[java-idp-oidc] branch main updated: JOIDC-96 - Still unable to request a claim to be placed in the ID_token
Henri Mikkonen
henri.mikkonen at iki.fi
Tue Apr 26 12:21:35 UTC 2022
This is an automated email from the git hooks/post-receive script.
hjmikkon pushed a commit to branch main
in repository java-idp-oidc.
View the commit online:
http://git.shibboleth.net/view/?p=java-idp-oidc.git;a=commit;h=b008de0e55ed7044e299f02c31bd2b8b7ae0748c
The following commit(s) were added to refs/heads/main by this push:
new b008de0e JOIDC-96 - Still unable to request a claim to be placed in the ID_token
b008de0e is described below
commit b008de0e55ed7044e299f02c31bd2b8b7ae0748c
Author: Henri Mikkonen <henri.mikkonen at iki.fi>
AuthorDate: Tue Apr 26 15:19:27 2022 +0300
JOIDC-96 - Still unable to request a claim to be placed in the ID_token
https://shibboleth.atlassian.net/browse/JOIDC-96
Modified SetTokenDeliveryAttributesToResponseContext to take the requested
claims into account. Previously only profile configuration options were
honored.
---
...etTokenDeliveryAttributesToResponseContext.java | 24 ++++++++--
...kenDeliveryAttributesToResponseContextTest.java | 54 +++++++++++++++++++++-
2 files changed, 73 insertions(+), 5 deletions(-)
diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/SetTokenDeliveryAttributesToResponseContext.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/SetTokenDeliveryAttributesToResponseContext.java
index 83f419c4..410720c8 100644
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/SetTokenDeliveryAttributesToResponseContext.java
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/SetTokenDeliveryAttributesToResponseContext.java
@@ -27,6 +27,7 @@ import javax.annotation.Nullable;
import net.minidev.json.JSONObject;
import net.shibboleth.idp.attribute.AttributeEncodingException;
+import net.shibboleth.idp.attribute.AttributesMapContainer;
import net.shibboleth.idp.attribute.IdPAttribute;
import net.shibboleth.idp.attribute.context.AttributeContext;
import net.shibboleth.idp.attribute.transcoding.AttributeTranscoder;
@@ -283,11 +284,15 @@ public class SetTokenDeliveryAttributesToResponseContext extends AbstractOIDCRes
final OIDCAuthenticationResponseTokenClaimsContext tokenClaimsCtx =
getOidcResponseContext().getSubcontext(OIDCAuthenticationResponseTokenClaimsContext.class, true);
+ final AttributesMapContainer requestedToIdTokenContainer =
+ getOidcResponseContext().getMappedIdTokenRequestedClaims();
for (final TranscodingRule rule : transcodingRules) {
try {
final AttributeTranscoder<JSONObject> transcoder = TranscoderSupport.<JSONObject>getTranscoder(rule);
-
+ final boolean requestedToIdToken = requestedToIdTokenContainer != null
+ && requestedToIdTokenContainer.get().containsKey(attribute.getId());
+
if (alwaysIncludedAttributes.contains(attribute.getId()) &&
!deniedUserInfoAttributes.contains(attribute.getId())) {
// Deliver for UserInfo and ID token
@@ -306,12 +311,25 @@ public class SetTokenDeliveryAttributesToResponseContext extends AbstractOIDCRes
k -> tokenClaimsCtx.getIdtokenClaims().setClaim(k, encodedAttribute.get(k)));
}
} else if (!deniedUserInfoAttributes.contains(attribute.getId())) {
- // Deliver only for UserInfo token
+ // Deliver only for UserInfo token, unless requested in ID token too
+ final JSONObject encodedAttribute =
+ transcoder.encode(profileRequestContext, attribute, JSONObject.class, rule);
+ if (encodedAttribute != null) {
+ if (requestedToIdToken) {
+ encodedAttribute.keySet().forEach(
+ k -> tokenClaimsCtx.getClaims().setClaim(k, encodedAttribute.get(k)));
+ } else {
+ encodedAttribute.keySet().forEach(
+ k -> tokenClaimsCtx.getUserinfoClaims().setClaim(k, encodedAttribute.get(k)));
+ }
+ }
+ } else if (requestedToIdToken) {
+ // Deliver only in ID token, if requested
final JSONObject encodedAttribute =
transcoder.encode(profileRequestContext, attribute, JSONObject.class, rule);
if (encodedAttribute != null) {
encodedAttribute.keySet().forEach(
- k -> tokenClaimsCtx.getUserinfoClaims().setClaim(k, encodedAttribute.get(k)));
+ k -> tokenClaimsCtx.getIdtokenClaims().setClaim(k, encodedAttribute.get(k)));
}
}
diff --git a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/SetTokenDeliveryAttributesToResponseContextTest.java b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/SetTokenDeliveryAttributesToResponseContextTest.java
index caa5e5cc..a42becbe 100644
--- a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/SetTokenDeliveryAttributesToResponseContextTest.java
