[java-idp-oidc] branch main updated: JOIDC-61 Support metadata policies in the dyn. reg. profile configuration
Henri Mikkonen
henri.mikkonen at iki.fi
Fri Feb 4 13:58:15 UTC 2022
This is an automated email from the git hooks/post-receive script.
hjmikkon pushed a commit to branch main
in repository java-idp-oidc.
View the commit online:
http://git.shibboleth.net/view/?p=java-idp-oidc.git;a=commit;h=88cd94778ea36c11486c0f0358748a8b9b5b2e06
The following commit(s) were added to refs/heads/main by this push:
new 88cd9477 JOIDC-61 Support metadata policies in the dyn. reg. profile configuration
88cd9477 is described below
commit 88cd94778ea36c11486c0f0358748a8b9b5b2e06
Author: Henri Mikkonen <henri.mikkonen at iki.fi>
AuthorDate: Fri Feb 4 15:56:54 2022 +0200
JOIDC-61 Support metadata policies in the dyn. reg. profile configuration
https://shibboleth.atlassian.net/browse/JOIDC-61
Switched the registration flow into using policy-enforced metadata.
---
...IDCClientRegistrationMetadataPolicyContext.java | 25 +++++++
...tRegistrationRequestMetadataLookupFunction.java | 79 ++++++++++++++++++++++
...AbstractOIDCClientMetadataPopulationAction.java | 4 +-
.../impl/ValidateRegistrationRequestMetadata.java | 52 ++++++++------
.../oidc/op/profile/flow/RegistrationFlowTest.java | 70 ++++++++++++++-----
.../impl/BaseOIDCClientMetadataPopulationTest.java | 6 +-
.../src/test/resources/conf/metadata-policy1.json | 2 +-
.../src/test/resources/conf/relying-party.xml | 7 ++
8 files changed, 202 insertions(+), 43 deletions(-)
diff --git a/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/messaging/context/OIDCClientRegistrationMetadataPolicyContext.java b/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/messaging/context/OIDCClientRegistrationMetadataPolicyContext.java
index 987b3afc..87e7b1be 100644
--- a/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/messaging/context/OIDCClientRegistrationMetadataPolicyContext.java
+++ b/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/messaging/context/OIDCClientRegistrationMetadataPolicyContext.java
@@ -19,11 +19,15 @@ package net.shibboleth.idp.plugin.oidc.op.messaging.context;
import java.util.Map;
+import javax.annotation.Nonnull;
import javax.annotation.Nullable;
import org.opensaml.messaging.context.BaseContext;
+import com.nimbusds.openid.connect.sdk.rp.OIDCClientMetadata;
+
import net.shibboleth.oidc.metadata.policy.MetadataPolicy;
+import net.shibboleth.utilities.java.support.logic.Constraint;
/**
* Subcontext carrying information on the metadata policy related to the dynamic client registration.
@@ -36,6 +40,9 @@ public class OIDCClientRegistrationMetadataPolicyContext extends BaseContext {
/** The metadata policy related to dynamic client registration. */
private Map<String, MetadataPolicy> metadataPolicy;
+
+ /** The policy-enforced requested client metadata. */
+ private OIDCClientMetadata enforcedMetadata;
/**
* Constructor.
@@ -61,4 +68,22 @@ public class OIDCClientRegistrationMetadataPolicyContext extends BaseContext {
@Nullable public Map<String, MetadataPolicy> getMetadataPolicy() {
return metadataPolicy;
}
+
+ /**
+ * Set the policy-enforced requested client metadata.
+ *
+ * @param metadata What to set.
+ */
+ public void setPolicyEnforcedMetadata(@Nonnull final OIDCClientMetadata metadata) {
+ enforcedMetadata = Constraint.isNotNull(metadata, "the enforced requested metadata cannot be null");
+ }
+
+ /**
+ * Get the policy-enforced requested client metadata.
+ *
+ * @return The policy-enforced requested client metadata.
