[java-idp-oidc] branch main updated: JOIDC-70 - Scope handling changes to accomodate client_credentials grant
Scott Cantor
cantor.2 at osu.edu
Wed Jan 5 01:16:41 UTC 2022
This is an automated email from the git hooks/post-receive script.
scantor pushed a commit to branch main
in repository java-idp-oidc.
View the commit online:
http://git.shibboleth.net/view/?p=java-idp-oidc.git;a=commit;h=ba34e4abde84bbf07a7a31f43403b10a035b8108
The following commit(s) were added to refs/heads/main by this push:
new ba34e4ab JOIDC-70 - Scope handling changes to accomodate client_credentials grant
ba34e4ab is described below
commit ba34e4abde84bbf07a7a31f43403b10a035b8108
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Tue Jan 4 20:16:39 2022 -0500
JOIDC-70 - Scope handling changes to accomodate client_credentials grant
https://shibboleth.atlassian.net/browse/JOIDC-70
Merge in original scope reduction logic and relocate later in flow.
---
.../TokenRequestRequestedClaimsLookupFunction.java | 2 +-
.../oidc/op/profile/impl/ReduceValidatedScope.java | 107 ----------------
.../impl/SetConsentFromTokenToResponseContext.java | 9 +-
.../plugin/oidc/op/profile/impl/ValidateScope.java | 46 ++++++-
.../idp/flows/oidc/token/token-beans.xml | 19 ++-
.../shibboleth/idp/flows/oidc/token/token-flow.xml | 3 +-
.../idp/flows/oidc/userinfo/userinfo-beans.xml | 2 +-
.../op/profile/impl/ReduceValidatedScopeTest.java | 134 ---------------------
.../oidc/op/profile/impl/ValidateScopeTest.java | 35 +++++-
9 files changed, 90 insertions(+), 267 deletions(-)
diff --git a/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/TokenRequestRequestedClaimsLookupFunction.java b/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/TokenRequestRequestedClaimsLookupFunction.java
index 41339f5e..4f47d6e3 100644
--- a/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/TokenRequestRequestedClaimsLookupFunction.java
+++ b/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/TokenRequestRequestedClaimsLookupFunction.java
@@ -27,7 +27,7 @@ import net.shibboleth.idp.plugin.oidc.op.token.support.TokenClaimsSet;
* For Token and UserInfo end points.
*
* A function that returns copy of requested claims via a lookup function. This lookup locates requested claims from
- * token for token request handling. If token claims are not available, null is returned.
+ * the prior authz grant for token request handling. If token claims are not available, null is returned.
*/
public class TokenRequestRequestedClaimsLookupFunction extends AbstractTokenClaimsLookupFunction<OIDCClaimsRequest> {
diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/ReduceValidatedScope.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/ReduceValidatedScope.java
deleted file mode 100644
index 9b49fe46..00000000
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/ReduceValidatedScope.java
+++ /dev/null
@@ -1,107 +0,0 @@
-/*
- * Licensed to the University Corporation for Advanced Internet Development,
- * Inc. (UCAID) under one or more contributor license agreements. See the
- * NOTICE file distributed with this work for additional information regarding
- * copyright ownership. The UCAID licenses this file to You under the Apache
- * License, Version 2.0 (the "License"); you may not use this file except in
- * compliance with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.plugin.oidc.op.profile.impl;
-
-import java.util.List;
-import java.util.function.Function;
-
-import javax.annotation.Nonnull;
-import javax.annotation.Nullable;
-
-import org.opensaml.messaging.context.BaseContext;
-import org.opensaml.messaging.context.navigate.ChildContextLookup;
-import org.opensaml.profile.context.ProfileRequestContext;
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
-
-import com.nimbusds.oauth2.sdk.Scope;
-
-import net.shibboleth.idp.plugin.oidc.op.messaging.context.OIDCAuthenticationResponseTokenClaimsContext;
-import net.shibboleth.idp.plugin.oidc.op.profile.context.navigate.OIDCAuthenticationResponseContextLookupFunction;
-import net.shibboleth.utilities.java.support.component.ComponentSupport;
-import net.shibboleth.utilities.java.support.logic.Constraint;
-
-/**
- * An action that reduces validated scopes of the original authentication request to scopes of token request when using
- * refresh token as a grant and scopes are set.
