[java-idp-oidc] branch main updated: Fix OAuth flow wiring for unverified clients.
Scott Cantor
cantor.2 at osu.edu
Mon Feb 14 22:48:20 UTC 2022
This is an automated email from the git hooks/post-receive script.
scantor pushed a commit to branch main
in repository java-idp-oidc.
View the commit online:
http://git.shibboleth.net/view/?p=java-idp-oidc.git;a=commit;h=74389a32060cf64203a59af13d98e8654e0141f9
The following commit(s) were added to refs/heads/main by this push:
new 74389a32 Fix OAuth flow wiring for unverified clients.
74389a32 is described below
commit 74389a32060cf64203a59af13d98e8654e0141f9
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Mon Feb 14 17:48:18 2022 -0500
Fix OAuth flow wiring for unverified clients.
---
.../idp/service/relying-party/postconfig.xml | 25 ++++----
.../op/authn/impl/JWTCredentialValidatorTest.java | 11 +++-
.../op/profile/flow/IntrospectionFlowTest.java | 66 +++++++++++++++-------
.../oidc/op/profile/flow/RevocationFlowTest.java | 55 ++++++++++--------
4 files changed, 98 insertions(+), 59 deletions(-)
diff --git a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/service/relying-party/postconfig.xml b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/service/relying-party/postconfig.xml
index 1ccb0f55..acc6f2dd 100644
--- a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/service/relying-party/postconfig.xml
+++ b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/service/relying-party/postconfig.xml
@@ -76,13 +76,15 @@
class="net.shibboleth.oidc.profile.oauth2.config.OAuth2TokenIntrospectionConfiguration"
p:issuer-ref="issuer"
p:tokenEndpointAuthMethods="%{idp.oidc.dynreg.tokenEndpointAuthMethods:client_secret_basic,client_secret_post,client_secret_jwt,private_key_jwt}"
- p:claimsValidator-ref="DefaultIntrospectionJWTClaimsValidator" />
+ p:claimsValidator-ref="DefaultJWTClaimsValidator"
+ p:issuedClaimsValidator-ref="DefaultIntrospectionJWTClaimsValidator" />
<bean id="OAUTH2.Revocation" parent="AbstractOIDCProfile" lazy-init="true"
class="net.shibboleth.oidc.profile.oauth2.config.OAuth2TokenRevocationConfiguration"
p:issuer-ref="issuer"
p:tokenEndpointAuthMethods="%{idp.oidc.dynreg.tokenEndpointAuthMethods:client_secret_basic,client_secret_post,client_secret_jwt,private_key_jwt}"
- p:claimsValidator-ref="DefaultRevocationJWTClaimsValidator" />
+ p:claimsValidator-ref="DefaultJWTClaimsValidator"
+ p:issuedClaimsValidator-ref="DefaultRevocationJWTClaimsValidator" />
<!-- Metadata-driven variants. -->
@@ -438,13 +440,14 @@
<!-- Default client-auth JWT validation wiring. -->
+ <bean id="AdaptedRelyingPartyIdLookup" class="net.shibboleth.utilities.java.support.logic.BiFunctionSupport"
+ factory-method="forFunctionOfFirstArg"
+ c:_0-ref="shibboleth.RelyingPartyIdLookup.Simple" />
+
<bean id="DefaultJWTClaimsValidator"
class="net.shibboleth.oidc.security.jwt.claims.impl.ChainingJWTClaimsValidator"
p:claimValidators-ref="ClaimsValidators" />
- <bean id="ClientIDFromOIDCMetadataContextLookupFunction"
- class="net.shibboleth.idp.plugin.oidc.op.profile.logic.ClientIDFromOIDCMetadataContextLookupFunction" />
-
<bean id="ExpiryClaimsValidator"
class="net.shibboleth.oidc.security.jwt.claims.impl.ExpiryClaimsValidator"
p:clockSkew="%{idp.policy.clockSkew:PT1M}" />
@@ -461,11 +464,11 @@
<bean id="IssuerClaimsValidator"
class="net.shibboleth.oidc.security.jwt.claims.impl.ExactMatchClaimsValidator"
- p:claimName="iss" p:valueToMatchLookupStrategy-ref="ClientIDFromOIDCMetadataContextLookupFunction" />
