Skip to content
This repository has been archived by the owner on Jun 1, 2022. It is now read-only.

Commit

Permalink
ignore token issuer and audience (#382)
Browse files Browse the repository at this point in the history
* ignore token issuer and audience

Signed-off-by: Ian Simpson <[email protected]>

* fix botched change

Signed-off-by: Ian Simpson <[email protected]>

* Fix formatting and naming

Signed-off-by: David Fuelling <[email protected]>

* Add checks to validate non-present audience and issuer

Signed-off-by: David Fuelling <[email protected]>

* validate issuer and audience are empty

Signed-off-by: Ian Simpson <[email protected]>

* apply same changes to outgoing

Signed-off-by: Ian Simpson <[email protected]>
  • Loading branch information
theotherian authored Nov 28, 2019
1 parent a47d9c9 commit 9b674c8
Show file tree
Hide file tree
Showing 6 changed files with 167 additions and 70 deletions.
Original file line number Diff line number Diff line change
Expand Up @@ -75,38 +75,47 @@ static ImmutableIncomingLinkSettings.Builder applyCustomSettings(
.map(Object::toString)
.map(String::toUpperCase)
.map(IlpOverHttpLinkSettings.AuthType::valueOf)
.ifPresent(builder::authType);
.ifPresent((authType) -> {
builder.authType(authType);

if (authType != IlpOverHttpLinkSettings.AuthType.SIMPLE) {
Optional.ofNullable(incomingSettings.get(TOKEN_ISSUER))
.map(Object::toString)
.map(HttpUrl::parse)
.ifPresent(builder::tokenIssuer);

Optional.ofNullable(incomingSettings.get(TOKEN_AUDIENCE))
.map(Object::toString)
.map(HttpUrl::parse)
.ifPresent(builder::tokenAudience);
}
});

Optional.ofNullable(incomingSettings.get(SHARED_SECRET))
.map(Object::toString)
.ifPresent(builder::encryptedTokenSharedSecret);

Optional.ofNullable(incomingSettings.get(TOKEN_ISSUER))
.map(Object::toString)
.map(HttpUrl::parse)
.ifPresent(builder::tokenIssuer);

Optional.ofNullable(incomingSettings.get(TOKEN_AUDIENCE))
.map(Object::toString)
.map(HttpUrl::parse)
.ifPresent(builder::tokenAudience);
}));

Optional.ofNullable(customSettings.get(HTTP_INCOMING_AUTH_TYPE))
.map(Object::toString)
.map(String::toUpperCase)
.map(IlpOverHttpLinkSettings.AuthType::valueOf)
.ifPresent(builder::authType);

Optional.ofNullable(customSettings.get(HTTP_INCOMING_TOKEN_ISSUER))
.map(Object::toString)
.map(HttpUrl::parse)
.ifPresent(builder::tokenIssuer);

Optional.ofNullable(customSettings.get(HTTP_INCOMING_TOKEN_AUDIENCE))
.map(Object::toString)
.map(HttpUrl::parse)
.ifPresent(builder::tokenAudience);
.ifPresent((authType) -> {
builder.authType(authType);

if (authType != IlpOverHttpLinkSettings.AuthType.SIMPLE) {
Optional.ofNullable(customSettings.get(HTTP_INCOMING_TOKEN_ISSUER))
.map(Object::toString)
.map(HttpUrl::parse)
.ifPresent(builder::tokenIssuer);

Optional.ofNullable(customSettings.get(HTTP_INCOMING_TOKEN_AUDIENCE))
.map(Object::toString)
.map(HttpUrl::parse)
.ifPresent(builder::tokenAudience);
}
});

Optional.ofNullable(customSettings.get(HTTP_INCOMING_SHARED_SECRET))
.map(Object::toString)
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -78,21 +78,25 @@ static ImmutableOutgoingLinkSettings.Builder applyCustomSettings(
.map(Object::toString)
.ifPresent(builder::tokenSubject);

