[java-idp-oidc] branch main updated: JOIDC-18 - Work out better mechanism for overriding issuer in profiles
Henri Mikkonen
henri.mikkonen at iki.fi
Fri May 14 09:27:11 UTC 2021
This is an automated email from the git hooks/post-receive script.
hjmikkon pushed a commit to branch main
in repository java-idp-oidc.
View the commit online:
http://git.shibboleth.net/view/?p=java-idp-oidc.git;a=commit;h=1913757309dcafb0f6b8ffe6b7403aba9352b0a5
The following commit(s) were added to refs/heads/main by this push:
new 19137573 JOIDC-18 - Work out better mechanism for overriding issuer in profiles
19137573 is described below
commit 1913757309dcafb0f6b8ffe6b7403aba9352b0a5
Author: Henri Mikkonen <henri.mikkonen at iki.fi>
AuthorDate: Fri May 14 12:26:08 2021 +0300
JOIDC-18 - Work out better mechanism for overriding issuer in profiles
https://issues.shibboleth.net/jira/browse/JOIDC-18
Improved unit testing to check if the expected issuer value is included
when the user info responses are signed.
---
.../oidc/op/profile/flow/AbstractOidcFlowTest.java | 12 ++++-
.../plugin/oidc/op/profile/flow/UserInfoTest.java | 55 ++++++++++++++++------
2 files changed, 51 insertions(+), 16 deletions(-)
diff --git a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/AbstractOidcFlowTest.java b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/AbstractOidcFlowTest.java
index 3148919f..e08f2038 100644
--- a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/AbstractOidcFlowTest.java
+++ b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/AbstractOidcFlowTest.java
@@ -149,14 +149,21 @@ public abstract class AbstractOidcFlowTest extends AbstractFlowTest {
protected void storeMetadata(final StorageService storageService, final String clientId, final String secret,
final String... redirectUri) throws IOException {
- storeMetadata(storageService, clientId, secret, null, ClientAuthenticationMethod.CLIENT_SECRET_BASIC,
+ storeMetadata(storageService, clientId, secret, null, ClientAuthenticationMethod.CLIENT_SECRET_BASIC, null,
redirectUri);
}
-
+
protected void storeMetadata(final StorageService storageService, final String clientId, final String secret,
final JWSAlgorithm tokenEndpointSigAlg, final ClientAuthenticationMethod tokenEndpointMethod,
final String... redirectUri)
throws IOException {
+ storeMetadata(storageService, clientId, secret, tokenEndpointSigAlg, tokenEndpointMethod, null, redirectUri);
+ }
+
+ protected void storeMetadata(final StorageService storageService, final String clientId, final String secret,
+ final JWSAlgorithm tokenEndpointSigAlg, final ClientAuthenticationMethod tokenEndpointMethod,
+ final JWSAlgorithm userInfoSigAlg, final String... redirectUri)
+ throws IOException {
final OIDCClientMetadata metadata = new OIDCClientMetadata();
metadata.setGrantTypes(new HashSet<GrantType>(Arrays.asList(GrantType.AUTHORIZATION_CODE)));
final HashSet<URI> uris = new HashSet<>();
@@ -174,6 +181,7 @@ public abstract class AbstractOidcFlowTest extends AbstractFlowTest {
metadata.setScope(Scope.parse("openid profile email"));
metadata.setTokenEndpointAuthJWSAlg(tokenEndpointSigAlg);
metadata.setTokenEndpointAuthMethod(tokenEndpointMethod);
+ metadata.setUserInfoJWSAlg(userInfoSigAlg);
final OIDCClientInformation information = new OIDCClientInformation(new ClientID(clientId), new Date(),
metadata, new Secret(secret));
storageService.create(BaseStorageServiceClientInformationComponent.CONTEXT_NAME, clientId,
diff --git a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/UserInfoTest.java b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/UserInfoTest.java
index b9ea3416..c82c2df8 100644
--- a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/UserInfoTest.java
+++ b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/UserInfoTest.java
