OAuth 2.0 አራት የተለያዩ ፍሰቶችን ይሰጣል ፣ ግን የእያንዳንዱ ፍሰት ዋና ግብ ወደ ነው የመዳረሻ_ጥቆማ ያግኙ እና የተጠበቁ ሀብቶችን ለመድረስ ይጠቀሙበት ፡፡
አራቱ የተለያዩ ፍሰቶች-
ይህ መማሪያ የ OAuth 2.0 ፍሰቶችን ፣ የፈቃድ ኮድ ግራንት እና የደንበኛ ማረጋገጫ ፍሰቶችን ለመፈተሽ በ REST የተረጋገጠ በመጠቀም የኮድ ምሳሌዎችን ይሰጣል ፡፡
ይህ ኮድ የሚወጣበት እና ጥቅም ላይ የሚውልበት በጣም የተለመደ ፍሰት ነው የመዳረሻ_ጥያቄ . ይህ ኮድ ተጠቃሚው ከገባ በኋላ ወደ ፊት-መጨረሻ ትግበራ (በአሳሹ ላይ) ይገፋል ፡፡ የመዳረሻ_መረጃ ምልክት በአገልጋይ በኩል ይሰጣል ፣ ደንበኛውን በይለፍ ቃሉ እና በተገኘው ኮድ ያረጋግጣል ፡፡
ሶስት እርምጃ ሂደት
የመጀመሪያው እርምጃ code
: ማግኘት ነው
import io.restassured.RestAssured; import io.restassured.http.ContentType; import io.restassured.response.Response; import org.junit.jupiter.api.Assertions; import org.junit.jupiter.api.BeforeAll; import org.junit.jupiter.api.Test; import static io.restassured.RestAssured.given; import java.util.Base64; public class RestAssuredOAuth2 {
public static String clientId = 'some_client_id';
public static String redirectUri = 'some_redirect_uri';
public static String scope = 'some_scope';
public static String username = 'some_email';
public static String password = 'some_password';
public static String encode(String str1, String str2) {
return new String(Base64.getEncoder().encode((str1 + ':' + str2).getBytes()));
}
public static Response getCode() {
String authorization = encode(username, password);
return
given()
.header('authorization', 'Basic ' + authorization)
.contentType(ContentType.URLENC)
.formParam('response_type', 'code')
.queryParam('client_id', clientId)
.queryParam('redirect_uri', redirectUri)
.queryParam('scope', scope)
.post('/oauth2/authorize')
.then()
.statusCode(200)
.extract()
.response();
}
public static String parseForOAuth2Code(Response response) {
return response.jsonPath().getString('code');
}
@BeforeAll
public static void setup() {
RestAssured.baseURI = 'https://some-url.com';
}
@Test
public void iShouldGetCode() {
Response response = getCode();
String code = parseForOAuth2Code(response);
Assertions.assertNotNull(code);
} }
የፈቃድ ኮዱን አንዴ ካገኘን ከዚያ ለ _ _ + _ |
access_token
በመጨረሻም ፣ ትክክለኛ public static Response getToken(String authCode) {
ሲኖረን ከዚያ ለተጠበቁ ሀብቶች ጥያቄ ማቅረብ እንችላለን-
String authorization = encode(username, password);
return
given()
.header('authorization', 'Basic ' + authorization)
.contentType(ContentType.URLENC)
.queryParam('code', authCode)
.queryParam('redirect_uri', redirectUri)
.queryParam('grant_type', grantType)
.post('/oauth2/token')
.then()
.statusCode(200)
.extract()
.response();
}
public static String parseForAccessToken(Response loginResponse) {
return loginResponse.jsonPath().getString('access_token');
}
@Test
public void iShouldGetToken() {
Response tokenResponse = getToken(code);
String accessToken = parseForAccessToken(tokenResponse);
Assertions.assertNotNull(accessToken);
}
access_token
እንዲሁም የመዳረሻ ምልክቱን እንደ አንድ _ _ + _ | መላክ እንችላለን ከ public static void getUsers() {
ጋር ቅድመ ቅጥያ
given().auth()
.oauth2(accessToken)
.when()
.get('/users')
.then()
.statusCode(200); }
ለምሳሌ:
Authorization Header
የደንበኛው የምስክር ወረቀት ፍሰት ምንም የተጠቃሚ በይነገጽ (አሳሽ) የለውም እና በዋናነት ለማሽን-ለማሽን ፈቃድ ጥቅም ላይ ይውላል ፡፡
በተረጋገጠበት ሁኔታ ይህ ይመስላል:
Bearer
እዚህ ላይ public static void getUsers() {
እንዴት ማግኘት እንደሚችሉ ላይ ኮርስ ምሳሌዎችን በ REST በተረጋገጠ አቅርበናል የ OAuth 2.0 ፍሰቶችን በመጠቀም። አንዴ
given()
.header('Authorization', 'Bearer ' + accessToken)
.when()
.get('/users')
.then()
.statusCode(200); } import io.restassured.RestAssured; import io.restassured.http.ContentType; import io.restassured.response.Response; import org.junit.jupiter.api.Assertions; import org.junit.jupiter.api.BeforeAll; import org.junit.jupiter.api.Test; import static io.restassured.RestAssured.given; import static io.restassured.RestAssured.requestSpecification; public class RestAssuredOAuth2 {
ን ካገኘን ከዚያ ለተጠበቁ ሀብቶች ጥያቄ ማቅረብ እንችላለን ፡፡
public static Response response;
private String userAdminClientId = System.getenv('M2M_USER_ADMIN_CLIENT_ID');
private String userAdminClientSecret = System.getenv('M2M_USER_ADMIN_CLIENT_SECRET');
private String oauth2Payload = '{
' +
' 'client_id': '' + userAdminClientId + '',
' +
' 'client_secret': '' + userAdminClientSecret + '',
' +
' 'audience': 'https://some-url.com/user',
' +
' 'grant_type': 'client_credentials',
' +
' 'scope': 'user:admin'
}';
private static String createUserPayload = '{
' +
' 'username': 'api-user',
' +
' 'email': 'api-user@putsbox.com',
' +
' 'password': 'Passw0rd123!',
' +
' 'firstName': 'my-first-name',
' +
' 'lastName': 'my-last-name',
' +
' 'roles': ['read']
}';
public void userAdminConfigSetup() {
requestSpecification = given().auth().oauth2(getAccessToken(oauth2Payload))
.header('Accept', ContentType.JSON.getAcceptHeader())
.contentType(ContentType.JSON);
}
public String getAccessToken(String payload) {
return given()
.contentType(ContentType.JSON)
.body(payload)
.post('/token')
.then().extract().response()
.jsonPath().getString('access_token');
}
@BeforeAll
public static void setup() {
RestAssured.baseURI = 'https://some-url.com';
}
@Test
public void createUser() {
userAdminConfigSetup();
response = given(requestSpecification)
.body(createUserPayload)
.post('/user')
.then().extract().response();
Assertions.assertEquals(201, response.statusCode());
} }
ከላይ የተጠቀሰው ጠቃሚ ሆኖ አግኝተነዋል ፡፡