Add Authorization Code Grant OAuth security test

joeyleeeeeee97 commented 2 years ago

Secure Communication

Test the data that travels across a network can not be accessed by someone who is not the intended recipient, and test varities combination of cryptography and application protocol works together.

User Story

Assume server is an small application needs to read data from github, and github access requires a token to use its public API. Normally, users won't trust the 3rd party application with their account and password, so we need to redirect user to the github login website and callback to app with logined token. But still, token is very important and shouldn't be transported via plain text, so we introduce Authorization Code and let the application backend to request the token with specific app secret.
But the Authorization Code is still text, what if someone try to get a token via that code?

OAuth center must verify code and app secret to ensure only the application could get token.
Is this a common usage?

Authorization Code Grant https://www.oauth.com/oauth2-servers/server-side-apps/authorization-code/

joeyleeeeeee97 commented 2 years ago

https://github.com/adoptium/aqa-systemtest/issues/453

tellison commented 2 years ago

I'll let the test experts speak to the details of this, but it looks like a great contribution to me! Thank you.

joeyleeeeeee97 commented 2 years ago

@smlambert Thanks for the suggestions and yes I am working on a PR in aqa-tests to include this test.

joeyleeeeeee97 commented 2 years ago

https://ci.adoptopenjdk.net/job/Grinder/1661/console I run this in Grinder, test passed but I got a

14:49:50  TAP Reports Processing: START
14:49:50  Looking for TAP results report in workspace using pattern: **/*.tap
14:49:51  Did not find any matching files. Setting build result to FAILURE.

Did I miss something?

smlambert commented 2 years ago

re: https://github.com/adoptium/aqa-systemtest/pull/457#issuecomment-938392650 I've added a comment on https://github.com/adoptium/aqa-tests/pull/2970 - I think you just need to include the TEST_STATUS in the <command> tag.

Mesbah-Alam commented 2 years ago

Another grinder link testing this PR : https://ci.adoptopenjdk.net/view/Test_grinder/job/Grinder/1686/console

adoptium / aqa-systemtest

Add Authorization Code Grant OAuth security test #457

Secure Communication