Add Reactive One-Time Token Login support
Closes gh-15699
This commit is contained in:
Max Batischev
committed by
Josh Cummings
Josh Cummings
parent
1adb13db66
commit
2ca2e56383
@@ -0,0 +1,132 @@
|
||||
/*
|
||||
* Copyright 2002-2024 the original author or authors.
|
||||
*
|
||||
* Licensed under the Apache License, Version 2.0 (the "License");
|
||||
* you may not use this file except in compliance with the License.
|
||||
* You may obtain a copy of the License at
|
||||
*
|
||||
* https://www.apache.org/licenses/LICENSE-2.0
|
||||
*
|
||||
* Unless required by applicable law or agreed to in writing, software
|
||||
* distributed under the License is distributed on an "AS IS" BASIS,
|
||||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
* See the License for the specific language governing permissions and
|
||||
* limitations under the License.
|
||||
*/
|
||||
|
||||
package org.springframework.security.authentication.ott.reactive;
|
||||
|
||||
import java.time.Clock;
|
||||
import java.time.Instant;
|
||||
import java.time.ZoneOffset;
|
||||
import java.time.temporal.ChronoUnit;
|
||||
import java.util.ArrayList;
|
||||
import java.util.List;
|
||||
import java.util.Objects;
|
||||
import java.util.UUID;
|
||||
|
||||
import org.junit.jupiter.api.Test;
|
||||
|
||||
import org.springframework.security.authentication.ott.GenerateOneTimeTokenRequest;
|
||||
import org.springframework.security.authentication.ott.OneTimeToken;
|
||||
import org.springframework.security.authentication.ott.OneTimeTokenAuthenticationToken;
|
||||
|
||||
import static org.assertj.core.api.Assertions.assertThat;
|
||||
import static org.assertj.core.api.Assertions.assertThatNoException;
|
||||
|
||||
/**
|
||||
* Tests for {@link InMemoryReactiveOneTimeTokenService}
|
||||
*
|
||||
* @author Max Batischev
|
||||
*/
|
||||
public class InMemoryReactiveOneTimeTokenServiceTests {
|
||||
|
||||
private final InMemoryReactiveOneTimeTokenService oneTimeTokenService = new InMemoryReactiveOneTimeTokenService();
|
||||
|
||||
private static final String USERNAME = "user";
|
||||
|
||||
private static final String TOKEN = "token";
|
||||
|
||||
@Test
|
||||
void generateThenTokenValueShouldBeValidUuidAndProvidedUsernameIsUsed() {
|
||||
GenerateOneTimeTokenRequest request = new GenerateOneTimeTokenRequest(USERNAME);
|
||||
|
||||
OneTimeToken oneTimeToken = this.oneTimeTokenService.generate(request).block();
|
||||
|
||||
assertThatNoException().isThrownBy(() -> UUID.fromString(oneTimeToken.getTokenValue()));
|
||||
assertThat(oneTimeToken.getUsername()).isEqualTo(USERNAME);
|
||||
}
|
||||
|
||||
@Test
|
||||
void consumeWhenTokenDoesNotExistThenNull() {
|
||||
OneTimeTokenAuthenticationToken authenticationToken = new OneTimeTokenAuthenticationToken(TOKEN);
|
||||
|
||||
OneTimeToken oneTimeToken = this.oneTimeTokenService.consume(authenticationToken).block();
|
||||
|
||||
assertThat(oneTimeToken).isNull();
|
||||
}
|
||||
|
||||
@Test
|
||||
void consumeWhenTokenExistsThenReturnItself() {
|
||||
GenerateOneTimeTokenRequest request = new GenerateOneTimeTokenRequest(USERNAME);
|
||||
OneTimeToken generated = this.oneTimeTokenService.generate(request).block();
|
||||
OneTimeTokenAuthenticationToken authenticationToken = new OneTimeTokenAuthenticationToken(
|
||||
generated.getTokenValue());
|
||||
|
||||
OneTimeToken consumed = this.oneTimeTokenService.consume(authenticationToken).block();
|
||||
|
||||
assertThat(consumed.getTokenValue()).isEqualTo(generated.getTokenValue());
|
||||
assertThat(consumed.getUsername()).isEqualTo(generated.getUsername());
|
||||
assertThat(consumed.getExpiresAt()).isEqualTo(generated.getExpiresAt());
|
||||
}
|
||||
|
||||
@Test
|
||||
void consumeWhenTokenIsExpiredThenReturnNull() {
|
||||
GenerateOneTimeTokenRequest request = new GenerateOneTimeTokenRequest(USERNAME);
|
||||
OneTimeToken generated = this.oneTimeTokenService.generate(request).block();
|
||||
OneTimeTokenAuthenticationToken authenticationToken = new OneTimeTokenAuthenticationToken(
|
||||
generated.getTokenValue());
|
||||
Clock tenMinutesFromNow = Clock.fixed(Instant.now().plus(10, ChronoUnit.MINUTES), ZoneOffset.UTC);
|
||||
this.oneTimeTokenService.setClock(tenMinutesFromNow);
|
||||
|
