[java-idp-plugin-oidc-rp] branch main updated: Add ACR requested claims to Request Object construction
Phil Smart
philip.smart at jisc.ac.uk
Wed Dec 21 09:50:20 UTC 2022
This is an automated email from the git hooks/post-receive script.
philsmart pushed a commit to branch main
in repository java-idp-plugin-oidc-rp.
View the commit online:
http://git.shibboleth.net/view/?p=java-idp-plugin-oidc-rp.git;a=commit;h=a27461ff717b9d587e2509ac794947f935115700
The following commit(s) were added to refs/heads/main by this push:
new a27461f Add ACR requested claims to Request Object construction
a27461f is described below
commit a27461ff717b9d587e2509ac794947f935115700
Author: Phil Smart <philip.smart at jisc.ac.uk>
AuthorDate: Wed Dec 21 09:50:13 2022 +0000
Add ACR requested claims to Request Object construction
---
.../authn/oidc/rp/impl/BuildRequestObject.java | 98 ++++++++-
.../resources/templates/oidc-request-form-post.vm | 4 +-
.../authn/oidc/rp/impl/BuildRequestObjectTest.java | 234 +++++++++++++++++++++
3 files changed, 334 insertions(+), 2 deletions(-)
diff --git a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/BuildRequestObject.java b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/BuildRequestObject.java
index 23304ec..dd7fa5f 100644
--- a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/BuildRequestObject.java
+++ b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/BuildRequestObject.java
@@ -18,6 +18,8 @@
package net.shibboleth.idp.plugin.authn.oidc.rp.impl;
import java.time.Duration;
+import java.util.ArrayList;
+import java.util.List;
import java.util.function.Function;
import java.util.function.Predicate;
@@ -37,7 +39,11 @@ import com.google.common.base.Predicates;
import com.nimbusds.jwt.JWT;
import com.nimbusds.oauth2.sdk.id.Audience;
import com.nimbusds.oauth2.sdk.id.Issuer;
+import com.nimbusds.openid.connect.sdk.OIDCClaimsRequest;
+import com.nimbusds.openid.connect.sdk.claims.ACR;
+import com.nimbusds.openid.connect.sdk.claims.ClaimRequirement;
import com.nimbusds.openid.connect.sdk.claims.ClaimsSet;
+import com.nimbusds.openid.connect.sdk.claims.ClaimsSetRequest;
import com.nimbusds.openid.connect.sdk.op.OIDCProviderMetadata;
import net.shibboleth.idp.authn.AbstractAuthenticationAction;
@@ -47,6 +53,7 @@ import net.shibboleth.idp.plugin.authn.oidc.rp.context.OIDCPeerEntityContext;
import net.shibboleth.idp.profile.context.RelyingPartyContext;
import net.shibboleth.oidc.metadata.context.OIDCProviderMetadataContext;
import net.shibboleth.oidc.profile.core.OIDCAuthenticationRequest;
+import net.shibboleth.oidc.security.jwt.claims.impl.IDTokenClaims;
import net.shibboleth.utilities.java.support.component.ComponentSupport;
import net.shibboleth.utilities.java.support.logic.Constraint;
@@ -240,9 +247,12 @@ public class BuildRequestObject extends AbstractAuthenticationAction {
setClaimIfPresent(requestObjectClaims, "max_age", authnRequest.getMaxAge());
setClaimIfPresent(requestObjectClaims, "prompt", authnRequest.getPrompt());
+ // Build the ACRs if set before adding the 'claims' claim
+ buildACRClaimsRequest(requestObjectClaims);
+
if (authnRequest.getRequestedClaims() != null) {
requestObjectClaims.setClaim("claims", authnRequest.getRequestedClaims());
- }
+ }
// Validate the request object
if (!validateRequestObject(profileRequestContext, requestObjectClaims)) {
@@ -261,6 +271,92 @@ public class BuildRequestObject extends AbstractAuthenticationAction {
}
+ /**
+ * Build an ID Token requested claims request with any ACR values in the authentication request. Will add to any
+ * requested claims that already exist, or create a new requested claims if none already exist. If the 'acr' claim
+ * already exists, the new ACRs will be added to the existing set of values and the Claim Requirement for all will
+ * be set to ESSENTIAL.
