[java-idp-oidc] 37/44: JOIDC-5 Added schema validation to test and updated test descriptor.
Henri Mikkonen
henri.mikkonen at iki.fi
Thu Oct 22 13:08:49 UTC 2020
This is an automated email from the git hooks/post-receive script.
hjmikkon pushed a commit to branch main
in repository java-idp-oidc.
View the commit online:
http://git.shibboleth.net/view/?p=java-idp-oidc.git;a=commit;h=75ebb9e9efb9eefd1c318af1c5981674737ff1ef
commit 75ebb9e9efb9eefd1c318af1c5981674737ff1ef
Author: Henri Mikkonen <henri.mikkonen at iki.fi>
AuthorDate: Fri Sep 18 15:36:57 2020 +0300
JOIDC-5 Added schema validation to test and updated test descriptor.
https://issues.shibboleth.net/jira/browse/JOIDC-5
---
.../impl/ClientInformationNodeProcessorTest.java | 34 ++++++++++--
.../impl/EntitiesDescriptor-with-oidcmd.xml | 63 +++++++++++-----------
2 files changed, 63 insertions(+), 34 deletions(-)
diff --git a/idp-oidc-extension-impl/src/test/java/org/geant/idpextension/oidc/metadata/impl/ClientInformationNodeProcessorTest.java b/idp-oidc-extension-impl/src/test/java/org/geant/idpextension/oidc/metadata/impl/ClientInformationNodeProcessorTest.java
index 12dc5af8..8956c211 100644
--- a/idp-oidc-extension-impl/src/test/java/org/geant/idpextension/oidc/metadata/impl/ClientInformationNodeProcessorTest.java
+++ b/idp-oidc-extension-impl/src/test/java/org/geant/idpextension/oidc/metadata/impl/ClientInformationNodeProcessorTest.java
@@ -17,10 +17,12 @@
package org.geant.idpextension.oidc.metadata.impl;
import java.io.File;
+import java.io.IOException;
import java.net.URI;
import java.net.URISyntaxException;
import java.net.URL;
import java.util.ArrayList;
+import java.util.Collection;
import java.util.List;
import java.util.Set;
@@ -29,10 +31,13 @@ import org.geant.idpextension.keyinfo.ext.impl.provider.InlineJwksProvider;
import org.geant.idpextension.keyinfo.ext.impl.provider.JWKSReferenceProvider;
import org.opensaml.core.criterion.EntityIdCriterion;
import org.opensaml.core.xml.XMLObjectBaseTestCase;
+import org.opensaml.saml.common.xml.SAMLSchemaBuilder;
import org.opensaml.saml.criterion.EntityRoleCriterion;
import org.opensaml.saml.criterion.ProtocolCriterion;
+import org.opensaml.saml.metadata.resolver.filter.MetadataFilterChain;
import org.opensaml.saml.metadata.resolver.filter.MetadataNodeProcessor;
import org.opensaml.saml.metadata.resolver.filter.impl.NodeProcessingMetadataFilter;
+import org.opensaml.saml.metadata.resolver.filter.impl.SchemaValidationFilter;
import org.opensaml.saml.metadata.resolver.impl.FilesystemMetadataResolver;
import org.opensaml.saml.metadata.resolver.impl.PredicateRoleDescriptorResolver;
import org.opensaml.saml.saml2.metadata.RoleDescriptor;
@@ -41,6 +46,7 @@ import org.opensaml.xmlsec.keyinfo.impl.KeyInfoProvider;
import org.opensaml.xmlsec.keyinfo.impl.provider.DSAKeyValueProvider;
import org.opensaml.xmlsec.keyinfo.impl.provider.InlineX509DataProvider;
import org.opensaml.xmlsec.keyinfo.impl.provider.RSAKeyValueProvider;
+import org.springframework.core.io.ClassPathResource;
import org.testng.Assert;
import org.testng.annotations.Test;
@@ -59,9 +65,12 @@ import com.nimbusds.openid.connect.sdk.rp.ApplicationType;
import com.nimbusds.openid.connect.sdk.rp.OIDCClientInformation;
import com.nimbusds.openid.connect.sdk.rp.OIDCClientMetadata;
+import net.shibboleth.ext.spring.resource.ResourceHelper;
import net.shibboleth.utilities.java.support.component.ComponentInitializationException;
import net.shibboleth.utilities.java.support.resolver.CriteriaSet;
import net.shibboleth.utilities.java.support.resolver.ResolverException;
+import net.shibboleth.utilities.java.support.resource.Resource;
+import net.shibboleth.utilities.java.support.xml.SchemaBuilder;
/**
* Unit tests for {@link ClientInformationNodeProcessor}.
