[java-idp-oidc] branch main updated: Cleanup pass over TokenClaimSet and subclass builder APIs.
Scott Cantor
cantor.2 at osu.edu
Thu Jan 6 23:26:12 UTC 2022
This is an automated email from the git hooks/post-receive script.
scantor pushed a commit to branch main
in repository java-idp-oidc.
View the commit online:
http://git.shibboleth.net/view/?p=java-idp-oidc.git;a=commit;h=eb97243d275e4888023783f109919ddd8408ad56
The following commit(s) were added to refs/heads/main by this push:
new eb97243d Cleanup pass over TokenClaimSet and subclass builder APIs.
eb97243d is described below
commit eb97243d275e4888023783f109919ddd8408ad56
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Thu Jan 6 18:26:08 2022 -0500
Cleanup pass over TokenClaimSet and subclass builder APIs.
---
.../op/token/support/AccessTokenClaimsSet.java | 151 +++---
.../op/token/support/AuthorizeCodeClaimsSet.java | 99 ++--
.../op/token/support/RefreshTokenClaimsSet.java | 70 ++-
.../oidc/op/token/support/TokenClaimsSet.java | 515 ++++++++++++++-------
.../AbstractTokenClaimsLookupFunctionTest.java | 18 +-
.../BaseTokenRequestLookupFunctionTest.java | 30 +-
.../TokenRequestNonceLookupFunctionTest.java | 2 -
...stUserInfoDeliveryClaimsLookupFunctionTest.java | 2 -
.../UserInfoRequestClientIDLookupFunctionTest.java | 6 +-
.../op/token/support/AccessTokenClaimsSetTest.java | 52 ++-
.../token/support/AuthorizeCodeClaimsSetTest.java | 35 +-
.../token/support/RefreshTokenClaimsSetTest.java | 35 +-
.../oidc/op/token/support/TokenClaimsSetTest.java | 83 ----
.../FormOutboundIntrospectionResponseMessage.java | 3 +-
.../op/profile/impl/InitializeSubjectContext.java | 23 +-
.../impl/SetAccessTokenToResponseContext.java | 29 +-
.../SetAuthorizationCodeToResponseContext.java | 31 +-
.../profile/impl/SetSubjectToResponseContext.java | 3 +-
.../op/oauth2/profile/impl/RevokeTokenTest.java | 15 +-
.../op/profile/flow/AbstractOidcApiFlowTest.java | 19 +-
.../profile/impl/InitializeSubjectContextTest.java | 32 +-
.../impl/SetAccessTokenToResponseContextTest.java | 108 ++++-
...eferenceFromAuthzCodeToResponseContextTest.java | 34 +-
.../SetConsentFromTokenToResponseContextTest.java | 25 +-
.../impl/SetRefreshTokenToResponseContextTest.java | 69 ++-
.../SetRequestedClaimsToResponseContextTest.java | 30 +-
.../impl/SetSubjectToResponseContextTest.java | 28 +-
...ryAttributesFromTokenToResponseContextTest.java | 34 +-
.../op/profile/impl/ValidateAccessTokenTest.java | 85 +++-
.../oidc/op/profile/impl/ValidateGrantTest.java | 31 +-
.../oidc/op/profile/impl/ValidatePKCETest.java | 228 ++++++---
.../oidc/op/profile/impl/ValidateScopeTest.java | 52 ++-
32 files changed, 1324 insertions(+), 653 deletions(-)
diff --git a/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/token/support/AccessTokenClaimsSet.java b/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/token/support/AccessTokenClaimsSet.java
index 7830d7fc..68be3b0d 100644
--- a/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/token/support/AccessTokenClaimsSet.java
+++ b/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/token/support/AccessTokenClaimsSet.java
@@ -25,8 +25,6 @@ import org.slf4j.LoggerFactory;
import com.nimbusds.jwt.JWTClaimsSet;
import com.nimbusds.oauth2.sdk.Scope;
import com.nimbusds.oauth2.sdk.id.ClientID;
-import com.nimbusds.openid.connect.sdk.Nonce;
-import com.nimbusds.openid.connect.sdk.OIDCClaimsRequest;
import com.nimbusds.openid.connect.sdk.claims.ACR;
import com.nimbusds.openid.connect.sdk.claims.ClaimsSet;
@@ -37,7 +35,6 @@ import net.shibboleth.utilities.java.support.security.IdentifierGenerationStrate
import java.net.URI;
import java.text.ParseException;
import java.time.Instant;
-import java.util.List;
/** Class wrapping claims set for access token. */
public final class AccessTokenClaimsSet extends TokenClaimsSet {
@@ -50,63 +47,28 @@ public final class AccessTokenClaimsSet extends TokenClaimsSet {
private Logger log = LoggerFactory.getLogger(AccessTokenClaimsSet.class);
/**
- * Constructor for access token claims set when derived from authz code.
