oxide-auth 0.2.0

A OAuth2 server library, for use in combination with iron or other frontends, featuring a set of configurable and pluggable backends.
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141

use primitives::authorizer::Storage;
use primitives::issuer::TokenMap;
use primitives::generator::RandomGenerator;
use primitives::registrar::{Client, ClientMap};

use code_grant::frontend::{AuthorizationFlow, GrantFlow};

use super::{Allow, CraftedRequest, CraftedResponse, TestGenerator, ToSingleValueQuery};
use super::defaults::*;

struct PkceSetup {
    registrar: ClientMap,
    authorizer: Storage<TestGenerator>,
    issuer: TokenMap<RandomGenerator>,
    auth_token: String,
    verifier: String,
    sha256_challenge: String,
}

impl PkceSetup {
    fn new() -> PkceSetup {
        let client = Client::public(EXAMPLE_CLIENT_ID,
            EXAMPLE_REDIRECT_URI.parse().unwrap(),
            EXAMPLE_SCOPE.parse().unwrap());

        let mut registrar = ClientMap::new();
        registrar.register_client(client);

        let token = "ExampleAuthorizationToken".to_string();
        let authorizer = Storage::new(TestGenerator(token.clone()));
        let issuer = TokenMap::new(RandomGenerator::new(16));

        PkceSetup {
            registrar: registrar,
            authorizer: authorizer,
            issuer: issuer,
            auth_token: token,
            // The following are from https://tools.ietf.org/html/rfc7636#page-18
            sha256_challenge: "E9Melhoa2OwvFrEMTJguCHaoeK1t8URWbuGJSstw-cM".to_string(),
            verifier: "dBjftJeZ4CVP-mB92K27uhbUJU1p1r_wW1gFWFOEjXk".to_string(),
        }
    }

    fn test_correct_access(&mut self, mut auth_request: CraftedRequest, mut access_request: CraftedRequest) {
        use code_grant::extensions::Pkce;

        let pagehandler = Allow(EXAMPLE_OWNER_ID.to_string());
        let pkce_extension = Pkce::required();

        match AuthorizationFlow::new(&self.registrar, &mut self.authorizer)
                .with_extension(&pkce_extension)
                .handle(&mut auth_request, &pagehandler) {
            Ok(ref _response) => (),
            resp => panic!("Expected non-error reponse, got {:?}", resp),
        }

        match GrantFlow::new(&self.registrar, &mut self.authorizer, &mut self.issuer)
                .with_extension(&pkce_extension)
                .handle(&mut access_request) {
            Ok(ref _response) => (),
            resp => panic!("Expected non-error reponse, got {:?}", resp),
        }
    }

    fn test_failed_verification(&mut self, mut auth_request: CraftedRequest, mut access_request: CraftedRequest) {
        use code_grant::extensions::Pkce;

        let pagehandler = Allow(EXAMPLE_OWNER_ID.to_string());
        let pkce_extension = Pkce::required();

        match AuthorizationFlow::new(&self.registrar, &mut self.authorizer)
                .with_extension(&pkce_extension)
                .handle(&mut auth_request, &pagehandler) {
            Ok(ref _response) => (),
            resp => panic!("Expected non-error reponse, got {:?}", resp),
        }

        match GrantFlow::new(&self.registrar, &mut self.authorizer, &mut self.issuer)
                .with_extension(&pkce_extension)
                .handle(&mut access_request) {
            Ok(CraftedResponse::ClientError(_)) => (),
            resp => panic!("Expected non-error reponse, got {:?}", resp),
        }
    }
}

#[test]
fn pkce_correct_verifier() {
    let mut setup = PkceSetup::new();

    let correct_authorization = CraftedRequest {
        query: Some(vec![("client_id", EXAMPLE_CLIENT_ID),
                         ("redirect_uri", EXAMPLE_REDIRECT_URI),
                         ("grant_type", "authorization_code"),
                         ("code_challenge", &setup.sha256_challenge),
                         ("code_challenge_method", "S256")]
            .iter().to_single_value_query()),
        urlbody: None,
        auth: None,
    };

    let correct_access = CraftedRequest {
        query: None,
        urlbody: Some(vec![("grant_type", "authorization_code"),
                           ("code", &setup.auth_token),
                           ("redirect_uri", EXAMPLE_REDIRECT_URI),
                           ("code_verifier", &setup.verifier)]
            .iter().to_single_value_query()),
        auth: None,
    };

    setup.test_correct_access(correct_authorization, correct_access);
}

#[test]
fn pkce_failed_verifier() {
    let mut setup = PkceSetup::new();

    let correct_authorization = CraftedRequest {
        query: Some(vec![("client_id", EXAMPLE_CLIENT_ID),
                         ("redirect_uri", EXAMPLE_REDIRECT_URI),
                         ("grant_type", "authorization_code"),
                         ("code_challenge", &setup.sha256_challenge),
                         ("code_challenge_method", "S256")]
            .iter().to_single_value_query()),
        urlbody: None,
        auth: None,
    };

    let correct_access = CraftedRequest {
        query: None,
        urlbody: Some(vec![("grant_type", "authorization_code"),
                           ("code", &setup.auth_token),
                           ("redirect_uri", EXAMPLE_REDIRECT_URI),
                           ("code_verifier", "Notthecorrectverifier")]
            .iter().to_single_value_query()),
        auth: None,
    };

    setup.test_failed_verification(correct_authorization, correct_access);
}