[java-idp-oidc] branch main updated: Use criteria-based RP config resolver in token flow.
Scott Cantor
cantor.2 at osu.edu
Wed Feb 9 21:40:51 UTC 2022
This is an automated email from the git hooks/post-receive script.
scantor pushed a commit to branch main
in repository java-idp-oidc.
View the commit online:
http://git.shibboleth.net/view/?p=java-idp-oidc.git;a=commit;h=5281072b079586cbe32f6601a2444fa1638db8b6
The following commit(s) were added to refs/heads/main by this push:
new 5281072b Use criteria-based RP config resolver in token flow.
5281072b is described below
commit 5281072b079586cbe32f6601a2444fa1638db8b6
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Wed Feb 9 16:40:48 2022 -0500
Use criteria-based RP config resolver in token flow.
---
.../shibboleth/idp/flows/oidc/token/token-beans.xml | 2 +-
.../oidc/op/profile/flow/AbstractOidcFlowTest.java | 18 ++++++++++++++++--
.../profile/flow/ClientCredentialsTokenFlowTest.java | 16 +++++++++++++++-
.../src/test/resources/conf/relying-party.xml | 7 +++++++
4 files changed, 39 insertions(+), 4 deletions(-)
diff --git a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/token/token-beans.xml b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/token/token-beans.xml
index 54290282..0cd017fd 100644
--- a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/token/token-beans.xml
+++ b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/token/token-beans.xml
@@ -275,7 +275,7 @@
<bean id="SelectAudienceRelyingPartyConfiguration"
class="net.shibboleth.idp.profile.impl.SelectRelyingPartyConfiguration" scope="prototype"
p:relyingPartyContextLookupStrategy-ref="AudienceRelyingPartyCreationStrategy"
- p:relyingPartyConfigurationResolver-ref="shibboleth.RelyingPartyConfigurationResolver" />
+ p:relyingPartyConfigurationResolver-ref="shibboleth.CriteriaRelyingPartyConfigurationResolver" />
<bean id="SelectAudienceProfileConfiguration"
class="net.shibboleth.idp.profile.impl.SelectProfileConfiguration" scope="prototype"
diff --git a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/AbstractOidcFlowTest.java b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/AbstractOidcFlowTest.java
index 2ca7aed5..51f597ec 100644
--- a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/AbstractOidcFlowTest.java
+++ b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/AbstractOidcFlowTest.java
@@ -42,7 +42,9 @@ import org.springframework.webflow.test.MockExternalContext;
import org.testng.Assert;
import org.testng.annotations.BeforeMethod;
+import com.nimbusds.jose.EncryptionMethod;
import com.nimbusds.jose.JOSEException;
+import com.nimbusds.jose.JWEAlgorithm;
import com.nimbusds.jose.JWSAlgorithm;
import com.nimbusds.jose.JWSHeader;
import com.nimbusds.jose.crypto.MACSigner;
@@ -185,6 +187,15 @@ public abstract class AbstractOidcFlowTest extends AbstractFlowTest {
final Scope scope, final JWSAlgorithm tokenEndpointSigAlg,
final ClientAuthenticationMethod tokenEndpointMethod, final JWSAlgorithm userInfoSigAlg,
final RSAPublicKey publicKey, final String... redirectUri) throws IOException {
+ storeMetadata(storageService, clientId, secret, scope, tokenEndpointSigAlg, null, null, tokenEndpointMethod,
+ userInfoSigAlg, null, redirectUri);
+ }
+
+ protected void storeMetadata(final StorageService storageService, final String clientId, final String secret,
+ final Scope scope, final JWSAlgorithm tokenEndpointSigAlg, final JWEAlgorithm tokenEncAlg,
+ final EncryptionMethod encMethod, final ClientAuthenticationMethod tokenEndpointMethod,
+ final JWSAlgorithm userInfoSigAlg, final RSAPublicKey publicKey, final String... redirectUri)
+ throws IOException {
final OIDCClientMetadata metadata = new OIDCClientMetadata();
metadata.setGrantTypes(new HashSet<GrantType>(List.of(GrantType.AUTHORIZATION_CODE,
GrantType.REFRESH_TOKEN, GrantType.CLIENT_CREDENTIALS)));
@@ -202,18 +213,21 @@ public abstract class AbstractOidcFlowTest extends AbstractFlowTest {
metadata.setRedirectionURIs(uris);