Optional.ofNullable(outgoingSettings.get(TOKEN_ISSUER))
.map(Object::toString)
.map(HttpUrl::parse)
.ifPresent(builder::tokenIssuer);

Optional.ofNullable(outgoingSettings.get(TOKEN_AUDIENCE))
.map(Object::toString)
.map(HttpUrl::parse)
.ifPresent(builder::tokenAudience);

Optional.ofNullable(outgoingSettings.get(AUTH_TYPE))
.map(Object::toString)
.map(String::toUpperCase)
.map(IlpOverHttpLinkSettings.AuthType::valueOf)
.ifPresent(builder::authType);
.map(Object::toString)
.map(String::toUpperCase)
.map(IlpOverHttpLinkSettings.AuthType::valueOf)
.ifPresent((authType) -> {
builder.authType(authType);

if (authType != IlpOverHttpLinkSettings.AuthType.SIMPLE) {
Optional.ofNullable(outgoingSettings.get(TOKEN_ISSUER))
.map(Object::toString)
.map(HttpUrl::parse)
.ifPresent(builder::tokenIssuer);

Optional.ofNullable(outgoingSettings.get(TOKEN_AUDIENCE))
.map(Object::toString)
.map(HttpUrl::parse)
.ifPresent(builder::tokenAudience);
}
});

Optional.ofNullable(outgoingSettings.get(SHARED_SECRET))
.map(Object::toString)
Expand All @@ -111,21 +115,24 @@ static ImmutableOutgoingLinkSettings.Builder applyCustomSettings(
});
});

Optional.ofNullable(customSettings.get(HTTP_OUTGOING_TOKEN_ISSUER))
.map(Object::toString)
.map(HttpUrl::parse)
.ifPresent(builder::tokenIssuer);

Optional.ofNullable(customSettings.get(HTTP_OUTGOING_TOKEN_AUDIENCE))
.map(Object::toString)
.map(HttpUrl::parse)
.ifPresent(builder::tokenAudience);

Optional.ofNullable(customSettings.get(HTTP_OUTGOING_AUTH_TYPE))
.map(Object::toString)
.map(String::toUpperCase)
.map(IlpOverHttpLinkSettings.AuthType::valueOf)
.ifPresent(builder::authType);
.map(Object::toString)
.map(String::toUpperCase)
.map(IlpOverHttpLinkSettings.AuthType::valueOf)
.ifPresent((authType) -> {
builder.authType(authType);
if (authType != IlpOverHttpLinkSettings.AuthType.SIMPLE) {
Optional.ofNullable(customSettings.get(HTTP_OUTGOING_TOKEN_ISSUER))
.map(Object::toString)
.map(HttpUrl::parse)
.ifPresent(builder::tokenIssuer);

Optional.ofNullable(customSettings.get(HTTP_OUTGOING_TOKEN_AUDIENCE))
.map(Object::toString)
.map(HttpUrl::parse)
.ifPresent(builder::tokenAudience);
}
});

Optional.ofNullable(customSettings.get(HTTP_OUTGOING_TOKEN_SUBJECT))
.map(Object::toString)
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -31,13 +31,18 @@
public abstract class AbstractHttpLinkSettingsTest {

protected Map<String, Object> customSettingsFlat() {
return customSettingsFlat(IlpOverHttpLinkSettings.AuthType.JWT_HS_256, IlpOverHttpLinkSettings.AuthType.JWT_HS_256);
}

protected Map<String, Object> customSettingsFlat(IlpOverHttpLinkSettings.AuthType incomingAuthType,
IlpOverHttpLinkSettings.AuthType outgoingAuthType) {
return ImmutableMap.<String, Object>builder()
.put(HTTP_INCOMING_AUTH_TYPE, IlpOverHttpLinkSettings.AuthType.JWT_HS_256.name())
.put(HTTP_INCOMING_AUTH_TYPE, incomingAuthType.name())
.put(HTTP_INCOMING_TOKEN_ISSUER, "https://incoming-issuer.example.com/")
.put(HTTP_INCOMING_SHARED_SECRET, "incoming-credential")
.put(HTTP_INCOMING_TOKEN_AUDIENCE, "https://incoming-audience.example.com/")