+ */
+ public OIDCClientMetadata getPolicyEnforcedMetadata() {
+ return enforcedMetadata;
+ }
}
\ No newline at end of file
diff --git a/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/messaging/context/navigate/OIDCPolicyEnforcedClientRegistrationRequestMetadataLookupFunction.java b/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/messaging/context/navigate/OIDCPolicyEnforcedClientRegistrationRequestMetadataLookupFunction.java
new file mode 100644
index 00000000..faf8791b
--- /dev/null
+++ b/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/messaging/context/navigate/OIDCPolicyEnforcedClientRegistrationRequestMetadataLookupFunction.java
@@ -0,0 +1,79 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.idp.plugin.oidc.op.messaging.context.navigate;
+
+import java.util.function.Function;
+
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+
+import org.opensaml.messaging.context.navigate.ChildContextLookup;
+import org.opensaml.messaging.context.navigate.ContextDataLookupFunction;
+import org.opensaml.profile.context.ProfileRequestContext;
+import org.opensaml.profile.context.navigate.InboundMessageContextLookup;
+
+import com.nimbusds.openid.connect.sdk.rp.OIDCClientMetadata;
+
+import net.shibboleth.idp.plugin.oidc.op.messaging.context.OIDCClientRegistrationMetadataPolicyContext;
+import net.shibboleth.utilities.java.support.logic.Constraint;
+
+/**
+ * A lookup function for fetching policy-enforced client metadata related to the dynamic client registration request.
+ *
+ * @since 3.1.0
+ */
+public class OIDCPolicyEnforcedClientRegistrationRequestMetadataLookupFunction
+ implements ContextDataLookupFunction<ProfileRequestContext, OIDCClientMetadata> {
+
+ /** Strategy that will return {@link OIDCClientRegistrationMetadataPolicyContext}. */
+ @Nonnull
+ private Function<ProfileRequestContext, OIDCClientRegistrationMetadataPolicyContext>
+ registrationMetadataPolicyContextLookupStrategy;
+
+ /**
+ * Constructor.
+ */
+ public OIDCPolicyEnforcedClientRegistrationRequestMetadataLookupFunction() {
+ registrationMetadataPolicyContextLookupStrategy =
+ new ChildContextLookup<>(OIDCClientRegistrationMetadataPolicyContext.class, false)
+ .compose(new InboundMessageContextLookup());
+ }
+
+ /**
+ * Set the strategy that will return {@link OIDCClientRegistrationMetadataPolicyContext}.
+ *
+ * @param strategy Strategy that will return {@link OIDCClientRegistrationMetadataPolicyContext}.
+ */
+ public void setRegistrationMetadataPolicyContextLookupStrategy(
+ @Nonnull final Function<ProfileRequestContext, OIDCClientRegistrationMetadataPolicyContext> strategy) {
+ registrationMetadataPolicyContextLookupStrategy =
+ Constraint.isNotNull(strategy, "Registration metadata policy context lookup strategy cannot be null");
+ }
+
+ /** {@inheritDoc} */
+ @Nullable
+ public OIDCClientMetadata apply(final ProfileRequestContext input) {
+ final OIDCClientRegistrationMetadataPolicyContext registrationMetadataPolicyContext =
+ registrationMetadataPolicyContextLookupStrategy.apply(input);
+ if (registrationMetadataPolicyContext != null) {
+ return registrationMetadataPolicyContext.getPolicyEnforcedMetadata();
+ }
+ return null;
+ }
+
+}
diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/AbstractOIDCClientMetadataPopulationAction.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/AbstractOIDCClientMetadataPopulationAction.java
index 117a3536..d4c5d903 100644
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/AbstractOIDCClientMetadataPopulationAction.java
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/AbstractOIDCClientMetadataPopulationAction.java
@@ -31,8 +31,8 @@ import org.slf4j.LoggerFactory;
import com.nimbusds.oauth2.sdk.client.ClientRegistrationRequest;
import com.nimbusds.openid.connect.sdk.rp.OIDCClientMetadata;
-import net.shibboleth.idp.plugin.oidc.op.messaging.context.navigate.OIDCClientRegistrationRequestMetadataLookupFunction;
import net.shibboleth.idp.plugin.oidc.op.messaging.context.navigate.OIDCClientRegistrationResponseMetadataLookupFunction;
