[java-idp-oidc] branch main updated: JOIDC-52 Uncaught exception in OIDC extension
Henri Mikkonen
henri.mikkonen at iki.fi
Fri Aug 13 14:10:15 UTC 2021
This is an automated email from the git hooks/post-receive script.
hjmikkon pushed a commit to branch main
in repository java-idp-oidc.
View the commit online:
http://git.shibboleth.net/view/?p=java-idp-oidc.git;a=commit;h=e2a07d50412a157d6a9993a5a7cfd9cab37bc5e8
The following commit(s) were added to refs/heads/main by this push:
new e2a07d50 JOIDC-52 Uncaught exception in OIDC extension
e2a07d50 is described below
commit e2a07d50412a157d6a9993a5a7cfd9cab37bc5e8
Author: Henri Mikkonen <henri.mikkonen at iki.fi>
AuthorDate: Fri Aug 13 17:04:35 2021 +0300
JOIDC-52 Uncaught exception in OIDC extension
https://shibboleth.atlassian.net/browse/JOIDC-52
TokenClaimsSet.isConsentEnabled() was not compatible with the tokens
produced by the earlier (V1 and V2) versions of the OIDC extension. It
was requiring a "csnt" claim to exist in the tokens: nowadays it always
does but before it never did. The method was fixed, but also all the flow
tests (token, userinfo, introspection and revocation) dealing with the
tokens (authorization code, access token or refresh token) were improved
to verify the interoperability with the "legacy" tokens.
---
.../oidc/op/token/support/TokenClaimsSet.java | 18 +++--
.../op/profile/flow/AbstractOidcApiFlowTest.java | 16 +++-
.../oidc/op/profile/flow/AbstractOidcFlowTest.java | 28 ++++++-
.../op/profile/flow/IntrospectionFlowTest.java | 28 +++++++
.../oidc/op/profile/flow/RevocationFlowTest.java | 23 ++++++
.../plugin/oidc/op/profile/flow/TokenFlowTest.java | 93 +++++++++++++++++++++-
.../plugin/oidc/op/profile/flow/UserInfoTest.java | 73 ++++++++++++++++-
7 files changed, 267 insertions(+), 12 deletions(-)
diff --git a/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/token/support/TokenClaimsSet.java b/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/token/support/TokenClaimsSet.java
index 0124c4eb..0d8cb9a2 100644
--- a/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/token/support/TokenClaimsSet.java
+++ b/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/token/support/TokenClaimsSet.java
@@ -487,13 +487,19 @@ public class TokenClaimsSet {
* @return whether consent has been enabled
*/
public boolean isConsentEnabled() {
- try {
- return tokenClaimsSet.getBooleanClaim(KEY_CONSENT_ENABLED).booleanValue();
- } catch (final ParseException e) {
- log.error("Error parsing scope in request {}", tokenClaimsSet.getClaim(KEY_CONSENT_ENABLED));
- // should never happen, programming error.
- return false;
+ if (tokenClaimsSet.getClaim(KEY_CONSENT_ENABLED) != null) {
+ try {
+ return tokenClaimsSet.getBooleanClaim(KEY_CONSENT_ENABLED).booleanValue();
+ } catch (final ParseException e) {
+ log.error("Error parsing scope in request {}", tokenClaimsSet.getClaim(KEY_CONSENT_ENABLED));
+ // should never happen, programming error.