- *
- * If in the case we do have scope request parameter we remove token delivery attributes as we have no way of
- * reproducing the circumstances they were produced in. ie. no way of telling if the scope change effects to their
- * release.
- */
-
-public class ReduceValidatedScope extends AbstractOIDCTokenResponseAction {
-
- /** Class logger. */
- @Nonnull private Logger log = LoggerFactory.getLogger(ReduceValidatedScope.class);
-
- /** Strategy used to locate the {@link OIDCAuthenticationResponseTokenClaimsContext}. */
- @Nonnull
- private Function<ProfileRequestContext,OIDCAuthenticationResponseTokenClaimsContext>
- tokenClaimsContextLookupStrategy;
-
- /** delivery claims to copy to claims set. */
- @Nullable private OIDCAuthenticationResponseTokenClaimsContext tokenClaimsCtx;
-
- /** Constructor. */
- ReduceValidatedScope() {
- tokenClaimsContextLookupStrategy =
- new ChildContextLookup<>(OIDCAuthenticationResponseTokenClaimsContext.class).compose(
- new OIDCAuthenticationResponseContextLookupFunction());
- }
-
- /**
- * Set the strategy used to locate the {@link OIDCAuthenticationResponseTokenClaimsContext} associated with a given
- * {@link ProfileRequestContext}.
- *
- * @param strategy lookup strategy
- */
- public void setOIDCAuthenticationResponseTokenClaimsContextLookupStrategy(
- @Nonnull final Function<ProfileRequestContext, OIDCAuthenticationResponseTokenClaimsContext> strategy) {
- ComponentSupport.ifInitializedThrowUnmodifiabledComponentException(this);
-
- tokenClaimsContextLookupStrategy = Constraint.isNotNull(strategy,
- "OIDCAuthenticationResponseTokenClaimsContextt lookup strategy cannot be null");
- }
-
- /** {@inheritDoc} */
- @Override
- protected void doExecute(@Nonnull final ProfileRequestContext profileRequestContext) {
- final Scope requestedScope = getTokenRequest().getScope();
- if (requestedScope == null) {
- return;
- }
- final List<String> validatedScopes = getOidcResponseContext().getScope().toStringList();
- log.debug("{} Original scope {}", getLogPrefix(), getOidcResponseContext().getScope().toString());
- validatedScopes.retainAll(requestedScope.toStringList());
- final Scope reducedScope = new Scope();
- for (final String scope : validatedScopes) {
- reducedScope.add(scope);
- }
- log.debug("{} Reduced scope {}", getLogPrefix(), reducedScope.toString());
- if (!reducedScope.equals(getOidcResponseContext().getScope())) {
- getOidcResponseContext().setScope(reducedScope);
- tokenClaimsCtx = tokenClaimsContextLookupStrategy.apply(profileRequestContext);
- if (tokenClaimsCtx != null) {
- log.debug("{} Removing token delivery attributes due to reduced scope", getLogPrefix());
- final BaseContext parent = tokenClaimsCtx.getParent();
- parent.removeSubcontext(tokenClaimsCtx);
- }
- }
- }
-}
diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/SetConsentFromTokenToResponseContext.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/SetConsentFromTokenToResponseContext.java
index 579a33e4..46e4d48f 100644
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/SetConsentFromTokenToResponseContext.java
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/SetConsentFromTokenToResponseContext.java
@@ -56,12 +56,11 @@ public class SetConsentFromTokenToResponseContext extends AbstractOIDCResponseAc
*
* @param strategy lookup strategy
*/
- public void
- setConsentedAttributesLookupStrategy(@Nonnull final Function<ProfileRequestContext,
- List<Object>> strategy) {
+ public void setConsentedAttributesLookupStrategy(
+ @Nonnull final Function<ProfileRequestContext,List<Object>> strategy) {
ComponentSupport.ifInitializedThrowUnmodifiabledComponentException(this);