||||
OneTimeToken consumed = this.oneTimeTokenService.consume(authenticationToken).block();
|
||||
|
||||
assertThat(consumed).isNull();
|
||||
}
|
||||
|
||||
@Test
|
||||
void generateWhenMoreThan100TokensThenClearExpired() {
|
||||
// @formatter:off
|
||||
List<OneTimeToken> toExpire = generate(50); // 50 tokens will expire in 5 minutes from now
|
||||
Clock twoMinutesFromNow = Clock.fixed(Instant.now().plus(2, ChronoUnit.MINUTES), ZoneOffset.UTC);
|
||||
this.oneTimeTokenService.setClock(twoMinutesFromNow);
|
||||
List<OneTimeToken> toKeep = generate(50); // 50 tokens will expire in 7 minutes from now
|
||||
Clock sixMinutesFromNow = Clock.fixed(Instant.now().plus(6, ChronoUnit.MINUTES), ZoneOffset.UTC);
|
||||
this.oneTimeTokenService.setClock(sixMinutesFromNow);
|
||||
|
||||
assertThat(toExpire)
|
||||
.extracting((token) -> this.oneTimeTokenService.consume(new OneTimeTokenAuthenticationToken(token.getTokenValue()))
|
||||
.block()
|
||||
)
|
||||
.containsOnlyNulls();
|
||||
|
||||
assertThat(toKeep)
|
||||
.extracting((token) -> this.oneTimeTokenService.consume(new OneTimeTokenAuthenticationToken(token.getTokenValue()))
|
||||
.block()
|
||||
)
|
||||
.noneMatch(Objects::isNull);
|
||||
// @formatter:on
|
||||
}
|
||||
|
||||
private List<OneTimeToken> generate(int howMany) {
|
||||
List<OneTimeToken> generated = new ArrayList<>(howMany);
|
||||
for (int i = 0; i < howMany; i++) {
|
||||
OneTimeToken oneTimeToken = this.oneTimeTokenService
|
||||
.generate(new GenerateOneTimeTokenRequest("generated" + i))
|
||||
.block();
|
||||
generated.add(oneTimeToken);
|
||||
}
|
||||
return generated;
|
||||
}
|
||||
|
||||
}
|
||||
@@ -0,0 +1,141 @@
|
||||
/*
|
||||
* Copyright 2002-2024 the original author or authors.
|
||||
*
|
||||
* Licensed under the Apache License, Version 2.0 (the "License");
|
||||
* you may not use this file except in compliance with the License.
|
||||
* You may obtain a copy of the License at
|
||||
*
|
||||
* https://www.apache.org/licenses/LICENSE-2.0
|
||||
*
|
||||
* Unless required by applicable law or agreed to in writing, software
|
||||
* distributed under the License is distributed on an "AS IS" BASIS,
|
||||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
* See the License for the specific language governing permissions and
|
||||
* limitations under the License.
|
||||
*/
|
||||
|
||||
package org.springframework.security.authentication.ott.reactive;
|
||||
|
||||
import java.time.Instant;
|
||||
import java.util.Collection;
|
||||
|
||||
import org.junit.jupiter.api.Test;
|
||||
import org.mockito.ArgumentMatchers;
|
||||
import reactor.core.publisher.Mono;
|
||||
|
||||
import org.springframework.security.authentication.ReactiveAuthenticationManager;
|
||||
import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
|
||||
import org.springframework.security.authentication.ott.DefaultOneTimeToken;
|
||||
import org.springframework.security.authentication.ott.InvalidOneTimeTokenException;
|
||||
import org.springframework.security.authentication.ott.OneTimeTokenAuthenticationToken;
|
||||
import org.springframework.security.core.Authentication;
|
||||
import org.springframework.security.core.GrantedAuthority;
|
||||
import org.springframework.security.core.authority.AuthorityUtils;
|
||||
import org.springframework.security.core.userdetails.ReactiveUserDetailsService;
|
||||
import org.springframework.security.core.userdetails.User;
|
||||
import org.springframework.security.core.userdetails.UserDetails;
|
||||
import org.springframework.util.CollectionUtils;
|
||||
|
||||
import static org.assertj.core.api.Assertions.assertThat;
|
||||
import static org.assertj.core.api.Assertions.assertThatExceptionOfType;
|
||||
import static org.assertj.core.api.Assertions.assertThatIllegalArgumentException;
|
||||
import static org.mockito.ArgumentMatchers.eq;
|
||||
import static org.mockito.BDDMockito.given;
|
||||
import static org.mockito.Mockito.mock;
|
||||
|
||||
/**
|
||||
* Tests for {@link OneTimeTokenReactiveAuthenticationManager}
|
||||
*
|
||||
* @author Max Batischev
|
||||
*/
|
||||
public class OneTimeTokenReactiveAuthenticationManagerTests {
|
||||
|
||||
private ReactiveAuthenticationManager authenticationManager;