@@ -69,13 +78,14 @@ import net.shibboleth.utilities.java.support.resolver.ResolverException;
public class ClientInformationNodeProcessorTest extends XMLObjectBaseTestCase {
protected RoleDescriptor parseRoleDescriptor(final String mdFileName)
- throws ResolverException, ComponentInitializationException, URISyntaxException {
+ throws ResolverException, ComponentInitializationException, URISyntaxException, IOException {
final URL mdURL = ClientInformationNodeProcessorTest.class.getResource(mdFileName);
final File mdFile = new File(mdURL.toURI());
final FilesystemMetadataResolver mdProvider = new FilesystemMetadataResolver(mdFile);
mdProvider.setParserPool(parserPool);
mdProvider.setId("test");
+ final MetadataFilterChain filterChain = new MetadataFilterChain();
final NodeProcessingMetadataFilter filter = new NodeProcessingMetadataFilter();
final List<KeyInfoProvider> providers = new ArrayList<>();
providers.add(new DSAKeyValueProvider());
@@ -89,7 +99,9 @@ public class ClientInformationNodeProcessorTest extends XMLObjectBaseTestCase {
processors.add(new ClientInformationNodeProcessor(providers));
filter.setNodeProcessors(processors);
filter.initialize();
- mdProvider.setMetadataFilter(filter);
+ filterChain.getFilters().add(buildSchemaValidationFilter());
+ filterChain.getFilters().add(filter);
+ mdProvider.setMetadataFilter(filterChain);
mdProvider.initialize();
final PredicateRoleDescriptorResolver roleResolver = new PredicateRoleDescriptorResolver(mdProvider);
@@ -101,9 +113,25 @@ public class ClientInformationNodeProcessorTest extends XMLObjectBaseTestCase {
}
+ protected SchemaValidationFilter buildSchemaValidationFilter() {
+ final SAMLSchemaBuilder samlSchemaBuilder = new SAMLSchemaBuilder(SAMLSchemaBuilder.SAML1Version.SAML_11);
+ final SchemaBuilder schemaBuilder = new SchemaBuilder();
+ schemaBuilder.setResourceResolver(new net.shibboleth.utilities.java.support.xml.ClasspathResolver());
+ final Collection<Resource> schemaResources = new ArrayList<>();
+ schemaResources.add(ResourceHelper.of(
+ new ClassPathResource(org.opensaml.saml.common.xml.SAMLConstants.XMLSIG_SCHEMA_LOCATION)));
+ schemaResources.add(ResourceHelper.of(
+ new ClassPathResource(net.shibboleth.idp.saml.xmlobject.ExtensionsConstants.