+ * Constructor for access token claims set when derived from existing claims set.
*
- * @param tokenClaimSet Authorize Code / Refresh Token this token is based on. Must not be NULL.
- * @param scope Validated and possibly reduced scope of the authentication request. Must not be NULL.
+ * @param tokenClaimsSet Authorize Code / Refresh Token this token is based on
+ * @param scope Validated and possibly reduced scope of the authentication request
* @param dlClaims Claims set for token delivery.
* @param dlClaimsUI Claims set for token delivery, user info only.
- * @param iat Issue time of the token. Must not be NULL.
- * @param exp Expiration time of the token. Must not be NULL.
- * @throws RuntimeException if called with non allowed null parameters
+ * @param iat Issue time of the token
+ * @param exp Expiration time of the token
*/
// Checkstyle: ParameterNumber OFF
- public AccessTokenClaimsSet(@Nonnull final TokenClaimsSet tokenClaimSet, @Nonnull final Scope scope,
+ public AccessTokenClaimsSet(@Nonnull final TokenClaimsSet tokenClaimsSet, @Nonnull final Scope scope,
@Nullable final ClaimsSet dlClaims, @Nullable final ClaimsSet dlClaimsUI, @Nonnull final Instant iat,
@Nonnull final Instant exp) {
- super(VALUE_TYPE_AT, tokenClaimSet.getID(), tokenClaimSet.getClientID(),
- tokenClaimSet.getClaimsSet().getIssuer(), tokenClaimSet.getPrincipal(),
- tokenClaimSet.getClaimsSet().getSubject(),
- tokenClaimSet.getACR() == null ? null : new ACR(tokenClaimSet.getACR()), iat, exp,
- tokenClaimSet.getNonce(), tokenClaimSet.getAuthenticationTime(), tokenClaimSet.getRedirectURI(), scope,
- tokenClaimSet.getClaimsRequest(), dlClaims, null, dlClaimsUI, tokenClaimSet.getConsentedClaims(),
- null, tokenClaimSet.isConsentEnabled());
- }
- // Checkstyle: ParameterNumber ON
-
- /**
- * Constructor for access token claims set.
- *
- * @param idGenerator Generator for pseudo unique identifier for the code. Must not be NULL.
- * @param clientID Client Id of the rp. Must not be NULL.
- * @param issuer OP issuer value. Must not be NULL.
- * @param userPrincipal User Principal of the authenticated user. Must not be NULL.
- * @param subject subject of the authenticated user. Must not be NULL
- * @param acr Authentication context class reference value of the authentication. May be NULL.
- * @param iat Issue time of the authorize code. Must not be NULL.
- * @param exp Expiration time of the authorize code. Must not be NULL.
- * @param nonce Nonce of the authentication request. May be NULL.
- * @param authTime Authentication time of the user. Must not be NULL.
- * @param redirectURI Validated redirect URI of the authentication request. Must not be NULL.
- * @param scope Scope of the authentication request. Must not be NULL.
- * @param claims Claims request of the authentication request. May be NULL.
- * @param dlClaims token delivery claims delivered both for id token and userinfo response. May be NULL.
- * @param dlClaimsUI token delivery claims delivered for userinfo response. May be NULL.
- * @param consentedClaims consented claims. May be NULL.
- * @param consentEnabled Whether consent has been enabled.
