[java-idp-oidc] branch main updated: JOIDC-20 - Replace token placement options on AttributeTranscoders
Scott Cantor
cantor.2 at osu.edu
Thu Dec 17 03:20:28 UTC 2020
This is an automated email from the git hooks/post-receive script.
scantor pushed a commit to branch main
in repository java-idp-oidc.
View the commit online:
http://git.shibboleth.net/view/?p=java-idp-oidc.git;a=commit;h=65d2c0564f9af8eb8db23029e317a63fc04ddc8b
The following commit(s) were added to refs/heads/main by this push:
new 65d2c056 JOIDC-20 - Replace token placement options on AttributeTranscoders
65d2c056 is described below
commit 65d2c0564f9af8eb8db23029e317a63fc04ddc8b
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Wed Dec 16 22:20:24 2020 -0500
JOIDC-20 - Replace token placement options on AttributeTranscoders
https://issues.shibboleth.net/jira/browse/JOIDC-20
Replace "inToken" flag with encodedAttributes profile setting.
---
.../transcoding/OIDCAttributeTranscoder.java | 3 --
.../enc/impl/BaseOIDCAttributeEncoderParser.java | 5 --
.../oidc/config/OIDCCoreProtocolConfiguration.java | 52 ++++++++++++++++++++-
.../navigate/EncodedAttributesLookupFunction.java | 54 ++++++++++++++++++++++
...etTokenDeliveryAttributesToResponseContext.java | 42 +++++++++++++----
.../idp/service/relying-party/postconfig.xml | 12 ++++-
.../idp/plugin/oidc/op/conf/oidc.properties | 3 ++
.../idp-oidc-extension-attribute-encoder.xsd | 8 ----
...kenDeliveryAttributesToResponseContextTest.java | 19 +++++---
9 files changed, 166 insertions(+), 32 deletions(-)
diff --git a/idp-oidc-extension-api/src/main/java/org/geant/idpextension/oidc/attribute/transcoding/OIDCAttributeTranscoder.java b/idp-oidc-extension-api/src/main/java/org/geant/idpextension/oidc/attribute/transcoding/OIDCAttributeTranscoder.java
index 0d622ff2..1f61c49c 100644
--- a/idp-oidc-extension-api/src/main/java/org/geant/idpextension/oidc/attribute/transcoding/OIDCAttributeTranscoder.java
+++ b/idp-oidc-extension-api/src/main/java/org/geant/idpextension/oidc/attribute/transcoding/OIDCAttributeTranscoder.java
@@ -42,9 +42,6 @@ public interface OIDCAttributeTranscoder extends AttributeTranscoder<JSONObject>
/** Separator to use when not encoding multiple values to array. */
@Nonnull @NotEmpty static final String PROP_STRING_DELIMITER = "oidc.stringDelimiter";
-
- /** Whether to encode data into authorization code and access token. */
- @Nonnull @NotEmpty static final String PROP_IN_TOKEN = "oidc.inToken";
/** Whether to forcibly include data in ID token regardless of response type. */
@Nonnull @NotEmpty static final String PROP_FORCE_ID_TOKEN = "oidc.forceIDToken";
diff --git a/idp-oidc-extension-impl/src/main/java/org/geant/idpextension/oidc/attribute/resolver/spring/enc/impl/BaseOIDCAttributeEncoderParser.java b/idp-oidc-extension-impl/src/main/java/org/geant/idpextension/oidc/attribute/resolver/spring/enc/impl/BaseOIDCAttributeEncoderParser.java
index 681532ae..373265cb 100644
--- a/idp-oidc-extension-impl/src/main/java/org/geant/idpextension/oidc/attribute/resolver/spring/enc/impl/BaseOIDCAttributeEncoderParser.java
+++ b/idp-oidc-extension-impl/src/main/java/org/geant/idpextension/oidc/attribute/resolver/spring/enc/impl/BaseOIDCAttributeEncoderParser.java
@@ -63,11 +63,6 @@ public abstract class BaseOIDCAttributeEncoderParser extends BaseAttributeEncode
StringSupport.trimOrNull(config.getAttributeNS(null, "stringDelimiter")));
}
- if (config.hasAttributeNS(null, "setToToken")) {
- rule.put(OIDCAttributeTranscoder.PROP_IN_TOKEN,
- StringSupport.trimOrNull(config.getAttributeNS(null, "setToToken")));
- }
-
if (config.hasAttributeNS(null, "placeToIDToken")) {
rule.put(OIDCAttributeTranscoder.PROP_FORCE_ID_TOKEN,
StringSupport.trimOrNull(config.getAttributeNS(null, "placeToIDToken")));
diff --git a/idp-oidc-extension-impl/src/main/java/org/geant/idpextension/oidc/config/OIDCCoreProtocolConfiguration.java b/idp-oidc-extension-impl/src/main/java/org/geant/idpextension/oidc/config/OIDCCoreProtocolConfiguration.java
index b5fa192d..adf436a6 100644
--- a/idp-oidc-extension-impl/src/main/java/org/geant/idpextension/oidc/config/OIDCCoreProtocolConfiguration.java
+++ b/idp-oidc-extension-impl/src/main/java/org/geant/idpextension/oidc/config/OIDCCoreProtocolConfiguration.java
@@ -46,7 +46,7 @@ import net.shibboleth.utilities.java.support.logic.FunctionSupport;
import net.shibboleth.utilities.java.support.primitive.StringSupport;
/**
- * Profile configuration for the OpenID Connect authorization and token end points.