+ p:claimName="iss" p:valueToMatchLookupStrategy-ref="AdaptedRelyingPartyIdLookup" />
<bean id="SubjectClaimsValidator"
class="net.shibboleth.oidc.security.jwt.claims.impl.ExactMatchClaimsValidator"
- p:claimName="sub" p:valueToMatchLookupStrategy-ref="ClientIDFromOIDCMetadataContextLookupFunction" />
+ p:claimName="sub" p:valueToMatchLookupStrategy-ref="AdaptedRelyingPartyIdLookup" />
<bean id="AudienceClaimsValidator"
class="net.shibboleth.oidc.security.jwt.claims.impl.AudienceClaimsValidator">
@@ -499,7 +502,7 @@
<bean id="DefaultRevocationJWTClaimsValidator"
class="net.shibboleth.oidc.security.jwt.claims.impl.ChainingJWTClaimsValidator"
- p:claimValidators-ref="IntrospectionClaimsValidators" />
+ p:claimValidators-ref="RevocationClaimsValidators" />
<bean id="SelfIssuedClaimsValidator"
class="net.shibboleth.oidc.security.jwt.claims.impl.ExactMatchClaimsValidator"
@@ -517,15 +520,15 @@
<bean id="ClientIDClaimsValidator"
class="net.shibboleth.oidc.security.jwt.claims.impl.ExactMatchClaimsValidator"
- p:claimName="client_id" p:valueToMatchLookupStrategy-ref="ClientIDFromOIDCMetadataContextLookupFunction" />
+ p:claimName="client_id" p:valueToMatchLookupStrategy-ref="AdaptedRelyingPartyIdLookup" />
<bean id="LegacyClientIDClaimsValidator"
class="net.shibboleth.oidc.security.jwt.claims.impl.ExactMatchClaimsValidator"
- p:claimName="clid" p:valueToMatchLookupStrategy-ref="ClientIDFromOIDCMetadataContextLookupFunction" />
+ p:claimName="clid" p:valueToMatchLookupStrategy-ref="AdaptedRelyingPartyIdLookup" />
<bean id="ClientIDInAudienceClaimsValidator"
class="net.shibboleth.oidc.security.jwt.claims.impl.AudienceClaimsValidator"
- p:audienceLookupStrategy-ref="ClientIDFromOIDCMetadataContextLookupFunction" />
+ p:audienceLookupStrategy-ref="AdaptedRelyingPartyIdLookup" />
<bean id="JWTIDRevocationClaimsValidator"
class="net.shibboleth.oidc.security.jwt.claims.impl.JWTIdentifierRevocationValidator"
diff --git a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/authn/impl/JWTCredentialValidatorTest.java b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/authn/impl/JWTCredentialValidatorTest.java
index 85ddf769..6eb3e0dd 100644
--- a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/authn/impl/JWTCredentialValidatorTest.java
+++ b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/authn/impl/JWTCredentialValidatorTest.java
@@ -70,8 +70,8 @@ import net.shibboleth.idp.authn.impl.testing.BaseAuthenticationContextTest;
import net.shibboleth.idp.authn.principal.UsernamePrincipal;
import net.shibboleth.idp.plugin.oidc.op.authn.context.OAuth2ClientAuthenticationContext;
import net.shibboleth.idp.plugin.oidc.op.messaging.context.OIDCMetadataContext;
-import net.shibboleth.idp.plugin.oidc.op.profile.logic.ClientIDFromOIDCMetadataContextLookupFunction;
import net.shibboleth.idp.profile.context.RelyingPartyContext;
+import net.shibboleth.idp.profile.context.navigate.RelyingPartyIdLookupFunction;
import net.shibboleth.idp.profile.testing.ActionTestingSupport;
import net.shibboleth.oidc.jwt.claims.ClaimsValidator;
import net.shibboleth.oidc.profile.config.OIDCTokenConfiguration;
@@ -85,6 +85,7 @@ import net.shibboleth.oidc.security.jwt.claims.impl.ExpiryClaimsValidator;
import net.shibboleth.oidc.security.jwt.claims.impl.IssuedAtClaimsValidator;
import net.shibboleth.oidc.security.jwt.claims.impl.JWTIdentifierClaimsValidator;
import net.shibboleth.utilities.java.support.component.ComponentInitializationException;
+import net.shibboleth.utilities.java.support.logic.BiFunctionSupport;
/**
* Unit tests for {@link JWTCredentialValidator}.
