[java-idp-oidc] branch main updated: JOIDC-67 Introspection and revocation flows don't support SAML metadata
Scott Cantor
cantor.2 at osu.edu
Wed Dec 22 18:20:21 UTC 2021
This is an automated email from the git hooks/post-receive script.
scantor pushed a commit to branch main
in repository java-idp-oidc.
View the commit online:
http://git.shibboleth.net/view/?p=java-idp-oidc.git;a=commit;h=7b020807e1bb3aa8cc4165d46246018175641998
The following commit(s) were added to refs/heads/main by this push:
new 7b020807 JOIDC-67 Introspection and revocation flows don't support SAML metadata
7b020807 is described below
commit 7b020807e1bb3aa8cc4165d46246018175641998
Author: Henri Mikkonen <henri.mikkonen at iki.fi>
AuthorDate: Wed Dec 22 19:46:22 2021 +0200
JOIDC-67 Introspection and revocation flows don't support SAML metadata
https://shibboleth.atlassian.net/browse/JOIDC-67
Wired oidc/metadata-lookup flow into introspection and revocation flows
and improved flow testing.
---
.../oauth2/introspection/introspection-beans.xml | 20 +-------------------
.../oauth2/introspection/introspection-flow.xml | 10 +++++++---
.../idp/flows/oauth2/revocation/revocation-beans.xml | 20 +-------------------
.../idp/flows/oauth2/revocation/revocation-flow.xml | 10 +++++++---
.../oidc/op/profile/flow/IntrospectionFlowTest.java | 15 +++++++++++++++
.../oidc/op/profile/flow/RevocationFlowTest.java | 13 +++++++++++++
6 files changed, 44 insertions(+), 44 deletions(-)
diff --git a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oauth2/introspection/introspection-beans.xml b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oauth2/introspection/introspection-beans.xml
index 7b2ff74a..e8fe1895 100644
--- a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oauth2/introspection/introspection-beans.xml
+++ b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oauth2/introspection/introspection-beans.xml
@@ -17,28 +17,10 @@
</constructor-arg>
</bean>
- <bean id="OIDCMetadataLookup" class="net.shibboleth.idp.profile.impl.WebFlowMessageHandlerAdaptor"
- scope="prototype" c:executionDirection="INBOUND">
- <constructor-arg name="messageHandler">
- <bean class="net.shibboleth.idp.plugin.oidc.op.profile.impl.OIDCMetadataLookupHandler" scope="prototype">
- <property name="clientInformationResolver">
- <ref bean="shibboleth.ClientInformationResolver" />
- </property>
- <property name="clientIDLookupStrategy">
- <ref bean="shibboleth.TokenRequestClientIDLookupStrategy" />
- </property>
- </bean>
- </constructor-arg>
- </bean>
-
- <bean id="shibboleth.TokenRequestClientIDLookupStrategy"
+ <bean id="shibboleth.ClientIDLookupStrategy"
class="net.shibboleth.idp.plugin.oidc.op.profile.context.navigate.TokenRequestClientIDLookupFunction"
scope="prototype" />
- <bean id="InitializeRelyingPartyContext"
- class="net.shibboleth.idp.plugin.oidc.op.profile.impl.InitializeRelyingPartyContext" scope="prototype"
- p:clientIDLookupStrategy-ref="shibboleth.TokenRequestClientIDLookupStrategy" />
-
<bean id="InitializeOutboundMessageContext"
class="net.shibboleth.idp.plugin.oidc.op.oauth2.profile.impl.InitializeOutboundTokenIntrospectionResponseMessageContext"
scope="prototype" />
diff --git a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oauth2/introspection/introspection-flow.xml b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oauth2/introspection/introspection-flow.xml
index 2d56704c..5df00ffd 100644
--- a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oauth2/introspection/introspection-flow.xml
+++ b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oauth2/introspection/introspection-flow.xml
@@ -1,7 +1,7 @@
<flow xmlns="http://www.springframework.org/schema/webflow"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="http://www.springframework.org/schema/webflow http://www.springframework.org/schema/webflow/spring-webflow.xsd"