- * @throws RuntimeException if called with nonallowed null parameters
- */
- // Checkstyle: ParameterNumber OFF
- private AccessTokenClaimsSet(@Nonnull final IdentifierGenerationStrategy idGenerator,
- @Nonnull final ClientID clientID, @Nonnull final String issuer, @Nonnull final String userPrincipal,
- @Nonnull final String subject, @Nullable final ACR acr, @Nonnull final Instant iat,
- @Nonnull final Instant exp, @Nullable final Nonce nonce, @Nonnull final Instant authTime,
- @Nonnull final URI redirectURI, @Nonnull final Scope scope, @Nullable final OIDCClaimsRequest claims,
- @Nullable final ClaimsSet dlClaims, @Nullable final ClaimsSet dlClaimsUI,
- @Nullable final List<Object> consentedClaims, final boolean consentEnabled) {
- super(VALUE_TYPE_AT, idGenerator.generateIdentifier(), clientID, issuer, userPrincipal, subject, acr, iat, exp,
- nonce, authTime, redirectURI, scope, claims, dlClaims, null, dlClaimsUI, consentedClaims, null,
- consentEnabled);
+
+ final Builder builder = new Builder(tokenClaimsSet);
+ builder.setScope(scope);
+ builder.setDlClaims(dlClaims);
+ builder.setDlClaimsUI(dlClaimsUI);
+ builder.setIssuedAt(iat);
+ builder.setExpiresAt(exp);
+
+ setClaimsSet(builder.buildJWTClaimsSet(VALUE_TYPE_AT));
}
// Checkstyle: ParameterNumber ON
@@ -116,7 +78,7 @@ public final class AccessTokenClaimsSet extends TokenClaimsSet {
* @param accessTokenClaimsSet access token claims set
*/
private AccessTokenClaimsSet(final JWTClaimsSet accessTokenClaimsSet) {
- setClaimsSet(accessTokenClaimsSet);
+ super(accessTokenClaimsSet);
}
/**
@@ -148,42 +110,85 @@ public final class AccessTokenClaimsSet extends TokenClaimsSet {
}
/** Builder to create instance of AccessTokenClaimsSet. */
- public static class Builder extends TokenClaimsSet.Builder<AccessTokenClaimsSet> {
+ public static final class Builder extends TokenClaimsSet.Builder<AccessTokenClaimsSet> {
/**
* Constructor for access token builder.
*
- * @param idGenerator Generator for pseudo unique identifier for the code. Must not be NULL.
- * @param clientID Client Id of the rp. Must not be NULL.
- * @param issuer OP issuer value. Must not be NULL.
- * @param userPrincipal User Principal of the authenticated user. Must not be NULL.
- * @param subject subject of the authenticated user. Must not be NULL
- * @param issuedAt Issue time of the authorize code. Must not be NULL.
- * @param expiresAt Expiration time of the authorize code. Must not be NULL.
- * @param authenticationTime Authentication time of the user. Must not be NULL.
- * @param redirectURI Validated redirect URI of the authentication request. Must not be NULL.
- * @param scope Scope of the authentication request. Must not be NULL.
+ * @param idGenerator Generator for pseudo unique identifier for the code
+ * @param clientID Client Id of the rp
+ * @param issuer OP issuer value
+ * @param userPrincipal User Principal of the authenticated user
+ * @param subject subject of the authenticated user
+ * @param issuedAt Issue time of the authorize code
+ * @param expiresAt Expiration time of the authorize code
+ * @param authenticationTime Authentication time of the user
+ * @param redirectURI Validated redirect URI of the authentication request
+ * @param scope Scope of the authentication request
+ *
+ * @deprecated
*/
- // Checkstyle: ParameterNumber OFF
+// Checkstyle: ParameterNumber OFF
+ @Deprecated(since="3.1.0", forRemoval=true)
public Builder(@Nonnull final IdentifierGenerationStrategy idGenerator, @Nonnull final ClientID clientID,
@Nonnull final String issuer, @Nonnull final String userPrincipal, @Nonnull final String subject,
@Nonnull final Instant issuedAt, @Nonnull final Instant expiresAt,
@Nonnull final Instant authenticationTime, @Nonnull final URI redirectURI, @Nonnull final Scope scope) {
- super(idGenerator, clientID, issuer, userPrincipal, subject, issuedAt, expiresAt, authenticationTime,
- redirectURI, scope);
+ setJWTID(idGenerator);
+ setClientID(clientID);
+ setIssuer(issuer);
+ setPrincipal(userPrincipal);
+ setSubject(subject);
+ setIssuedAt(issuedAt);
+ setExpiresAt(expiresAt);
+ setAuthenticationTime(authenticationTime);
+ setRedirectURI(redirectURI);
+ setScope(scope);
}
- // Checkstyle: ParameterNumber ON
+// Checkstyle: ParameterNumber ON
+ /**
+ * Default constructor.