@@ -209,6 +210,8 @@ public class JWTCredentialValidatorTest extends BaseAuthenticationContextTest {
ac.setAttemptedFlow(authenticationFlows.get(0));
ac.getSubcontext(OAuth2ClientAuthenticationContext.class, true).setClientAuthentication(clientAuth);
+ prc.getSubcontext(RelyingPartyContext.class, true).setRelyingPartyId(clientId.getValue());
+
final AuthorizationGrant authzGrant = new AuthorizationCodeGrant(new AuthorizationCode(), null);
completeSetup(new TokenRequest(null, clientAuth, authzGrant), method, sameSecret);
}
@@ -221,10 +224,12 @@ public class JWTCredentialValidatorTest extends BaseAuthenticationContextTest {
iatValidator.setRequiredRule(false);
final ExactMatchClaimsValidator issValidator = new ExactMatchClaimsValidator();
issValidator.setClaimName("iss");
- issValidator.setValueToMatchLookupStrategy(new ClientIDFromOIDCMetadataContextLookupFunction());
+ issValidator.setValueToMatchLookupStrategy(
+ BiFunctionSupport.forFunctionOfFirstArg(new RelyingPartyIdLookupFunction()));
final ExactMatchClaimsValidator subValidator = new ExactMatchClaimsValidator();
subValidator.setClaimName("sub");
- subValidator.setValueToMatchLookupStrategy(new ClientIDFromOIDCMetadataContextLookupFunction());
+ subValidator.setValueToMatchLookupStrategy(
+ BiFunctionSupport.forFunctionOfFirstArg(new RelyingPartyIdLookupFunction()));
final AudienceClaimsValidator audValidator = new AudienceClaimsValidator();
audValidator.setAudienceLookupStrategy((prc, claims) -> httpRequest.getRequestURL().toString());
final JWTIdentifierClaimsValidator jitValidator = new JWTIdentifierClaimsValidator();
diff --git a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/IntrospectionFlowTest.java b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/IntrospectionFlowTest.java
index 96425b4e..a3a3d37e 100644
--- a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/IntrospectionFlowTest.java
+++ b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/IntrospectionFlowTest.java
@@ -60,13 +60,6 @@ public class IntrospectionFlowTest extends AbstractOidcClientAuthenticationFlowT
public static final String FLOW_ID = "oauth2/introspection";
- private String clientId = "mockClientId";
-
- private String clientSecret = "mockClientSecret";
-
- private String clientIdSaml = "mockSamlClientId";
- private String clientSecretSaml = "mockClientSecretmockClientSecretmockClientSecret";
-
private Scope scope = Scope.parse("openid profile email");
@Autowired
@@ -89,13 +82,25 @@ public class IntrospectionFlowTest extends AbstractOidcClientAuthenticationFlowT
@Test
public void testUntrustedClient() throws NoSuchAlgorithmException, URISyntaxException, DataSealerException,
ComponentInitializationException {
- setBasicAuth(clientId, clientSecret);
+ setBasicAuth(clientId, clientSecret + "bad");
setHttpFormRequest("POST", Collections.singletonMap("token",
buildToken(clientId, "sub", Scope.parse("openid")).toJSONObject().getAsString("access_token")));
final FlowExecutionResult result = flowExecutor.launchExecution(FLOW_ID, null, externalContext);
assertErrorCode(result, OAuth2Error.INVALID_CLIENT_CODE);
}
+ @Test
+ public void testFailedAuthentication() throws IOException, NoSuchAlgorithmException, URISyntaxException,
+ DataSealerException, ComponentInitializationException {
+ storeMetadata(storageService, clientId, clientSecret, scope);
+ setBasicAuth(clientId, clientSecret + "X");
+ setHttpFormRequest("POST", Collections.singletonMap("token",
+ buildToken(clientId, "sub", Scope.parse("openid")).toJSONObject().getAsString("access_token")));
+ final FlowExecutionResult result = flowExecutor.launchExecution(FLOW_ID, null, externalContext);
+ final TokenIntrospectionErrorResponse resp = (TokenIntrospectionErrorResponse) parseErrorResponse(result);
+ Assert.assertEquals(resp.getErrorObject().getCode(), OAuth2Error.INVALID_CLIENT_CODE);