+import net.shibboleth.idp.plugin.oidc.op.messaging.context.navigate.OIDCPolicyEnforcedClientRegistrationRequestMetadataLookupFunction;
import net.shibboleth.idp.profile.AbstractProfileAction;
import net.shibboleth.utilities.java.support.logic.Constraint;
@@ -64,7 +64,7 @@ public abstract class AbstractOIDCClientMetadataPopulationAction extends Abstrac
/** Constructor. */
public AbstractOIDCClientMetadataPopulationAction() {
- oidcInputMetadataLookupStrategy = new OIDCClientRegistrationRequestMetadataLookupFunction();
+ oidcInputMetadataLookupStrategy = new OIDCPolicyEnforcedClientRegistrationRequestMetadataLookupFunction();
oidcOutputMetadataLookupStrategy = new OIDCClientRegistrationResponseMetadataLookupFunction();
}
diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/ValidateRegistrationRequestMetadata.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/ValidateRegistrationRequestMetadata.java
index 7883fb2d..ebd18c00 100644
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/ValidateRegistrationRequestMetadata.java
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/ValidateRegistrationRequestMetadata.java
@@ -31,6 +31,8 @@ import org.opensaml.profile.context.ProfileRequestContext;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
+import com.nimbusds.oauth2.sdk.ParseException;
+import com.nimbusds.openid.connect.sdk.rp.OIDCClientMetadata;
import com.nimbusds.openid.connect.sdk.rp.OIDCClientRegistrationRequest;
import net.minidev.json.JSONObject;
@@ -45,9 +47,8 @@ import net.shibboleth.utilities.java.support.logic.Constraint;
/**
* Validates the incoming dynamic client registration request against the metadata policy stored in the
- * {@link OIDCClientRegistrationMetadataPolicyContext}.
- *
- * TODO: where to store the result
+ * {@link OIDCClientRegistrationMetadataPolicyContext}. The policy-enforced request metadata is stored via
+ * {@link OIDCClientRegistrationMetadataPolicyContext#setPolicyEnforcedMetadata(OIDCClientMetadata)}.
*/
public class ValidateRegistrationRequestMetadata extends AbstractProfileAction {
@@ -64,6 +65,9 @@ public class ValidateRegistrationRequestMetadata extends AbstractProfileAction {
/** The OIDCClientRegistrationRequest to validate. */
@Nullable private OIDCClientRegistrationRequest request;
+
+ /** The metadata policy context to operate on. */
+ private OIDCClientRegistrationMetadataPolicyContext registrationMetadataPolicyContext;
/** The metadata policy used for validation. */
private Map<String, MetadataPolicy> metadataPolicy;
@@ -127,9 +131,7 @@ public class ValidateRegistrationRequestMetadata extends AbstractProfileAction {
request = (OIDCClientRegistrationRequest) message;
- final OIDCClientRegistrationMetadataPolicyContext registrationMetadataPolicyContext =
- registrationMetadataPolicyContextLookupStrategy.apply(messageContext);
-
+ registrationMetadataPolicyContext = registrationMetadataPolicyContextLookupStrategy.apply(messageContext);
if (registrationMetadataPolicyContext == null) {
log.debug("{} No metadata policy context associated with this request", getLogPrefix());
ActionSupport.buildEvent(profileRequestContext, EventIds.INVALID_MSG_CTX);
@@ -150,31 +152,39 @@ public class ValidateRegistrationRequestMetadata extends AbstractProfileAction {
log.debug("{} Metadata policy to be validated: {}", getLogPrefix(), metadataPolicy);
boolean compliant = true;
+ final JSONObject requestMetadata = request.getOIDCClientMetadata().toJSONObject();
+
for (final String claim : metadataPolicy.keySet()) {
log.trace("{} Analysing claim {}", getLogPrefix(), claim);
- final JSONObject requestMetadata = request.getOIDCClientMetadata().toJSONObject();
- if (requestMetadata.containsKey(claim)) {
- final Object value = requestMetadata.get(claim);
- log.debug("{} The claim {} set in policy included in the request", getLogPrefix(), claim);
- final MetadataPolicy policy = metadataPolicy.get(claim);
- final Pair<Object, MetadataPolicy> candidate = new Pair<>(value, policy);