- consentedAttributesLookupStrategy =
- Constraint.isNotNull(strategy, "ConsentedAttributesLookupStrategy lookup strategy cannot be null");
+
+ consentedAttributesLookupStrategy = Constraint.isNotNull(strategy, "Lookup strategy cannot be null");
}
/** {@inheritDoc} */
diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/ValidateScope.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/ValidateScope.java
index f22098d4..95830de9 100644
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/ValidateScope.java
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/ValidateScope.java
@@ -23,6 +23,7 @@ import java.util.function.Function;
import javax.annotation.Nonnull;
import javax.annotation.Nullable;
+import org.opensaml.messaging.context.navigate.ChildContextLookup;
import org.opensaml.profile.context.ProfileRequestContext;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
@@ -31,16 +32,20 @@ import com.nimbusds.oauth2.sdk.ResponseType;
import com.nimbusds.oauth2.sdk.Scope;
import com.nimbusds.openid.connect.sdk.OIDCScopeValue;
+import net.shibboleth.idp.plugin.oidc.op.messaging.context.OIDCAuthenticationResponseTokenClaimsContext;
import net.shibboleth.idp.plugin.oidc.op.profile.context.navigate.DefaultRequestResponseTypeLookupFunction;
import net.shibboleth.idp.plugin.oidc.op.profile.context.navigate.DefaultRequestedScopeLookupFunction;
+import net.shibboleth.idp.plugin.oidc.op.profile.context.navigate.OIDCAuthenticationResponseContextLookupFunction;
import net.shibboleth.utilities.java.support.component.ComponentSupport;
+import net.shibboleth.utilities.java.support.logic.Constraint;
/**
* Action that validates requested scopes are registered ones and stores the resulting set in the
* response context.
*
* <p>Explicitly requested scopes are also filtered against, and override, any scopes previously
- * validated as part of an authorization grant claim set.</p>
+ * validated as part of an authorization grant claim set. If this occurs, any grant-borne claims
+ * are removed because the association to specific scopes is gone by this point.</p>
*
* <p>The "offline_access" scope is ignored in authentication endpoint validation unless the
* response type includes "code".</p>
@@ -52,12 +57,21 @@ public class ValidateScope extends AbstractOIDCAuthenticationResponseAction {
/** Strategy used to obtain the requested scope value. */
@Nullable private Function<ProfileRequestContext,Scope> requestedScopesLookupStrategy;
+
+ /** Strategy used to locate the {@link OIDCAuthenticationResponseTokenClaimsContext}. */
+ @Nonnull
+ private Function<ProfileRequestContext,OIDCAuthenticationResponseTokenClaimsContext>
+ tokenClaimsContextLookupStrategy;
/**
* Constructor.
*/
public ValidateScope() {
requestedScopesLookupStrategy = new DefaultRequestedScopeLookupFunction();
+
+ tokenClaimsContextLookupStrategy =
+ new ChildContextLookup<>(OIDCAuthenticationResponseTokenClaimsContext.class).compose(
+ new OIDCAuthenticationResponseContextLookupFunction());
}
/**
@@ -65,11 +79,26 @@ public class ValidateScope extends AbstractOIDCAuthenticationResponseAction {
*
* @param strategy lookup strategy
*/
- public void setScopeLookupStrategy(@Nullable final Function<ProfileRequestContext, Scope> strategy) {
+ public void setRequestedScopesLookupStrategy(@Nullable final Function<ProfileRequestContext, Scope> strategy) {
ComponentSupport.ifInitializedThrowUnmodifiabledComponentException(this);
requestedScopesLookupStrategy = strategy;
}
+
+ /**
+ * Set the strategy used to locate the {@link OIDCAuthenticationResponseTokenClaimsContext} associated with a given
+ * {@link ProfileRequestContext}.