.put(HTTP_OUTGOING_AUTH_TYPE, IlpOverHttpLinkSettings.AuthType.SIMPLE.name())
.put(HTTP_OUTGOING_AUTH_TYPE, outgoingAuthType.name())
.put(HTTP_OUTGOING_TOKEN_SUBJECT, "outgoing-subject")
.put(HTTP_OUTGOING_SHARED_SECRET, "outgoing-credential")
.put(HTTP_OUTGOING_TOKEN_ISSUER, "https://outgoing-issuer.example.com/")
Expand All @@ -48,16 +53,22 @@ protected Map<String, Object> customSettingsFlat() {
.build();
}

protected Map<String, Object> customSettingsHeirarchical() {
protected Map<String, Object> customSettingsHierarchical() {
return customSettingsHierarchical(IlpOverHttpLinkSettings.AuthType.JWT_HS_256,
IlpOverHttpLinkSettings.AuthType.JWT_HS_256);
}

protected Map<String, Object> customSettingsHierarchical(IlpOverHttpLinkSettings.AuthType incomingAuthType,
IlpOverHttpLinkSettings.AuthType outgoingAuthType) {
final Map<String, Object> incomingMap = new HashMap<>();
incomingMap.put(AUTH_TYPE, IlpOverHttpLinkSettings.AuthType.JWT_HS_256.name());
incomingMap.put(AUTH_TYPE, incomingAuthType.name());
incomingMap.put(TOKEN_SUBJECT, "incoming-subject");
incomingMap.put(SHARED_SECRET, "incoming-credential");
incomingMap.put(TOKEN_ISSUER, "https://incoming-issuer.example.com/");
incomingMap.put(TOKEN_AUDIENCE, "https://incoming-audience.example.com/");

final Map<String, Object> outgoingMap = new HashMap<>();
outgoingMap.put(AUTH_TYPE, IlpOverHttpLinkSettings.AuthType.SIMPLE.name());
outgoingMap.put(AUTH_TYPE, outgoingAuthType.name());
outgoingMap.put(TOKEN_SUBJECT, "outgoing-subject");
outgoingMap.put(SHARED_SECRET, "outgoing-credential");
outgoingMap.put(TOKEN_ISSUER, "https://outgoing-issuer.example.com/");
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -11,7 +11,7 @@
/**
* Unit tests for {@link IlpOverHttpLinkSettings}.
*/
public class IlpOverIlpOverHttpLinkSettingsTest extends AbstractHttpLinkSettingsTest {
public class IlpOverHttpLinkSettingsTest extends AbstractHttpLinkSettingsTest {

/**
* Tests the builder when customAttributes is a flat collection of key/value pairs using dotted-notation.
Expand All @@ -36,7 +36,7 @@ public void applyCustomSettingsWithFlatDottedNotation() {
.isEqualTo(Duration.ofMillis(2500));

assertThat(ilpOverHttpLinkSettings.outgoingHttpLinkSettings().authType())
.isEqualTo(IlpOverHttpLinkSettings.AuthType.SIMPLE);
.isEqualTo(IlpOverHttpLinkSettings.AuthType.JWT_HS_256);
assertThat(ilpOverHttpLinkSettings.outgoingHttpLinkSettings().tokenIssuer().get())
.isEqualTo(HttpUrl.parse("https://outgoing-issuer.example.com/"));
assertThat(ilpOverHttpLinkSettings.outgoingHttpLinkSettings().tokenAudience().get())
Expand All @@ -54,7 +54,7 @@ public void applyCustomSettingsWithFlatDottedNotation() {
*/
@Test
public void applyCustomSettingsWithMapHeirarchy() {
final Map<String, Object> customSettings = this.customSettingsHeirarchical();
final Map<String, Object> customSettings = this.customSettingsHierarchical();