+ *
+ * @since 3.1.0
+ */
+ public Builder() {
+
+ }
+
+ /**
+ * Bases a builder on an existing token claims set.
+ *
+ * @param existing existing claim set
+ */
+ private Builder(@Nonnull final TokenClaimsSet existing) {
+ setJWTID(existing.getID());
+ setClientID(existing.getClientID());
+ setIssuer(existing.getClaimsSet().getIssuer());
+ setPrincipal(existing.getPrincipal());
+ setSubject(existing.getClaimsSet().getSubject());
+ setACR(existing.getACR() == null ? null : new ACR(existing.getACR()));
+ setNonce(existing.getNonce());
+ setNotBefore(existing.getNotBefore());
+ setAuthenticationTime(existing.getAuthenticationTime());
+ setAudience(existing.getAudience());
+ setRedirectURI(existing.getRedirectURI());
+ setClaims(existing.getClaimsRequest());
+ setConsentedClaims(existing.getConsentedClaims());
+ setConsentEnabled(existing.isConsentEnabled());
+ }
+
/**
* Builds AccessTokenClaimsSet.
*
- * @return AccessTokenClaimsSet instance.
+ * @return AccessTokenClaimsSet instance
+ *
+ * @since 3.1.0
*/
public AccessTokenClaimsSet build() {
- return new AccessTokenClaimsSet(idGen, rpId, iss, usrPrincipal, sub, acr, iat, exp, nonce, authTime,
- redirect, reqScope, claims, dlClaims, dlClaimsUI, cnsntdClaims, cnsntEnabled);
+ return new AccessTokenClaimsSet(buildJWTClaimsSet(VALUE_TYPE_AT));
}
-
+
}
}
diff --git a/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/token/support/AuthorizeCodeClaimsSet.java b/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/token/support/AuthorizeCodeClaimsSet.java
index 44a383fd..55310642 100644
--- a/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/token/support/AuthorizeCodeClaimsSet.java
+++ b/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/token/support/AuthorizeCodeClaimsSet.java
@@ -18,15 +18,10 @@
package net.shibboleth.idp.plugin.oidc.op.token.support;
import javax.annotation.Nonnull;
-import javax.annotation.Nullable;
import com.nimbusds.jwt.JWTClaimsSet;
import com.nimbusds.oauth2.sdk.Scope;
import com.nimbusds.oauth2.sdk.id.ClientID;
-import com.nimbusds.openid.connect.sdk.Nonce;
-import com.nimbusds.openid.connect.sdk.OIDCClaimsRequest;
-import com.nimbusds.openid.connect.sdk.claims.ACR;
-import com.nimbusds.openid.connect.sdk.claims.ClaimsSet;
import net.shibboleth.utilities.java.support.security.DataSealer;
import net.shibboleth.utilities.java.support.security.DataSealerException;
@@ -34,7 +29,6 @@ import net.shibboleth.utilities.java.support.security.IdentifierGenerationStrate
import java.net.URI;
import java.text.ParseException;
import java.time.Instant;
-import java.util.List;
/** Class wrapping claims set for authorize code. */
public final class AuthorizeCodeClaimsSet extends TokenClaimsSet {
@@ -42,52 +36,13 @@ public final class AuthorizeCodeClaimsSet extends TokenClaimsSet {
/** Value of authorize code claims set type. */
public static final String VALUE_TYPE_AC = "ac";
- /**
- * Constructor for authorize code claims set.
- *
- * @param idGenerator Generator for pseudo unique identifier for the code. Must not be NULL.
- * @param clientID Client Id of the rp. Must not be NULL.
- * @param issuer OP issuer value. Must not be NULL.