+ * Profile configuration for the OpenID Connect authorization and token endpoints.
*/
public class OIDCCoreProtocolConfiguration extends AbstractOIDCFlowAwareProfileConfiguration
implements AuthenticationProfileConfiguration, OverriddenIssuerProfileConfiguration {
@@ -102,6 +102,9 @@ public class OIDCCoreProtocolConfiguration extends AbstractOIDCFlowAwareProfileC
/** Lookup function to supply additional audiences for ID token. */
@Nonnull private Function<ProfileRequestContext,Set<String>> assertionAudiencesLookupStrategy;
+
+ /** Lookup function to supply attribute IDs to embed in authorization code or access token. */
+ @Nonnull private Function<ProfileRequestContext,Set<String>> encodedAttributesLookupStrategy;
/**
* Constructor.
@@ -135,6 +138,8 @@ public class OIDCCoreProtocolConfiguration extends AbstractOIDCFlowAwareProfileC
defaultAuthenticationContextsLookupStrategy = FunctionSupport.constant(null);
authenticationFlowsLookupStrategy = FunctionSupport.constant(null);
postAuthenticationFlowsLookupStrategy = FunctionSupport.constant(null);
+
+ encodedAttributesLookupStrategy = FunctionSupport.constant(null);
}
/** {@inheritDoc} */
@@ -644,4 +649,49 @@ public class OIDCCoreProtocolConfiguration extends AbstractOIDCFlowAwareProfileC
allowPKCEPlainPredicate = Constraint.isNotNull(condition, "Condition cannot be null");
}
+ /**
+ * Get the set of attribute IDs which should be encoded in encrypted form into the authorization code
+ * and/or access/refresh tokens to enable recovery on the back-channel.
+ *
+ * @param profileRequestContext profile request context
+ *
+ * @return the attribute IDs to encode
+ */
+ @Nonnull @NonnullElements @NotLive public Set<String> getEncodedAttributes(
+ @Nullable final ProfileRequestContext profileRequestContext) {
+
+ final Set<String> attributes = encodedAttributesLookupStrategy.apply(profileRequestContext);
+ if (attributes != null) {
+ return Set.copyOf(attributes);
+ }
+ return Collections.emptySet();
+ }
+
+ /**
+ * Set the set of attribute IDs which should be encoded in encrypted form into the authorization code
+ * and/or access/refresh tokens to enable recovery on the back-channel.
+ *
+ * @param attributes the attribute IDs to encode
+ */
+ public void setEncodedAttributes(@Nullable @NonnullElements final Collection<String> attributes) {
+
+ if (attributes == null || attributes.isEmpty()) {
+ encodedAttributesLookupStrategy = FunctionSupport.constant(null);
+ } else {
+ encodedAttributesLookupStrategy = FunctionSupport.constant(
+ Set.copyOf(StringSupport.normalizeStringCollection(attributes)));
+ }
+ }
+
+ /**
+ * Set a lookup strategy for the attribute IDs which should be encoded in encrypted form into the
+ * authorization code and/or access/refresh tokens to enable recovery on the back-channel.
