARER, "access-token",
161+
null, null, Collections.singleton("user"));
162+
return new OidcLoginMutator(accessToken);
163+
}
164+
133165
public static CsrfMutator csrf() {
134166
return new CsrfMutator();
135167
}
@@ -429,4 +461,185 @@ private <T extends WebTestClientConfigurer & MockServerConfigurer> T configurer(
429461
return mockAuthentication(new JwtAuthenticationToken(this.jwt, this.authoritiesConverter.convert(this.jwt)));
430462
}
431463
}
464+
465+
/**
466+
* @author Josh Cummings
467+
* @since 5.3
468+
*/
469+
public final static class OidcLoginMutator implements WebTestClientConfigurer, MockServerConfigurer {
470+
private ClientRegistration clientRegistration;
471+
private OAuth2AccessToken accessToken;
472+
private OidcIdToken idToken;
473+
private OidcUserInfo userInfo;
474+
private OidcUser oidcUser;
475+
private Collection<GrantedAuthority> authorities;
476+
477+
ServerOAuth2AuthorizedClientRepository authorizedClientRepository =
478+
new WebSessionServerOAuth2AuthorizedClientRepository();
479+
480+
private OidcLoginMutator(OAuth2AccessToken accessToken) {
481+
this.accessToken = accessToken;
482+
this.clientRegistration = clientRegistrationBuilder().build();
483+
}
484+
485+
/**
486+
* Use the provided authorities in the {@link Authentication}
487+
*
488+
* @param authorities the authorities to use
489+
* @return the {@link OidcLoginMutator} for further configuration
490+
*/
491+
public OidcLoginMutator authorities(Collection<GrantedAuthority> authorities) {
492+
Assert.notNull(authorities, "authorities cannot be null");
493+
this.authorities = authorities;
494+
return this;
495+
}
496+
497+
/**
498+
* Use the provided authorities in the {@link Authentication}
499+
*
500+
* @param authorities the authorities to use
501+
* @return the {@link OidcLoginMutator} for further configuration
502+
*/
503+
public OidcLoginMutator authorities(GrantedAuthority... authorities) {
504+
Assert.notNull(authorities, "authorities cannot be null");
505+
this.authorities = Arrays.asList(authorities);
506+
return this;
507+
}
508+
509+
/**
510+
* Use the provided {@link OidcIdToken} when constructing the authenticated user
511+
*
512+
* @param idTokenBuilderConsumer a {@link Consumer} of a {@link OidcIdToken.Builder}
513+
* @return the {@link OidcLoginMutator} for further configuration
514+
*/
515+
public OidcLoginMutator idToken(Consumer<OidcIdToken.Builder> idTokenBuilderConsumer) {
516+
OidcIdToken.Builder builder = OidcIdToken.withTokenValue("id-token");
517+
builder.subject("test-subject");
518+
idTokenBuilderConsumer.accept(builder);
519+
this.idToken = builder.build();
520+
return this;
521+
}
522+
523+
/**
524+
* Use the provided {@link OidcUserInfo} when constructing the authenticated user
525+
*
526+
* @param userInfoBuilderConsumer a {@link Consumer} of a {@link OidcUserInfo.Builder}
527+
* @return the {@link OidcLoginMutator} for further configuration
528+
*/
529+
public OidcLoginMutator userInfoToken(Consumer<OidcUserInfo.Builder> userInfoBuilderConsumer) {
530+
OidcUserInfo.Builder builder = OidcUserInfo.builder();
531+
userInfoBuilderConsumer.accept(builder);
532+
this.userInfo = builder.build();
533+
return this;
534+
}
535+
536+
/**
537+
* Use the provided {@link OidcUser} as the authenticated user.
538+
* <p>
539+
* Supplying an {@link OidcUser} will take precedence over {@link #idToken}, {@link #userInfo},
540+
* and list of {@link GrantedAuthority}s to use.
541+
*
542+
* @param oidcUser the {@link OidcUser} to use
543+
* @return the {@link OidcLoginMutator} for further configuration
544+
*/
545+
public OidcLoginMutator oidcUser(OidcUser oidcUser) {
546+
this.oidcUser = oidcUser;
547+
return this;
548+
}
549+
550+
/**
551+
* Use the provided {@link ClientRegistration} as the client to authorize.