+ return false;
+ }
+ }
+ if (tokenClaimsSet.getClaim(KEY_CONSENTED_CLAIMS) != null) {
+ return true;
}
+ return false;
}
/**
diff --git a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/AbstractOidcApiFlowTest.java b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/AbstractOidcApiFlowTest.java
index 7f88879e..7f737cad 100644
--- a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/AbstractOidcApiFlowTest.java
+++ b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/AbstractOidcApiFlowTest.java
@@ -47,14 +47,28 @@ public class AbstractOidcApiFlowTest extends AbstractOidcFlowTest {
return buildToken(clientId, subject, scope, null);
}
+ protected BearerAccessToken buildLegacyToken(final String clientId, final String subject, final Scope scope,
+ String... consentedClaims)
+ throws URISyntaxException, NoSuchAlgorithmException, DataSealerException, ComponentInitializationException {
+ return buildLegacyToken(clientId, subject, scope, null, consentedClaims);
+ }
+
protected BearerAccessToken buildToken(final String clientId, final String subject, final Scope scope,
final ClaimsSet userInfoDeliverySet)
throws URISyntaxException, NoSuchAlgorithmException, DataSealerException, ComponentInitializationException {
TokenClaimsSet claims = new AccessTokenClaimsSet.Builder(idGenerator, new ClientID(clientId),
"https://op.example.org",
"jdoe", subject, Instant.now(), Instant.now().plusSeconds(30), Instant.now(),
- new URI("http://example.com"), scope).setDlClaimsUI(userInfoDeliverySet).build();
+ new URI("https://example.org/cb"), scope).setDlClaimsUI(userInfoDeliverySet).build();
return new BearerAccessToken(claims.serialize(BaseOIDCResponseActionTest.initializeDataSealer()));
}
+ protected BearerAccessToken buildLegacyToken(final String clientId, final String subject, final Scope scope,
+ final ClaimsSet userInfoDeliverySet, String... consentedClaims)
+ throws URISyntaxException, NoSuchAlgorithmException, DataSealerException, ComponentInitializationException {
+
+ final String json = buildJsonForLegacyToken(subject, clientId, scope, "at", consentedClaims);
+ return new BearerAccessToken(BaseOIDCResponseActionTest.initializeDataSealer().wrap(json,
+ Instant.now().plusSeconds(30)));
+ }
}
\ No newline at end of file
diff --git a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/AbstractOidcFlowTest.java b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/AbstractOidcFlowTest.java
index e08f2038..1accfa5d 100644
--- a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/AbstractOidcFlowTest.java
+++ b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/AbstractOidcFlowTest.java
@@ -20,6 +20,7 @@ package net.shibboleth.idp.plugin.oidc.op.profile.flow;
import java.io.IOException;
import java.net.URI;
import java.net.URISyntaxException;
+import java.time.Instant;
import java.util.Arrays;
import java.util.Date;
import java.util.HashSet;
@@ -165,7 +166,8 @@ public abstract class AbstractOidcFlowTest extends AbstractFlowTest {
final JWSAlgorithm userInfoSigAlg, final String... redirectUri)
throws IOException {
final OIDCClientMetadata metadata = new OIDCClientMetadata();
- metadata.setGrantTypes(new HashSet<GrantType>(Arrays.asList(GrantType.AUTHORIZATION_CODE)));
+ metadata.setGrantTypes(new HashSet<GrantType>(Arrays.asList(GrantType.AUTHORIZATION_CODE,
+ GrantType.REFRESH_TOKEN)));
final HashSet<URI> uris = new HashSet<>();
for (final String uri : redirectUri) {
try {
@@ -203,4 +205,28 @@ public abstract class AbstractOidcFlowTest extends AbstractFlowTest {
consented.append("]").toString(), System.currentTimeMillis() + (60 * 60 * 1000));
}
+ protected String buildJsonForLegacyToken(final String subject, final String clientId, final Scope scope,
+ final String type, final String... consentedClaims) {
+ final String consentClaims;
+ if (consentedClaims != null && consentedClaims.length > 0) {