+ *
+ *
+ * @param requestObjectClaims the request object claims
+ */
+ private void buildACRClaimsRequest(@Nonnull final ClaimsSet requestObjectClaims) {
+
+ final List<ACR> acrs = authnRequest.getAcrs();
+
+ if (!acrs.isEmpty()) {
+
+ // Create new claim and value. All explicitly requested ACRs are essential
+ final ClaimsSetRequest.Entry acrEntry =
+ new ClaimsSetRequest.Entry(IDTokenClaims.AUTHENTICATION_CONTEXT_CLASS_REFERENCE.getClaimName())
+ .withValues(acrs).withClaimRequirement(ClaimRequirement.ESSENTIAL);
+
+ if (authnRequest.getRequestedClaims() != null
+ && authnRequest.getRequestedClaims().getIDTokenClaimsRequest() != null) {
+ // Requested claims may already exist, if so add.
+ final ClaimsSetRequest requestedIdTokenClaims =
+ authnRequest.getRequestedClaims().getIDTokenClaimsRequest();
+
+ if (requestedIdTokenClaims.get(IDTokenClaims.AUTHENTICATION_CONTEXT_CLASS_REFERENCE.getClaimName())
+ != null) {
+
+ // Must add ACRs to existing requested claims
+ final ClaimsSetRequest.Entry existingAcr =
+ requestedIdTokenClaims.get(IDTokenClaims.AUTHENTICATION_CONTEXT_CLASS_REFERENCE
+ .getClaimName());
+
+ // Copy over the existing ones
+ final List<ACR> acrValues = new ArrayList<>();
+ if (existingAcr != null) {
+ if (existingAcr.getValuesAsRawList() != null) {
+ existingAcr.getValuesAsRawList().stream().forEach(acr -> {
+ if (acr instanceof ACR) {
+ acrValues.add((ACR)acr);
+ } else if (acr != null) {
+ acrValues.add(new ACR(acr.toString()));
+ }
+ });
+ }
+ // Value and values hold distinct entries for some reason
+ if (existingAcr.getRawValue() instanceof ACR) {
+ acrValues.add((ACR)existingAcr.getRawValue());
+ } else {
+ acrValues.add(new ACR(existingAcr.getValueAsString()));
+ }
+ }
+ // Add the new ones
+ acrs.stream().forEach(acrValues::add);
+
+ // New claimset without ACR
+ final ClaimsSetRequest deletedAcr =
+ requestedIdTokenClaims.delete(IDTokenClaims.AUTHENTICATION_CONTEXT_CLASS_REFERENCE
+ .getClaimName());
+ // New claimset with new ACR
+ final ClaimsSetRequest addedNewAcr = deletedAcr.add(
+ new ClaimsSetRequest.Entry(IDTokenClaims.AUTHENTICATION_CONTEXT_CLASS_REFERENCE
+ .getClaimName()).withValues(acrValues)
+ .withClaimRequirement(ClaimRequirement.ESSENTIAL));
+
+ authnRequest.setRequestedClaims(authnRequest.getRequestedClaims()
+ .withIDTokenClaimsRequest(addedNewAcr));
+ } else {
+ // Add ACRs to existing set of requested claims
+ final ClaimsSetRequest requestPlusAcr = requestedIdTokenClaims.add(acrEntry);
+ authnRequest.setRequestedClaims(authnRequest.getRequestedClaims()
+ .withIDTokenClaimsRequest(requestPlusAcr));
+ }
+ } else {
+ // Else create new
+ final ClaimsSetRequest idTokenClaimsRequest = new ClaimsSetRequest().add(acrEntry);
+ final OIDCClaimsRequest requested =
+ new OIDCClaimsRequest().withIDTokenClaimsRequest(idTokenClaimsRequest);
+ authnRequest.setRequestedClaims(requested);
+ }
+
+ }
+
+ }
+
/**
* Set the claim onto the claims set if not {@code null}. Calls toString on each value, assuming it
* will produce the correct value.