+ *
+ * @param strategy lookup strategy
+ */
+ public void setOIDCAuthenticationResponseTokenClaimsContextLookupStrategy(
+ @Nonnull final Function<ProfileRequestContext,OIDCAuthenticationResponseTokenClaimsContext> strategy) {
+ ComponentSupport.ifInitializedThrowUnmodifiabledComponentException(this);
+
+ tokenClaimsContextLookupStrategy = Constraint.isNotNull(strategy,
+ "OIDCAuthenticationResponseTokenClaimsContextt lookup strategy cannot be null");
+ }
+
// Checkstyle: CyclomaticComplexity OFF
/** {@inheritDoc} */
@@ -100,6 +129,8 @@ public class ValidateScope extends AbstractOIDCAuthenticationResponseAction {
previouslyGrantedScopes = null;
}
+ boolean reducedRequestedScopes = false;
+
for (Iterator<Scope.Value> i = requestedScopes.iterator(); i.hasNext();) {
final Scope.Value scope = i.next();
if (!registeredScopes.contains(scope)) {
@@ -110,6 +141,7 @@ public class ValidateScope extends AbstractOIDCAuthenticationResponseAction {
log.warn("{} Removing requested but previously ungranted scope {} for RP {}", getLogPrefix(),
scope.getValue(), getMetadataContext().getClientInformation().getID());
i.remove();
+ reducedRequestedScopes = true;
}
}
@@ -126,6 +158,16 @@ public class ValidateScope extends AbstractOIDCAuthenticationResponseAction {
if (!requestedScopes.isEmpty()) {
getOidcResponseContext().setScope(requestedScopes);
}
+
+ if (reducedRequestedScopes) {
+ final OIDCAuthenticationResponseTokenClaimsContext tokenClaimsCtx =
+ tokenClaimsContextLookupStrategy.apply(profileRequestContext);
+ if (tokenClaimsCtx != null) {
+ log.debug("{} Removing grant-encoded attributes due to reduction of requested scopes",
+ getLogPrefix());
+ tokenClaimsCtx.getParent().removeSubcontext(tokenClaimsCtx);
+ }
+ }
}
// Checkstyle: CyclomaticComplexity ON
diff --git a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/token/token-beans.xml b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/token/token-beans.xml
index 33dac13a..1609014c 100644
--- a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/token/token-beans.xml
+++ b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/token/token-beans.xml
@@ -66,9 +66,6 @@
class="net.shibboleth.idp.plugin.oidc.op.profile.context.navigate.TokenRequestValidRequestURIsLookupFunction"
scope="prototype" />
- <bean id="ValidateScope" class="net.shibboleth.idp.plugin.oidc.op.profile.impl.ValidateScope" scope="prototype"
- p:scopeLookupStrategy-ref="shibboleth.TokenRequestScopeLookupStrategy" />
-
<bean id="SetRequestedClaimsToResponseContext"
class="net.shibboleth.idp.plugin.oidc.op.profile.impl.SetRequestedClaimsToResponseContext" scope="prototype"
p:requestedClaimsLookupStrategy-ref="shibboleth.TokenRequestRequestedClaimsLookupFunction"
@@ -86,19 +83,19 @@
class="net.shibboleth.idp.plugin.oidc.op.profile.impl.SetAuthenticationTimeToResponseContext" scope="prototype"
p:authTimeLookupStrategy-ref="shibboleth.TokenRequestAuthTimeLookupFunction" />
+ <bean id="shibboleth.TokenRequestAuthTimeLookupFunction"
+ class="net.shibboleth.idp.plugin.oidc.op.profile.context.navigate.TokenRequestAuthTimeLookupFunction"
+ scope="prototype" />
+
<bean id="SetTokenDeliveryAttributesFromTokenToResponseContext"
- class="net.shibboleth.idp.plugin.oidc.op.profile.impl.SetTokenDeliveryAttributesFromTokenToResponseContext" scope="prototype">
- </bean>
+ class="net.shibboleth.idp.plugin.oidc.op.profile.impl.SetTokenDeliveryAttributesFromTokenToResponseContext"
+ scope="prototype" />
<bean id="SetConsentToResponseContext"