+ final String jsonArray = "[\"" + String.join("\",\"", consentedClaims) + "\"]";
+ consentClaims = "\"cnsntd_claims\":" + jsonArray + ",\"cnsntbl_claims\":" + jsonArray + ",";
+ } else {
+ consentClaims = "";
+ }
+ return "{\"sub\":\"" + subject + "\"," + consentClaims +
+ "\"iss\":\"https:\\/\\/op.example.org\"," +
+ "\"clid\":\"" + clientId + "\"," +
+ "\"prncpl\":\"jdoe\"," +
+ "\"type\":\"" + type + "\"," +
+ "\"nonce\":\"j2hzbXZhqkNh8to0\"," +
+ "\"dl_claims_ui\":{}," +
+ "\"auth_time\":" + Instant.now().getEpochSecond() + "," +
+ "\"scope\":\"" + scope.toString() + "\"," +
+ "\"dl_claims\":{}," +
+ "\"redirect_uri\":\"https:\\/\\/example.org\\/cb\"," +
+ "\"exp\":" + Instant.now().plusSeconds(30).getEpochSecond() + "," +
+ "\"iat\":" + Instant.now().getEpochSecond() + "," +
+ "\"jti\":\"" + idGenerator.generateIdentifier() + "\"}";
+ }
}
diff --git a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/IntrospectionFlowTest.java b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/IntrospectionFlowTest.java
index b205d9e8..b38ceca1 100644
--- a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/IntrospectionFlowTest.java
+++ b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/IntrospectionFlowTest.java
@@ -97,6 +97,34 @@ public class IntrospectionFlowTest extends AbstractOidcApiFlowTest {
Assert.assertTrue(resp.isActive());
}
+ @Test
+ public void testSuccessWithLegacyToken() throws IOException, NoSuchAlgorithmException, URISyntaxException,
+ DataSealerException, ComponentInitializationException {
+ storeMetadata(storageService, clientId, clientSecret);
+ setBasicAuth(clientId, clientSecret);
+ setHttpFormRequest("POST", Collections.singletonMap("token",
+ super.buildLegacyToken(clientId, "sub",
+ Scope.parse("openid")).toJSONObject().getAsString("access_token")));
+ final FlowExecutionResult result = flowExecutor.launchExecution(FLOW_ID, null, externalContext);
+ TokenIntrospectionSuccessResponse resp = parseSuccessResponse(result, TokenIntrospectionSuccessResponse.class);
+ Assert.assertEquals(resp.getClientID().getValue(), clientId);
+ Assert.assertTrue(resp.isActive());
+ }
+
+ @Test
+ public void testSuccessWithLegacyConsentToken() throws IOException, NoSuchAlgorithmException, URISyntaxException,
+ DataSealerException, ComponentInitializationException {
+ storeMetadata(storageService, clientId, clientSecret);
+ setBasicAuth(clientId, clientSecret);
+ setHttpFormRequest("POST", Collections.singletonMap("token",
+ super.buildLegacyToken(clientId, "sub", Scope.parse("openid"),
+ "mail").toJSONObject().getAsString("access_token")));
+ final FlowExecutionResult result = flowExecutor.launchExecution(FLOW_ID, null, externalContext);
+ TokenIntrospectionSuccessResponse resp = parseSuccessResponse(result, TokenIntrospectionSuccessResponse.class);
+ Assert.assertEquals(resp.getClientID().getValue(), clientId);
+ Assert.assertTrue(resp.isActive());
+ }
+
@Test
public void testUnidentifiedToken() throws IOException, NoSuchAlgorithmException, URISyntaxException,
DataSealerException, ComponentInitializationException {
diff --git a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/RevocationFlowTest.java b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/RevocationFlowTest.java
index 627a1e73..626e3bf4 100644
--- a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/RevocationFlowTest.java
+++ b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/RevocationFlowTest.java
@@ -29,6 +29,7 @@ import org.springframework.webflow.executor.FlowExecutionResult;
import org.testng.annotations.BeforeMethod;
import org.testng.annotations.Test;
+import com.nimbusds.oauth2.sdk.ParseException;
import com.nimbusds.oauth2.sdk.Scope;
import net.shibboleth.idp.plugin.oidc.op.oauth2.messaging.impl.OAuth2RevocationSuccessResponse;
@@ -79,4 +80,26 @@ public class RevocationFlowTest extends AbstractOidcApiFlowTest {