- * @param userPrincipal User Principal of the authenticated user. Must not be NULL.
- * @param subject Subject of the authenticated user. Must not be NULL
- * @param acr Authentication context class reference value of the authentication. May be NULL.
- * @param iat Issue time of the authorize code. Must not be NULL.
- * @param exp Expiration time of the authorize code. Must not be NULL.
- * @param nonce Nonce of the authentication request. May be NULL.
- * @param authTime Authentication time of the user. Must not be NULL.
- * @param redirectURI Validated redirect URI of the authentication request. Must not be NULL.
- * @param scope Scope of the authentication request. Must not be NULL.
- * @param claims Claims request of the authentication request. May be NULL.
- * @param dlClaims Token delivery claims delivered both for id token and userinfo response. May be NULL.
- * @param dlClaimsID Token delivery claims delivered for id token. May be NULL.
- * @param dlClaimsUI Token delivery claims delivered for userinfo response. May be NULL.
- * @param consentedClaims consented claims. May be NULL.
- * @param codeChallenge Code Challenge. May be NULL.
- * @param consentEnabled Whether consent has been enabled.
- * @throws RuntimeException if called with nonallowed null parameters
- */
- // Checkstyle: ParameterNumber OFF
- private AuthorizeCodeClaimsSet(@Nonnull final IdentifierGenerationStrategy idGenerator,
- @Nonnull final ClientID clientID, @Nonnull final String issuer, @Nonnull final String userPrincipal,
- @Nonnull final String subject, @Nonnull final ACR acr, @Nonnull final Instant iat,
- @Nonnull final Instant exp, @Nullable final Nonce nonce, @Nonnull final Instant authTime,
- @Nonnull final URI redirectURI, @Nonnull final Scope scope, @Nullable final OIDCClaimsRequest claims,
- @Nullable final ClaimsSet dlClaims, @Nullable final ClaimsSet dlClaimsID,
- @Nullable final ClaimsSet dlClaimsUI, @Nullable final List<Object> consentedClaims,
- @Nullable final String codeChallenge, final boolean consentEnabled) {
- super(VALUE_TYPE_AC, idGenerator.generateIdentifier(), clientID, issuer, userPrincipal, subject, acr, iat, exp,
- nonce, authTime, redirectURI, scope, claims, dlClaims, dlClaimsID, dlClaimsUI, consentedClaims,
- codeChallenge, consentEnabled);
- }
- // Checkstyle: ParameterNumber ON
-
/**
* Private constructor for the parser.
*
* @param authzCodeClaimsSet authorize code claims set
*/
private AuthorizeCodeClaimsSet(final JWTClaimsSet authzCodeClaimsSet) {
- setClaimsSet(authzCodeClaimsSet);
+ super(authzCodeClaimsSet);
}
/**
@@ -121,41 +76,59 @@ public final class AuthorizeCodeClaimsSet extends TokenClaimsSet {
/** Builder to create instance of AuthorizeCodeClaimsSet. */
public static class Builder extends TokenClaimsSet.Builder<AuthorizeCodeClaimsSet> {
+ /**
+ * Default constructor.
+ *
+ * @since 3.1.0
+ */
+ public Builder() {
+
+ }
+
/**
* Constructor for authorize code builder.
*
- * @param idGenerator Generator for pseudo unique identifier for the code. Must not be NULL.
- * @param clientID Client Id of the rp. Must not be NULL.
- * @param issuer OP issuer value. Must not be NULL.
- * @param userPrincipal User Principal of the authenticated user. Must not be NULL.
- * @param subject subject of the authenticated user. Must not be NULL
- * @param issuedAt Issue time of the authorize code. Must not be NULL.
- * @param expiresAt Expiration time of the authorize code. Must not be NULL.
- * @param authenticationTime Authentication time of the user. Must not be NULL.
- * @param redirectURI Validated redirect URI of the authentication request. Must not be NULL.
- * @param scope Scope of the authentication request. Must not be NULL.