class="net.shibboleth.idp.plugin.oidc.op.profile.impl.SetConsentFromTokenToResponseContext" scope="prototype" />
- <bean id="ReduceValidatedScope" class="net.shibboleth.idp.plugin.oidc.op.profile.impl.ReduceValidatedScope"
- scope="prototype" />
-
- <bean id="shibboleth.TokenRequestAuthTimeLookupFunction"
- class="net.shibboleth.idp.plugin.oidc.op.profile.context.navigate.TokenRequestAuthTimeLookupFunction"
- scope="prototype" />
+ <bean id="ValidateScope" class="net.shibboleth.idp.plugin.oidc.op.profile.impl.ValidateScope" scope="prototype"
+ p:requestedScopesLookupStrategy-ref="shibboleth.TokenRequestScopeLookupStrategy" />
<bean id="PopulateIDTokenSignatureSigningParameters"
class="net.shibboleth.idp.plugin.oidc.op.profile.impl.PopulateOIDCSignatureSigningParameters " scope="prototype"
diff --git a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/token/token-flow.xml b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/token/token-flow.xml
index 5ee0e880..34ee4e0a 100644
--- a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/token/token-flow.xml
+++ b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/token/token-flow.xml
@@ -35,13 +35,12 @@
<evaluate expression="ValidateGrant" />
<evaluate expression="ValidatePKCE" />
<evaluate expression="ValidateRedirectURI" />
- <evaluate expression="ValidateScope" />
<evaluate expression="SetRequestedClaimsToResponseContext" />
<evaluate expression="SetAuthenticationContextClassReferenceToResponseContext" />
<evaluate expression="SetAuthenticationTimeToResponseContext" />
<evaluate expression="SetTokenDeliveryAttributesFromTokenToResponseContext" />
<evaluate expression="SetConsentToResponseContext" />
- <evaluate expression="ReduceValidatedScope" />
+ <evaluate expression="ValidateScope" />
<evaluate expression="PopulateIDTokenSignatureSigningParameters" />
<evaluate expression="PopulateIDTokenEncryptionParameters" />
<evaluate expression="'proceed'" />
diff --git a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/userinfo/userinfo-beans.xml b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/userinfo/userinfo-beans.xml
index f64a95f5..3441930a 100644
--- a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/userinfo/userinfo-beans.xml
+++ b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/userinfo/userinfo-beans.xml
@@ -35,7 +35,7 @@
scope="prototype" />
<bean id="ValidateScope" class="net.shibboleth.idp.plugin.oidc.op.profile.impl.ValidateScope" scope="prototype">
- <property name="scopeLookupStrategy">
+ <property name="requestedScopesLookupStrategy">
<null/>
</property>
</bean>
diff --git a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/ReduceValidatedScopeTest.java b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/ReduceValidatedScopeTest.java
deleted file mode 100644
index dbd79b21..00000000
--- a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/ReduceValidatedScopeTest.java
+++ /dev/null
@@ -1,134 +0,0 @@
-/*
- * Licensed to the University Corporation for Advanced Internet Development,
- * Inc. (UCAID) under one or more contributor license agreements. See the
- * NOTICE file distributed with this work for additional information regarding
- * copyright ownership. The UCAID licenses this file to You under the Apache
- * License, Version 2.0 (the "License"); you may not use this file except in
- * compliance with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.plugin.oidc.op.profile.impl;
-
-import net.shibboleth.idp.plugin.oidc.op.messaging.context.OIDCAuthenticationResponseTokenClaimsContext;