final FlowExecutionResult result = flowExecutor.launchExecution(FLOW_ID, null, externalContext);
parseSuccessResponse(result, OAuth2RevocationSuccessResponse.class);
}
+
+ @Test
+ public void testSuccessWithLegacyToken() throws IOException, NoSuchAlgorithmException, URISyntaxException,
+ DataSealerException, ComponentInitializationException, ParseException {
+ setBasicAuth(clientId, clientSecret);
+ setHttpFormRequest("POST", Collections.singletonMap("token", super.buildLegacyToken(clientId, "sub",
+ Scope.parse("openid")).toJSONObject().getAsString("access_token")));
+ storeMetadata(storageService, clientId, clientSecret);
+ final FlowExecutionResult result = flowExecutor.launchExecution(FLOW_ID, null, externalContext);
+ parseSuccessResponse(result, OAuth2RevocationSuccessResponse.class);
+ }
+
+ @Test
+ public void testSuccessWithLegacyConsentToken() throws IOException, NoSuchAlgorithmException, URISyntaxException,
+ DataSealerException, ComponentInitializationException, ParseException {
+ setBasicAuth(clientId, clientSecret);
+ setHttpFormRequest("POST", Collections.singletonMap("token", super.buildLegacyToken(clientId, "sub",
+ Scope.parse("openid"), "mail").toJSONObject().getAsString("access_token")));
+ storeMetadata(storageService, clientId, clientSecret);
+ final FlowExecutionResult result = flowExecutor.launchExecution(FLOW_ID, null, externalContext);
+ parseSuccessResponse(result, OAuth2RevocationSuccessResponse.class);
+ }
}
diff --git a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/TokenFlowTest.java b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/TokenFlowTest.java
index 2b48da9e..b83c10ea 100644
--- a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/TokenFlowTest.java
+++ b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/TokenFlowTest.java
@@ -21,6 +21,8 @@ import java.io.IOException;
import java.net.URI;
import java.net.URISyntaxException;
import java.security.NoSuchAlgorithmException;
+import java.text.ParseException;
+import java.time.Instant;
import java.util.HashMap;
import java.util.Map;
@@ -35,7 +37,8 @@ import org.testng.annotations.Test;
import com.nimbusds.jose.JOSEException;
import com.nimbusds.jose.JWSAlgorithm;
import com.nimbusds.jwt.JWT;
-import com.nimbusds.oauth2.sdk.ParseException;
+import com.nimbusds.oauth2.sdk.AuthorizationCode;
+import com.nimbusds.oauth2.sdk.Scope;
import com.nimbusds.oauth2.sdk.auth.ClientAuthenticationMethod;
import com.nimbusds.oauth2.sdk.auth.ClientSecretJWT;
import com.nimbusds.oauth2.sdk.auth.JWTAuthentication;
@@ -45,6 +48,7 @@ import com.nimbusds.oauth2.sdk.pkce.CodeChallenge;
import com.nimbusds.oauth2.sdk.pkce.CodeChallengeMethod;
import com.nimbusds.oauth2.sdk.pkce.CodeVerifier;
import com.nimbusds.oauth2.sdk.token.AccessToken;
+import com.nimbusds.oauth2.sdk.token.RefreshToken;
import com.nimbusds.openid.connect.sdk.OIDCTokenResponse;
import com.nimbusds.openid.connect.sdk.claims.ClaimsSet;
@@ -52,6 +56,7 @@ import net.minidev.json.JSONObject;
import net.shibboleth.idp.plugin.oidc.op.profile.impl.BaseOIDCResponseActionTest;
import net.shibboleth.idp.plugin.oidc.op.profile.impl.ValidateGrantTest;
import net.shibboleth.idp.plugin.oidc.op.token.support.AccessTokenClaimsSet;
+import net.shibboleth.idp.plugin.oidc.op.token.support.TokenClaimsSet;
import net.shibboleth.utilities.java.support.component.ComponentInitializationException;
import net.shibboleth.utilities.java.support.security.DataSealerException;
@@ -148,6 +153,42 @@ public class TokenFlowTest extends AbstractOidcFlowTest {
Assert.assertNotNull(response.getTokens().getAccessToken());
Assert.assertNotNull(response.getOIDCTokens().getIDToken());
}
+
+ @Test
+ public void testValidLegacyGrant() throws ParseException, IOException, NoSuchAlgorithmException,
+ URISyntaxException, DataSealerException, ComponentInitializationException {
