[java-oidc-common] branch main updated: JCOMOIDC-57 - Add requested ACR validation check
Phil Smart
philip.smart at jisc.ac.uk
Fri Dec 16 12:34:31 UTC 2022
This is an automated email from the git hooks/post-receive script.
philsmart pushed a commit to branch main
in repository java-oidc-common.
View the commit online:
http://git.shibboleth.net/view/?p=java-oidc-common.git;a=commit;h=0de2ab1dfb25c2e08954b44ba72e8859ac2918ef
The following commit(s) were added to refs/heads/main by this push:
new 0de2ab1 JCOMOIDC-57 - Add requested ACR validation check
0de2ab1 is described below
commit 0de2ab1dfb25c2e08954b44ba72e8859ac2918ef
Author: Phil Smart <philip.smart at jisc.ac.uk>
AuthorDate: Fri Dec 16 12:34:29 2022 +0000
JCOMOIDC-57 - Add requested ACR validation check
- Add validator and lookup strategy
https://shibboleth.atlassian.net/browse/JCOMOIDC-57
---
.../jwt/claims/impl/ACRClaimsValidator.java | 110 ++++++++++++++++++++
.../jwt/claims/impl/AudienceClaimsValidator.java | 1 -
.../RequestedEssentialACRClaimsLookupStrategy.java | 89 ++++++++++++++++
.../jwt/claims/impl/ACRClaimsValidatorTest.java | 112 +++++++++++++++++++++
.../AuthTimeRequestedActivationConditionTest.java | 9 +-
...uestedEssentialACRClaimsLookupStrategyTest.java | 107 ++++++++++++++++++++
6 files changed, 424 insertions(+), 4 deletions(-)
diff --git a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/jwt/claims/impl/ACRClaimsValidator.java b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/jwt/claims/impl/ACRClaimsValidator.java
new file mode 100644
index 0000000..2fdd3fa
--- /dev/null
+++ b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/jwt/claims/impl/ACRClaimsValidator.java
@@ -0,0 +1,110 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.oidc.security.jwt.claims.impl;
+
+import java.text.ParseException;
+import java.util.List;
+import java.util.function.BiFunction;
+
+import javax.annotation.Nonnull;
+
+import org.opensaml.profile.context.ProfileRequestContext;
+
+import com.nimbusds.jwt.JWTClaimsSet;
+
+import net.shibboleth.oidc.jwt.claims.AbstractClaimsValidator;
+import net.shibboleth.oidc.jwt.claims.JWTValidationException;
+import net.shibboleth.utilities.java.support.annotation.constraint.NonnullAfterInit;
+import net.shibboleth.utilities.java.support.annotation.constraint.ThreadSafeAfterInit;
+import net.shibboleth.utilities.java.support.component.ComponentInitializationException;
+import net.shibboleth.utilities.java.support.component.ComponentSupport;
+import net.shibboleth.utilities.java.support.logic.Constraint;
+
+/**
+ * Check the ACR value requested was received.
+ *
+ * <p>Only those essential ACR requested values are validated. Voluntary ACR claims optionally appear in the returned
+ * claims set and can not be meaningfully validated here.</p>
+ */
+ at ThreadSafeAfterInit
+public class ACRClaimsValidator extends AbstractClaimsValidator {
+
+ /** Strategy to find the essential requested ACR claim values.*/
+ @NonnullAfterInit
+ private BiFunction<ProfileRequestContext,JWTClaimsSet, List<String>> requestedEssentialAcrsClaimLookupStrategy;
+
+
+ @Override
+ protected void doInitialize() throws ComponentInitializationException {
+ super.doInitialize();
+
+ if (requestedEssentialAcrsClaimLookupStrategy == null) {
+ throw new ComponentInitializationException("Requested Essential ACR Claim Lookup Strategy can not be null");
+ }
+ }
+
+ /**
+ * Set the strategy to locate the requested ACR claim values, if any.