diff --git a/idp-oidc-rp-impl/src/main/resources/templates/oidc-request-form-post.vm b/idp-oidc-rp-impl/src/main/resources/templates/oidc-request-form-post.vm
index 8afcbfd..2a674f4 100644
--- a/idp-oidc-rp-impl/src/main/resources/templates/oidc-request-form-post.vm
+++ b/idp-oidc-rp-impl/src/main/resources/templates/oidc-request-form-post.vm
@@ -33,7 +33,9 @@
<input type="hidden" name="prompt" value="${prompt}" />#end #if($request)
- <input type="hidden" name="request" value="${request}" />#end #if($claims)
+ <input type="hidden" name="request" value="${request}" />#end #if($acr_values)
+
+ <input type="hidden" name="acr_values" value="${acr_values}" />#end #if($claims)
<input type="hidden" name="claims" value="${claims}" />#end #if($nonce)
diff --git a/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/BuildRequestObjectTest.java b/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/BuildRequestObjectTest.java
index 82dd5bb..bf8da7f 100644
--- a/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/BuildRequestObjectTest.java
+++ b/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/BuildRequestObjectTest.java
@@ -7,6 +7,7 @@ import static org.testng.Assert.assertNull;
import static org.testng.Assert.assertTrue;
import java.time.Duration;
+import java.util.List;
import org.opensaml.messaging.context.navigate.ChildContextLookup;
import org.opensaml.messaging.context.navigate.ParentContextLookup;
@@ -21,7 +22,10 @@ import com.nimbusds.oauth2.sdk.ResponseType;
import com.nimbusds.openid.connect.sdk.Nonce;
import com.nimbusds.openid.connect.sdk.OIDCClaimsRequest;
import com.nimbusds.openid.connect.sdk.assurance.claims.VerifiedClaimsSetRequest;
+import com.nimbusds.openid.connect.sdk.claims.ACR;
+import com.nimbusds.openid.connect.sdk.claims.ClaimRequirement;
import com.nimbusds.openid.connect.sdk.claims.ClaimsSet;
+import com.nimbusds.openid.connect.sdk.claims.ClaimsSetRequest;
import net.shibboleth.idp.authn.context.AuthenticationContext;
import net.shibboleth.idp.profile.context.RelyingPartyContext;
@@ -92,6 +96,236 @@ public class BuildRequestObjectTest extends AbstractOIDCTest {
assertTrue(isValidJSON(claims.toJSONString()));
}
+ @Test
+ public void testBuildRequestObject_WithACRs_Success() throws ComponentInitializationException {
+
+ authnRequest.setAcrs(List.of(new ACR("urn:mace:incommon:iap:silver")));
+
+ action.initialize();
+ final Event event = action.execute(src);
+ assertNull(event);
+ assertNotNull(prc.getOutboundMessageContext().getMessage());
+ assertNotNull(((OIDCAuthenticationRequest)prc.getOutboundMessageContext()
+ .getMessage()).getRequestObjectClaimsSet());
+ final ClaimsSet claims = (((OIDCAuthenticationRequest)prc.getOutboundMessageContext()
+ .getMessage()).getRequestObjectClaimsSet());
+ assertEquals(claims.getStringClaim("scope"),"openid");
+ assertEquals(claims.getStringClaim("iss"),"https://rp.example.com");
+ assertEquals(claims.getStringClaim("client_id"),"https://rp.example.com");
+ assertEquals(claims.getStringClaim("response_type"),"code");
+ assertEquals(claims.getNumberClaim("max_age").longValue(),60);
+ assertEquals(claims.getStringClaim("redirect_uri"),"https://rp.example.com/callback");
+ assertNotNull(claims.getStringClaim("nonce"));
+ assertNotNull(claims.getClaim("aud"));
+ assertNotNull(claims.getClaim("claims"));
+
+ final Object claimsObject = claims.getClaim("claims");
+ assertTrue(claimsObject instanceof OIDCClaimsRequest);
+ final OIDCClaimsRequest requestedClaims =(OIDCClaimsRequest) claimsObject;
+ assertNotNull(requestedClaims.getIDTokenClaimsRequest().get("acr"));
+
+ assertTrue(isValidJSON(claims.toJSONString()));