+ initializeGrantAndRequest(clientId, createRequestParameters(redirectUri, "authorization_code",
+ buildLegacyAuthorizationCode(clientId), clientId));
+ final FlowExecutionResult result = flowExecutor.launchExecution(FLOW_ID, null, externalContext);
+ OIDCTokenResponse response = parseSuccessResponse(result, OIDCTokenResponse.class);
+ final AccessToken accessToken = response.getTokens().getAccessToken();
+ Assert.assertNotNull(accessToken);
+ Assert.assertNotNull(response.getOIDCTokens().getIDToken());
+ validateConsentFromAccessToken(response, false);
+ }
+
+ @Test
+ public void testValidLegacyConsentGrant() throws ParseException, IOException, NoSuchAlgorithmException,
+ URISyntaxException, DataSealerException, ComponentInitializationException {
+ initializeGrantAndRequest(clientId, createRequestParameters(redirectUri, "authorization_code",
+ buildLegacyAuthorizationCode(clientId, "mail"), clientId));
+ final FlowExecutionResult result = flowExecutor.launchExecution(FLOW_ID, null, externalContext);
+ OIDCTokenResponse response = parseSuccessResponse(result, OIDCTokenResponse.class);
+ final AccessToken accessToken = response.getTokens().getAccessToken();
+ Assert.assertNotNull(accessToken);
+ Assert.assertNotNull(response.getOIDCTokens().getIDToken());
+ validateConsentFromAccessToken(response, true);
+ }
+
+ protected void validateConsentFromAccessToken(final OIDCTokenResponse response, final boolean value) throws
+ NoSuchAlgorithmException, DataSealerException, ComponentInitializationException,
+ ParseException {
+ final AccessTokenClaimsSet claims = unwrapAccessToken(response);
+ Assert.assertTrue(claims.getClaimsSet().getClaims().containsKey(TokenClaimsSet.KEY_CONSENT_ENABLED));
+ Assert.assertEquals(claims.getClaimsSet().getBooleanClaim(TokenClaimsSet.KEY_CONSENT_ENABLED).booleanValue(),
+ value);
+ Assert.assertEquals(claims.isConsentEnabled(), value);
+ }
@Test
public void testValidGrantSaml() throws ParseException, IOException, NoSuchAlgorithmException, URISyntaxException,
@@ -159,6 +200,7 @@ public class TokenFlowTest extends AbstractOidcFlowTest {
final FlowExecutionResult result = flowExecutor.launchExecution(FLOW_ID, null, externalContext);
OIDCTokenResponse response = parseSuccessResponse(result, OIDCTokenResponse.class);
Assert.assertNotNull(response.getTokens().getAccessToken());
+ // the email-claim exists in id_token as it's defined to be always included in the SAML metadata
final JWT idToken = response.getOIDCTokens().getIDToken();
Assert.assertNotNull(idToken);
Assert.assertEquals(idToken.getJWTClaimsSet().getClaim("email"), "jdoe at example.org");
@@ -182,6 +224,23 @@ public class TokenFlowTest extends AbstractOidcFlowTest {
"openid profile email").toString();
}
+ protected String buildLegacyAuthorizationCode(String clientId, String... consentedClaims) throws
+ NoSuchAlgorithmException, URISyntaxException, DataSealerException, ComponentInitializationException {
+ final String json = buildJsonForLegacyToken("jdoe", clientId, Scope.parse("openid email"), "ac",
+ consentedClaims);
+ return new AuthorizationCode(BaseOIDCResponseActionTest.initializeDataSealer().wrap(json,
+ Instant.now().plusSeconds(30))).getValue();
+ }
+
+ protected String buildLegacyRefreshToken(String clientId, String... consentedClaims) throws
+ NoSuchAlgorithmException, URISyntaxException, DataSealerException, ComponentInitializationException {
+ final String json = buildJsonForLegacyToken("jdoe", clientId, Scope.parse("openid email"), "rf",
+ consentedClaims);
+ return new RefreshToken(BaseOIDCResponseActionTest.initializeDataSealer().wrap(json,
+ Instant.now().plusSeconds(30))).getValue();
+}
+
+
@Test
public void testValidSecretJWT() throws ParseException, IOException, NoSuchAlgorithmException, URISyntaxException,
DataSealerException, ComponentInitializationException, JOSEException {
@@ -356,6 +415,32 @@ public class TokenFlowTest extends AbstractOidcFlowTest {