+ *
+ * @param strategy the strategy
+ */
+ public void setRequestedEssentialAcrsClaimLookupStrategy(
+ @Nonnull final BiFunction<ProfileRequestContext, JWTClaimsSet, List<String>> strategy) {
+ ComponentSupport.ifInitializedThrowUnmodifiabledComponentException(this);
+ ComponentSupport.ifDestroyedThrowDestroyedComponentException(this);
+
+ requestedEssentialAcrsClaimLookupStrategy = Constraint.isNotNull(strategy,
+ "requestedAcrClaimLookupStrategy can not be null");
+ }
+
+
+ @Override
+ protected void doValidate(@Nonnull final JWTClaimsSet claims, @Nonnull final ProfileRequestContext context)
+ throws JWTValidationException {
+
+
+ final List<String> requestedClaims = requestedEssentialAcrsClaimLookupStrategy.apply(context, claims);
+
+ if (requestedClaims == null || requestedClaims.isEmpty()) {
+ // Nothing requested, nothing to check
+ return;
+ }
+
+ try {
+ final String receivedAcrClaim = claims.getStringClaim("acr");
+ if (receivedAcrClaim == null) {
+ // ACR claim has been requested but not received
+ throw new JWTValidationException("ACR claim requested but not received inside ID Token");
+ }
+
+ // Check the received claim was one of the requested ones.
+ final boolean receivedWasRequested = requestedClaims.contains(receivedAcrClaim);
+ if (!receivedWasRequested) {
+ throw new JWTValidationException("Did not receive one of the requested ACR claim values. Requested '"
+ +requestedClaims.toString()+"', received '"+receivedAcrClaim+"'");
+ }
+
+ } catch (final ParseException e) {
+ throw new JWTValidationException("ACR claim requested, but none received inside ID Token");
+ }
+
+
+
+ }
+
+}
diff --git a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/jwt/claims/impl/AudienceClaimsValidator.java b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/jwt/claims/impl/AudienceClaimsValidator.java
index 58aeb69..555d05a 100644
--- a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/jwt/claims/impl/AudienceClaimsValidator.java
+++ b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/jwt/claims/impl/AudienceClaimsValidator.java
@@ -15,7 +15,6 @@
* limitations under the License.
*/
-
package net.shibboleth.oidc.security.jwt.claims.impl;
import java.util.Collections;
diff --git a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/jwt/claims/impl/RequestedEssentialACRClaimsLookupStrategy.java b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/jwt/claims/impl/RequestedEssentialACRClaimsLookupStrategy.java
new file mode 100644
index 0000000..20aaad1
--- /dev/null
+++ b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/jwt/claims/impl/RequestedEssentialACRClaimsLookupStrategy.java
@@ -0,0 +1,89 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.oidc.security.jwt.claims.impl;
+
+import java.util.Collections;
+import java.util.List;
+import java.util.function.BiFunction;
+import java.util.function.Function;
+
+import javax.annotation.Nonnull;
+
+import org.opensaml.profile.context.ProfileRequestContext;
+
+import com.nimbusds.jwt.JWTClaimsSet;
+import com.nimbusds.openid.connect.sdk.OIDCClaimsRequest;
+import com.nimbusds.openid.connect.sdk.claims.ClaimRequirement;
+import com.nimbusds.openid.connect.sdk.claims.ClaimsSetRequest;
+import com.nimbusds.openid.connect.sdk.claims.ClaimsSetRequest.Entry;
+
+import net.shibboleth.oidc.profile.core.OIDCAuthenticationRequest;
+import net.shibboleth.utilities.java.support.annotation.ParameterName;
+import net.shibboleth.utilities.java.support.logic.Constraint;
+
+/**
+ * Strategy that looks up any requested ACR claims from the requested claims object that have to be contained in
+ * the token's claims set.
