[java-idp-oidc] 06/06: JOIDC-5 Improved unit testing.
Henri Mikkonen
henri.mikkonen at iki.fi
Fri Jun 26 13:31:05 UTC 2020
This is an automated email from the git hooks/post-receive script.
hjmikkon pushed a commit to branch dev/JOIDC-5
in repository java-idp-oidc.
View the commit online:
http://git.shibboleth.net/view/?p=java-idp-oidc.git;a=commit;h=62c4b7ad7e47c10b4d25a8c52729fa69cdb887d0
commit 62c4b7ad7e47c10b4d25a8c52729fa69cdb887d0
Author: Henri Mikkonen <henri.mikkonen at iki.fi>
AuthorDate: Fri Jun 26 16:30:40 2020 +0300
JOIDC-5 Improved unit testing.
https://issues.shibboleth.net/jira/browse/JOIDC-5
---
.../impl/ClientInformationNodeProcessorTest.java | 136 ++++++++++++++++-----
.../impl/EntitiesDescriptor-with-oidcmd.xml | 37 +++++-
2 files changed, 136 insertions(+), 37 deletions(-)
diff --git a/idp-oidc-extension-impl/src/test/java/org/geant/idpextension/oidc/metadata/impl/ClientInformationNodeProcessorTest.java b/idp-oidc-extension-impl/src/test/java/org/geant/idpextension/oidc/metadata/impl/ClientInformationNodeProcessorTest.java
index 98b065a7..12dc5af8 100644
--- a/idp-oidc-extension-impl/src/test/java/org/geant/idpextension/oidc/metadata/impl/ClientInformationNodeProcessorTest.java
+++ b/idp-oidc-extension-impl/src/test/java/org/geant/idpextension/oidc/metadata/impl/ClientInformationNodeProcessorTest.java
@@ -17,9 +17,12 @@
package org.geant.idpextension.oidc.metadata.impl;
import java.io.File;
+import java.net.URI;
+import java.net.URISyntaxException;
import java.net.URL;
import java.util.ArrayList;
import java.util.List;
+import java.util.Set;
import org.geant.idpextension.keyinfo.ext.impl.provider.ClientSecretProvider;
import org.geant.idpextension.keyinfo.ext.impl.provider.InlineJwksProvider;
@@ -39,34 +42,42 @@ import org.opensaml.xmlsec.keyinfo.impl.provider.DSAKeyValueProvider;
import org.opensaml.xmlsec.keyinfo.impl.provider.InlineX509DataProvider;
import org.opensaml.xmlsec.keyinfo.impl.provider.RSAKeyValueProvider;
import org.testng.Assert;
-import org.testng.annotations.BeforeMethod;
import org.testng.annotations.Test;
+import com.nimbusds.jose.EncryptionMethod;
+import com.nimbusds.jose.JWEAlgorithm;
+import com.nimbusds.jose.JWSAlgorithm;
+import com.nimbusds.jose.jwk.JWKSet;
+import com.nimbusds.oauth2.sdk.GrantType;
+import com.nimbusds.oauth2.sdk.ParseException;
+import com.nimbusds.oauth2.sdk.ResponseType;
+import com.nimbusds.oauth2.sdk.Scope;
+import com.nimbusds.oauth2.sdk.auth.ClientAuthenticationMethod;
+import com.nimbusds.openid.connect.sdk.SubjectType;
+import com.nimbusds.openid.connect.sdk.claims.ACR;
+import com.nimbusds.openid.connect.sdk.rp.ApplicationType;
import com.nimbusds.openid.connect.sdk.rp.OIDCClientInformation;
+import com.nimbusds.openid.connect.sdk.rp.OIDCClientMetadata;
+import net.shibboleth.utilities.java.support.component.ComponentInitializationException;
import net.shibboleth.utilities.java.support.resolver.CriteriaSet;
import net.shibboleth.utilities.java.support.resolver.ResolverException;
+/**
+ * Unit tests for {@link ClientInformationNodeProcessor}.