Assert.assertNull(claimsSet.getIDTokenDeliveryClaims());
}
+ @Test
+ public void testValidLegacyRefreshTokenGrant() throws ParseException, IOException, NoSuchAlgorithmException,
+ URISyntaxException, DataSealerException, ComponentInitializationException {
+ initializeGrantAndRequest(clientId, createRequestParameters(redirectUri, "refresh_token",
+ buildLegacyRefreshToken(clientId), clientId));
+ final FlowExecutionResult result = flowExecutor.launchExecution(FLOW_ID, null, externalContext);
+ OIDCTokenResponse response = parseSuccessResponse(result, OIDCTokenResponse.class);
+ final AccessToken accessToken = response.getTokens().getAccessToken();
+ Assert.assertNotNull(accessToken);
+ Assert.assertNotNull(response.getOIDCTokens().getIDToken());
+ validateConsentFromAccessToken(response, false);
+ }
+
+ @Test
+ public void testValidLegacyConsentRefreshTokenGrant() throws ParseException, IOException, NoSuchAlgorithmException,
+ URISyntaxException, DataSealerException, ComponentInitializationException {
+ initializeGrantAndRequest(clientId, createRequestParameters(redirectUri, "refresh_token",
+ buildLegacyRefreshToken(clientId, "mail"), clientId));
+ final FlowExecutionResult result = flowExecutor.launchExecution(FLOW_ID, null, externalContext);
+ OIDCTokenResponse response = parseSuccessResponse(result, OIDCTokenResponse.class);
+ final AccessToken accessToken = response.getTokens().getAccessToken();
+ Assert.assertNotNull(accessToken);
+ Assert.assertNotNull(response.getOIDCTokens().getIDToken());
+ validateConsentFromAccessToken(response, true);
+ }
+
private AccessTokenClaimsSet unwrapAccessToken(final OIDCTokenResponse tokenResponse) {
final AccessToken accessToken = tokenResponse.getTokens().getAccessToken();
Assert.assertNotNull(accessToken);
@@ -405,7 +490,11 @@ public class TokenFlowTest extends AbstractOidcFlowTest {
Map<String, String> parameters = new HashMap<>();
addNonNullValue(parameters, "redirect_uri", redirectUri);
addNonNullValue(parameters, "grant_type", grantType);
- addNonNullValue(parameters, "code", code);
+ if ("refresh_token".equals(grantType)) {
+ addNonNullValue(parameters, "refresh_token", code);
+ } else {
+ addNonNullValue(parameters, "code", code);
+ }
addNonNullValue(parameters, "client_id", clientId);
return parameters;
}
diff --git a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/UserInfoTest.java b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/UserInfoTest.java
index c82c2df8..2e61fad6 100644
--- a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/UserInfoTest.java
+++ b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/UserInfoTest.java
@@ -107,7 +107,23 @@ public class UserInfoTest extends AbstractOidcApiFlowTest {
Assert.assertNull(userInfo.getNickname());
Assert.assertNull(response.getUserInfoJWT());
}
-
+
+ @Test
+ public void testSuccessOnlySubjectWithLegacyToken() throws URISyntaxException, NoSuchAlgorithmException, DataSealerException,
+ ComponentInitializationException, IOException, com.nimbusds.oauth2.sdk.ParseException {
+ final BearerAccessToken token = buildLegacyToken(clientId, subject, new Scope("openid"));
+ storeMetadata(storageService, clientId, "mockSecret");
+ request.addHeader("Authorization", token.toAuthorizationHeader());
+ final FlowExecutionResult result = flowExecutor.launchExecution(FLOW_ID, null, externalContext);
+ final UserInfoSuccessResponse response = parseSuccessResponse(result, UserInfoSuccessResponse.class);
+ Assert.assertEquals(response.getUserInfo().getSubject().getValue(), subject);
+ final UserInfo userInfo = response.getUserInfo();
+ Assert.assertNotNull(userInfo);
+ Assert.assertNull(userInfo.getEmailAddress());
+ Assert.assertNull(userInfo.getNickname());
+ Assert.assertNull(response.getUserInfoJWT());
+ }
+
@Test
public void testSuccessOnlySubjectSaml() throws URISyntaxException, NoSuchAlgorithmException, DataSealerException,