final ImmutableIlpOverHttpLinkSettings.Builder builder = IlpOverHttpLinkSettings.builder();
final ImmutableIlpOverHttpLinkSettings httpLinkSettings =
Expand All @@ -71,7 +71,7 @@ public void applyCustomSettingsWithMapHeirarchy() {
assertThat(httpLinkSettings.incomingHttpLinkSettings().getMinMessageWindow()).isEqualTo(Duration.ofMillis(2500));

assertThat(httpLinkSettings.outgoingHttpLinkSettings().authType())
.isEqualTo(IlpOverHttpLinkSettings.AuthType.SIMPLE);
.isEqualTo(IlpOverHttpLinkSettings.AuthType.JWT_HS_256);
assertThat(httpLinkSettings.outgoingHttpLinkSettings().tokenIssuer().get())
.isEqualTo(HttpUrl.parse("https://outgoing-issuer.example.com/"));
assertThat(httpLinkSettings.outgoingHttpLinkSettings().tokenAudience().get())
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -11,7 +11,7 @@
/**
* Unit tests for {@link IncomingLinkSettings}.
*/
public class IncomingIlpOverIlpOverHttpLinkSettingsSettingsTest extends AbstractHttpLinkSettingsTest {
public class IncomingIlpOverHttpLinkSettingsSettingsTest extends AbstractHttpLinkSettingsTest {

// This value doesn't _strictly_ need to be encrypted for purposes of this test. It could easily be plain-text, but
// for completeness we use the encrypted test-variant.
Expand All @@ -28,9 +28,26 @@ public void applyCustomSettingsWithFlatDottedNotation() {

assertThat(incomingLinksettings.authType()).isEqualTo(IlpOverHttpLinkSettings.AuthType.JWT_HS_256);
assertThat(incomingLinksettings.tokenIssuer().get())
.isEqualTo(HttpUrl.parse("https://incoming-issuer.example.com/"));
.isEqualTo(HttpUrl.parse("https://incoming-issuer.example.com/"));
assertThat(incomingLinksettings.tokenAudience().get())
.isEqualTo(HttpUrl.parse("https://incoming-audience.example.com/"));
.isEqualTo(HttpUrl.parse("https://incoming-audience.example.com/"));
assertThat(incomingLinksettings.encryptedTokenSharedSecret()).isEqualTo("incoming-credential");
assertThat(incomingLinksettings.getMinMessageWindow()).isEqualTo(Duration.ofMillis(2500));
}

/**
* Tests the builder when customAttributes is a flat collection of key/value pairs using dotted-notation,
* ignoring properties not applicable to SIMPLE auth
*/
@Test
public void applyCustomSettingsWithFlatDottedNotationSimpleAuth() {
final Map<String, Object> customSettings = this.customSettingsFlat(IlpOverHttpLinkSettings.AuthType.SIMPLE,
IlpOverHttpLinkSettings.AuthType.SIMPLE);
final IncomingLinkSettings incomingLinksettings = IncomingLinkSettings.fromCustomSettings(customSettings).build();