+ */
public class ClientInformationNodeProcessorTest extends XMLObjectBaseTestCase {
-
- private String mdFileName;
- private FilesystemMetadataResolver mdProvider;
-
- private PredicateRoleDescriptorResolver roleResolver;
-
- @BeforeMethod
- protected void setUp() throws Exception {
- mdFileName = "/org/geant/idpextension/oidc/metadata/impl/EntitiesDescriptor-with-oidcmd.xml";
+ protected RoleDescriptor parseRoleDescriptor(final String mdFileName)
+ throws ResolverException, ComponentInitializationException, URISyntaxException {
+ final URL mdURL = ClientInformationNodeProcessorTest.class.getResource(mdFileName);
+ final File mdFile = new File(mdURL.toURI());
- URL mdURL = ClientInformationNodeProcessorTest.class.getResource(mdFileName);
- File mdFile = new File(mdURL.toURI());
-
- mdProvider = new FilesystemMetadataResolver(mdFile);
+ final FilesystemMetadataResolver mdProvider = new FilesystemMetadataResolver(mdFile);
mdProvider.setParserPool(parserPool);
mdProvider.setId("test");
- NodeProcessingMetadataFilter filter = new NodeProcessingMetadataFilter();
- List<KeyInfoProvider> providers = new ArrayList<>();
+ final NodeProcessingMetadataFilter filter = new NodeProcessingMetadataFilter();
+ final List<KeyInfoProvider> providers = new ArrayList<>();
providers.add(new DSAKeyValueProvider());
providers.add(new RSAKeyValueProvider());
providers.add(new InlineX509DataProvider());
@@ -74,37 +85,100 @@ public class ClientInformationNodeProcessorTest extends XMLObjectBaseTestCase {
providers.add(new JWKSReferenceProvider());
providers.add(new ClientSecretProvider());
- List<MetadataNodeProcessor> processors = new ArrayList<>();
+ final List<MetadataNodeProcessor> processors = new ArrayList<>();
processors.add(new ClientInformationNodeProcessor(providers));
filter.setNodeProcessors(processors);
filter.initialize();
mdProvider.setMetadataFilter(filter);
mdProvider.initialize();
- roleResolver = new PredicateRoleDescriptorResolver(mdProvider);
+ final PredicateRoleDescriptorResolver roleResolver = new PredicateRoleDescriptorResolver(mdProvider);
roleResolver.initialize();
+ return roleResolver.resolveSingle(new CriteriaSet(
+ new EntityIdCriterion("mockSamlClientId"),
+ new EntityRoleCriterion(SPSSODescriptor.DEFAULT_ELEMENT_NAME),
+ new ProtocolCriterion("http://openid.net/specs/openid-connect-core-1_0.html")));
}
- // Success cases
-
- /**
- * Test valid index.
- * @throws ResolverException
- */
@Test
- public void testWithValidIndex() throws ResolverException {
- RoleDescriptor role = roleResolver.resolveSingle(new CriteriaSet(
- new EntityIdCriterion("mockSamlClientId"),
- new EntityRoleCriterion(SPSSODescriptor.DEFAULT_ELEMENT_NAME),
- new ProtocolCriterion("http://openid.net/specs/openid-connect-core-1_0.html")));
+ public void testParsedXMLMetadata() throws ResolverException, ComponentInitializationException,
+ URISyntaxException, ParseException {
+ final RoleDescriptor role =
+ parseRoleDescriptor("/org/geant/idpextension/oidc/metadata/impl/EntitiesDescriptor-with-oidcmd.xml");
Assert.assertNotNull(role);
+ Assert.assertTrue(role instanceof SPSSODescriptor);
final SPSSODescriptor sp = (SPSSODescriptor) role;
final List<OIDCClientInformation> clientInformations = sp.getObjectMetadata().get(OIDCClientInformation.class);
Assert.assertNotNull(clientInformations);
Assert.assertEquals(clientInformations.size(), 1);
- Assert.assertEquals(clientInformations.get(0).getID().getValue(), "mockSamlClientId");
- Assert.assertEquals(clientInformations.get(0).getOIDCMetadata().getRedirectionURIs().size(), 2);
+ final OIDCClientInformation clientInformation = clientInformations.get(0);
+ Assert.assertEquals(clientInformation.getID().getValue(), "mockSamlClientId");
+ final OIDCClientMetadata metadata = clientInformation.getOIDCMetadata();
+
