[java-idp-plugin-oidc-rp] branch main updated: Improve request object tests
Phil Smart
philip.smart at jisc.ac.uk
Mon Dec 19 09:56:52 UTC 2022
This is an automated email from the git hooks/post-receive script.
philsmart pushed a commit to branch main
in repository java-idp-plugin-oidc-rp.
View the commit online:
http://git.shibboleth.net/view/?p=java-idp-plugin-oidc-rp.git;a=commit;h=35630a40a08671ae58f6aeea4ef13efa519eee77
The following commit(s) were added to refs/heads/main by this push:
new 35630a4 Improve request object tests
35630a4 is described below
commit 35630a40a08671ae58f6aeea4ef13efa519eee77
Author: Phil Smart <philip.smart at jisc.ac.uk>
AuthorDate: Mon Dec 19 09:56:34 2022 +0000
Improve request object tests
---
.../impl/{AddState.java => AddStateHandler.java} | 6 +-
.../oidc-relying-party-authn-beans.xml | 2 +-
.../oidc/rp/impl/AuthorizationControllerTest.java | 69 ++++++++++++----------
...{AddStateTest.java => AddStateHandlerTest.java} | 6 +-
4 files changed, 46 insertions(+), 37 deletions(-)
diff --git a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/impl/AddState.java b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/impl/AddStateHandler.java
similarity index 96%
rename from idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/impl/AddState.java
rename to idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/impl/AddStateHandler.java
index 2df4d73..1aa88a6 100644
--- a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/impl/AddState.java
+++ b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/impl/AddStateHandler.java
@@ -39,19 +39,19 @@ import net.shibboleth.utilities.java.support.component.ComponentSupport;
* By default this is generated by concatenating the Hex value of the spring webflow execution
* key with a secure random 32 character nonce.
* */
-public class AddState extends AbstractOIDCAuthenticationRequestMessageHandler {
+public class AddStateHandler extends AbstractOIDCAuthenticationRequestMessageHandler {
/** The 'state' claim name.*/
@Nonnull private static final String STATE_CLAIM = "state";
/** Logger. */
- @Nonnull private final Logger log = LoggerFactory.getLogger(AddState.class);
+ @Nonnull private final Logger log = LoggerFactory.getLogger(AddStateHandler.class);
/** Function to create a suitable 'state' to add to the authentication request.*/
@Nonnull private Function<MessageContext, String> stateGenerationStrategy;
/** Constructor.*/
- public AddState() {
+ public AddStateHandler() {
// By default, generate state from the SWF key and a 32 character nonce.
stateGenerationStrategy = msg -> {
if (getOutboundMessageContext() != null) {
diff --git a/idp-oidc-rp-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/OIDCRelyingParty/oidc-relying-party-authn-beans.xml b/idp-oidc-rp-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/OIDCRelyingParty/oidc-relying-party-authn-beans.xml
index 7669289..22f69c7 100644
--- a/idp-oidc-rp-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/OIDCRelyingParty/oidc-relying-party-authn-beans.xml
+++ b/idp-oidc-rp-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/OIDCRelyingParty/oidc-relying-party-authn-beans.xml
@@ -261,7 +261,7 @@
scope="prototype">
<property name="handlers">
<list>
- <bean id="AddState" class="net.shibboleth.idp.plugin.authn.oidc.rp.messaging.impl.AddState"
+ <bean id="AddState" class="net.shibboleth.idp.plugin.authn.oidc.rp.messaging.impl.AddStateHandler"
scope="prototype"
p:stateGenerationStrategy="#{getObject('shibboleth.authn.oidc.rp.StateGenerationStrategy')}" />
diff --git a/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/AuthorizationControllerTest.java b/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/AuthorizationControllerTest.java
index 29b9a58..12ebb26 100644
--- a/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/AuthorizationControllerTest.java
+++ b/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/AuthorizationControllerTest.java
@@ -20,6 +20,7 @@ package net.shibboleth.idp.plugin.authn.oidc.rp.impl;