+ *
+ * <p>These only come from 'essential' ACR claim requests. 'voluntary' ACR claim requests and the optional 'acr_values'
+ * authentication request parameter are not included.</p>
+ */
+public class RequestedEssentialACRClaimsLookupStrategy
+ implements BiFunction<ProfileRequestContext,JWTClaimsSet, List<String>> {
+
+ /** Strategy to find the authentication request.*/
+ @Nonnull private final
+ Function<ProfileRequestContext, OIDCAuthenticationRequest> authenticationRequestLookupStrategy;
+
+ public RequestedEssentialACRClaimsLookupStrategy(@ParameterName(name = "authenticationRequestLookupStrategy")
+ @Nonnull final Function<ProfileRequestContext, OIDCAuthenticationRequest> strategy) {
+ authenticationRequestLookupStrategy = Constraint.isNotNull(strategy,
+ "authenticationRequestLookupStrategy can not be null");
+ }
+
+ @Override
+ public List<String> apply(final ProfileRequestContext prc, final JWTClaimsSet claims) {
+
+ final OIDCAuthenticationRequest authRequest = authenticationRequestLookupStrategy.apply(prc);
+
+ if (authRequest == null) {
+ return Collections.emptyList();
+ }
+
+
+ final OIDCClaimsRequest requestedClaims = authRequest.getRequestedClaims();
+ if (requestedClaims != null) {
+ final ClaimsSetRequest idTokenRequested = requestedClaims.getIDTokenClaimsRequest();
+ if (idTokenRequested == null) {
+ // Nothing requested
+ return Collections.emptyList();
+ }
+ final Entry acrs = idTokenRequested.get("acr");
+ if (acrs != null && acrs.getClaimRequirement() == ClaimRequirement.ESSENTIAL) {
+ if (acrs.getValueAsString() != null) {
+ return List.of(acrs.getValueAsString());
+ } else if (acrs.getValuesAsListOfStrings() != null){
+ return Collections.unmodifiableList(acrs.getValuesAsListOfStrings());
+ }
+ // Else we do not know what they are
+ }
+ }
+ return Collections.emptyList();
+ }
+
+}
diff --git a/oidc-common-crypto-impl/src/test/java/net/shibboleth/oidc/security/jwt/claims/impl/ACRClaimsValidatorTest.java b/oidc-common-crypto-impl/src/test/java/net/shibboleth/oidc/security/jwt/claims/impl/ACRClaimsValidatorTest.java
new file mode 100644
index 0000000..5a42011
--- /dev/null
+++ b/oidc-common-crypto-impl/src/test/java/net/shibboleth/oidc/security/jwt/claims/impl/ACRClaimsValidatorTest.java
@@ -0,0 +1,112 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.oidc.security.jwt.claims.impl;
+
+import java.util.Collections;
+import java.util.List;
+
+import javax.annotation.Nonnull;
+
+import org.testng.annotations.BeforeMethod;
+import org.testng.annotations.Test;
+
+import com.nimbusds.jwt.JWTClaimsSet;
+
+import net.shibboleth.oidc.jwt.claims.JWTValidationException;
+import net.shibboleth.utilities.java.support.component.ComponentInitializationException;
+
+/** Tests for the {@link ACRClaimsValidator}.*/
+public class ACRClaimsValidatorTest extends AbstractClaimsValidatorTest {
+
+ /** The validator to test.*/
+ @Nonnull private ACRClaimsValidator validator;
+
+
+ @Override
+ @BeforeMethod
+ public void setup() throws ComponentInitializationException {
+ super.setup();
+ validator = new ACRClaimsValidator();
+ }
+
+ @Test
+ public void testValid() throws JWTValidationException, ComponentInitializationException {
+ final JWTClaimsSet claimsSet = new JWTClaimsSet.Builder().audience("client-id")