+ }
+
+ @Test
+ public void testBuildRequestObject_WithACRsAndExistingRequestedClaims_Success() throws ComponentInitializationException {
+
+ final ClaimsSetRequest.Entry nameEntry =
+ new ClaimsSetRequest.Entry("first_name").withClaimRequirement(ClaimRequirement.ESSENTIAL);
+ final ClaimsSetRequest idTokenClaimsRequest = new ClaimsSetRequest().add(nameEntry);
+ final OIDCClaimsRequest requested =
+ new OIDCClaimsRequest().withIDTokenClaimsRequest(idTokenClaimsRequest);
+
+ authnRequest.setRequestedClaims(requested);
+ authnRequest.setAcrs(List.of(new ACR("urn:mace:incommon:iap:silver")));
+
+ action.initialize();
+ final Event event = action.execute(src);
+ assertNull(event);
+ assertNotNull(prc.getOutboundMessageContext().getMessage());
+ assertNotNull(((OIDCAuthenticationRequest)prc.getOutboundMessageContext()
+ .getMessage()).getRequestObjectClaimsSet());
+ final ClaimsSet claims = (((OIDCAuthenticationRequest)prc.getOutboundMessageContext()
+ .getMessage()).getRequestObjectClaimsSet());
+ assertEquals(claims.getStringClaim("scope"),"openid");
+ assertEquals(claims.getStringClaim("iss"),"https://rp.example.com");
+ assertEquals(claims.getStringClaim("client_id"),"https://rp.example.com");
+ assertEquals(claims.getStringClaim("response_type"),"code");
+ assertEquals(claims.getNumberClaim("max_age").longValue(),60);
+ assertEquals(claims.getStringClaim("redirect_uri"),"https://rp.example.com/callback");
+ assertNotNull(claims.getStringClaim("nonce"));
+ assertNotNull(claims.getClaim("aud"));
+ assertNotNull(claims.getClaim("claims"));
+
+ final Object claimsObject = claims.getClaim("claims");
+ assertTrue(claimsObject instanceof OIDCClaimsRequest);
+ final OIDCClaimsRequest requestedClaims =(OIDCClaimsRequest) claimsObject;
+ assertNotNull(requestedClaims.getIDTokenClaimsRequest().get("first_name"));
+ assertNotNull(requestedClaims.getIDTokenClaimsRequest().get("acr"));
+ assertNotNull(requestedClaims.getIDTokenClaimsRequest().get("acr").getValuesAsRawList());
+ assertEquals(requestedClaims.getIDTokenClaimsRequest().get("acr")
+ .getValuesAsRawList().get(0).toString(),"urn:mace:incommon:iap:silver");
+
+ assertTrue(isValidJSON(claims.toJSONString()));
+ }
+
+ @Test
+ public void testBuildRequestObject_WithACRsAndExistingACRs_Success() throws ComponentInitializationException {
+
+ // Add some to the existing requested claims set
+ final ClaimsSetRequest.Entry acrEntry =
+ new ClaimsSetRequest.Entry("acr").withValues(List.of(new ACR("urn:mace:incommon:iap:bronze")))
+ .withClaimRequirement(ClaimRequirement.ESSENTIAL);
+ final ClaimsSetRequest idTokenClaimsRequest = new ClaimsSetRequest().add(acrEntry);
+ final OIDCClaimsRequest requested =
+ new OIDCClaimsRequest().withIDTokenClaimsRequest(idTokenClaimsRequest);
+
+ authnRequest.setRequestedClaims(requested);
+
+ // Now add ACRs
+ authnRequest.setAcrs(List.of(new ACR("urn:mace:incommon:iap:silver"), new ACR("urn:mace:incommon:iap:purple")));
+
+ action.initialize();
+ final Event event = action.execute(src);
+ assertNull(event);
+ assertNotNull(prc.getOutboundMessageContext().getMessage());
+ assertNotNull(((OIDCAuthenticationRequest)prc.getOutboundMessageContext()
+ .getMessage()).getRequestObjectClaimsSet());
+ final ClaimsSet claims = (((OIDCAuthenticationRequest)prc.getOutboundMessageContext()
+ .getMessage()).getRequestObjectClaimsSet());
+ assertEquals(claims.getStringClaim("scope"),"openid");
+ assertEquals(claims.getStringClaim("iss"),"https://rp.example.com");
+ assertEquals(claims.getStringClaim("client_id"),"https://rp.example.com");
+ assertEquals(claims.getStringClaim("response_type"),"code");