- parent="oidc/abstract-api">
+ parent="oidc/abstract-api, oidc/metadata-lookup">
<action-state id="InitializeMandatoryContexts">
<evaluate expression="InitializeProfileRequestContext" />
@@ -15,8 +15,12 @@
<action-state id="DecodeMessage">
<evaluate expression="DecodeMessage" />
<evaluate expression="PostDecodePopulateAuditContext" />
- <evaluate expression="OIDCMetadataLookup" />
- <evaluate expression="InitializeRelyingPartyContext" />
+ <evaluate expression="'proceed'" />
+ <!-- DoMetadataLookup is expected to proceed to SelectConfiguration -->
+ <transition on="proceed" to="DoMetadataLookup" />
+ </action-state>
+
+ <action-state id="SelectConfiguration">
<evaluate expression="SelectRelyingPartyConfiguration" />
<evaluate expression="SelectProfileConfiguration" />
<evaluate expression="PostLookupPopulateAuditContext" />
diff --git a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oauth2/revocation/revocation-beans.xml b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oauth2/revocation/revocation-beans.xml
index 7abf14d0..087c1770 100644
--- a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oauth2/revocation/revocation-beans.xml
+++ b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oauth2/revocation/revocation-beans.xml
@@ -17,28 +17,10 @@
</constructor-arg>
</bean>
- <bean id="OIDCMetadataLookup" class="net.shibboleth.idp.profile.impl.WebFlowMessageHandlerAdaptor"
- scope="prototype" c:executionDirection="INBOUND">
- <constructor-arg name="messageHandler">
- <bean class="net.shibboleth.idp.plugin.oidc.op.profile.impl.OIDCMetadataLookupHandler" scope="prototype">
- <property name="clientInformationResolver">
- <ref bean="shibboleth.ClientInformationResolver" />
- </property>
- <property name="clientIDLookupStrategy">
- <ref bean="shibboleth.TokenRequestClientIDLookupStrategy" />
- </property>
- </bean>
- </constructor-arg>
- </bean>
-
- <bean id="shibboleth.TokenRequestClientIDLookupStrategy"
+ <bean id="shibboleth.ClientIDLookupStrategy"
class="net.shibboleth.idp.plugin.oidc.op.profile.context.navigate.TokenRequestClientIDLookupFunction"
scope="prototype" />
- <bean id="InitializeRelyingPartyContext"
- class="net.shibboleth.idp.plugin.oidc.op.profile.impl.InitializeRelyingPartyContext" scope="prototype"
- p:clientIDLookupStrategy-ref="shibboleth.TokenRequestClientIDLookupStrategy" />
-
<bean id="InitializeOutboundMessageContext"
class="net.shibboleth.idp.plugin.oidc.op.oauth2.profile.impl.InitializeOutboundRevokeTokenResponseMessageContext"
scope="prototype" />
diff --git a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oauth2/revocation/revocation-flow.xml b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oauth2/revocation/revocation-flow.xml
index 77ac1a52..775360af 100644
--- a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oauth2/revocation/revocation-flow.xml
+++ b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oauth2/revocation/revocation-flow.xml
@@ -1,7 +1,7 @@
<flow xmlns="http://www.springframework.org/schema/webflow"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="http://www.springframework.org/schema/webflow http://www.springframework.org/schema/webflow/spring-webflow.xsd"
- parent="oidc/abstract-api">
+ parent="oidc/abstract-api, oidc/metadata-lookup">
<action-state id="InitializeMandatoryContexts">
<evaluate expression="InitializeProfileRequestContext" />
@@ -15,8 +15,12 @@
<action-state id="DecodeMessage">
<evaluate expression="DecodeMessage" />
<evaluate expression="PostDecodePopulateAuditContext" />
- <evaluate expression="OIDCMetadataLookup" />
- <evaluate expression="InitializeRelyingPartyContext" />
+ <evaluate expression="'proceed'" />