+++ b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/SetTokenDeliveryAttributesToResponseContextTest.java
@@ -26,6 +26,7 @@ import java.util.Map;
import java.util.Set;
import net.shibboleth.ext.spring.testing.MockApplicationContext;
+import net.shibboleth.idp.attribute.AttributesMapContainer;
import net.shibboleth.idp.attribute.IdPAttribute;
import net.shibboleth.idp.attribute.IdPAttributeValue;
import net.shibboleth.idp.attribute.StringAttributeValue;
@@ -50,6 +51,9 @@ import org.testng.annotations.AfterMethod;
import org.testng.annotations.BeforeMethod;
import org.testng.annotations.Test;
+import com.google.common.collect.HashMultimap;
+import com.google.common.collect.Multimap;
+
/** {@link SetTokenDeliveryAttributesToResponseContext} unit test. */
public class SetTokenDeliveryAttributesToResponseContextTest extends BaseOIDCResponseActionTest {
@@ -61,13 +65,13 @@ public class SetTokenDeliveryAttributesToResponseContextTest extends BaseOIDCRes
public void setup() throws ComponentInitializationException {
((OIDCAuthorizationConfiguration) rpCtx.getProfileConfig()).setEncodedAttributes(
- Set.of("test1", "test2", "test3"));
+ Set.of("test1", "test2", "test3", "test4"));
((OIDCAuthorizationConfiguration) rpCtx.getProfileConfig()).setAlwaysIncludedAttributes(
Set.of("test2", "test3"));
((OIDCAuthorizationConfiguration) rpCtx.getProfileConfig()).setDeniedUserInfoAttributes(
- Collections.singleton("test2"));
+ Set.of("test2", "test4"));
registry = new AttributeTranscoderRegistryImpl();
registry.setId("test");
@@ -175,9 +179,55 @@ public class SetTokenDeliveryAttributesToResponseContextTest extends BaseOIDCRes
final OIDCAuthenticationResponseTokenClaimsContext respTokenClaims =
respCtx.getSubcontext(OIDCAuthenticationResponseTokenClaimsContext.class);
Assert.assertNotNull(respTokenClaims);
+
+ Assert.assertNull(respTokenClaims.getClaims().getClaim("test1"));
+ Assert.assertNull(respTokenClaims.getIdtokenClaims().getClaim("test1"));
Assert.assertEquals(respTokenClaims.getUserinfoClaims().getClaim("test1"), "value1 value2");
+
+ Assert.assertNull(respTokenClaims.getClaims().getClaim("test2"));
Assert.assertEquals(respTokenClaims.getIdtokenClaims().getClaim("test2"), "value");
+ Assert.assertNull(respTokenClaims.getUserinfoClaims().getClaim("test2"));
+
Assert.assertEquals(respTokenClaims.getClaims().getClaim("test3"), "value3");
+ Assert.assertNull(respTokenClaims.getIdtokenClaims().getClaim("test3"));
+ Assert.assertNull(respTokenClaims.getUserinfoClaims().getClaim("test3"));
+
+ Assert.assertNull(respTokenClaims.getClaims().getClaim("test4"));
+ Assert.assertNull(respTokenClaims.getIdtokenClaims().getClaim("test4"));
+ Assert.assertNull(respTokenClaims.getUserinfoClaims().getClaim("test4"));
+ }
+
+ /**
+ * Test that action create the context with a claim requested to id_token.
+ */
+ @Test
+ public void testSuccessWithClaimsRequestedToIdToken() {
+ setAttributeContext();
+ final Multimap<String,IdPAttribute> map = HashMultimap.create();
+ map.put("test1", new IdPAttribute("test1"));
+ map.put("test4", new IdPAttribute("test4"));
+ final AttributesMapContainer container = new AttributesMapContainer(map);
+ respCtx.setMappedIdTokenRequestedClaims(container);
+ final Event event = action.execute(requestCtx);
+ ActionTestingSupport.assertProceedEvent(event);
+ final OIDCAuthenticationResponseTokenClaimsContext respTokenClaims =
+ respCtx.getSubcontext(OIDCAuthenticationResponseTokenClaimsContext.class);
+ Assert.assertNotNull(respTokenClaims);
+ Assert.assertEquals(respTokenClaims.getClaims().getClaim("test1"), "value1 value2");
+ Assert.assertNull(respTokenClaims.getIdtokenClaims().getClaim("test1"));
+ Assert.assertNull(respTokenClaims.getUserinfoClaims().getClaim("test1"));
+
+ Assert.assertNull(respTokenClaims.getClaims().getClaim("test2"));
+ Assert.assertEquals(respTokenClaims.getIdtokenClaims().getClaim("test2"), "value");
+ Assert.assertNull(respTokenClaims.getUserinfoClaims().getClaim("test2"));
+
+ Assert.assertEquals(respTokenClaims.getClaims().getClaim("test3"), "value3");
+ Assert.assertNull(respTokenClaims.getIdtokenClaims().getClaim("test3"));
+ Assert.assertNull(respTokenClaims.getUserinfoClaims().getClaim("test3"));
+
+ Assert.assertNull(respTokenClaims.getClaims().getClaim("test4"));
+ Assert.assertEquals(respTokenClaims.getIdtokenClaims().getClaim("test4"), "value4");
+ Assert.assertNull(respTokenClaims.getUserinfoClaims().getClaim("test4"));
}
}
\ No newline at end of file
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list