+ assertEquals(claims.getNumberClaim("max_age").longValue(),60);
+ assertEquals(claims.getStringClaim("redirect_uri"),"https://rp.example.com/callback");
+ assertNotNull(claims.getStringClaim("nonce"));
+ assertNotNull(claims.getClaim("aud"));
+ assertNotNull(claims.getClaim("claims"));
+
+ final Object claimsObject = claims.getClaim("claims");
+ assertTrue(claimsObject instanceof OIDCClaimsRequest);
+ final OIDCClaimsRequest requestedClaims =(OIDCClaimsRequest) claimsObject;
+ assertNotNull(requestedClaims.getIDTokenClaimsRequest().get("acr"));
+ assertNotNull(requestedClaims.getIDTokenClaimsRequest().get("acr").getValuesAsRawList());
+ assertEquals(requestedClaims.getIDTokenClaimsRequest().get("acr").getValuesAsRawList().size(),3);
+
+ assertTrue(requestedClaims.getIDTokenClaimsRequest().get("acr")
+ .getValuesAsRawList().stream().anyMatch(acr -> acr.toString().equals("urn:mace:incommon:iap:bronze")));
+ assertTrue(requestedClaims.getIDTokenClaimsRequest().get("acr")
+ .getValuesAsRawList().stream().anyMatch(acr -> acr.toString().equals("urn:mace:incommon:iap:silver")));
+ assertTrue(requestedClaims.getIDTokenClaimsRequest().get("acr")
+ .getValuesAsRawList().stream().anyMatch(acr -> acr.toString().equals("urn:mace:incommon:iap:purple")));
+
+ assertTrue(isValidJSON(claims.toJSONString()));
+ }
+
+ @Test
+ public void testBuildRequestObject_WithACRsAndExistingACRs_WithSingleValue_Success()
+ throws ComponentInitializationException {
+
+ // Add some to the existing requested claims set. Set using with Value, not Value(s)
+ final ClaimsSetRequest.Entry acrEntry =
+ new ClaimsSetRequest.Entry("acr").withValue(new ACR("urn:mace:incommon:iap:bronze"))
+ .withClaimRequirement(ClaimRequirement.ESSENTIAL);
+ final ClaimsSetRequest idTokenClaimsRequest = new ClaimsSetRequest().add(acrEntry);
+ final OIDCClaimsRequest requested =
+ new OIDCClaimsRequest().withIDTokenClaimsRequest(idTokenClaimsRequest);
+
+ authnRequest.setRequestedClaims(requested);
+
+ // Now add ACRs
+ authnRequest.setAcrs(List.of(new ACR("urn:mace:incommon:iap:silver"), new ACR("urn:mace:incommon:iap:purple")));
+
+ action.initialize();
+ final Event event = action.execute(src);
+ assertNull(event);
+ assertNotNull(prc.getOutboundMessageContext().getMessage());
+ assertNotNull(((OIDCAuthenticationRequest)prc.getOutboundMessageContext()
+ .getMessage()).getRequestObjectClaimsSet());
+ final ClaimsSet claims = (((OIDCAuthenticationRequest)prc.getOutboundMessageContext()
+ .getMessage()).getRequestObjectClaimsSet());
+ assertEquals(claims.getStringClaim("scope"),"openid");
+ assertEquals(claims.getStringClaim("iss"),"https://rp.example.com");
+ assertEquals(claims.getStringClaim("client_id"),"https://rp.example.com");
+ assertEquals(claims.getStringClaim("response_type"),"code");
+ assertEquals(claims.getNumberClaim("max_age").longValue(),60);
+ assertEquals(claims.getStringClaim("redirect_uri"),"https://rp.example.com/callback");
+ assertNotNull(claims.getStringClaim("nonce"));
+ assertNotNull(claims.getClaim("aud"));
+ assertNotNull(claims.getClaim("claims"));
+
+ final Object claimsObject = claims.getClaim("claims");
+ assertTrue(claimsObject instanceof OIDCClaimsRequest);
+ final OIDCClaimsRequest requestedClaims =(OIDCClaimsRequest) claimsObject;
+ assertNotNull(requestedClaims.getIDTokenClaimsRequest().get("acr"));
+ assertNotNull(requestedClaims.getIDTokenClaimsRequest().get("acr").getValuesAsRawList());
+ assertEquals(requestedClaims.getIDTokenClaimsRequest().get("acr").getValuesAsRawList().size(),3);
+
+ assertTrue(requestedClaims.getIDTokenClaimsRequest().get("acr")