import static org.springframework.test.web.servlet.request.MockMvcRequestBuilders.get;
import static org.springframework.test.web.servlet.result.MockMvcResultHandlers.print;
import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.status;
+import static org.testng.Assert.assertEquals;
import static org.testng.Assert.assertFalse;
import static org.testng.Assert.assertNotNull;
import static org.testng.Assert.assertNull;
@@ -28,7 +29,9 @@ import static org.testng.Assert.assertTrue;
import java.io.IOException;
import java.net.URI;
import java.net.URLEncoder;
+import java.nio.charset.Charset;
import java.util.ArrayList;
+import java.util.List;
import javax.annotation.Nonnull;
import javax.annotation.Nullable;
@@ -36,6 +39,8 @@ import javax.servlet.ServletContext;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
+import org.apache.http.NameValuePair;
+import org.apache.http.client.utils.URLEncodedUtils;
import org.mockito.Mockito;
import org.opensaml.messaging.context.MessageContext;
import org.opensaml.messaging.decoder.MessageDecodingException;
@@ -67,10 +72,7 @@ import org.springframework.webflow.executor.FlowExecutorImpl;
import org.testng.annotations.BeforeMethod;
import org.testng.annotations.Test;
-import com.nimbusds.jose.JWEAlgorithm;
-import com.nimbusds.jose.jwk.KeyUse;
-import com.nimbusds.jose.jwk.RSAKey;
-import com.nimbusds.jose.jwk.gen.RSAKeyGenerator;
+import com.nimbusds.jwt.SignedJWT;
import com.nimbusds.oauth2.sdk.ResponseType;
import com.nimbusds.oauth2.sdk.Scope;
import com.nimbusds.oauth2.sdk.id.Audience;
@@ -90,7 +92,7 @@ import net.shibboleth.idp.plugin.authn.oidc.rp.context.OIDCAuthnContext;
import net.shibboleth.idp.plugin.authn.oidc.rp.context.OIDCPeerEntityContext;
import net.shibboleth.idp.plugin.authn.oidc.rp.messaging.context.logic.JWTClaimsSetFromRequestObjectLookupFunction;
import net.shibboleth.idp.plugin.authn.oidc.rp.messaging.context.logic.PayloadFromRequestObjectLookupFunction;
-import net.shibboleth.idp.plugin.authn.oidc.rp.messaging.impl.AddState;
+import net.shibboleth.idp.plugin.authn.oidc.rp.messaging.impl.AddStateHandler;
import net.shibboleth.idp.plugin.authn.oidc.rp.messaging.impl.BuildPlainRequestObjectJWT;
import net.shibboleth.idp.plugin.authn.oidc.rp.messaging.impl.EncryptJWT;
import net.shibboleth.idp.plugin.authn.oidc.rp.messaging.impl.SignJWT;
@@ -102,7 +104,6 @@ import net.shibboleth.oidc.profile.config.OIDCAuthorizationConfiguration.OIDCHtt
import net.shibboleth.oidc.profile.core.OIDCAuthenticationRequest;
import net.shibboleth.oidc.profile.decoding.OIDCMessageDecoder;
import net.shibboleth.oidc.profile.encoding.impl.AbstractOIDCMessageEncoder;
-import net.shibboleth.oidc.security.JWTEncryptionParameters;
import net.shibboleth.oidc.security.JWTSignatureSigningParameters;
import net.shibboleth.oidc.security.context.JWTSecurityParametersContext;
import net.shibboleth.utilities.java.support.component.ComponentInitializationException;
@@ -208,15 +209,32 @@ public class AuthorizationControllerTest extends AbstractTestNGSpringContextTest
assertNotNull(result.getResponse().getHeader("Location"));
final ExternalAuthenticationContext extContext = extractExternalAuthContext();
// assert no error in the context
- assertNull(extContext.getAuthnError());
- //basic check of the redirection URL.
+ assertNull(extContext.getAuthnError());
assertTrue(result.getResponse().getRedirectedUrl().contains(ENDPOINT_URI));
- assertTrue(result.getResponse().getRedirectedUrl().contains("client_id"));
- assertTrue(result.getResponse().getRedirectedUrl().contains("response_type"));
- assertTrue(result.getResponse().getRedirectedUrl().contains("scope"));
- assertTrue(result.getResponse().getRedirectedUrl().contains("request"));
- // TODO state must be inside RequestObject. validate the request object
- //assertTrue(result.getResponse().getRedirectedUrl().contains("state"));
+ final String redirect = result.getResponse().getRedirectedUrl();
+ final List<NameValuePair> params = URLEncodedUtils.parse(new URI(redirect), Charset.forName("UTF-8"));
+ //basic check of the redirection URL.