-import net.shibboleth.idp.plugin.oidc.op.profile.impl.ReduceValidatedScope;
-import net.shibboleth.idp.profile.testing.ActionTestingSupport;
-import net.shibboleth.utilities.java.support.component.ComponentInitializationException;
-import java.net.URI;
-import java.net.URISyntaxException;
-
-import org.springframework.webflow.execution.Event;
-import org.testng.Assert;
-import org.testng.annotations.Test;
-import com.nimbusds.oauth2.sdk.RefreshTokenGrant;
-import com.nimbusds.oauth2.sdk.Scope;
-import com.nimbusds.oauth2.sdk.TokenRequest;
-import com.nimbusds.oauth2.sdk.token.RefreshToken;
-
-/** {@link ReduceValidatedScope} unit test. */
-public class ReduceValidatedScopeTest extends BaseOIDCResponseActionTest {
-
- private ReduceValidatedScope action;
-
- private void init() throws ComponentInitializationException {
- action = new ReduceValidatedScope();
- action.initialize();
- OIDCAuthenticationResponseTokenClaimsContext tokenClaimsCtx =
- (OIDCAuthenticationResponseTokenClaimsContext) respCtx
- .addSubcontext(new OIDCAuthenticationResponseTokenClaimsContext());
- tokenClaimsCtx.getClaims().setClaim("gen", "value1");
- tokenClaimsCtx.getIdtokenClaims().setClaim("idtoken", "value2");
- tokenClaimsCtx.getUserinfoClaims().setClaim("userinfo", "value3");
- }
-
- /**
- * Test that scope reducing works as expected allowing only predefined new scopes and removing token delivery
- * attributes if scope is reduced.
- *
- * @throws ComponentInitializationException
- * @throws URISyntaxException
- */
- @Test
- public void testSuccessReduced() throws ComponentInitializationException, URISyntaxException {
- init();
- Scope scope = new Scope();
- scope.add("1");
- scope.add("2");
- scope.add("3");
- respCtx.setScope(scope);
- scope = new Scope();
- scope.add("2");
- scope.add("4");
- TokenRequest req =
- new TokenRequest(new URI("http://example.com"), new RefreshTokenGrant(new RefreshToken()), scope);
- setTokenRequest(req);
- final Event event = action.execute(requestCtx);
- Scope reducedScope = respCtx.getScope();
- ActionTestingSupport.assertProceedEvent(event);
- Assert.assertTrue(reducedScope.contains("2"));
- Assert.assertTrue(reducedScope.size() == 1);
- Assert.assertNull(respCtx.getSubcontext(OIDCAuthenticationResponseTokenClaimsContext.class, false));
- }
-
- /**
- * Test that scope reducing works as expected allowing only predefined new scopes and not removing token delivery
- * attributes if scope is not reduced.
- *
- * @throws ComponentInitializationException
- * @throws URISyntaxException
- */
- @Test
- public void testSuccessNotReduced() throws ComponentInitializationException, URISyntaxException {
- init();
- Scope scope = new Scope();
- scope.add("1");
- scope.add("2");
- scope.add("3");
- respCtx.setScope(scope);
- scope = new Scope();
- scope.add("1");
- scope.add("2");
- scope.add("3");
- scope.add("4");
- TokenRequest req =
- new TokenRequest(new URI("http://example.com"), new RefreshTokenGrant(new RefreshToken()), scope);
- setTokenRequest(req);
- final Event event = action.execute(requestCtx);
- Scope reducedScope = respCtx.getScope();
- ActionTestingSupport.assertProceedEvent(event);
- Assert.assertTrue(!reducedScope.contains("4"));
- Assert.assertTrue(reducedScope.size() == 3);
- Assert.assertNotNull(respCtx.getSubcontext(OIDCAuthenticationResponseTokenClaimsContext.class, false));
- }
-
- /**
- * Test that scope reducing works as expected when there is no new scopes defined.