+ Assert.assertEquals(metadata.getApplicationType(), ApplicationType.WEB);
+ Assert.assertEquals(metadata.getURI(), new URI("https://example.org/clientUri"));
+
+ final List<ACR> defaultAcrs = metadata.getDefaultACRs();
+ Assert.assertEquals(defaultAcrs.size(), 2);
+ Assert.assertTrue(defaultAcrs.contains(new ACR("password")));
+ Assert.assertTrue(defaultAcrs.contains(new ACR("mfa")));
+
+ final Set<GrantType> grantTypes = metadata.getGrantTypes();
+ Assert.assertEquals(grantTypes.size(), 1);
+ Assert.assertEquals(grantTypes.iterator().next(), GrantType.AUTHORIZATION_CODE);
+
+ Assert.assertEquals(metadata.getIDTokenJWEAlg(), JWEAlgorithm.A256KW);
+ Assert.assertEquals(metadata.getIDTokenJWEEnc(), EncryptionMethod.A256GCM);
+ Assert.assertEquals(metadata.getIDTokenJWSAlg(), JWSAlgorithm.RS512);
+
+ Assert.assertEquals(metadata.getInitiateLoginURI(), new URI("https://example.org/initiateLogin"));
+
+ final Set<URI> postLogoutUris = metadata.getPostLogoutRedirectionURIs();
+ Assert.assertEquals(postLogoutUris.size(), 1);
+ Assert.assertEquals(postLogoutUris.iterator().next(), new URI("https://example.org/postLogout"));
+
+ Assert.assertEquals(metadata.getRequestObjectJWEAlg(), JWEAlgorithm.A128KW);
+ Assert.assertEquals(metadata.getRequestObjectJWEEnc(), EncryptionMethod.A128GCM);
+ Assert.assertEquals(metadata.getRequestObjectJWSAlg(), JWSAlgorithm.RS256);
+
+ final Set<URI> requestUris = metadata.getRequestObjectURIs();
+ Assert.assertEquals(requestUris.size(), 1);
+ Assert.assertEquals(requestUris.iterator().next(), new URI("https://example.org/request"));
+
+ final Set<ResponseType> responseTypes = metadata.getResponseTypes();
+ Assert.assertEquals(responseTypes.size(), 2);
+ Assert.assertTrue(responseTypes.contains(ResponseType.parse("code")));
+ Assert.assertTrue(responseTypes.contains(ResponseType.parse("id_token")));
+
+ final Scope scope = metadata.getScope();
+ Assert.assertEquals(scope.size(), 2);
+ Assert.assertTrue(scope.contains("openid"));
+ Assert.assertTrue(scope.contains("profile"));
+
+ Assert.assertEquals(metadata.getSectorIDURI(), new URI("https://example.org/sectorIdentifier"));
+ Assert.assertEquals(metadata.getSoftwareID().getValue(), "mockSoftwareId");
+ Assert.assertEquals(metadata.getSoftwareVersion().getValue(), "mockSoftwareVersion");
+ Assert.assertEquals(metadata.getTokenEndpointAuthMethod(), ClientAuthenticationMethod.CLIENT_SECRET_BASIC);
+ Assert.assertEquals(metadata.getTokenEndpointAuthJWSAlg(), JWSAlgorithm.RS512);
+
+ Assert.assertEquals(metadata.getUserInfoJWEAlg(), JWEAlgorithm.A192KW);
+ Assert.assertEquals(metadata.getUserInfoJWEEnc(), EncryptionMethod.A192GCM);
+ Assert.assertEquals(metadata.getUserInfoJWSAlg(), JWSAlgorithm.RS384);
+
+ final JWKSet jwkSet = metadata.getJWKSet();
+ Assert.assertEquals(jwkSet.getKeys().size(), 4);
+ Assert.assertNotNull(jwkSet.getKeyByKeyId("mock"));
+ Assert.assertNotNull(jwkSet.getKeyByKeyId("mockRSA"));
+ Assert.assertNotNull(jwkSet.getKeyByKeyId("mockX509RSA"));
+ Assert.assertNotNull(jwkSet.getKeyByKeyId("mockX509EC"));
+
+ final Set<URI> redirectUris = metadata.getRedirectionURIs();
+ Assert.assertEquals(redirectUris.size(), 2);
+ Assert.assertTrue(redirectUris.contains(new URI("https://example.org/cb")));
+ Assert.assertTrue(redirectUris.contains(new URI("https://example.org/cb2")));
+
+ Assert.assertEquals(metadata.getSubjectType(), SubjectType.PAIRWISE);
}
}
diff --git a/idp-oidc-extension-impl/src/test/resources/org/geant/idpextension/oidc/metadata/impl/EntitiesDescriptor-with-oidcmd.xml b/idp-oidc-extension-impl/src/test/resources/org/geant/idpextension/oidc/metadata/impl/EntitiesDescriptor-with-oidcmd.xml
index ef0a2153..d813391a 100644
--- a/idp-oidc-extension-impl/src/test/resources/org/geant/idpextension/oidc/metadata/impl/EntitiesDescriptor-with-oidcmd.xml