+ .claim("acr", "urn:mace:incommon:iap:silver").build();
+ validator.setId("test-validator");
+ validator.setRequestedEssentialAcrsClaimLookupStrategy((prc, claims) -> List.of("urn:mace:incommon:iap:silver"));
+ validator.initialize();
+ validator.validate(claimsSet, prc);
+ }
+
+ @Test
+ public void testValid_NothingRequested() throws JWTValidationException, ComponentInitializationException {
+ final JWTClaimsSet claimsSet = new JWTClaimsSet.Builder().audience("client-id")
+ .claim("acr", "urn:mace:incommon:iap:silver").build();
+ validator.setId("test-validator");
+ validator.setRequestedEssentialAcrsClaimLookupStrategy((prc, claims) -> Collections.emptyList());
+ validator.initialize();
+ validator.validate(claimsSet, prc);
+ }
+
+ @Test
+ public void testValid_NullRequested() throws JWTValidationException, ComponentInitializationException {
+ final JWTClaimsSet claimsSet = new JWTClaimsSet.Builder().audience("client-id")
+ .claim("acr", "urn:mace:incommon:iap:silver").build();
+ validator.setId("test-validator");
+ validator.setRequestedEssentialAcrsClaimLookupStrategy((prc, claims) -> null);
+ validator.initialize();
+ validator.validate(claimsSet, prc);
+ }
+
+
+ @Test
+ public void testValid_OneOfRequestedReturned() throws JWTValidationException, ComponentInitializationException {
+ final JWTClaimsSet claimsSet = new JWTClaimsSet.Builder().audience("client-id")
+ .claim("acr", "urn:mace:incommon:iap:silver").build();
+ validator.setId("test-validator");
+ validator.setRequestedEssentialAcrsClaimLookupStrategy((prc, claims) -> List.of("urn:mace:incommon:iap:bronze",
+ "urn:mace:incommon:iap:silver"));
+ validator.initialize();
+ validator.validate(claimsSet, prc);
+ }
+
+ @Test(expectedExceptions = JWTValidationException.class)
+ public void testRejected_ReceivedDifferentThanRequested()
+ throws JWTValidationException, ComponentInitializationException {
+ final JWTClaimsSet claimsSet = new JWTClaimsSet.Builder().audience("client-id")
+ .claim("acr", "urn:mace:incommon:iap:bronze").build();
+ validator.setId("test-validator");
+ validator.setRequestedEssentialAcrsClaimLookupStrategy((prc, claims) -> List.of("urn:mace:incommon:iap:silver"));
+ validator.initialize();
+ validator.validate(claimsSet, prc);
+ }
+
+ @Test(expectedExceptions = JWTValidationException.class)
+ public void testRejected_RequestedBuNotReceived()
+ throws JWTValidationException, ComponentInitializationException {
+ final JWTClaimsSet claimsSet = new JWTClaimsSet.Builder().audience("client-id").build();
+ validator.setId("test-validator");
+ validator.setRequestedEssentialAcrsClaimLookupStrategy((prc, claims) -> List.of("urn:mace:incommon:iap:silver"));
+ validator.initialize();
+ validator.validate(claimsSet, prc);
+ }
+
+
+
+}
diff --git a/oidc-common-crypto-impl/src/test/java/net/shibboleth/oidc/security/jwt/claims/impl/AuthTimeRequestedActivationConditionTest.java b/oidc-common-crypto-impl/src/test/java/net/shibboleth/oidc/security/jwt/claims/impl/AuthTimeRequestedActivationConditionTest.java
index b5bfb6d..bd697c7 100644
--- a/oidc-common-crypto-impl/src/test/java/net/shibboleth/oidc/security/jwt/claims/impl/AuthTimeRequestedActivationConditionTest.java