+ SHIB_MDEXT10_SCHEMA_LOCATION)));
+ schemaResources.add(ResourceHelper.of(new ClassPathResource("/schema/saml-metadata-ext-oidcmd.xsd")));
+ schemaBuilder.setSchemaResources(schemaResources);
+ samlSchemaBuilder.setSchemaBuilder(schemaBuilder);
+ return new SchemaValidationFilter(samlSchemaBuilder);
+ }
+
@Test
public void testParsedXMLMetadata() throws ResolverException, ComponentInitializationException,
- URISyntaxException, ParseException {
+ URISyntaxException, ParseException, IOException {
final RoleDescriptor role =
parseRoleDescriptor("/org/geant/idpextension/oidc/metadata/impl/EntitiesDescriptor-with-oidcmd.xml");
Assert.assertNotNull(role);
diff --git a/idp-oidc-extension-impl/src/test/resources/org/geant/idpextension/oidc/metadata/impl/EntitiesDescriptor-with-oidcmd.xml b/idp-oidc-extension-impl/src/test/resources/org/geant/idpextension/oidc/metadata/impl/EntitiesDescriptor-with-oidcmd.xml
index 44c2953e..1e3195d4 100644
--- a/idp-oidc-extension-impl/src/test/resources/org/geant/idpextension/oidc/metadata/impl/EntitiesDescriptor-with-oidcmd.xml
+++ b/idp-oidc-extension-impl/src/test/resources/org/geant/idpextension/oidc/metadata/impl/EntitiesDescriptor-with-oidcmd.xml
@@ -4,6 +4,37 @@
<md:EntityDescriptor entityID="mockSamlClientId">
<md:SPSSODescriptor xmlns:oidcmd="urn:mace:shibboleth:metadata:oidc:1.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" protocolSupportEnumeration="http://openid.net/specs/openid-connect-core-1_0.html">
+ <md:Extensions>
+ <oidcmd:OAuthRPExtensions>
+ <oidcmd:ApplicationType>web</oidcmd:ApplicationType>
+ <oidcmd:ClientUri>https://example.org/clientUri</oidcmd:ClientUri>
+ <oidcmd:DefaultAcrValue>password</oidcmd:DefaultAcrValue>
+ <oidcmd:DefaultAcrValue>mfa</oidcmd:DefaultAcrValue>
+ <oidcmd:GrantType>authorization_code</oidcmd:GrantType>
+ <oidcmd:IdTokenEncryptedResponseAlg>A256KW</oidcmd:IdTokenEncryptedResponseAlg>
+ <oidcmd:IdTokenEncryptedResponseEnc>A256GCM</oidcmd:IdTokenEncryptedResponseEnc>
+ <oidcmd:IdTokenSignedResponseAlg>RS512</oidcmd:IdTokenSignedResponseAlg>
+ <oidcmd:InitiateLoginUri>https://example.org/initiateLogin</oidcmd:InitiateLoginUri>
+ <oidcmd:PostLogoutRedirectUri>https://example.org/postLogout</oidcmd:PostLogoutRedirectUri>
+ <oidcmd:RequestObjectEncryptionAlg>A128KW</oidcmd:RequestObjectEncryptionAlg>
+ <oidcmd:RequestObjectEncryptionEnc>A128GCM</oidcmd:RequestObjectEncryptionEnc>
+ <oidcmd:RequestObjectSigningAlg>RS256</oidcmd:RequestObjectSigningAlg>
+ <oidcmd:RequestUri>https://example.org/request</oidcmd:RequestUri>
+ <oidcmd:ResponseType>code</oidcmd:ResponseType>
+ <oidcmd:ResponseType>id_token</oidcmd:ResponseType>
+ <oidcmd:Scope>openid</oidcmd:Scope>
+ <oidcmd:Scope>profile</oidcmd:Scope>
+ <oidcmd:SoftwareId>mockSoftwareId</oidcmd:SoftwareId>
+ <oidcmd:SoftwareVersion>mockSoftwareVersion</oidcmd:SoftwareVersion>
+ <oidcmd:TokenEndpointAuthMethod>client_secret_basic</oidcmd:TokenEndpointAuthMethod>
+ <oidcmd:TokenEndpointAuthSigningAlg>RS512</oidcmd:TokenEndpointAuthSigningAlg>