@@ -20,6 +20,7 @@ package net.shibboleth.idp.plugin.oidc.op.profile.flow;
import java.io.IOException;
import java.net.URISyntaxException;
import java.security.NoSuchAlgorithmException;
+import java.text.ParseException;
import org.opensaml.storage.StorageService;
import org.springframework.beans.factory.annotation.Autowired;
@@ -29,7 +30,12 @@ import org.testng.Assert;
import org.testng.annotations.BeforeMethod;
import org.testng.annotations.Test;
+import com.nimbusds.jose.JWSAlgorithm;
+import com.nimbusds.jwt.JWT;
+import com.nimbusds.jwt.JWTClaimsSet;
+import com.nimbusds.jwt.SignedJWT;
import com.nimbusds.oauth2.sdk.Scope;
+import com.nimbusds.oauth2.sdk.auth.ClientAuthenticationMethod;
import com.nimbusds.oauth2.sdk.token.BearerAccessToken;
import com.nimbusds.openid.connect.sdk.UserInfoSuccessResponse;
import com.nimbusds.openid.connect.sdk.claims.UserInfo;
@@ -80,7 +86,7 @@ public class UserInfoTest extends AbstractOidcApiFlowTest {
@Test
public void testFailsUntrustedClient() throws URISyntaxException, NoSuchAlgorithmException, DataSealerException,
ComponentInitializationException {
- BearerAccessToken token = buildToken(idGenerator.generateIdentifier(), subject, new Scope());
+ final BearerAccessToken token = buildToken(idGenerator.generateIdentifier(), subject, new Scope());
request.addHeader("Authorization", token.toAuthorizationHeader());
final FlowExecutionResult result = flowExecutor.launchExecution(FLOW_ID, null, externalContext);
assertErrorCode(result, "invalid_request");
@@ -89,13 +95,13 @@ public class UserInfoTest extends AbstractOidcApiFlowTest {
@Test
public void testSuccessOnlySubject() throws URISyntaxException, NoSuchAlgorithmException, DataSealerException,
ComponentInitializationException, IOException {
- BearerAccessToken token = buildToken(clientId, subject, new Scope("openid"));
+ final BearerAccessToken token = buildToken(clientId, subject, new Scope("openid"));
storeMetadata(storageService, clientId, "mockSecret");
request.addHeader("Authorization", token.toAuthorizationHeader());
final FlowExecutionResult result = flowExecutor.launchExecution(FLOW_ID, null, externalContext);
- UserInfoSuccessResponse response = parseSuccessResponse(result, UserInfoSuccessResponse.class);
+ final UserInfoSuccessResponse response = parseSuccessResponse(result, UserInfoSuccessResponse.class);
Assert.assertEquals(response.getUserInfo().getSubject().getValue(), subject);
- UserInfo userInfo = response.getUserInfo();
+ final UserInfo userInfo = response.getUserInfo();
Assert.assertNotNull(userInfo);
Assert.assertNull(userInfo.getEmailAddress());
Assert.assertNull(userInfo.getNickname());
@@ -105,12 +111,12 @@ public class UserInfoTest extends AbstractOidcApiFlowTest {
@Test
public void testSuccessOnlySubjectSaml() throws URISyntaxException, NoSuchAlgorithmException, DataSealerException,
ComponentInitializationException, IOException {
- BearerAccessToken token = buildToken(clientIdSaml, subject, new Scope("openid"));
+ final BearerAccessToken token = buildToken(clientIdSaml, subject, new Scope("openid"));
request.addHeader("Authorization", token.toAuthorizationHeader());
final FlowExecutionResult result = flowExecutor.launchExecution(FLOW_ID, null, externalContext);
- UserInfoSuccessResponse response = parseSuccessResponse(result, UserInfoSuccessResponse.class);
+ final UserInfoSuccessResponse response = parseSuccessResponse(result, UserInfoSuccessResponse.class);
Assert.assertEquals(response.getUserInfo().getSubject().getValue(), subject);
- UserInfo userInfo = response.getUserInfo();
+ final UserInfo userInfo = response.getUserInfo();
Assert.assertNotNull(userInfo);
Assert.assertNull(userInfo.getEmailAddress());
Assert.assertNull(userInfo.getNickname());
@@ -121,13 +127,13 @@ public class UserInfoTest extends AbstractOidcApiFlowTest {
@Test