|
||||
|
||||
private static final String USERNAME = "user";
|
||||
|
||||
private static final String PASSWORD = "password";
|
||||
|
||||
private static final String TOKEN = "token";
|
||||
|
||||
@Test
|
||||
public void constructorWhenOneTimeTokenServiceNullThenIllegalArgumentException() {
|
||||
ReactiveUserDetailsService userDetailsService = mock(ReactiveUserDetailsService.class);
|
||||
// @formatter:off
|
||||
assertThatIllegalArgumentException()
|
||||
.isThrownBy(() -> new OneTimeTokenReactiveAuthenticationManager(null, userDetailsService));
|
||||
// @formatter:on
|
||||
}
|
||||
|
||||
@Test
|
||||
public void constructorWhenUserDetailsServiceNullThenIllegalArgumentException() {
|
||||
ReactiveOneTimeTokenService oneTimeTokenService = mock(ReactiveOneTimeTokenService.class);
|
||||
// @formatter:off
|
||||
assertThatIllegalArgumentException()
|
||||
.isThrownBy(() -> new OneTimeTokenReactiveAuthenticationManager(oneTimeTokenService, null));
|
||||
// @formatter:on
|
||||
}
|
||||
|
||||
@Test
|
||||
void authenticateWhenOneTimeTokenAuthenticationTokenIsPresentThenSuccess() {
|
||||
ReactiveOneTimeTokenService oneTimeTokenService = mock(ReactiveOneTimeTokenService.class);
|
||||
given(oneTimeTokenService.consume(ArgumentMatchers.any(OneTimeTokenAuthenticationToken.class)))
|
||||
.willReturn(Mono.just(new DefaultOneTimeToken(TOKEN, USERNAME, Instant.now())));
|
||||
ReactiveUserDetailsService userDetailsService = mock(ReactiveUserDetailsService.class);
|
||||
User testUser = new User(USERNAME, PASSWORD, AuthorityUtils.createAuthorityList("TEST"));
|
||||
given(userDetailsService.findByUsername(eq(USERNAME))).willReturn(Mono.just(testUser));
|
||||
|
||||
this.authenticationManager = new OneTimeTokenReactiveAuthenticationManager(oneTimeTokenService,
|
||||
userDetailsService);
|
||||
|
||||
Authentication auth = this.authenticationManager
|
||||
.authenticate(OneTimeTokenAuthenticationToken.unauthenticated(TOKEN))
|
||||
.block();
|
||||
|
||||
OneTimeTokenAuthenticationToken token = (OneTimeTokenAuthenticationToken) auth;
|
||||
UserDetails user = (UserDetails) token.getPrincipal();
|
||||
Collection<GrantedAuthority> authorities = token.getAuthorities();
|
||||
|
||||
assertThat(user).isNotNull();
|
||||
assertThat(user.getUsername()).isEqualTo(USERNAME);
|
||||
assertThat(user.getPassword()).isEqualTo(PASSWORD);
|
||||
assertThat(token.isAuthenticated()).isTrue();
|
||||
assertThat(CollectionUtils.isEmpty(authorities)).isFalse();
|
||||
}
|
||||
|
||||
@Test
|
||||
void authenticateWhenInvalidOneTimeTokenAuthenticationTokenIsPresentThenFail() {
|
||||
ReactiveOneTimeTokenService oneTimeTokenService = mock(ReactiveOneTimeTokenService.class);
|
||||
given(oneTimeTokenService.consume(ArgumentMatchers.any(OneTimeTokenAuthenticationToken.class)))
|
||||
.willReturn(Mono.empty());
|
||||
ReactiveUserDetailsService userDetailsService = mock(ReactiveUserDetailsService.class);
|
||||
|
||||
this.authenticationManager = new OneTimeTokenReactiveAuthenticationManager(oneTimeTokenService,
|
||||
userDetailsService);
|
||||
|
||||
// @formatter:off
|
||||
assertThatExceptionOfType(InvalidOneTimeTokenException.class)
|
||||
.isThrownBy(() -> this.authenticationManager.authenticate(OneTimeTokenAuthenticationToken.unauthenticated(TOKEN))
|
||||
.block());
|
||||
// @formatter:on
|
||||
}
|
||||
|
||||
@Test
|
||||
void authenticateWhenIncorrectTypeOfAuthenticationIsPresentThenFail() {
|
||||
ReactiveOneTimeTokenService oneTimeTokenService = mock(ReactiveOneTimeTokenService.class);
|
||||
given(oneTimeTokenService.consume(ArgumentMatchers.any(OneTimeTokenAuthenticationToken.class)))
|
||||
.willReturn(Mono.empty());
|
||||
ReactiveUserDetailsService userDetailsService = mock(ReactiveUserDetailsService.class);
|
||||
|
||||
this.authenticationManager = new OneTimeTokenReactiveAuthenticationManager(oneTimeTokenService,
|
||||
userDetailsService);
|
||||
|
||||
// @formatter:off
|
||||
Authentication authentication = this.authenticationManager.authenticate(new UsernamePasswordAuthenticationToken(USERNAME, PASSWORD))
|
||||
.block();
|
||||
// @formatter:on
|
||||
|
||||
assertThat(authentication).isNull();
|
||||
}
|
||||
|
||||
}
|
||||
Reference in New Issue
Block a user