metadata.setScope(scope);
metadata.setTokenEndpointAuthJWSAlg(tokenEndpointSigAlg);
+ metadata.setIDTokenJWEAlg(tokenEncAlg);
+ metadata.setIDTokenJWEEnc(encMethod);
metadata.setTokenEndpointAuthMethod(tokenEndpointMethod);
metadata.setUserInfoJWSAlg(userInfoSigAlg);
metadata.setCustomField("audience", List.of("https://rp.example.org", "https://rp2.example.org"));
final OIDCClientInformation information;
if (publicKey == null) {
information = new OIDCClientInformation(new ClientID(clientId), new Date(),
- metadata, new Secret(secret));
+ metadata, secret != null ? new Secret(secret) : null);
} else {
final RSAKey rsaKey = new RSAKey.Builder(publicKey).build();
final JWKSet jwkSet = new JWKSet(rsaKey);
metadata.setJWKSet(jwkSet);
- information = new OIDCClientInformation(new ClientID(clientId), metadata);
+ information = new OIDCClientInformation(new ClientID(clientId), new Date(),
+ metadata, secret != null ? new Secret(secret) : null);
}
storageService.create(BaseStorageServiceClientInformationComponent.CONTEXT_NAME, clientId,
information.toJSONObject().toJSONString(), System.currentTimeMillis() + (60 * 60 * 1000));
diff --git a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/ClientCredentialsTokenFlowTest.java b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/ClientCredentialsTokenFlowTest.java
index 79e95294..c8a49d32 100644
--- a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/ClientCredentialsTokenFlowTest.java
+++ b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/ClientCredentialsTokenFlowTest.java
@@ -157,7 +157,7 @@ public class ClientCredentialsTokenFlowTest extends AbstractOidcClientAuthentica
}
@Test
- public void testRequestedScopeJWT() throws Exception {
+ public void testRequestedScopeJWTUnverifiedAudience() throws Exception {
setHttpFormRequest("POST", createRequestParameters(clientId + "JWT", scope, resource));
storeMetadata(storageService, clientId + "JWT", clientSecret, scope);
setBasicAuth(clientId + "JWT", clientSecret);
@@ -170,6 +170,20 @@ public class ClientCredentialsTokenFlowTest extends AbstractOidcClientAuthentica
Collections.singletonList(resource), "email", "eduPersonScopedAffiliation");
}
+ @Test
+ public void testRequestedScopeJWTVerifiedAudience() throws Exception {
+ setHttpFormRequest("POST", createRequestParameters(clientId + "JWT", scope, resource));
+ storeMetadata(storageService, clientId + "JWT", clientSecret, scope);
+ storeMetadata(storageService, resource, null, null);
+ setBasicAuth(clientId + "JWT", clientSecret);
+ final FlowExecutionResult result = flowExecutor.launchExecution(FLOW_ID, null, externalContext);
+ final AccessTokenResponse response = parseSuccessResponse(result, AccessTokenResponse.class);
+ Assert.assertNotNull(response.getTokens().getBearerAccessToken());
+ Assert.assertEquals(response.getTokens().getBearerAccessToken().getLifetime(), 600);
+ Assert.assertEquals(response.getTokens().getBearerAccessToken().getScope(), scope);
+ verifyClaims("JWT", response.getTokens().getBearerAccessToken(), scope,
+ Collections.singletonList(resource), "email", "eduPersonScopedAffiliation");
+ }
@Test
public void testInvalidSecretJWTAuthn() throws Exception {
diff --git a/idp-oidc-extension-impl/src/test/resources/conf/relying-party.xml b/idp-oidc-extension-impl/src/test/resources/conf/relying-party.xml
index 13f0b1e0..9a562883 100644
--- a/idp-oidc-extension-impl/src/test/resources/conf/relying-party.xml
+++ b/idp-oidc-extension-impl/src/test/resources/conf/relying-party.xml
@@ -85,6 +85,13 @@
</list>
</property>
</bean>
+ <bean parent="RelyingPartyByName" c:relyingPartyIds="https://rp.example.org">
+ <property name="profileConfigurations">
+ <list>
+ <bean parent="OIDC.Token.MDDriven" p:accessTokenType="JWT" />
+ </list>
+ </property>
+ </bean>
<bean parent="RelyingPartyByName" c:relyingPartyIds="mockDynRegClient">
<property name="profileConfigurations">
<list>
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list