- final Pair<Object, Boolean> result = metadataPolicyEnforcer.apply(candidate);
+ final MetadataPolicy policy = metadataPolicy.get(claim);
+ final Object value = requestMetadata.get(claim);
+ log.debug("{} The claim {} set in policy included in the request", getLogPrefix(), claim);
+ final Pair<Object, MetadataPolicy> candidate = new Pair<>(value, policy);
+ final Pair<Object, Boolean> result = metadataPolicyEnforcer.apply(candidate);
- if (!result.getSecond()) {
- log.warn("{} the metadata claim {} is not compliant with the policy", getLogPrefix(), claim);
- compliant = false;
- } else {
- log.trace("{} validation result is OK for claim {}", getLogPrefix(), claim);
- }
+ if (!result.getSecond()) {
+ log.warn("{} the metadata claim {} is not compliant with the policy", getLogPrefix(), claim);
+ compliant = false;
+ } else {
+ log.trace("{} validation result is OK for claim {}", getLogPrefix(), claim);
+ log.trace("{} policy {} value {} result {}", getLogPrefix(), policy, value, result.getFirst());
+ requestMetadata.put(claim, result.getFirst());
}
-
- //TODO: store the result
}
if (!compliant) {
log.warn("{} The requested metadata is not compliant with the policy", getLogPrefix());
ActionSupport.buildEvent(profileRequestContext, EventIds.INVALID_MESSAGE);
}
+
+ try {
+ final OIDCClientMetadata enforcedMetadata = OIDCClientMetadata.parse(requestMetadata);
+ registrationMetadataPolicyContext.setPolicyEnforcedMetadata(enforcedMetadata);
+ log.debug("{} The enforced metadata stored in context", getLogPrefix());
+ } catch (final ParseException e) {
+ log.error("{} Could not parse the enforced metadata", getLogPrefix(), e);
+ ActionSupport.buildEvent(profileRequestContext, EventIds.INVALID_MSG_CTX);
+ }
}
}
diff --git a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/RegistrationFlowTest.java b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/RegistrationFlowTest.java
index 3c9b1810..110ceaf0 100644
--- a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/RegistrationFlowTest.java
+++ b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/RegistrationFlowTest.java
@@ -19,16 +19,21 @@ package net.shibboleth.idp.plugin.oidc.op.profile.flow;
import java.io.IOException;
import java.io.UnsupportedEncodingException;
+import java.net.URI;
+import java.net.URISyntaxException;
import java.security.NoSuchAlgorithmException;
import java.time.Instant;
import org.opensaml.storage.StorageService;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.beans.factory.annotation.Qualifier;
+import org.springframework.webflow.core.FlowException;
import org.springframework.webflow.executor.FlowExecutionResult;
import org.testng.Assert;
import org.testng.annotations.Test;
+import com.nimbusds.langtag.LangTag;
+import com.nimbusds.langtag.LangTagException;
import com.nimbusds.oauth2.sdk.ParseException;
import com.nimbusds.oauth2.sdk.token.BearerAccessToken;
import com.nimbusds.openid.connect.sdk.rp.OIDCClientInformation;
@@ -59,13 +64,6 @@ public class RegistrationFlowTest extends AbstractOidcFlowTest {
super(FLOW_ID);
}
- @Test
- public void testNoRedirectUri() throws UnsupportedEncodingException, ParseException {
- setJsonRequest("POST", "{ \"test\":false }");
- final FlowExecutionResult result = flowExecutor.launchExecution(FLOW_ID, null, externalContext);
- assertErrorCode(result, "invalid_redirect_uri");
- }
-
@Test
public void testInvalidMessage() throws UnsupportedEncodingException, ParseException {
setJsonRequest("POST", "{ \"test\":not_json");
@@ -124,35 +122,71 @@ public class RegistrationFlowTest extends AbstractOidcFlowTest {
}
@Test
- public void testAccessToken_success() throws ParseException, IOException, net.minidev.json.parser.ParseException, NoSuchAlgorithmException, DataSealerException, ComponentInitializationException {
- setJsonRequest("POST", "{ \"redirect_uris\":[\"" + redirectUri + "\"] }");
+ public void testAccessToken_success() throws ParseException, IOException, net.minidev.json.parser.ParseException, NoSuchAlgorithmException, DataSealerException, ComponentInitializationException, FlowException {