ComponentInitializationException, IOException {
@@ -141,6 +157,60 @@ public class UserInfoTest extends AbstractOidcApiFlowTest {
Assert.assertNull(response.getUserInfoJWT());
}
+ @Test
+ public void testSuccessEmailResolutionWithLegacyToken() throws URISyntaxException, NoSuchAlgorithmException,
+ DataSealerException, ComponentInitializationException, IOException, com.nimbusds.oauth2.sdk.ParseException {
+ final BearerAccessToken token = buildLegacyToken(clientId, subject, new Scope("openid", "email", "profile"));
+ storeMetadata(storageService, clientId, "mockSecret");
+ storeConsent(storageService, "jdoe", clientId, "mail");
+ request.addHeader("Authorization", token.toAuthorizationHeader());
+ final FlowExecutionResult result = flowExecutor.launchExecution(FLOW_ID, null, externalContext);
+ final UserInfoSuccessResponse response = parseSuccessResponse(result, UserInfoSuccessResponse.class);
+ final UserInfo userInfo = response.getUserInfo();
+ Assert.assertNotNull(userInfo);
+ Assert.assertEquals(userInfo.getSubject().getValue(), subject);
+ Assert.assertEquals(userInfo.getEmailAddress(), "jdoe at example.org");
+ Assert.assertNull(userInfo.getNickname());
+ Assert.assertNull(response.getUserInfoJWT());
+ }
+
+ @Test
+ public void testSuccessEmailResolutionWithLegacyConsentToken() throws URISyntaxException, NoSuchAlgorithmException,
+ DataSealerException, ComponentInitializationException, IOException, com.nimbusds.oauth2.sdk.ParseException {
+ final BearerAccessToken token = buildLegacyToken(clientId, subject, new Scope("openid", "email", "profile"),
+ "mail");
+ storeMetadata(storageService, clientId, "mockSecret");
+ storeConsent(storageService, "jdoe", clientId, "mail");
+ request.addHeader("Authorization", token.toAuthorizationHeader());
+ final FlowExecutionResult result = flowExecutor.launchExecution(FLOW_ID, null, externalContext);
+ final UserInfoSuccessResponse response = parseSuccessResponse(result, UserInfoSuccessResponse.class);
+ final UserInfo userInfo = response.getUserInfo();
+ Assert.assertNotNull(userInfo);
+ Assert.assertEquals(userInfo.getSubject().getValue(), subject);
+ Assert.assertEquals(userInfo.getEmailAddress(), "jdoe at example.org");
+ Assert.assertNull(userInfo.getNickname());
+ Assert.assertNull(response.getUserInfoJWT());
+ }
+
+ @Test
+ public void testNotConsentedEmailResolutionWithLegacyConsentToken() throws URISyntaxException,
+ NoSuchAlgorithmException, DataSealerException, ComponentInitializationException, IOException,
+ com.nimbusds.oauth2.sdk.ParseException {
+ final BearerAccessToken token = buildLegacyToken(clientId, subject, new Scope("openid", "email", "profile"),
+ "not_mail");
+ storeMetadata(storageService, clientId, "mockSecret");
+ storeConsent(storageService, "jdoe", clientId, "mail");
+ request.addHeader("Authorization", token.toAuthorizationHeader());
+ final FlowExecutionResult result = flowExecutor.launchExecution(FLOW_ID, null, externalContext);
+ final UserInfoSuccessResponse response = parseSuccessResponse(result, UserInfoSuccessResponse.class);
+ final UserInfo userInfo = response.getUserInfo();
+ Assert.assertNotNull(userInfo);
+ Assert.assertEquals(userInfo.getSubject().getValue(), subject);
+ Assert.assertNull(userInfo.getEmailAddress());
+ Assert.assertNull(userInfo.getNickname());
+ Assert.assertNull(response.getUserInfoJWT());
+ }
+
@Test
public void testSuccessNicknameInToken() throws URISyntaxException, NoSuchAlgorithmException, DataSealerException,
ComponentInitializationException, IOException {
@@ -178,5 +248,4 @@ public class UserInfoTest extends AbstractOidcApiFlowTest {
Assert.assertEquals(claimsSet.getClaim("email"), "jdoe at example.org");
Assert.assertEquals(claimsSet.getClaim("iss"), "https://op.example.org");
}
-
}
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list