+ }
+
@Test
public void testInvalidMessage() throws IOException, NoSuchAlgorithmException, URISyntaxException,
DataSealerException, ComponentInitializationException {
@@ -106,7 +111,40 @@ public class IntrospectionFlowTest extends AbstractOidcClientAuthenticationFlowT
final FlowExecutionResult result = flowExecutor.launchExecution(FLOW_ID, null, externalContext);
assertErrorCode(result, OAuth2Error.INVALID_REQUEST_CODE);
}
+
+ @Test
+ public void testFailureUnverified() throws IOException, NoSuchAlgorithmException, URISyntaxException,
+ DataSealerException, ComponentInitializationException {
+ setBasicAuth(clientId, clientSecret);
+ setHttpFormRequest("POST", Map.of(
+ "token",
+ buildToken(clientId + "2", "sub", Scope.parse("openid")).toJSONObject().getAsString("access_token"),
+ "token_type",
+ "access_token"));
+ final FlowExecutionResult result = flowExecutor.launchExecution(FLOW_ID, null, externalContext);
+ final TokenIntrospectionSuccessResponse resp =
+ parseSuccessResponse(result, TokenIntrospectionSuccessResponse.class);
+ Assert.assertFalse(resp.isActive());
+ }
+ @Test
+ public void testSuccessUnverified() throws IOException, NoSuchAlgorithmException, URISyntaxException,
+ DataSealerException, ComponentInitializationException {
+ setBasicAuth(clientId, clientSecret);
+ setHttpFormRequest("POST", Map.of(
+ "token",
+ buildToken(clientId, "sub", Scope.parse("openid")).toJSONObject().getAsString("access_token"),
+ "token_type",
+ "access_token"));
+ final FlowExecutionResult result = flowExecutor.launchExecution(FLOW_ID, null, externalContext);
+ final TokenIntrospectionSuccessResponse resp =
+ parseSuccessResponse(result, TokenIntrospectionSuccessResponse.class);
+ Assert.assertTrue(resp.isActive());
+ Assert.assertEquals(resp.getClientID().getValue(), clientId);
+ Assert.assertEquals(resp.getScope(), Scope.parse("openid"));
+ Assert.assertNull(resp.getAudience());
+ }
+
@Test
public void testSuccess() throws IOException, NoSuchAlgorithmException, URISyntaxException, DataSealerException,
ComponentInitializationException {
@@ -309,18 +347,6 @@ public class IntrospectionFlowTest extends AbstractOidcClientAuthenticationFlowT
Assert.assertFalse(resp.isActive());
}
- @Test
- public void testFailedAuthentication() throws IOException, NoSuchAlgorithmException, URISyntaxException,
- DataSealerException, ComponentInitializationException {
- storeMetadata(storageService, clientId, clientSecret, scope);
- setBasicAuth(clientId, clientSecret + "X");
- setHttpFormRequest("POST", Collections.singletonMap("token",
- buildToken(clientId, "sub", Scope.parse("openid")).toJSONObject().getAsString("access_token")));
- final FlowExecutionResult result = flowExecutor.launchExecution(FLOW_ID, null, externalContext);
- final TokenIntrospectionErrorResponse resp = (TokenIntrospectionErrorResponse) parseErrorResponse(result);
- Assert.assertEquals(resp.getErrorObject().getCode(), OAuth2Error.INVALID_CLIENT_CODE);
- }
-
protected FlowExecutionResult launchWithJwtAuthentication(final SignedJWT jwt, final JWSAlgorithm algorithm,
final ClientAuthenticationMethod method) throws Exception {
if (ClientAuthenticationMethod.CLIENT_SECRET_JWT.equals(method)) {
diff --git a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/RevocationFlowTest.java b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/RevocationFlowTest.java
index b52bb476..83265876 100644
--- a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/RevocationFlowTest.java
+++ b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/RevocationFlowTest.java
@@ -58,11 +58,6 @@ public class RevocationFlowTest extends AbstractOidcClientAuthenticationFlowTest
public static final String FLOW_ID = "oauth2/revocation";
- String clientId = "mockClientId";
- String clientSecret = "mockClientSecret";