+ <!-- DoMetadataLookup is expected to proceed to SelectConfiguration -->
+ <transition on="proceed" to="DoMetadataLookup" />
+ </action-state>
+
+ <action-state id="SelectConfiguration">
<evaluate expression="SelectRelyingPartyConfiguration" />
<evaluate expression="SelectProfileConfiguration" />
<evaluate expression="PostLookupPopulateAuditContext" />
diff --git a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/IntrospectionFlowTest.java b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/IntrospectionFlowTest.java
index 930ae64e..0959c0f1 100644
--- a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/IntrospectionFlowTest.java
+++ b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/IntrospectionFlowTest.java
@@ -49,6 +49,9 @@ public class IntrospectionFlowTest extends AbstractOidcApiFlowTest {
String clientSecret = "mockClientSecret";
+ String clientIdSaml = "mockSamlClientId";
+ String clientSecretSaml = "mockClientSecretmockClientSecretmockClientSecret";
+
@Autowired
@Qualifier("shibboleth.StorageService")
StorageService storageService;
@@ -97,6 +100,18 @@ public class IntrospectionFlowTest extends AbstractOidcApiFlowTest {
Assert.assertTrue(resp.isActive());
}
+ @Test
+ public void testSuccessWithSamlMetadata() throws IOException, NoSuchAlgorithmException, URISyntaxException, DataSealerException,
+ ComponentInitializationException {
+ setBasicAuth(clientIdSaml, clientSecretSaml);
+ setHttpFormRequest("POST", Collections.singletonMap("token",
+ super.buildToken(clientIdSaml, "sub", Scope.parse("openid")).toJSONObject().getAsString("access_token")));
+ final FlowExecutionResult result = flowExecutor.launchExecution(FLOW_ID, null, externalContext);
+ TokenIntrospectionSuccessResponse resp = parseSuccessResponse(result, TokenIntrospectionSuccessResponse.class);
+ Assert.assertEquals(resp.getClientID().getValue(), clientIdSaml);
+ Assert.assertTrue(resp.isActive());
+ }
+
@Test
public void testSuccessWithLegacyToken() throws IOException, NoSuchAlgorithmException, URISyntaxException,
DataSealerException, ComponentInitializationException {
diff --git a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/RevocationFlowTest.java b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/RevocationFlowTest.java
index 6dffdb5f..7174eccb 100644
--- a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/RevocationFlowTest.java
+++ b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/RevocationFlowTest.java
@@ -48,6 +48,9 @@ public class RevocationFlowTest extends AbstractOidcApiFlowTest {
String clientId = "mockClientId";
String clientSecret = "mockClientSecret";
+
+ String clientIdSaml = "mockSamlClientId";
+ String clientSecretSaml = "mockClientSecretmockClientSecretmockClientSecret";
@Autowired
@Qualifier("shibboleth.StorageService")
@@ -83,6 +86,16 @@ public class RevocationFlowTest extends AbstractOidcApiFlowTest {
parseSuccessResponse(result, OAuth2RevocationSuccessResponse.class);
}
+ @Test
+ public void testSuccessWithSamlMetadata() throws IOException, NoSuchAlgorithmException, URISyntaxException,
+ DataSealerException, ComponentInitializationException {
+ setBasicAuth(clientIdSaml, clientSecretSaml);
+ setHttpFormRequest("POST", Collections.singletonMap("token", super.buildToken(clientIdSaml, "sub",
+ Scope.parse("openid")).toJSONObject().getAsString("access_token")));
+ final FlowExecutionResult result = flowExecutor.launchExecution(FLOW_ID, null, externalContext);
+ parseSuccessResponse(result, OAuth2RevocationSuccessResponse.class);
+ }
+
@Test
public void testSuccessWithLegacyToken() throws IOException, NoSuchAlgorithmException, URISyntaxException,
DataSealerException, ComponentInitializationException, ParseException {
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list