+ *
+ * @param strategy lookup strategy
+ */
+ public void setEncodedAttributesLookupStrategy(
+ @Nonnull final Function<ProfileRequestContext,Set<String>> strategy) {
+ encodedAttributesLookupStrategy = Constraint.isNotNull(strategy, "Lookup strategy cannot be null");
+ }
+
}
\ No newline at end of file
diff --git a/idp-oidc-extension-impl/src/main/java/org/geant/idpextension/oidc/config/navigate/EncodedAttributesLookupFunction.java b/idp-oidc-extension-impl/src/main/java/org/geant/idpextension/oidc/config/navigate/EncodedAttributesLookupFunction.java
new file mode 100644
index 00000000..8e4eb01f
--- /dev/null
+++ b/idp-oidc-extension-impl/src/main/java/org/geant/idpextension/oidc/config/navigate/EncodedAttributesLookupFunction.java
@@ -0,0 +1,54 @@
+/*
+ * Copyright (c) 2017 - 2020, GÉANT
+ *
+ * Licensed under the Apache License, Version 2.0 (the “License”); you may not
+ * use this file except in compliance with the License. You may obtain a copy
+ * of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an “AS IS” BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.geant.idpextension.oidc.config.navigate;
+
+import java.util.Set;
+
+import javax.annotation.Nullable;
+
+import org.geant.idpextension.oidc.config.OIDCCoreProtocolConfiguration;
+import org.opensaml.profile.context.ProfileRequestContext;
+
+import net.shibboleth.idp.profile.config.ProfileConfiguration;
+import net.shibboleth.idp.profile.context.RelyingPartyContext;
+import net.shibboleth.idp.profile.context.navigate.AbstractRelyingPartyLookupFunction;
+
+/**
+ * A function that obtains
+ * {@link OIDCCoreProtocolConfiguration#getEncodedAttributes(ProfileRequestContext)}
+ * if such a profile is available from a {@link RelyingPartyContext} obtained via a lookup function,
+ * by default a child of the {@link ProfileRequestContext}.
+ *
+ * <p>If a specific setting is unavailable, a null value is returned.</p>
+ */
+public class EncodedAttributesLookupFunction
+ extends AbstractRelyingPartyLookupFunction<Set<String>> {
+
+ /** {@inheritDoc} */
+ @Nullable public Set<String> apply(@Nullable final ProfileRequestContext input) {
+ final RelyingPartyContext rpc = getRelyingPartyContextLookupStrategy().apply(input);
+ if (rpc != null) {
+ final ProfileConfiguration pc = rpc.getProfileConfig();
+ if (pc != null && pc instanceof OIDCCoreProtocolConfiguration) {
+ return ((OIDCCoreProtocolConfiguration)pc).getEncodedAttributes(input);
+ }
+ }
+
+ return null;
+ }
+
+}
\ No newline at end of file
diff --git a/idp-oidc-extension-impl/src/main/java/org/geant/idpextension/oidc/profile/impl/SetTokenDeliveryAttributesToResponseContext.java b/idp-oidc-extension-impl/src/main/java/org/geant/idpextension/oidc/profile/impl/SetTokenDeliveryAttributesToResponseContext.java
index 43d722b5..5b912bea 100644
--- a/idp-oidc-extension-impl/src/main/java/org/geant/idpextension/oidc/profile/impl/SetTokenDeliveryAttributesToResponseContext.java
+++ b/idp-oidc-extension-impl/src/main/java/org/geant/idpextension/oidc/profile/impl/SetTokenDeliveryAttributesToResponseContext.java
@@ -17,6 +17,8 @@
package org.geant.idpextension.oidc.profile.impl;
import java.util.Collection;
+import java.util.Collections;
+import java.util.Set;
import java.util.function.Function;
import javax.annotation.Nonnull;
@@ -40,6 +42,7 @@ import net.shibboleth.utilities.java.support.service.ReloadableService;
import net.shibboleth.utilities.java.support.service.ServiceableComponent;
import org.geant.idpextension.oidc.attribute.transcoding.OIDCAttributeTranscoder;
+import org.geant.idpextension.oidc.config.navigate.EncodedAttributesLookupFunction;
import org.geant.idpextension.oidc.messaging.context.OIDCAuthenticationResponseContext;
import org.geant.idpextension.oidc.messaging.context.OIDCAuthenticationResponseTokenClaimsContext;
import org.opensaml.messaging.context.navigate.ChildContextLookup;
@@ -61,8 +64,11 @@ public class SetTokenDeliveryAttributesToResponseContext extends AbstractOIDCRes
/**
* Strategy used to locate the {@link AttributeContext} associated with a given {@link ProfileRequestContext}.