+ assertTrue(params.stream().anyMatch(p -> p.getName().equals("client_id")));
+ assertTrue(params.stream().anyMatch(p -> p.getName().equals("response_type")));
+ assertTrue(params.stream().anyMatch(p -> p.getName().equals("scope")));
+ assertTrue(params.stream().anyMatch(p -> p.getName().equals("request")));
+
+ //Check Request Object contents
+ final NameValuePair requestPair =
+ params.stream().filter(p -> p.getName().equals("request")).findFirst().orElseThrow();
+
+ final SignedJWT jwt = SignedJWT.parse(requestPair.getValue());
+ assertNotNull(jwt);
+ assertEquals(jwt.getJWTClaimsSet().getAudience().size(),1);
+ assertEquals(jwt.getJWTClaimsSet().getAudience().get(0),"mock_rp");
+ assertEquals(jwt.getJWTClaimsSet().getIssuer(),"mock_op");
+ assertEquals(jwt.getJWTClaimsSet().getStringListClaim("scope").size(),1);
+ assertEquals(jwt.getJWTClaimsSet().getStringListClaim("scope").get(0),"openid");
+ assertEquals(jwt.getJWTClaimsSet().getStringClaim("nonce"),"nonce");
+ assertNotNull(jwt.getJWTClaimsSet().getStringClaim("state"));
+ assertEquals(jwt.getJWTClaimsSet().getStringClaim("redirect_uri"),REDIRECT_URI);
+
+
}
/**
@@ -228,10 +246,11 @@ public class AuthorizationControllerTest extends AbstractTestNGSpringContextTest
final ClaimsSet requestObjectClaims = new ClaimsSet();
requestObjectClaims.setClaim("client_id", "mock_client");
- requestObjectClaims.setAudience(new Audience("mock-op"));
- requestObjectClaims.setIssuer(new Issuer("mock_client"));
+ requestObjectClaims.setAudience(new Audience("mock_rp"));
+ requestObjectClaims.setIssuer(new Issuer("mock_op"));
requestObjectClaims.setClaim("scope", new Scope("openid"));
-
+ requestObjectClaims.setClaim("nonce", "nonce");
+ requestObjectClaims.setClaim("redirect_uri", REDIRECT_URI);
request.setRequestObjectClaimsSet(requestObjectClaims);
}
@@ -286,7 +305,7 @@ public class AuthorizationControllerTest extends AbstractTestNGSpringContextTest
final var chainingMsgHandler = new BasicMessageHandlerChain();
final var handlers = new ArrayList<MessageHandler>();
- final var addState = new AddState();
+ final var addState = new AddStateHandler();
addState.initialize();
final var signer = new SignJWT();
signer.setClaimsToSignLookupStrategy(new JWTClaimsSetFromRequestObjectLookupFunction());
@@ -297,8 +316,7 @@ public class AuthorizationControllerTest extends AbstractTestNGSpringContextTest
final var encrypter = new EncryptJWT();
encrypter.setPayloadToEncryptLookupStrategy(new PayloadFromRequestObjectLookupFunction());
encrypter.setJwtUpdateConsumer(new RequestObjectTokenUpdateStrategy());
- encrypter.initialize();
-
+ encrypter.initialize();
handlers.add(addState);
handlers.add(buildRequestObjectJwt);
@@ -324,16 +342,7 @@ public class AuthorizationControllerTest extends AbstractTestNGSpringContextTest
sigParams.setSigningCredential(TestCredentialHelper.createClientSecretCredential(CLIENT_SECRET));
secContext.setSignatureSigningParameters(sigParams);
- final var encParams = new JWTEncryptionParameters();
- encParams.setDataEncryptionAlgorithm("A128CBC-HS256");
- encParams.setKeyTransportEncryptionAlgorithm("RSA-OAEP-256");
- final RSAKey key = new RSAKeyGenerator(2048)
- .algorithm(JWEAlgorithm.RSA_OAEP_256)
- .keyUse(KeyUse.ENCRYPTION)
- .keyID("mock-key")
- .generate();
- encParams.setKeyTransportEncryptionCredential(TestCredentialHelper.createKeyEncryptionCredential(key));
- secContext.setEncryptionParameters(encParams);
+ // We only sign, so do not set enc. params
}
/**
diff --git a/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/impl/AddStateTest.java b/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/impl/AddStateHandlerTest.java
similarity index 96%
rename from idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/impl/AddStateTest.java
rename to idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/impl/AddStateHandlerTest.java
index e3ad43c..5e718f3 100644
--- a/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/impl/AddStateTest.java
+++ b/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/impl/AddStateHandlerTest.java
@@ -36,13 +36,13 @@ import net.shibboleth.idp.plugin.authn.oidc.rp.impl.AbstractOIDCTest;
import net.shibboleth.oidc.profile.core.OIDCAuthenticationRequest;
/** Tests for AddState.*/
-public class AddStateTest extends AbstractOIDCTest {
+public class AddStateHandlerTest extends AbstractOIDCTest {
/** The SWF key.*/
private static final String SWF_KEY = "s1e1";
/** The message handler to test.*/
- private AddState handler;
+ private AddStateHandler handler;
/** The authn request.*/
private OIDCAuthenticationRequest request;
@@ -54,7 +54,7 @@ public class AddStateTest extends AbstractOIDCTest {
@BeforeMethod
public void setup() throws Exception {
super.setup();
- handler = new AddState();
+ handler = new AddStateHandler();
request = new OIDCAuthenticationRequest(new ClientID("test-client"));
final JWTClaimsSet claims = new JWTClaimsSet.Builder()
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list