+ <oidcmd:UserInfoEncryptedResponseAlg>A192KW</oidcmd:UserInfoEncryptedResponseAlg>
+ <oidcmd:SectorIdentifierUri>https://example.org/sectorIdentifier</oidcmd:SectorIdentifierUri>
+ <oidcmd:UserInfoEncryptedResponseEnc>A192GCM</oidcmd:UserInfoEncryptedResponseEnc>
+ <oidcmd:UserInfoSignedResponseAlg>RS384</oidcmd:UserInfoSignedResponseAlg>
+ </oidcmd:OAuthRPExtensions>
+ </md:Extensions>
+
<md:KeyDescriptor use="signing">
<ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
<ds:KeyName>mockX509RSA</ds:KeyName>
@@ -92,36 +123,7 @@
<oidcmd:ClientSecret>mockClientSecretValue</oidcmd:ClientSecret>
</ds:KeyInfo>
</md:KeyDescriptor>
- <md:Extensions>
- <oidcmd:OAuthRPExtensions>
- <oidcmd:ApplicationType>web</oidcmd:ApplicationType>
- <oidcmd:ClientUri>https://example.org/clientUri</oidcmd:ClientUri>
- <oidcmd:DefaultAcrValue>password</oidcmd:DefaultAcrValue>
- <oidcmd:DefaultAcrValue>mfa</oidcmd:DefaultAcrValue>
- <oidcmd:GrantType>authorization_code</oidcmd:GrantType>
- <oidcmd:IdTokenEncryptionResponseAlg>A256KW</oidcmd:IdTokenEncryptionResponseAlg>
- <oidcmd:IdTokenEncryptionResponseEnc>A256GCM</oidcmd:IdTokenEncryptionResponseEnc>
- <oidcmd:IdTokenSignedResponseAlg>RS512</oidcmd:IdTokenSignedResponseAlg>
- <oidcmd:InitiateLoginUri>https://example.org/initiateLogin</oidcmd:InitiateLoginUri>
- <oidcmd:PostLogoutRedirectUri>https://example.org/postLogout</oidcmd:PostLogoutRedirectUri>
- <oidcmd:RequestObjectEncryptionAlg>A128KW</oidcmd:RequestObjectEncryptionAlg>
- <oidcmd:RequestObjectEncryptionEnc>A128GCM</oidcmd:RequestObjectEncryptionEnc>
- <oidcmd:RequestObjectSigningAlg>RS256</oidcmd:RequestObjectSigningAlg>
- <oidcmd:RequestUri>https://example.org/request</oidcmd:RequestUri>
- <oidcmd:ResponseType>code</oidcmd:ResponseType>
- <oidcmd:ResponseType>id_token</oidcmd:ResponseType>
- <oidcmd:Scope>openid</oidcmd:Scope>
- <oidcmd:Scope>profile</oidcmd:Scope>
- <oidcmd:SectorIdentifierUri>https://example.org/sectorIdentifier</oidcmd:SectorIdentifierUri>
- <oidcmd:SoftwareId>mockSoftwareId</oidcmd:SoftwareId>
- <oidcmd:SoftwareVersion>mockSoftwareVersion</oidcmd:SoftwareVersion>
- <oidcmd:TokenEndpointAuthMethod>client_secret_basic</oidcmd:TokenEndpointAuthMethod>
- <oidcmd:TokenEndpointAuthSigningAlg>RS512</oidcmd:TokenEndpointAuthSigningAlg>
- <oidcmd:UserInfoEncryptionResponseAlg>A192KW</oidcmd:UserInfoEncryptionResponseAlg>
- <oidcmd:UserInfoEncryptionResponseEnc>A192GCM</oidcmd:UserInfoEncryptionResponseEnc>
- <oidcmd:UserInfoSignedResponseAlg>RS384</oidcmd:UserInfoSignedResponseAlg>
- </oidcmd:OAuthRPExtensions>
- </md:Extensions>
+ <md:NameIDFormat>pairwise</md:NameIDFormat>
<md:AssertionConsumerService
Binding="https://tools.ietf.org/html/rfc6749#section-3.1.2"
Location="https://example.org/cb"
@@ -134,7 +136,6 @@
Binding="http://example.org/not/supported/profile/id"
Location="https://example.org/cb3"
index="3"/>
- <md:NameIDFormat>pairwise</md:NameIDFormat>
</md:SPSSODescriptor>
</md:EntityDescriptor>
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list