[java-idp-plugin-oidc-rp] branch main updated: Add test for encryption using key agreement (ECDH-ES)

[Phil Smart]

This is an automated email from the git hooks/post-receive script.

philsmart pushed a commit to branch main
in repository java-idp-plugin-oidc-rp.

View the commit online:
http://git.shibboleth.net/view/?p=java-idp-plugin-oidc-rp.git;a=commit;h=d717720bc8c500b18bc08876bb4fac508aa5214e

The following commit(s) were added to refs/heads/main by this push:
     new d717720  Add test for encryption using key agreement (ECDH-ES)
d717720 is described below

commit d717720bc8c500b18bc08876bb4fac508aa5214e
Author: Phil Smart <philip.smart at jisc.ac.uk>
AuthorDate: Mon Aug 15 10:06:43 2022 +0100

    Add test for encryption using key agreement (ECDH-ES)
---
 .../plugin/authn/oidc/rp/impl/EncryptJWTTest.java  | 29 ++++++++++++++++++++++
 .../authn/oidc/rp/impl/TestCredentialHelper.java   |  8 +++---
 2 files changed, 33 insertions(+), 4 deletions(-)

diff --git a/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/EncryptJWTTest.java b/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/EncryptJWTTest.java
index 2a13fa1..f8afacf 100644
--- a/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/EncryptJWTTest.java
+++ b/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/EncryptJWTTest.java
@@ -17,6 +17,7 @@ import com.nimbusds.jose.JOSEException;
 import com.nimbusds.jose.JWEAlgorithm;
 import com.nimbusds.jose.JWEObject.State;
 import com.nimbusds.jose.crypto.AESDecrypter;
+import com.nimbusds.jose.crypto.ECDHDecrypter;
 import com.nimbusds.jose.crypto.RSADecrypter;
 import com.nimbusds.jose.jwk.Curve;
 import com.nimbusds.jose.jwk.ECKey;
@@ -178,5 +179,33 @@ public class EncryptJWTTest extends AbstractOIDCTest {
         final JWTClaimsSet claims = encryptedJWT.getJWTClaimsSet();
         assertEquals(claims.getIssuer(), "https://rp.example.com"); 
     }
+    
+    @Test
+    public void testEncryptWithKeyAgreement() throws Exception {
+        
+        params.setKeyTransportEncryptionAlgorithm(KeyManagementConstants.ALGO_ID_ALG_ECDH_ES_AES_128_KW);
+        params.setDataEncryptionAlgorithm(EncryptionConstants.ALGO_ID_ENC_ALG_A128GCM);
+        
+        final var key = new ECKeyGenerator(Curve.P_256)
+                .keyUse(KeyUse.ENCRYPTION)
+                .keyID("1")
+                .generate();
+        
+        final var sharedKey = TestCredentialHelper.createKeyAgreementCredential(key);
+        params.setKeyTransportEncryptionCredential(sharedKey);
+        
+        action.initialize();        
+        action.invoke(prc.getOutboundMessageContext());
+        
+        assertNotNull(prc.getOutboundMessageContext().getMessage());
+        assertTrue(prc.getOutboundMessageContext().getMessage() instanceof EncryptedJWT);
+        
+        final EncryptedJWT encryptedJWT = (EncryptedJWT) prc.getOutboundMessageContext().getMessage();
+        final ECDHDecrypter decrypter = new ECDHDecrypter(key);
+        encryptedJWT.decrypt(decrypter);
+        assertTrue(encryptedJWT.getState() == State.DECRYPTED);
+        final JWTClaimsSet claims = encryptedJWT.getJWTClaimsSet();
+        assertEquals(claims.getIssuer(), "https://rp.example.com"); 
+    }
 
 }
diff --git a/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/TestCredentialHelper.java b/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/TestCredentialHelper.java
index 96bcaa9..2cf3a67 100644
--- a/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/TestCredentialHelper.java
+++ b/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/TestCredentialHelper.java
@@ -123,9 +123,9 @@ public final class TestCredentialHelper {
     
     
     /**
-     * Create a direct encryption {@link JWKCredential} from the given shared secret.
+     * Create a key encryption {@link JWKCredential} from the given RSA key.
      * 
-     * @param secret the secret to convert to a {@link JWKCredential}.
+     * @param secret the RSAKey to convert to a {@link JWKCredential}.
      * 
      * @return the credential
      * @throws JOSEException  on error
@@ -144,9 +144,9 @@ public final class TestCredentialHelper {
     }
     
     /**
-     * Create a direct encryption {@link JWKCredential} from the given shared secret.
+     * Create a key agreement encryption {@link JWKCredential} from the given EC key.
      * 
-     * @param secret the secret to convert to a {@link JWKCredential}.
+     * @param secret the ECKey to convert to a {@link JWKCredential}.
      * 
      * @return the credential
      * @throws JOSEException  on error

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.