*/
- @Nonnull private Function<ProfileRequestContext, AttributeContext> attributeContextLookupStrategy;
+ @Nonnull private Function<ProfileRequestContext,AttributeContext> attributeContextLookupStrategy;
+ /** Strategy used to obtain the set of attribute IDs to encode for back-channel recovery. */
+ @Nonnull private Function<ProfileRequestContext,Set<String>> encodedAttributesLookupStrategy;
+
/** Transcoder registry service object. */
@NonnullAfterInit private ReloadableService<AttributeTranscoderRegistry> transcoderRegistry;
@@ -75,11 +81,15 @@ public class SetTokenDeliveryAttributesToResponseContext extends AbstractOIDCRes
/** AttributeContext to use. */
@Nullable private AttributeContext attributeCtx;
+
+ /** Attributes to encode for recovery. */
+ @Nullable private Set<String> encodedAttributes;
/** Constructor. */
SetTokenDeliveryAttributesToResponseContext() {
attributeContextLookupStrategy = new ChildContextLookup<>(AttributeContext.class).compose(
new ChildContextLookup<>(RelyingPartyContext.class));
+ encodedAttributesLookupStrategy = new EncodedAttributesLookupFunction();
ignoringUnencodableAttributes = true;
}
@@ -121,6 +131,19 @@ public class SetTokenDeliveryAttributesToResponseContext extends AbstractOIDCRes
attributeContextLookupStrategy =
Constraint.isNotNull(strategy, "AttributeContext lookup strategy cannot be null");
}
+
+ /**
+ * Set the strategy used to obtain the set of attribute IDs to encode for back-channel recovery.
+ *
+ * @param strategy lookup strategy
+ */
+ public void setEncodedAttributesLookupStrategy(
+ @Nonnull final Function<ProfileRequestContext,Set<String>> strategy) {
+ ComponentSupport.ifInitializedThrowUnmodifiabledComponentException(this);
+
+ encodedAttributesLookupStrategy = Constraint.isNotNull(strategy,
+ "Encoded attributes lookup strategy cannot be null");
+ }
/** {@inheritDoc} */
@Override
@@ -138,11 +161,19 @@ public class SetTokenDeliveryAttributesToResponseContext extends AbstractOIDCRes
if (!super.doPreExecute(profileRequestContext)) {
return false;
}
+
attributeCtx = attributeContextLookupStrategy.apply(profileRequestContext);
if (attributeCtx == null) {
log.debug("{} No AttributeSubcontext available, nothing to do", getLogPrefix());
return false;
+
+ }
+
+ encodedAttributes = encodedAttributesLookupStrategy.apply(profileRequestContext);
+ if (encodedAttributes == null) {
+ encodedAttributes = Collections.emptySet();
}
+
return true;
}
@@ -159,7 +190,8 @@ public class SetTokenDeliveryAttributesToResponseContext extends AbstractOIDCRes
}
for (final IdPAttribute attribute : attributeCtx.getIdPAttributes().values()) {
- if (attribute != null && !attribute.getValues().isEmpty()) {
+ if (attribute != null && !attribute.getValues().isEmpty() &&
+ encodedAttributes.contains(attribute.getId())) {
// This will generate the claims and add them to the appropriate claims sets.
