System.out.println("Retrieved access token: " + accessToken);
reset();
// ensure access token can get security token for accessing resources
OAuth2AuthenticationHandler handler = injector.getInstance(OAuth2AuthenticationHandler.class);
req = new FakeHttpServletRequest("http://localhost:8080","/social/rest/activitystreams/john.doe/@self/1/object1", "access_token=" + accessToken);
req.setMethod("GET");
SecurityToken token = handler.getSecurityTokenFromRequest(req);
assertNotNull(token);
reset();
// attempt to re-use authorization code to get new access token
req = new FakeHttpServletRequest("http://localhost:8080","/oauth2", "client_id=" + CONF_CLIENT_ID + "&grant_type=authorization_code&redirect_uri=" + URLEncoder.encode(REDIRECT_URI,"UTF-8") + "&code=" + code + "&client_secret=" + CONF_CLIENT_SECRET);
req.setMethod("GET");
req.setServletPath("/oauth2");
req.setPathInfo("/access_token");
resp = mock(HttpServletResponse.class);
resp.setStatus(HttpServletResponse.SC_FORBIDDEN);
outputStream = new MockServletOutputStream();
EasyMock.expect(resp.getOutputStream()).andReturn(outputStream).anyTimes();
writer = new PrintWriter(outputStream);
EasyMock.expect(resp.getWriter()).andReturn(writer).anyTimes();
replay();
servlet.service(req, resp);
writer.flush();
tokenResponse = new JSONObject(new String(outputStream.getBuffer(),"UTF-8"));
System.out.println("Rejection response: " + tokenResponse.toString());
assertEquals("invalid_grant",tokenResponse.getString("error"));
verify();
// use (revoked) access token to get a resource
req = new FakeHttpServletRequest("http://localhost:8080","/social/rest/activitystreams/john.doe/@self/1/object1", "access_token=" + accessToken);
req.setMethod("GET");
try {
handler.getSecurityTokenFromRequest(req);
} catch (InvalidAuthenticationException ist) {
return; // test passed
}
fail("Should have thrown InvalidAuthenticationException");
}