+ setJsonRequest("POST", buildRequestMessage(redirectUri));
request.addHeader("Authorization", buildRegistrationAccessToken("[\"https://example.org/cb\"]")
.toAuthorizationHeader());
+ assertSuccessfulResponse(flowExecutor.launchExecution(FLOW_ID, null, externalContext));
+ }
+
+ @Test
+ public void testAccessToken_noPolicyNoRedirectUri() throws NoSuchAlgorithmException, DataSealerException,
+ ComponentInitializationException {
+ setJsonRequest("POST", "{ \"test\":false }");
+ request.addHeader("Authorization", buildRegistrationAccessToken("mockDynRegClient", null)
+ .toAuthorizationHeader());
final FlowExecutionResult result = flowExecutor.launchExecution(FLOW_ID, null, externalContext);
- OIDCClientInformationResponse parsedResponse = parseSuccessResponse(result, OIDCClientInformationResponse.class);
- OIDCClientInformation clientInfo = parsedResponse.getOIDCClientInformation();
- OIDCClientMetadata metadata = clientInfo.getOIDCMetadata();
- String record = storageService.read(BaseStorageServiceClientInformationComponent.CONTEXT_NAME,
+ assertErrorCode(result, "invalid_redirect_uri");
+ }
+
+ protected void assertSuccessfulResponse(final FlowExecutionResult result) throws IOException, ParseException, net.minidev.json.parser.ParseException {
+ final OIDCClientInformationResponse parsedResponse =
+ parseSuccessResponse(result, OIDCClientInformationResponse.class);
+ final OIDCClientInformation clientInfo = OIDCClientInformation.parse(
+ parsedResponse.getOIDCClientInformation().toJSONObject());
+ final OIDCClientMetadata metadata = clientInfo.getOIDCMetadata();
+ final String record = storageService.read(BaseStorageServiceClientInformationComponent.CONTEXT_NAME,
clientInfo.getID().toString()).getValue();
Assert.assertNotNull(record);
- JSONParser parser = new JSONParser(JSONParser.DEFAULT_PERMISSIVE_MODE);
- OIDCClientInformation storedInfo = OIDCClientInformation.parse((JSONObject) parser.parse(record));
+ final JSONParser parser = new JSONParser(JSONParser.DEFAULT_PERMISSIVE_MODE);
+ final OIDCClientInformation storedInfo = OIDCClientInformation.parse((JSONObject) parser.parse(record));
+ final OIDCClientMetadata storedMetadata = storedInfo.getOIDCMetadata();
Assert.assertEquals(storedInfo.getID(), clientInfo.getID());
Assert.assertEquals(storedInfo.getSecret(), clientInfo.getSecret());
- Assert.assertEquals(storedInfo.getOIDCMetadata().getRedirectionURIStrings(), metadata.getRedirectionURIStrings());
+ Assert.assertEquals(storedMetadata.getRedirectionURIStrings(), metadata.getRedirectionURIStrings());
Assert.assertTrue(metadata.getRedirectionURIStrings().contains(redirectUri));
+ Assert.assertEquals(metadata.getPolicyURIEntries().size(), 2);
+ try {
+ Assert.assertEquals(metadata.getPolicyURI(LangTag.parse("fi")), new URI("https://policy.org/finnish"));
+ Assert.assertEquals(metadata.getPolicyURI(LangTag.parse("en")), new URI("https://policy.org/english"));
+ } catch (LangTagException | URISyntaxException e) {
+ Assert.fail();
+ }
+ Assert.assertEquals(storedMetadata.getPolicyURIEntries(), metadata.getPolicyURIEntries());
}
protected BearerAccessToken buildRegistrationAccessToken(final String redirectUriSubset) throws NoSuchAlgorithmException, DataSealerException, ComponentInitializationException {
+ return buildRegistrationAccessToken("mockRpId", redirectUriSubset);
+ }
+
+ protected BearerAccessToken buildRegistrationAccessToken(final String rpId, final String redirectUriSubset) throws NoSuchAlgorithmException, DataSealerException, ComponentInitializationException {
final String json = "{" +
"\"prncpl\":\"jdoe\"," +
"\"type\":\"rat\"," +
"\"exp\":" + Instant.now().plusSeconds(30).getEpochSecond() + "," +
"\"iat\":" + Instant.now().getEpochSecond() + "," +
"\"jti\":\"" + idGenerator.generateIdentifier() + "\"," +
- "\"rp_id\":\"mockRpId\"," +
- "\"metadata\":{\"redirect_uris\":{\"subset_of\":" + redirectUriSubset + "}}}";
+ "\"rp_id\":\"" + rpId + "\"," +
+ "\"metadata\":" + (redirectUriSubset != null ?