-
- String clientIdSaml = "mockSamlClientId";
- String clientSecretSaml = "mockClientSecretmockClientSecretmockClientSecret";
Scope scope = Scope.parse("openid profile email");
@@ -86,20 +81,41 @@ public class RevocationFlowTest extends AbstractOidcClientAuthenticationFlowTest
@Test
public void testUntrustedClient() throws IOException, NoSuchAlgorithmException, URISyntaxException,
DataSealerException, ComponentInitializationException {
- setBasicAuth(clientId, clientSecret);
+ setBasicAuth(clientId, clientSecret + "bad");
setHttpFormRequest("POST", Collections.singletonMap("token", super.buildToken(clientId, "sub",
Scope.parse("openid")).toJSONObject().getAsString("access_token")));
final FlowExecutionResult result = flowExecutor.launchExecution(FLOW_ID, null, externalContext);
assertErrorCode(result, OAuth2Error.INVALID_CLIENT_CODE);
}
+
+ @Test
+ public void testFailedAuthentication() throws IOException, NoSuchAlgorithmException, URISyntaxException,
+ DataSealerException, ComponentInitializationException {
+ setBasicAuth(clientId, clientSecret + "X");
+ storeMetadata(storageService, clientId, clientSecret, scope);
+ setHttpFormRequest("POST", Collections.singletonMap("token", super.buildLegacyToken(clientId, "sub",
+ Scope.parse("openid"), "mail").toJSONObject().getAsString("access_token")));
+ final FlowExecutionResult result = flowExecutor.launchExecution(FLOW_ID, null, externalContext);
+ assertErrorCode(result, OAuth2Error.INVALID_CLIENT_CODE);
+ }
@Test
- public void testSuccess() throws IOException, NoSuchAlgorithmException, URISyntaxException,
+ public void testSuccessUnverified() throws IOException, NoSuchAlgorithmException, URISyntaxException,
DataSealerException, ComponentInitializationException {
setBasicAuth(clientId, clientSecret);
setHttpFormRequest("POST", Collections.singletonMap("token", super.buildToken(clientId, "sub",
Scope.parse("openid")).toJSONObject().getAsString("access_token")));
+ final FlowExecutionResult result = flowExecutor.launchExecution(FLOW_ID, null, externalContext);
+ parseSuccessResponse(result, OAuth2RevocationSuccessResponse.class);
+ }
+
+ @Test
+ public void testSuccess() throws IOException, NoSuchAlgorithmException, URISyntaxException,
+ DataSealerException, ComponentInitializationException {
+ setBasicAuth(clientId, clientSecret);
storeMetadata(storageService, clientId, clientSecret, scope);
+ setHttpFormRequest("POST", Collections.singletonMap("token", super.buildToken(clientId, "sub",
+ Scope.parse("openid")).toJSONObject().getAsString("access_token")));
final FlowExecutionResult result = flowExecutor.launchExecution(FLOW_ID, null, externalContext);
parseSuccessResponse(result, OAuth2RevocationSuccessResponse.class);
}
@@ -118,9 +134,9 @@ public class RevocationFlowTest extends AbstractOidcClientAuthenticationFlowTest
public void testSuccessWithLegacyToken() throws IOException, NoSuchAlgorithmException, URISyntaxException,
DataSealerException, ComponentInitializationException, ParseException {
setBasicAuth(clientId, clientSecret);
+ storeMetadata(storageService, clientId, clientSecret, scope);
setHttpFormRequest("POST", Collections.singletonMap("token", super.buildLegacyToken(clientId, "sub",
Scope.parse("openid")).toJSONObject().getAsString("access_token")));
- storeMetadata(storageService, clientId, clientSecret, scope);
final FlowExecutionResult result = flowExecutor.launchExecution(FLOW_ID, null, externalContext);
parseSuccessResponse(result, OAuth2RevocationSuccessResponse.class);
}
@@ -129,9 +145,9 @@ public class RevocationFlowTest extends AbstractOidcClientAuthenticationFlowTest
public void testSuccessWithLegacyConsentToken() throws IOException, NoSuchAlgorithmException, URISyntaxException,
DataSealerException, ComponentInitializationException, ParseException {