assertThat(incomingLinksettings.authType()).isEqualTo(IlpOverHttpLinkSettings.AuthType.SIMPLE);
assertThat(incomingLinksettings.tokenIssuer()).isEmpty();
assertThat(incomingLinksettings.tokenAudience()).isEmpty();
assertThat(incomingLinksettings.encryptedTokenSharedSecret()).isEqualTo("incoming-credential");
assertThat(incomingLinksettings.getMinMessageWindow()).isEqualTo(Duration.ofMillis(2500));
}
Expand All @@ -39,15 +56,31 @@ public void applyCustomSettingsWithFlatDottedNotation() {
* Tests the builder when customAttributes is a Map of Maps.
*/
@Test
public void applyCustomSettingsWithMapHeirarchy() {
final Map<String, Object> customSettings = this.customSettingsHeirarchical();
public void applyCustomSettingsWithMapHierarchy() {
final Map<String, Object> customSettings = this.customSettingsHierarchical();
final IncomingLinkSettings incomingLinksettings = IncomingLinkSettings.fromCustomSettings(customSettings).build();

assertThat(incomingLinksettings.authType()).isEqualTo(IlpOverHttpLinkSettings.AuthType.JWT_HS_256);
assertThat(incomingLinksettings.tokenIssuer().get())
.isEqualTo(HttpUrl.parse("https://incoming-issuer.example.com/"));
.isEqualTo(HttpUrl.parse("https://incoming-issuer.example.com/"));
assertThat(incomingLinksettings.tokenAudience().get())
.isEqualTo(HttpUrl.parse("https://incoming-audience.example.com/"));
.isEqualTo(HttpUrl.parse("https://incoming-audience.example.com/"));
assertThat(incomingLinksettings.encryptedTokenSharedSecret()).isEqualTo("incoming-credential");
assertThat(incomingLinksettings.getMinMessageWindow()).isEqualTo(Duration.ofMillis(2500));
}

/**
* Tests the builder when customAttributes is a Map of Maps, ignoring properties not applicable to SIMPLE auth
*/
@Test
public void applyCustomSettingsWithMapHierarchySimpleAuth() {
final Map<String, Object> customSettings = this.customSettingsHierarchical(IlpOverHttpLinkSettings.AuthType.SIMPLE,
IlpOverHttpLinkSettings.AuthType.SIMPLE);
final IncomingLinkSettings incomingLinksettings = IncomingLinkSettings.fromCustomSettings(customSettings).build();

assertThat(incomingLinksettings.authType()).isEqualTo(IlpOverHttpLinkSettings.AuthType.SIMPLE);
assertThat(incomingLinksettings.tokenIssuer()).isEmpty();
assertThat(incomingLinksettings.tokenAudience()).isEmpty();
assertThat(incomingLinksettings.encryptedTokenSharedSecret()).isEqualTo("incoming-credential");
assertThat(incomingLinksettings.getMinMessageWindow()).isEqualTo(Duration.ofMillis(2500));
}
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -11,7 +11,7 @@
/**
* Unit tests for {@link OutgoingLinkSettings}.
*/
public class OutgoingIlpOverIlpOverHttpLinkSettingsSettingsTest extends AbstractHttpLinkSettingsTest {
public class OutgoingIlpOverHttpLinkSettingsSettingsTest extends AbstractHttpLinkSettingsTest {

/**
* Tests the builder when customAttributes is a flat collection of key/value pairs using dotted-notation.
Expand All @@ -21,7 +21,7 @@ public void applyCustomSettingsWithFlatDottedNotation() {
final Map<String, Object> customSettings = this.customSettingsFlat();
final OutgoingLinkSettings outgoingLinksettings = OutgoingLinkSettings.fromCustomSettings(customSettings).build();

assertThat(outgoingLinksettings.authType()).isEqualTo(IlpOverHttpLinkSettings.AuthType.SIMPLE);
assertThat(outgoingLinksettings.authType()).isEqualTo(IlpOverHttpLinkSettings.AuthType.JWT_HS_256);
assertThat(outgoingLinksettings.tokenIssuer().get())
.isEqualTo(HttpUrl.parse("https://outgoing-issuer.example.com/"));
assertThat(outgoingLinksettings.tokenAudience().get())
Expand All @@ -33,14 +33,33 @@ public void applyCustomSettingsWithFlatDottedNotation() {
}