- *
- * @throws ComponentInitializationException
- * @throws URISyntaxException
- */
- @Test
- public void testSuccessNoScope() throws ComponentInitializationException, URISyntaxException {
- init();
- Scope scope = new Scope();
- scope.add("1");
- scope.add("2");
- scope.add("3");
- respCtx.setScope(scope);
- TokenRequest req = new TokenRequest(new URI("http://example.com"), new RefreshTokenGrant(new RefreshToken()));
- setTokenRequest(req);
- final Event event = action.execute(requestCtx);
- Scope reducedScope = respCtx.getScope();
- ActionTestingSupport.assertProceedEvent(event);
- Assert.assertTrue(reducedScope.size() == 3);
- Assert.assertNotNull(respCtx.getSubcontext(OIDCAuthenticationResponseTokenClaimsContext.class, false));
- }
-
-}
\ No newline at end of file
diff --git a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/ValidateScopeTest.java b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/ValidateScopeTest.java
index 0ab3d4e3..cd041d40 100644
--- a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/ValidateScopeTest.java
+++ b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/ValidateScopeTest.java
@@ -21,6 +21,7 @@ import java.net.URI;
import java.net.URISyntaxException;
import java.time.Instant;
+import net.shibboleth.idp.plugin.oidc.op.messaging.context.OIDCAuthenticationResponseTokenClaimsContext;
import net.shibboleth.idp.plugin.oidc.op.messaging.context.OIDCMetadataContext;
import net.shibboleth.idp.plugin.oidc.op.profile.context.navigate.TokenRequestScopeLookupFunction;
import net.shibboleth.idp.plugin.oidc.op.token.support.AuthorizeCodeClaimsSet;
@@ -74,6 +75,13 @@ public class ValidateScopeTest extends BaseOIDCResponseActionTest {
final OIDCClientInformation information =
new OIDCClientInformation(new ClientID("test"), null, metaData, null, null, null);
oidcCtx.setClientInformation(information);
+
+ // Populate grant-basec claims for detection of purge.
+ final OIDCAuthenticationResponseTokenClaimsContext tokenClaimsCtx =
+ respCtx.getSubcontext(OIDCAuthenticationResponseTokenClaimsContext.class, true);
+ tokenClaimsCtx.getClaims().setClaim("gen", "value1");
+ tokenClaimsCtx.getIdtokenClaims().setClaim("idtoken", "value2");
+ tokenClaimsCtx.getUserinfoClaims().setClaim("userinfo", "value3");
}
/**
@@ -104,6 +112,9 @@ public class ValidateScopeTest extends BaseOIDCResponseActionTest {
final Event event = action.execute(requestCtx);
ActionTestingSupport.assertProceedEvent(event);
Assert.assertNull(respCtx.getScope());
+ final OIDCAuthenticationResponseTokenClaimsContext tokenClaimsCtx =
+ respCtx.getSubcontext(OIDCAuthenticationResponseTokenClaimsContext.class);
+ Assert.assertNotNull(tokenClaimsCtx);
}
/**
@@ -116,7 +127,7 @@ public class ValidateScopeTest extends BaseOIDCResponseActionTest {
public void testTokenClientCredentials() throws ComponentInitializationException, URISyntaxException {
action = new ValidateScope();
- action.setScopeLookupStrategy(new TokenRequestScopeLookupFunction());
+ action.setRequestedScopesLookupStrategy(new TokenRequestScopeLookupFunction());
action.initialize();
final TokenRequest req = new TokenRequest(new URI("http://localhost"),
@@ -132,6 +143,10 @@ public class ValidateScopeTest extends BaseOIDCResponseActionTest {