setBasicAuth(clientId, clientSecret);
+ storeMetadata(storageService, clientId, clientSecret, scope);
setHttpFormRequest("POST", Collections.singletonMap("token", super.buildLegacyToken(clientId, "sub",
Scope.parse("openid"), "mail").toJSONObject().getAsString("access_token")));
- storeMetadata(storageService, clientId, clientSecret, scope);
final FlowExecutionResult result = flowExecutor.launchExecution(FLOW_ID, null, externalContext);
parseSuccessResponse(result, OAuth2RevocationSuccessResponse.class);
}
@@ -158,8 +174,8 @@ public class RevocationFlowTest extends AbstractOidcClientAuthenticationFlowTest
@Test
public void testSuccessJWTNoAudience() throws JOSEException, IOException {
- storeMetadata(storageService, clientId, clientSecret, scope);
setBasicAuth(clientId, clientSecret);
+ storeMetadata(storageService, clientId, clientSecret, scope);
setHttpFormRequest("POST", Map.of(
"token",
buildJWTToken(clientId, "sub", scope, null, signingKey.getPrivateKey(), "RS256").toJSONObject()
@@ -172,8 +188,8 @@ public class RevocationFlowTest extends AbstractOidcClientAuthenticationFlowTest
@Test
public void testSuccessJWTAudience() throws JOSEException, IOException {
- storeMetadata(storageService, clientId, clientSecret, scope);
setBasicAuth(clientId, clientSecret);
+ storeMetadata(storageService, clientId, clientSecret, scope);
setHttpFormRequest("POST", Map.of(
"token",
buildJWTToken("https://sp2.example.org", "sub", scope,
@@ -188,8 +204,8 @@ public class RevocationFlowTest extends AbstractOidcClientAuthenticationFlowTest
@Test
public void testSuccessJWTExpired() throws JOSEException, IOException {
- storeMetadata(storageService, clientId, clientSecret, scope);
setBasicAuth(clientId, clientSecret);
+ storeMetadata(storageService, clientId, clientSecret, scope);
final AccessTokenClaimsSet claims = new AccessTokenClaimsSet.Builder()
.setJWTID(idGenerator)
.setClientID(new ClientID(clientId))
@@ -212,8 +228,8 @@ public class RevocationFlowTest extends AbstractOidcClientAuthenticationFlowTest
@Test
public void testSuccessJWTNotAuthorized() throws JOSEException, IOException {
- storeMetadata(storageService, clientId, clientSecret, scope);
setBasicAuth(clientId, clientSecret);
+ storeMetadata(storageService, clientId, clientSecret, scope);
setHttpFormRequest("POST", Map.of(
"token",
buildJWTToken("https://sp3.example.org", "sub", scope,
@@ -228,8 +244,8 @@ public class RevocationFlowTest extends AbstractOidcClientAuthenticationFlowTest
@Test
public void testSuccessJWTWrongKey() throws JOSEException, IOException {
- storeMetadata(storageService, clientId, clientSecret, scope);
setBasicAuth(clientId, clientSecret);
+ storeMetadata(storageService, clientId, clientSecret, scope);
setHttpFormRequest("POST", Map.of(
"token",
buildJWTToken(clientId, "sub", scope, null, rsaPrivateKey, "RS256").toJSONObject()
@@ -239,16 +255,5 @@ public class RevocationFlowTest extends AbstractOidcClientAuthenticationFlowTest
final FlowExecutionResult result = flowExecutor.launchExecution(FLOW_ID, null, externalContext);
parseSuccessResponse(result, OAuth2RevocationSuccessResponse.class);
}
-
- @Test
- public void testFailedAuthentication() throws IOException, NoSuchAlgorithmException, URISyntaxException,
- DataSealerException, ComponentInitializationException {
- setBasicAuth(clientId, clientSecret + "X");
- setHttpFormRequest("POST", Collections.singletonMap("token", super.buildLegacyToken(clientId, "sub",
- Scope.parse("openid"), "mail").toJSONObject().getAsString("access_token")));
- storeMetadata(storageService, clientId, clientSecret, scope);
- final FlowExecutionResult result = flowExecutor.launchExecution(FLOW_ID, null, externalContext);
- assertErrorCode(result, OAuth2Error.INVALID_CLIENT_CODE);
- }
}
\ No newline at end of file
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list