/**
* Tests the builder when customAttributes is a Map of Maps.
* Tests the builder when customAttributes is a flat collection of key/value pairs using dotted-notation,
* ignoring properties not applicable to SIMPLE auth
*/
@Test
public void applyCustomSettingsWithMapHeirarchy() {
final Map<String, Object> customSettings = this.customSettingsHeirarchical();
public void applyCustomSettingsWithFlatDottedNotationWithSimpleAuth() {
final Map<String, Object> customSettings = this.customSettingsFlat(IlpOverHttpLinkSettings.AuthType.SIMPLE,
IlpOverHttpLinkSettings.AuthType.SIMPLE);
final OutgoingLinkSettings outgoingLinksettings = OutgoingLinkSettings.fromCustomSettings(customSettings).build();

assertThat(outgoingLinksettings.authType()).isEqualTo(IlpOverHttpLinkSettings.AuthType.SIMPLE);
assertThat(outgoingLinksettings.tokenIssuer()).isEmpty();
assertThat(outgoingLinksettings.tokenAudience()).isEmpty();
assertThat(outgoingLinksettings.tokenSubject()).isEqualTo("outgoing-subject");
assertThat(outgoingLinksettings.encryptedTokenSharedSecret()).isEqualTo("outgoing-credential");
assertThat(outgoingLinksettings.tokenExpiry().get()).isEqualTo(Duration.ofHours(24));
assertThat(outgoingLinksettings.url()).isEqualTo(HttpUrl.parse("https://outgoing.example.com/"));
}

/**
* Tests the builder when customAttributes is a Map of Maps.
*/
@Test
public void applyCustomSettingsWithMapHierarchy() {
final Map<String, Object> customSettings = this.customSettingsHierarchical();
final OutgoingLinkSettings outgoingLinksettings = OutgoingLinkSettings.fromCustomSettings(customSettings).build();

assertThat(outgoingLinksettings.authType()).isEqualTo(IlpOverHttpLinkSettings.AuthType.JWT_HS_256);
assertThat(outgoingLinksettings.tokenIssuer().get())
.isEqualTo(HttpUrl.parse("https://outgoing-issuer.example.com/"));
assertThat(outgoingLinksettings.tokenAudience().get())
Expand All @@ -51,6 +70,24 @@ public void applyCustomSettingsWithMapHeirarchy() {
assertThat(outgoingLinksettings.url()).isEqualTo(HttpUrl.parse("https://outgoing.example.com"));
}

/**
* Tests the builder when customAttributes is a Map of Maps, ignoring properties not applicable to simple auth
*/
@Test
public void applyCustomSettingsWithMapHierarchyWithSimpleAuth() {
final Map<String, Object> customSettings = this.customSettingsHierarchical(IlpOverHttpLinkSettings.AuthType.SIMPLE,
IlpOverHttpLinkSettings.AuthType.SIMPLE);
final OutgoingLinkSettings outgoingLinksettings = OutgoingLinkSettings.fromCustomSettings(customSettings).build();

assertThat(outgoingLinksettings.authType()).isEqualTo(IlpOverHttpLinkSettings.AuthType.SIMPLE);
assertThat(outgoingLinksettings.tokenIssuer()).isEmpty();
assertThat(outgoingLinksettings.tokenAudience()).isEmpty();
assertThat(outgoingLinksettings.tokenSubject()).isEqualTo("outgoing-subject");
assertThat(outgoingLinksettings.encryptedTokenSharedSecret()).isEqualTo("outgoing-credential");
assertThat(outgoingLinksettings.tokenExpiry().get()).isEqualTo(Duration.ofHours(48));
assertThat(outgoingLinksettings.url()).isEqualTo(HttpUrl.parse("https://outgoing.example.com"));
}

@Test
public void testWithoutCustomSettings() {
final OutgoingLinkSettings outgoingLinksettings =
Expand Down

0 comments on commit 9b674c8

Please sign in to comment.