encodeAttribute(component.getComponent(), profileRequestContext, attribute);
}
@@ -199,12 +231,6 @@ public class SetTokenDeliveryAttributesToResponseContext extends AbstractOIDCRes
for (final TranscodingRule rule : transcodingRules) {
try {
- if (!rule.getOrDefault(OIDCAttributeTranscoder.PROP_IN_TOKEN, Boolean.class, false)) {
- log.debug("{} Claim rule for '{}' marked recreatable, " +
- "not adding a token delivery claim to response context", getLogPrefix(), attribute.getId());
- continue;
- }
-
final AttributeTranscoder<JSONObject> transcoder = TranscoderSupport.<JSONObject>getTranscoder(rule);
if (rule.getOrDefault(OIDCAttributeTranscoder.PROP_FORCE_ID_TOKEN, Boolean.class, false)
diff --git a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/service/relying-party/postconfig.xml b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/service/relying-party/postconfig.xml
index 6ef9a115..95ef9b52 100644
--- a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/service/relying-party/postconfig.xml
+++ b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/service/relying-party/postconfig.xml
@@ -27,7 +27,8 @@
p:refreshTokenLifetime="%{idp.oidc.refreshToken.defaultLifetime:PT2H}"
p:tokenEndpointAuthMethods="%{idp.oidc.tokenEndpointAuthMethods:client_secret_basic,client_secret_post,client_secret_jwt,private_key_jwt}"
p:forcePKCE="%{idp.oidc.forcePKCE:false}"
- p:allowPKCEPlain="%{idp.oidc.allowPKCEPlain:false}"/>
+ p:allowPKCEPlain="%{idp.oidc.allowPKCEPlain:false}"
+ p:encodedAttributes="%{idp.oidc.encodedAttributes:}" />
<bean id="OIDC.UserInfo" parent="AbstractOIDCProfile" lazy-init="true"
class="org.geant.idpextension.oidc.config.OIDCUserInfoConfiguration" />
@@ -182,6 +183,15 @@
<bean parent="shibboleth.MDDrivenListProperty" p:propertyName="defaultAuthenticationMethods"
p:propertyType="#{T(org.geant.idpextension.oidc.authn.principal.AuthenticationContextClassReferencePrincipal)}" />
</property>
+ <property name="encodedAttributesLookupStrategy">
+ <bean parent="shibboleth.MDDrivenSetProperty" p:propertyName="encodedAttributes">
+ <property name="defaultValue">
+ <bean parent="shibboleth.CommaDelimStringArray">
+ <constructor-arg type="java.lang.String" value="%{idp.oidc.encodedAttributes:}" />
+ </bean>
+ </property>
+ </bean>
+ </property>
</bean>
<bean id="OIDC.UserInfo.MDDriven" parent="AbstractMDDrivenOIDCProfile" lazy-init="true"
diff --git a/idp-oidc-extension-impl/src/main/resources/net/shibboleth/idp/plugin/oidc/op/conf/oidc.properties b/idp-oidc-extension-impl/src/main/resources/net/shibboleth/idp/plugin/oidc/op/conf/oidc.properties
index db1d2c29..24d42776 100644
--- a/idp-oidc-extension-impl/src/main/resources/net/shibboleth/idp/plugin/oidc/op/conf/oidc.properties
+++ b/idp-oidc-extension-impl/src/main/resources/net/shibboleth/idp/plugin/oidc/op/conf/oidc.properties
@@ -46,6 +46,9 @@ idp.signing.oidc.rsa.enc.key = %{idp.home}/credentials/idp-encryption-rsa.jwk
# Reference to a global bean defining the dynamic contents for the openid-configuration
#idp.oidc.discovery.resolver = shibboleth.oidc.DefaultOpenIdConfigurationResolver
+# Special claim handling rules
+#idp.oidc.embeddedAttributes =
+
# The source attribute used in generating the sub claim
idp.oidc.subject.sourceAttribute = uid
diff --git a/idp-oidc-extension-impl/src/main/resources/schema/idp-oidc-extension-attribute-encoder.xsd b/idp-oidc-extension-impl/src/main/resources/schema/idp-oidc-extension-attribute-encoder.xsd
index f0ef9349..b2496572 100644
--- a/idp-oidc-extension-impl/src/main/resources/schema/idp-oidc-extension-attribute-encoder.xsd
+++ b/idp-oidc-extension-impl/src/main/resources/schema/idp-oidc-extension-attribute-encoder.xsd
@@ -97,14 +97,6 @@
</documentation>
</annotation>
</attribute>
- <attribute name="setToToken" type="string" use="optional">
- <annotation>
- <documentation>
- Instructs to encode the attribute to code/token. This is needed for attributes
- formed of session/context based information.
