1+ /*******************************************************************************
2+ * Copyright 2016 The MITRE Corporation
3+ * and the MIT Internet Trust Consortium
4+ *
5+ * Licensed under the Apache License, Version 2.0 (the "License");
6+ * you may not use this file except in compliance with the License.
7+ * You may obtain a copy of the License at
8+ *
9+ * http://www.apache.org/licenses/LICENSE-2.0
10+ *
11+ * Unless required by applicable law or agreed to in writing, software
12+ * distributed under the License is distributed on an "AS IS" BASIS,
13+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14+ * See the License for the specific language governing permissions and
15+ * limitations under the License.
16+ *******************************************************************************/
17+ /**
18+ *
19+ */
20+ package org .mitre .openid .connect .filter ;
21+
22+ import org .junit .Before ;
23+ import org .junit .Test ;
24+ import org .mitre .oauth2 .service .ClientDetailsEntityService ;
25+ import org .mockito .*;
26+ import org .springframework .mock .web .MockHttpServletRequest ;
27+ import org .springframework .security .oauth2 .provider .AuthorizationRequest ;
28+ import org .springframework .security .oauth2 .provider .ClientDetails ;
29+ import org .springframework .security .oauth2 .provider .OAuth2RequestFactory ;
30+ import org .springframework .test .web .servlet .request .MockHttpServletRequestBuilder ;
31+ import org .springframework .test .web .servlet .request .MockMvcRequestBuilders ;
32+
33+ import javax .servlet .FilterChain ;
34+ import javax .servlet .ServletRequest ;
35+ import javax .servlet .ServletResponse ;
36+ import java .util .Map ;
37+
38+ import static org .hamcrest .CoreMatchers .equalTo ;
39+ import static org .hamcrest .CoreMatchers .is ;
40+ import static org .junit .Assert .assertThat ;
41+ import static org .mockito .Matchers .any ;
42+ import static org .mockito .Mockito .never ;
43+ import static org .mockito .Mockito .times ;
44+
45+ /**
46+ * @author dpaniagua
47+ */
48+ public class AuthorizationRequestFilterTest {
49+
50+ @ InjectMocks
51+ private AuthorizationRequestFilter authorizationRequestFilter ;
52+
53+ @ Mock
54+ private OAuth2RequestFactory oAuth2RequestFactory ;
55+
56+ @ Mock
57+ private ClientDetails clientDetails ;
58+
59+ @ Mock
60+ private ClientDetailsEntityService clientDetailsService ;
61+
62+ @ Mock
63+ private FilterChain springSecurityFilterChain ;
64+
65+ @ Mock
66+ AuthorizationRequest authorizationRequest ;
67+
68+ ArgumentCaptor <Map > argumentCaptor ;
69+
70+ @ Before
71+ public void setUp () throws Exception {
72+ MockitoAnnotations .initMocks (this );
73+ argumentCaptor = ArgumentCaptor .forClass (Map .class );
74+ Mockito .when (oAuth2RequestFactory .createAuthorizationRequest (argumentCaptor .capture ())).thenReturn
75+ (authorizationRequest );
76+ }
77+
78+ @ Test ()
79+ public void testDoFilter_outsideRootServletPath () throws Exception {
80+
81+ // given
82+ String baseUrl = "https://server.example.com/oidc/authorize" ;
83+
84+ MockHttpServletRequestBuilder requestBuilder = MockMvcRequestBuilders .get (baseUrl );
85+ requestBuilder .servletPath ("/oidc" )
86+ .param ("response_type" , "code" )
87+ .param ("scope" , "openid" )
88+ .param ("redirect_uri" , "https://client.example.org/" );
89+ MockHttpServletRequest request = requestBuilder .buildRequest (null );
90+
91+ //when
92+ authorizationRequestFilter .doFilter (request , null , springSecurityFilterChain );
93+ //then
94+ ArgumentCaptor <Map > argumentCaptor = ArgumentCaptor .forClass (Map .class );
95+ Mockito .verify (oAuth2RequestFactory , times (1 )).createAuthorizationRequest (argumentCaptor .capture ());
96+ Mockito .verify (springSecurityFilterChain , times (1 )).doFilter (any (ServletRequest .class ), any (ServletResponse
97+ .class ));
98+ }
99+
100+ @ Test ()
101+ public void testDoFilter_RootServletPath () throws Exception {
102+
103+ // given
104+ // Values Taken from spec sample: http://openid.net/specs/openid-connect-core-1_0.html
105+ String baseUrl = "https://server.example.com/authorize" ;
106+
107+ MockHttpServletRequestBuilder requestBuilder = MockMvcRequestBuilders .get (baseUrl );
108+
109+ requestBuilder .servletPath ("/authorize" )
110+ .param ("response_type" , "code" )
111+ .param ("scope" , "openid" )
112+ .param ("redirect_uri" , "https://client.example.org/" );
113+ MockHttpServletRequest request = requestBuilder .buildRequest (null );
114+
115+ //when
116+ authorizationRequestFilter .doFilter (request , null , springSecurityFilterChain );
117+
118+ //then
119+ assertThat (request .getServletPath (), is (equalTo ("/authorize" )));
120+ Mockito .verify (oAuth2RequestFactory , times (1 )).createAuthorizationRequest (any (Map .class ));
121+ Mockito .verify (springSecurityFilterChain , times (1 )).doFilter (any (ServletRequest .class ), any (ServletResponse
122+ .class ));
123+ }
124+
125+ @ Test ()
126+ public void testDoFilter_withInValidUrl () throws Exception {
127+
128+ // given
129+ String baseUrl = "https://server.example.com/authorize/something/else" ;
130+
131+ MockHttpServletRequestBuilder requestBuilder = MockMvcRequestBuilders .get (baseUrl );
132+ requestBuilder .param ("response_type" , "code" )
133+ .param ("scope" , "openid" )
134+ .servletPath ("/authorize" )
135+ .param ("redirect_uri" , "https://client.example.org/" );
136+ MockHttpServletRequest request = requestBuilder .buildRequest (null );
137+
138+ //when
139+ authorizationRequestFilter .doFilter (request , null , springSecurityFilterChain );
140+
141+ //then
142+ Mockito .verify (oAuth2RequestFactory , times (1 )).createAuthorizationRequest (any (Map .class ));
143+ Mockito .verify (springSecurityFilterChain , times (1 )).doFilter (any (ServletRequest .class ), any (ServletResponse
144+ .class ));
145+ }
146+ }
0 commit comments