+++ b/idp-oidc-extension-impl/src/test/resources/org/geant/idpextension/oidc/metadata/impl/EntitiesDescriptor-with-oidcmd.xml
@@ -6,6 +6,7 @@
<md:SPSSODescriptor xmlns:oidcmd="urn:mace:shibboleth:metadata:oidc:1.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" protocolSupportEnumeration="http://openid.net/specs/openid-connect-core-1_0.html">
<md:KeyDescriptor use="signing">
<ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
+ <ds:KeyName>mockX509RSA</ds:KeyName>
<ds:X509Data>
<ds:X509Certificate>
MIIEQDCCAqigAwIBAgIVAIarXvdvyS47KJR7U40FlTufyD8vMA0GCSqGSIb3DQEB
@@ -35,8 +36,8 @@
</ds:KeyInfo>
</md:KeyDescriptor>
<md:KeyDescriptor use="signing">
- <ds:KeyInfo
- xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
+ <ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
+ <ds:KeyName>mockX509EC</ds:KeyName>
<ds:X509Data>
<ds:X509Certificate>
MIIBKDCBzgIJAOYlspXlaqguMAoGCCqGSM49BAMCMBwxCzAJBgNVBAYTAkZJMQ0w
@@ -51,7 +52,7 @@
</md:KeyDescriptor>
<md:KeyDescriptor use="signing">
<ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
- <ds:KeyName>Foo</ds:KeyName>
+ <ds:KeyName>mockRSA</ds:KeyName>
<ds:KeyValue>
<ds:RSAKeyValue>
<ds:Modulus>
@@ -93,12 +94,32 @@
</md:KeyDescriptor>
<md:Extensions>
<oidcmd:OAuthRPExtensions>
+ <oidcmd:ApplicationType>web</oidcmd:ApplicationType>
+ <oidcmd:ClientUri>https://example.org/clientUri</oidcmd:ClientUri>
+ <oidcmd:DefaultAcrValue>password</oidcmd:DefaultAcrValue>
+ <oidcmd:DefaultAcrValue>mfa</oidcmd:DefaultAcrValue>
<oidcmd:GrantType>authorization_code</oidcmd:GrantType>
+ <oidcmd:IdTokenEncryptionResponseAlg>A256KW</oidcmd:IdTokenEncryptionResponseAlg>
+ <oidcmd:IdTokenEncryptionResponseEnc>A256GCM</oidcmd:IdTokenEncryptionResponseEnc>
+ <oidcmd:IdTokenSignedResponseAlg>RS512</oidcmd:IdTokenSignedResponseAlg>
+ <oidcmd:InitiateLoginUri>https://example.org/initiateLogin</oidcmd:InitiateLoginUri>
+ <oidcmd:PostLogoutRedirectUri>https://example.org/postLogout</oidcmd:PostLogoutRedirectUri>
+ <oidcmd:RequestObjectEncryptionResponseAlg>A128KW</oidcmd:RequestObjectEncryptionResponseAlg>
+ <oidcmd:RequestObjectEncryptionResponseEnc>A128GCM</oidcmd:RequestObjectEncryptionResponseEnc>
+ <oidcmd:RequestObjectSignedResponseAlg>RS256</oidcmd:RequestObjectSignedResponseAlg>
+ <oidcmd:RequestUri>https://example.org/request</oidcmd:RequestUri>
<oidcmd:ResponseType>code</oidcmd:ResponseType>
- <oidcmd:ApplicationType>web</oidcmd:ApplicationType>
- <oidcmd:TokenEndpointAuthMethod>client_secret_basic</oidcmd:TokenEndpointAuthMethod>
+ <oidcmd:ResponseType>id_token</oidcmd:ResponseType>
<oidcmd:Scope>openid</oidcmd:Scope>
<oidcmd:Scope>profile</oidcmd:Scope>
+ <oidcmd:SectorIdentifierUri>https://example.org/sectorIdentifier</oidcmd:SectorIdentifierUri>
+ <oidcmd:SoftwareId>mockSoftwareId</oidcmd:SoftwareId>
+ <oidcmd:SoftwareVersion>mockSoftwareVersion</oidcmd:SoftwareVersion>
+ <oidcmd:TokenEndpointAuthMethod>client_secret_basic</oidcmd:TokenEndpointAuthMethod>
+ <oidcmd:TokenEndpointAuthSigningAlg>RS512</oidcmd:TokenEndpointAuthSigningAlg>
+ <oidcmd:UserInfoEncryptionResponseAlg>A192KW</oidcmd:UserInfoEncryptionResponseAlg>
+ <oidcmd:UserInfoEncryptionResponseEnc>A192GCM</oidcmd:UserInfoEncryptionResponseEnc>
+ <oidcmd:UserInfoSignedResponseAlg>RS384</oidcmd:UserInfoSignedResponseAlg>
</oidcmd:OAuthRPExtensions>
</md:Extensions>
<md:AssertionConsumerService
@@ -109,7 +130,11 @@
Binding="http://csc.fi/ns/profiles/oidc/sso/browser"
Location="https://example.org/cb2"
index="2"/>
- <md:NameIDFormat>public</md:NameIDFormat>
+ <md:AssertionConsumerService
+ Binding="http://example.org/not/supported/profile/id"
+ Location="https://example.org/cb3"
+ index="3"/>
+ <md:NameIDFormat>pairwise</md:NameIDFormat>
</md:SPSSODescriptor>
</md:EntityDescriptor>
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list