552+
* <p>
553+
* The supplied {@link ClientRegistration} will be registered into an
554+
* {@link WebSessionServerOAuth2AuthorizedClientRepository}. Tests relying on
555+
* {@link org.springframework.security.oauth2.client.annotation.RegisteredOAuth2AuthorizedClient}
556+
* annotations should register an {@link WebSessionServerOAuth2AuthorizedClientRepository} bean
557+
* to the application context.
558+
*
559+
* @param clientRegistration the {@link ClientRegistration} to use
560+
* @return the {@link OidcLoginMutator} for further configuration
561+
*/
562+
public OidcLoginMutator clientRegistration(ClientRegistration clientRegistration) {
563+
this.clientRegistration = clientRegistration;
564+
return this;
565+
}
566+
567+
@Override
568+
public void beforeServerCreated(WebHttpHandlerBuilder builder) {
569+
OAuth2AuthenticationToken token = getToken();
570+
builder.filters(addAuthorizedClientFilter(token));
571+
mockAuthentication(getToken()).beforeServerCreated(builder);
572+
}
573+
574+
@Override
575+
public void afterConfigureAdded(WebTestClient.MockServerSpec<?> serverSpec) {
576+
mockAuthentication(getToken()).afterConfigureAdded(serverSpec);
577+
}
578+
579+
@Override
580+
public void afterConfigurerAdded(
581+
WebTestClient.Builder builder,
582+
@Nullable WebHttpHandlerBuilder httpHandlerBuilder,
583+
@Nullable ClientHttpConnector connector) {
584+
OAuth2AuthenticationToken token = getToken();
585+
httpHandlerBuilder.filters(addAuthorizedClientFilter(token));
586+
mockAuthentication(token).afterConfigurerAdded(builder, httpHandlerBuilder, connector);
587+
}
588+
589+
private Consumer<List<WebFilter>> addAuthorizedClientFilter(OAuth2AuthenticationToken token) {
590+
OAuth2AuthorizedClient client = getClient();
591+
return filters -> filters.add(0, (exchange, chain) ->
592+
authorizedClientRepository.saveAuthorizedClient(client, token, exchange)
593+
.then(chain.filter(exchange)));
594+
}
595+
596+
private ClientRegistration.Builder clientRegistrationBuilder() {
597+
return ClientRegistration.withRegistrationId("test")
598+
.authorizationGrantType(AuthorizationGrantType.PASSWORD)
599+
.clientId("test-client")
600+
.tokenUri("https://token-uri.example.org");
601+
}
602+
603+
private OAuth2AuthenticationToken getToken() {
604+
OidcUser oidcUser = getOidcUser();
605+
return new OAuth2AuthenticationToken(oidcUser, oidcUser.getAuthorities(), this.clientRegistration.getRegistrationId());
606+
}
607+
608+
private OAuth2AuthorizedClient getClient() {
609+
return new OAuth2AuthorizedClient(this.clientRegistration, getToken().getName(), this.accessToken);
610+
}
611+
612+
private Collection<GrantedAuthority> getAuthorities() {
613+
if (this.authorities == null) {
614+
Set<GrantedAuthority> authorities = new LinkedHashSet<>();
615+
authorities.add(new OidcUserAuthority(getOidcIdToken(), getOidcUserInfo()));
616+
for (String authority : this.accessToken.getScopes()) {
617+
authorities.add(new SimpleGrantedAuthority("SCOPE_" + authority));
618+
}
619+
return authorities;
620+
} else {
621+
return this.authorities;
622+
}
623+
}
624+
625+
private OidcIdToken getOidcIdToken() {
626+
if (this.idToken == null) {
627+
return new OidcIdToken("id-token", null, null, Collections.singletonMap(IdTokenClaimNames.SUB, "test-subject"));
628+
} else {
629+
return this.idToken;
630+
}
631+
}
632+
633+
private OidcUserInfo getOidcUserInfo() {
634+
return this.userInfo;
635+
}
636+
637+
private OidcUser getOidcUser() {
638+
if (this.oidcUser == null) {
639+
return new DefaultOidcUser(getAuthorities(), getOidcIdToken(), this.userInfo);
640+
} else {
641+
return this.oidcUser;
642+
}
643+
}
644+
}
432645
}

0 commit comments

Comments
 (0)