public void testSuccessEmailResolution() throws URISyntaxException, NoSuchAlgorithmException, DataSealerException,
ComponentInitializationException, IOException {
- BearerAccessToken token = buildToken(clientId, subject, new Scope("openid", "email", "profile"));
+ final BearerAccessToken token = buildToken(clientId, subject, new Scope("openid", "email", "profile"));
storeMetadata(storageService, clientId, "mockSecret");
storeConsent(storageService, "jdoe", clientId, "mail");
request.addHeader("Authorization", token.toAuthorizationHeader());
final FlowExecutionResult result = flowExecutor.launchExecution(FLOW_ID, null, externalContext);
- UserInfoSuccessResponse response = parseSuccessResponse(result, UserInfoSuccessResponse.class);
- UserInfo userInfo = response.getUserInfo();
+ final UserInfoSuccessResponse response = parseSuccessResponse(result, UserInfoSuccessResponse.class);
+ final UserInfo userInfo = response.getUserInfo();
Assert.assertNotNull(userInfo);
Assert.assertEquals(userInfo.getSubject().getValue(), subject);
Assert.assertEquals(userInfo.getEmailAddress(), "jdoe at example.org");
@@ -138,18 +144,39 @@ public class UserInfoTest extends AbstractOidcApiFlowTest {
@Test
public void testSuccessNicknameInToken() throws URISyntaxException, NoSuchAlgorithmException, DataSealerException,
ComponentInitializationException, IOException {
- TokenDeliveryClaimsClaimsSet set = new TokenDeliveryClaimsClaimsSet();
+ final TokenDeliveryClaimsClaimsSet set = new TokenDeliveryClaimsClaimsSet();
set.setClaim("nickname", "mockNickname");
- BearerAccessToken token = buildToken(clientId, subject, new Scope("openid", "profile"), set);
+ final BearerAccessToken token = buildToken(clientId, subject, new Scope("openid", "profile"), set);
storeMetadata(storageService, clientId, "mockSecret");
request.addHeader("Authorization", token.toAuthorizationHeader());
final FlowExecutionResult result = flowExecutor.launchExecution(FLOW_ID, null, externalContext);
- UserInfoSuccessResponse response = parseSuccessResponse(result, UserInfoSuccessResponse.class);
- UserInfo userInfo = response.getUserInfo();
+ final UserInfoSuccessResponse response = parseSuccessResponse(result, UserInfoSuccessResponse.class);
+ final UserInfo userInfo = response.getUserInfo();
Assert.assertNotNull(userInfo);
Assert.assertEquals(userInfo.getSubject().getValue(), subject);
Assert.assertNull(userInfo.getEmailAddress());
Assert.assertEquals(userInfo.getNickname(), "mockNickname");
Assert.assertNull(response.getUserInfoJWT());
}
+
+ @Test
+ public void testSuccessEmailResolutionAndIssuerWithSignedResponse() throws URISyntaxException,
+ NoSuchAlgorithmException, DataSealerException, ComponentInitializationException, IOException, ParseException {
+ final BearerAccessToken token = buildToken(clientId, subject, new Scope("openid", "email", "profile"));
+ storeMetadata(storageService, clientId, "mockSecret", null, ClientAuthenticationMethod.CLIENT_SECRET_BASIC,
+ JWSAlgorithm.RS256);
+ storeConsent(storageService, "jdoe", clientId, "mail");
+ request.addHeader("Authorization", token.toAuthorizationHeader());
+ final FlowExecutionResult result = flowExecutor.launchExecution(FLOW_ID, null, externalContext);
+ final UserInfoSuccessResponse response = parseSuccessResponse(result, UserInfoSuccessResponse.class);
+ Assert.assertNull(response.getUserInfo());
+ final JWT userInfoJwt = response.getUserInfoJWT();
+ Assert.assertNotNull(userInfoJwt);
+ Assert.assertTrue(userInfoJwt instanceof SignedJWT);
+ final JWTClaimsSet claimsSet = userInfoJwt.getJWTClaimsSet();
+ Assert.assertEquals(claimsSet.getSubject(), subject);
+ Assert.assertEquals(claimsSet.getClaim("email"), "jdoe at example.org");
+ Assert.assertEquals(claimsSet.getClaim("iss"), "https://op.example.org");
+ }
+
}
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list