+ "{\"redirect_uris\":{\"subset_of\":" + redirectUriSubset + "}" : "null") +"}}";
return new BearerAccessToken(BaseOIDCResponseActionTest.initializeDataSealer().wrap(json,
Instant.now().plusSeconds(30)));
}
+
+ protected String buildRequestMessage(final String redirectUri) {
+ return new StringBuilder("{ \"redirect_uris\":[\"" + redirectUri + "\"],")
+ .append("\"policy_uri#en\":\"https://policy.org/english\",")
+ .append("\"policy_uri#fi\":\"https://policy.org/finnish\"")
+ .append("}").toString();
+ }
}
diff --git a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/BaseOIDCClientMetadataPopulationTest.java b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/BaseOIDCClientMetadataPopulationTest.java
index 01d20790..744caf80 100644
--- a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/BaseOIDCClientMetadataPopulationTest.java
+++ b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/BaseOIDCClientMetadataPopulationTest.java
@@ -28,8 +28,8 @@ import org.testng.annotations.Test;
import com.nimbusds.openid.connect.sdk.rp.OIDCClientMetadata;
import com.nimbusds.openid.connect.sdk.rp.OIDCClientRegistrationRequest;
+import net.shibboleth.idp.plugin.oidc.op.messaging.context.OIDCClientRegistrationMetadataPolicyContext;
import net.shibboleth.idp.plugin.oidc.op.messaging.context.OIDCClientRegistrationResponseContext;
-import net.shibboleth.idp.plugin.oidc.op.profile.impl.AbstractOIDCClientMetadataPopulationAction;
import net.shibboleth.idp.profile.context.navigate.WebflowRequestContextProfileRequestContextLookup;
import net.shibboleth.idp.profile.testing.ActionTestingSupport;
import net.shibboleth.idp.profile.testing.RequestContextBuilder;
@@ -53,7 +53,11 @@ public abstract class BaseOIDCClientMetadataPopulationTest {
profileRequestCtx = new WebflowRequestContextProfileRequestContextLookup().apply(requestCtx);
profileRequestCtx.setOutboundMessageContext(new MessageContext());
final OIDCClientRegistrationResponseContext responseCtx = new OIDCClientRegistrationResponseContext();
+ final OIDCClientRegistrationMetadataPolicyContext policyCtx =
+ profileRequestCtx.getInboundMessageContext().getSubcontext(
+ OIDCClientRegistrationMetadataPolicyContext.class, true);
responseCtx.setClientMetadata(output);
+ policyCtx.setPolicyEnforcedMetadata(input);
profileRequestCtx.getOutboundMessageContext().addSubcontext(responseCtx);
}
diff --git a/idp-oidc-extension-impl/src/test/resources/conf/metadata-policy1.json b/idp-oidc-extension-impl/src/test/resources/conf/metadata-policy1.json
index c5945dfb..71276cdf 100644
--- a/idp-oidc-extension-impl/src/test/resources/conf/metadata-policy1.json
+++ b/idp-oidc-extension-impl/src/test/resources/conf/metadata-policy1.json
@@ -15,7 +15,7 @@
"id_token_signed_response_alg": {
"subset_of": ["RS256", "RS384", "RS512"]
},
- "scopes": {
+ "scope": {
"subset_of": ["openid", "profile", "email", "phone"]
}
}
\ No newline at end of file
diff --git a/idp-oidc-extension-impl/src/test/resources/conf/relying-party.xml b/idp-oidc-extension-impl/src/test/resources/conf/relying-party.xml
index b25d62e5..d9c39df4 100644
--- a/idp-oidc-extension-impl/src/test/resources/conf/relying-party.xml
+++ b/idp-oidc-extension-impl/src/test/resources/conf/relying-party.xml
@@ -85,6 +85,13 @@
</list>
</property>
</bean>
+ <bean parent="RelyingPartyByName" c:relyingPartyIds="mockDynRegClient">
+ <property name="profileConfigurations">
+ <list>
+ <bean parent="OIDC.Registration" p:metadataPolicy="#{null}"/>
+ </list>
+ </property>
+ </bean>
</util:list>
</beans>
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list