Assert.assertTrue(respCtx.getScope().contains(OIDCScopeValue.EMAIL));
Assert.assertTrue(respCtx.getScope().contains(OIDCScopeValue.OFFLINE_ACCESS));
Assert.assertFalse(respCtx.getScope().contains(OIDCScopeValue.PROFILE));
+
+ final OIDCAuthenticationResponseTokenClaimsContext tokenClaimsCtx =
+ respCtx.getSubcontext(OIDCAuthenticationResponseTokenClaimsContext.class);
+ Assert.assertNotNull(tokenClaimsCtx);
}
/**
@@ -144,7 +159,7 @@ public class ValidateScopeTest extends BaseOIDCResponseActionTest {
public void testTokenNoGrantedScopes() throws ComponentInitializationException, URISyntaxException {
action = new ValidateScope();
- action.setScopeLookupStrategy(new TokenRequestScopeLookupFunction());
+ action.setRequestedScopesLookupStrategy(new TokenRequestScopeLookupFunction());
action.initialize();
final TokenRequest req = new TokenRequest(new URI("http://localhost"),
@@ -162,6 +177,10 @@ public class ValidateScopeTest extends BaseOIDCResponseActionTest {
final Event event = action.execute(requestCtx);
ActionTestingSupport.assertProceedEvent(event);
Assert.assertNull(respCtx.getScope());
+
+ final OIDCAuthenticationResponseTokenClaimsContext tokenClaimsCtx =
+ respCtx.getSubcontext(OIDCAuthenticationResponseTokenClaimsContext.class);
+ Assert.assertNull(tokenClaimsCtx);
}
/**
@@ -174,7 +193,7 @@ public class ValidateScopeTest extends BaseOIDCResponseActionTest {
public void testTokenGrantedScopes() throws ComponentInitializationException, URISyntaxException {
action = new ValidateScope();
- action.setScopeLookupStrategy(new TokenRequestScopeLookupFunction());
+ action.setRequestedScopesLookupStrategy(new TokenRequestScopeLookupFunction());
action.initialize();
final TokenRequest req = new TokenRequest(new URI("http://localhost"),
@@ -196,6 +215,10 @@ public class ValidateScopeTest extends BaseOIDCResponseActionTest {
Assert.assertTrue(respCtx.getScope().contains(OIDCScopeValue.EMAIL));
Assert.assertFalse(respCtx.getScope().contains(OIDCScopeValue.OFFLINE_ACCESS));
Assert.assertFalse(respCtx.getScope().contains(OIDCScopeValue.PROFILE));
+
+ final OIDCAuthenticationResponseTokenClaimsContext tokenClaimsCtx =
+ respCtx.getSubcontext(OIDCAuthenticationResponseTokenClaimsContext.class);
+ Assert.assertNull(tokenClaimsCtx);
}
/**
@@ -208,7 +231,7 @@ public class ValidateScopeTest extends BaseOIDCResponseActionTest {
public void testUserInfoGrantedScopes() throws ComponentInitializationException, URISyntaxException {
action = new ValidateScope();
- action.setScopeLookupStrategy(null);
+ action.setRequestedScopesLookupStrategy(null);
action.initialize();
final UserInfoRequest req =
@@ -228,6 +251,10 @@ public class ValidateScopeTest extends BaseOIDCResponseActionTest {
Assert.assertTrue(respCtx.getScope().contains(OIDCScopeValue.EMAIL));
Assert.assertFalse(respCtx.getScope().contains(OIDCScopeValue.OFFLINE_ACCESS));
Assert.assertFalse(respCtx.getScope().contains(OIDCScopeValue.PROFILE));
+
+ final OIDCAuthenticationResponseTokenClaimsContext tokenClaimsCtx =
+ respCtx.getSubcontext(OIDCAuthenticationResponseTokenClaimsContext.class);
+ Assert.assertNotNull(tokenClaimsCtx);
}
}
\ No newline at end of file
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list