- </documentation>
- </annotation>
- </attribute>
<attribute name="placeToIDToken" type="string" use="optional">
<annotation>
<documentation>
diff --git a/idp-oidc-extension-impl/src/test/java/org/geant/idpextension/oidc/profile/impl/SetTokenDeliveryAttributesToResponseContextTest.java b/idp-oidc-extension-impl/src/test/java/org/geant/idpextension/oidc/profile/impl/SetTokenDeliveryAttributesToResponseContextTest.java
index 4c79c3a5..6950b5b4 100644
--- a/idp-oidc-extension-impl/src/test/java/org/geant/idpextension/oidc/profile/impl/SetTokenDeliveryAttributesToResponseContextTest.java
+++ b/idp-oidc-extension-impl/src/test/java/org/geant/idpextension/oidc/profile/impl/SetTokenDeliveryAttributesToResponseContextTest.java
@@ -22,6 +22,7 @@ import java.util.Collections;
import java.util.HashMap;
import java.util.List;
import java.util.Map;
+import java.util.Set;
import net.shibboleth.ext.spring.testing.MockApplicationContext;
import net.shibboleth.idp.attribute.IdPAttribute;
@@ -36,7 +37,7 @@ import net.shibboleth.idp.profile.context.RelyingPartyContext;
import net.shibboleth.idp.profile.testing.ActionTestingSupport;
import net.shibboleth.utilities.java.support.component.ComponentInitializationException;
import net.shibboleth.utilities.java.support.test.service.MockReloadableService;
-
+import org.geant.idpextension.oidc.config.OIDCCoreProtocolConfiguration;
import org.geant.idpextension.oidc.attribute.transcoding.AbstractOIDCAttributeTranscoder;
import org.geant.idpextension.oidc.attribute.transcoding.OIDCAttributeTranscoder;
import org.geant.idpextension.oidc.attribute.transcoding.impl.OIDCStringAttributeTranscoder;
@@ -57,6 +58,9 @@ public class SetTokenDeliveryAttributesToResponseContextTest extends BaseOIDCRes
@BeforeMethod
public void setup() throws ComponentInitializationException {
+ ((OIDCCoreProtocolConfiguration) rpCtx.getProfileConfig()).setEncodedAttributes(
+ Set.of("test1", "test2", "test3"));
+
registry = new AttributeTranscoderRegistryImpl();
registry.setId("test");
@@ -67,14 +71,12 @@ public class SetTokenDeliveryAttributesToResponseContextTest extends BaseOIDCRes
rule1.put(AttributeTranscoderRegistry.PROP_ID, "test1");
rule1.put(AttributeTranscoderRegistry.PROP_TRANSCODER, transcoder);
rule1.put(OIDCAttributeTranscoder.PROP_NAME, "test1");
- rule1.put(OIDCAttributeTranscoder.PROP_IN_TOKEN, true);
final Map<String,Object> rule2 = new HashMap<>();
rule2.put(AttributeTranscoderRegistry.PROP_ID, "test2");
rule2.put(AttributeTranscoderRegistry.PROP_TRANSCODER, transcoder);
rule2.put(OIDCAttributeTranscoder.PROP_NAME, "test2");
rule2.put(OIDCAttributeTranscoder.PROP_FORCE_ID_TOKEN, true);
- rule2.put(OIDCAttributeTranscoder.PROP_IN_TOKEN, true);
rule2.put(OIDCAttributeTranscoder.PROP_DENY_USERINFO, true);
final Map<String,Object> rule3 = new HashMap<>();
@@ -82,7 +84,11 @@ public class SetTokenDeliveryAttributesToResponseContextTest extends BaseOIDCRes
rule3.put(AttributeTranscoderRegistry.PROP_TRANSCODER, transcoder);
rule3.put(OIDCAttributeTranscoder.PROP_NAME, "test3");
rule3.put(OIDCAttributeTranscoder.PROP_FORCE_ID_TOKEN, true);
- rule3.put(OIDCAttributeTranscoder.PROP_IN_TOKEN, true);
+
+ final Map<String,Object> rule4 = new HashMap<>();
+ rule4.put(AttributeTranscoderRegistry.PROP_ID, "test4");
+ rule4.put(AttributeTranscoderRegistry.PROP_TRANSCODER, transcoder);
+ rule4.put(OIDCAttributeTranscoder.PROP_NAME, "test4");
registry.setNamingRegistry(Collections.singletonList(
new BasicNamingFunction<>(transcoder.getEncodedType(),
@@ -91,7 +97,8 @@ public class SetTokenDeliveryAttributesToResponseContextTest extends BaseOIDCRes
registry.setTranscoderRegistry(List.of(
new TranscodingRule(rule1),
new TranscodingRule(rule2),
- new TranscodingRule(rule3)));
+ new TranscodingRule(rule3),
+ new TranscodingRule(rule4)));
registry.setApplicationContext(new MockApplicationContext());
registry.initialize();
@@ -126,7 +133,7 @@ public class SetTokenDeliveryAttributesToResponseContextTest extends BaseOIDCRes
stringAttributeValues3.add(new StringAttributeValue("value3"));
attribute3.setValues(stringAttributeValues3);
- // Attribute having no encoder
+ // Attribute not to be encoded
final IdPAttribute attribute4 = new IdPAttribute("test4");
final List<IdPAttributeValue> stringAttributeValues4 = new ArrayList<>();
stringAttributeValues4.add(new StringAttributeValue("value4"));
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list