OAuth2 is a widely-adopted protocol for authorization that allows applications to securely access user data without sharing passwords. When testing APIs that implement OAuth2, REST Assured can streamline the process, making it easy to perform requests with tokens. Here’s how to set it up.

Step 1: Setup Your Project

Before you can use REST Assured, ensure that you have it included in your project dependencies. If you’re using Maven, add the following to your pom.xml:

<dependency>
    <groupId>io.rest-assured</groupId>
    <artifactId>rest-assured</artifactId>
    <version>5.4.0</version>
    <scope>test</scope>
</dependency>

Make sure you also have JUnit or another testing framework set up for executing your tests.

Step 2: Understanding OAuth2 Flows

OAuth2 has several flows, but we’ll focus on the Authorization Code flow, which is typical for server-side applications. Here’s how it works:

1. The client application requests authorization from the user.
2. The user grants permission, and the authorization server returns an authorization code.
3. The client exchanges the authorization code for an access token.
4. The client uses the access token to request resources from the API.

Step 3: Get The Access Token

When using REST Assured, you need to perform a POST request to exchange the authorization code for a token. The following is an example of how you might implement this:

import io.restassured.RestAssured;
import io.restassured.response.Response;
import static io.restassured.RestAssured.*;

public class OAuth2Example {
    private String accessToken;

    public void getAccessToken() {
        Response response = given()
            .formParam("grant_type", "authorization_code")
            .formParam("client_id", "your_client_id")
            .formParam("client_secret", "your_client_secret")
            .formParam("code", "your_authorization_code")
            .formParam("redirect_uri", "your_redirect_uri") // Make sure this matches the one used in authorization
        .when()
            .post("https://oauth2server.com/token") // Replace with your token endpoint
        .then()
            .statusCode(200)
            .extract().response();

        accessToken = response.jsonPath().getString("access_token");
    }
}

In this snippet, we send a POST request to the token endpoint while supplying the necessary parameters. Upon a successful request, we retrieve the access token from the JSON response.

Step 4: Using the Access Token

Now that you have the access token, you can use it to authorize your requests. Here’s how you can attach the token when calling your API endpoints:

public void accessProtectedResource() {
    given()
        .auth()
        .oauth2(accessToken) // Attach the access token to your request
    .when()
        .get("https://api.yourservice.com/protected/resource") // Replace with your API endpoint
    .then()
        .statusCode(200); // Expecting a successful response
}

Step 5: Executing The Tests

You can run your test cases using your preferred test runner (like JUnit). Just make sure to call both the getAccessToken() and accessProtectedResource() methods within your test:

import org.junit.Before;
import org.junit.Test;

public class OAuth2Test {
    private OAuth2Example oauth2Example;

    @Before
    public void setUp() {
        oauth2Example = new OAuth2Example();
        oauth2Example.getAccessToken(); // Fetch the access token before tests
    }

    @Test
    public void testAccessProtectedResource() {
        oauth2Example.accessProtectedResource();
    }
}

In the above code, the @Before annotation ensures that the access token is fetched before executing the test that accesses protected resources.

Additional Notes

• Always ensure that your client credentials and tokens are kept secure and not hard-coded into your application.
• Token expiration should also be handled by refreshing the token when necessary.
• Since API specifications can vary, adjust your parameters and endpoints based on your API documentation.

With these steps, you should be well on your way to integrating OAuth2 authentication in your REST Assured tests, allowing for more secure and robust API testing.