+ .getValuesAsRawList().stream().anyMatch(acr -> acr.toString().equals("urn:mace:incommon:iap:bronze")));
+ assertTrue(requestedClaims.getIDTokenClaimsRequest().get("acr")
+ .getValuesAsRawList().stream().anyMatch(acr -> acr.toString().equals("urn:mace:incommon:iap:silver")));
+ assertTrue(requestedClaims.getIDTokenClaimsRequest().get("acr")
+ .getValuesAsRawList().stream().anyMatch(acr -> acr.toString().equals("urn:mace:incommon:iap:purple")));
+
+ assertTrue(isValidJSON(claims.toJSONString()));
+ }
+
+ @Test
+ public void testBuildRequestObject_WithACRsAndExistingACRsAndClaims_Success() throws ComponentInitializationException {
+
+ final ClaimsSetRequest.Entry nameEntry =
+ new ClaimsSetRequest.Entry("first_name").withClaimRequirement(ClaimRequirement.ESSENTIAL);
+ // Add some to the existing requested claims set
+ final ClaimsSetRequest.Entry acrEntry =
+ new ClaimsSetRequest.Entry("acr").withValues(List.of(new ACR("urn:mace:incommon:iap:bronze")))
+ .withClaimRequirement(ClaimRequirement.ESSENTIAL);
+ final ClaimsSetRequest idTokenClaimsRequest = new ClaimsSetRequest().add(acrEntry).add(nameEntry);
+ final OIDCClaimsRequest requested =
+ new OIDCClaimsRequest().withIDTokenClaimsRequest(idTokenClaimsRequest);
+
+ authnRequest.setRequestedClaims(requested);
+
+ // Now add ACRs
+ authnRequest.setAcrs(List.of(new ACR("urn:mace:incommon:iap:silver"), new ACR("urn:mace:incommon:iap:purple")));
+
+ action.initialize();
+ final Event event = action.execute(src);
+ assertNull(event);
+ assertNotNull(prc.getOutboundMessageContext().getMessage());
+ assertNotNull(((OIDCAuthenticationRequest)prc.getOutboundMessageContext()
+ .getMessage()).getRequestObjectClaimsSet());
+ final ClaimsSet claims = (((OIDCAuthenticationRequest)prc.getOutboundMessageContext()
+ .getMessage()).getRequestObjectClaimsSet());
+ assertEquals(claims.getStringClaim("scope"),"openid");
+ assertEquals(claims.getStringClaim("iss"),"https://rp.example.com");
+ assertEquals(claims.getStringClaim("client_id"),"https://rp.example.com");
+ assertEquals(claims.getStringClaim("response_type"),"code");
+ assertEquals(claims.getNumberClaim("max_age").longValue(),60);
+ assertEquals(claims.getStringClaim("redirect_uri"),"https://rp.example.com/callback");
+ assertNotNull(claims.getStringClaim("nonce"));
+ assertNotNull(claims.getClaim("aud"));
+ assertNotNull(claims.getClaim("claims"));
+
+ final Object claimsObject = claims.getClaim("claims");
+ assertTrue(claimsObject instanceof OIDCClaimsRequest);
+ final OIDCClaimsRequest requestedClaims =(OIDCClaimsRequest) claimsObject;
+ assertNotNull(requestedClaims.getIDTokenClaimsRequest().get("first_name"));
+ assertNotNull(requestedClaims.getIDTokenClaimsRequest().get("acr"));
+ assertNotNull(requestedClaims.getIDTokenClaimsRequest().get("acr").getValuesAsRawList());
+ assertEquals(requestedClaims.getIDTokenClaimsRequest().get("acr").getValuesAsRawList().size(),3);
+
+ assertTrue(requestedClaims.getIDTokenClaimsRequest().get("acr")
+ .getValuesAsRawList().stream().anyMatch(acr -> acr.toString().equals("urn:mace:incommon:iap:bronze")));
+ assertTrue(requestedClaims.getIDTokenClaimsRequest().get("acr")
+ .getValuesAsRawList().stream().anyMatch(acr -> acr.toString().equals("urn:mace:incommon:iap:silver")));
+ assertTrue(requestedClaims.getIDTokenClaimsRequest().get("acr")
+ .getValuesAsRawList().stream().anyMatch(acr -> acr.toString().equals("urn:mace:incommon:iap:purple")));
+
+ assertTrue(isValidJSON(claims.toJSONString()));
+ }
+
@Test
public void testBuildRequestObject_WithRequestedClaims_Success() throws ComponentInitializationException {
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list