+++ b/oidc-common-crypto-impl/src/test/java/net/shibboleth/oidc/security/jwt/claims/impl/AuthTimeRequestedActivationConditionTest.java
@@ -47,7 +47,8 @@ public class AuthTimeRequestedActivationConditionTest extends AbstractClaimsVali
}
@Test
- public void testRequired_AuthTimeRequestedViaMaxAge() throws JWTValidationException, ComponentInitializationException {
+ public void testRequired_AuthTimeRequestedViaMaxAge()
+ throws JWTValidationException, ComponentInitializationException {
final OIDCAuthenticationRequest request = new OIDCAuthenticationRequest(new ClientID("mock-client"));
request.setMaxAge(Duration.ofSeconds(60));
@@ -60,12 +61,14 @@ public class AuthTimeRequestedActivationConditionTest extends AbstractClaimsVali
}
@Test
- public void testRequired_AuthTimeRequestedViaEssentialClaim() throws JWTValidationException, ComponentInitializationException {
+ public void testRequired_AuthTimeRequestedViaEssentialClaim()
+ throws JWTValidationException, ComponentInitializationException {
final OIDCAuthenticationRequest request = new OIDCAuthenticationRequest(new ClientID("mock-client"));
final ClaimsSetRequest idTokenClaimsRequest =
- new ClaimsSetRequest().add(new ClaimsSetRequest.Entry("auth_time").withClaimRequirement(ClaimRequirement.ESSENTIAL));
+ new ClaimsSetRequest().add(new ClaimsSetRequest.Entry("auth_time")
+ .withClaimRequirement(ClaimRequirement.ESSENTIAL));
final OIDCClaimsRequest requested = new OIDCClaimsRequest().withIDTokenClaimsRequest(idTokenClaimsRequest);
request.setRequestedClaims(requested);
diff --git a/oidc-common-crypto-impl/src/test/java/net/shibboleth/oidc/security/jwt/claims/impl/RequestedEssentialACRClaimsLookupStrategyTest.java b/oidc-common-crypto-impl/src/test/java/net/shibboleth/oidc/security/jwt/claims/impl/RequestedEssentialACRClaimsLookupStrategyTest.java
new file mode 100644
index 0000000..b6d4e1e
--- /dev/null
+++ b/oidc-common-crypto-impl/src/test/java/net/shibboleth/oidc/security/jwt/claims/impl/RequestedEssentialACRClaimsLookupStrategyTest.java
@@ -0,0 +1,107 @@
+
+package net.shibboleth.oidc.security.jwt.claims.impl;
+
+import static org.testng.Assert.assertTrue;
+
+import java.util.List;
+
+import javax.annotation.Nonnull;
+
+import org.testng.annotations.BeforeMethod;
+import org.testng.annotations.Test;
+
+import com.nimbusds.jwt.JWTClaimsSet;
+import com.nimbusds.oauth2.sdk.id.ClientID;
+import com.nimbusds.openid.connect.sdk.OIDCClaimsRequest;
+import com.nimbusds.openid.connect.sdk.claims.ClaimRequirement;
+import com.nimbusds.openid.connect.sdk.claims.ClaimsSetRequest;
+
+import net.shibboleth.oidc.jwt.claims.JWTValidationException;
+import net.shibboleth.oidc.profile.core.OIDCAuthenticationRequest;
+import net.shibboleth.utilities.java.support.component.ComponentInitializationException;
+
+/** Tests for the {@link RequestedEssentialACRClaimsLookupStrategy}.*/
+public class RequestedEssentialACRClaimsLookupStrategyTest extends AbstractClaimsValidatorTest {
+
+ /** The validator to test.*/
+ @Nonnull private RequestedEssentialACRClaimsLookupStrategy strategy;
+
+
+ @Override
+ @BeforeMethod
+ public void setup() throws ComponentInitializationException {
+ super.setup();
+ }
+
+ @Test
+ public void testIncluded() throws JWTValidationException, ComponentInitializationException {
+
+ final OIDCAuthenticationRequest request = new OIDCAuthenticationRequest(new ClientID("mock-client"));
+
+ final ClaimsSetRequest idTokenClaimsRequest =
+ new ClaimsSetRequest().add(new ClaimsSetRequest.Entry("acr")
+ .withClaimRequirement(ClaimRequirement.ESSENTIAL).withValue("urn:mace:incommon:iap:silver"));
+
+ final OIDCClaimsRequest requested = new OIDCClaimsRequest().withIDTokenClaimsRequest(idTokenClaimsRequest);
+ request.setRequestedClaims(requested);
+
+ strategy = new RequestedEssentialACRClaimsLookupStrategy((prc) -> request);
+
+ final JWTClaimsSet claimsSet = new JWTClaimsSet.Builder().audience("client-id").build();
+ final List<String> essentialAcrs = strategy.apply(prc, claimsSet);
+ assertTrue(essentialAcrs.contains("urn:mace:incommon:iap:silver"));
+ }
+
+ @Test
+ public void testIncluded_List() throws JWTValidationException, ComponentInitializationException {
+
+ final OIDCAuthenticationRequest request = new OIDCAuthenticationRequest(new ClientID("mock-client"));
+
+ final ClaimsSetRequest idTokenClaimsRequest =
+ new ClaimsSetRequest().add(new ClaimsSetRequest.Entry("acr")
+ .withClaimRequirement(ClaimRequirement.ESSENTIAL).withValues(
+ List.of("urn:mace:incommon:iap:silver", "urn:mace:incommon:iap:bronze")));
+
+ final OIDCClaimsRequest requested = new OIDCClaimsRequest().withIDTokenClaimsRequest(idTokenClaimsRequest);
+ request.setRequestedClaims(requested);
+
+ strategy = new RequestedEssentialACRClaimsLookupStrategy((prc) -> request);
+
+ final JWTClaimsSet claimsSet = new JWTClaimsSet.Builder().audience("client-id").build();
+ final List<String> essentialAcrs = strategy.apply(prc, claimsSet);
+ assertTrue(essentialAcrs.contains("urn:mace:incommon:iap:silver"));
+ assertTrue(essentialAcrs.contains("urn:mace:incommon:iap:bronze"));
+ }
+
+ @Test
+ public void testNoRequestedClaims() throws JWTValidationException, ComponentInitializationException {
+
+ final OIDCAuthenticationRequest request = new OIDCAuthenticationRequest(new ClientID("mock-client"));
+
+ strategy = new RequestedEssentialACRClaimsLookupStrategy((prc) -> request);
+
+ final JWTClaimsSet claimsSet = new JWTClaimsSet.Builder().audience("client-id").build();
+ final List<String> essentialAcrs = strategy.apply(prc, claimsSet);
+ assertTrue(essentialAcrs.isEmpty());
+ }
+
+ @Test
+ public void testNotIncluded_NotEssential() throws JWTValidationException, ComponentInitializationException {
+
+ final OIDCAuthenticationRequest request = new OIDCAuthenticationRequest(new ClientID("mock-client"));
+
+ final ClaimsSetRequest idTokenClaimsRequest =
+ new ClaimsSetRequest().add(new ClaimsSetRequest.Entry("acr")
+ .withClaimRequirement(ClaimRequirement.VOLUNTARY).withValue("urn:mace:incommon:iap:silver"));
+
+ final OIDCClaimsRequest requested = new OIDCClaimsRequest().withIDTokenClaimsRequest(idTokenClaimsRequest);
+ request.setRequestedClaims(requested);
+
+ strategy = new RequestedEssentialACRClaimsLookupStrategy((prc) -> request);
+
+ final JWTClaimsSet claimsSet = new JWTClaimsSet.Builder().audience("client-id").build();
+ final List<String> essentialAcrs = strategy.apply(prc, claimsSet);
+ assertTrue(!essentialAcrs.contains("urn:mace:incommon:iap:silver"));
+ }
+
+}
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list