+ * @param idGenerator Generator for pseudo unique identifier for the code
+ * @param clientID Client Id of the rp
+ * @param issuer OP issuer value
+ * @param userPrincipal User Principal of the authenticated user
+ * @param subject subject of the authenticated user
+ * @param issuedAt Issue time of the authorize code
+ * @param expiresAt Expiration time of the authorize code
+ * @param authenticationTime Authentication time of the user
+ * @param redirectURI Validated redirect URI of the authentication request
+ * @param scope Scope of the authentication request
+ *
+ * @deprecated
*/
// Checkstyle: ParameterNumber OFF
+ @Deprecated(since="3.1.0", forRemoval=true)
public Builder(@Nonnull final IdentifierGenerationStrategy idGenerator, @Nonnull final ClientID clientID,
@Nonnull final String issuer, @Nonnull final String userPrincipal, @Nonnull final String subject,
@Nonnull final Instant issuedAt, @Nonnull final Instant expiresAt,
@Nonnull final Instant authenticationTime, @Nonnull final URI redirectURI, @Nonnull final Scope scope) {
- super(idGenerator, clientID, issuer, userPrincipal, subject, issuedAt, expiresAt, authenticationTime,
- redirectURI, scope);
+
+ setJWTID(idGenerator);
+ setClientID(clientID);
+ setIssuer(issuer);
+ setPrincipal(userPrincipal);
+ setSubject(subject);
+ setIssuedAt(issuedAt);
+ setExpiresAt(expiresAt);
+ setAuthenticationTime(authenticationTime);
+ setRedirectURI(redirectURI);
+ setScope(scope);
}
// Checkstyle: ParameterNumber ON
/**
* Builds AuthorizeCodeClaimsSet.
*
- * @return AuthorizeCodeClaimsSet instance.
+ * @return AuthorizeCodeClaimsSet instance
*/
public AuthorizeCodeClaimsSet build() {
- return new AuthorizeCodeClaimsSet(idGen, rpId, iss, usrPrincipal, sub, acr, iat, exp, nonce, authTime,
- redirect, reqScope, claims, dlClaims, dlClaimsID, dlClaimsUI, cnsntdClaims,
- codeChallenge, cnsntEnabled);
+ return new AuthorizeCodeClaimsSet(buildJWTClaimsSet(VALUE_TYPE_AC));
}
-
}
}
diff --git a/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/token/support/RefreshTokenClaimsSet.java b/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/token/support/RefreshTokenClaimsSet.java
index 1a551348..316d537a 100644
--- a/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/token/support/RefreshTokenClaimsSet.java
+++ b/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/token/support/RefreshTokenClaimsSet.java
@@ -25,6 +25,7 @@ import com.nimbusds.openid.connect.sdk.claims.ACR;
import net.shibboleth.utilities.java.support.security.DataSealer;
import net.shibboleth.utilities.java.support.security.DataSealerException;
+
import java.text.ParseException;
import java.time.Instant;
@@ -39,23 +40,20 @@ public final class RefreshTokenClaimsSet extends TokenClaimsSet {
private Logger log = LoggerFactory.getLogger(RefreshTokenClaimsSet.class);
/**
- * Constructor for refresh token claims set when derived from authz code.
+ * Constructor for refresh token claims set when derived from existing claim set.
*
- * @param tokenClaimsSet Authorize Code / Refresh Token this token is based on. Must not be NULL.
- * @param iat Issue time of the token. Must not be NULL.
- * @param exp Expiration time of the token. Must not be NULL.
- * @throws RuntimeException if called with non allowed null parameters
+ * @param tokenClaimsSet code or token this token is based on
+ * @param iat new issue time of the token
+ * @param exp new expiration time of the token
*/
public RefreshTokenClaimsSet(@Nonnull final TokenClaimsSet tokenClaimsSet, @Nonnull final Instant iat,
@Nonnull final Instant exp) {
- super(VALUE_TYPE_RF, tokenClaimsSet.getID(), tokenClaimsSet.getClientID(),
- tokenClaimsSet.getClaimsSet().getIssuer(), tokenClaimsSet.getPrincipal(),
- tokenClaimsSet.getClaimsSet().getSubject(),
- tokenClaimsSet.getACR() == null ? null : new ACR(tokenClaimsSet.getACR()), iat, exp,
- tokenClaimsSet.getNonce(), tokenClaimsSet.getAuthenticationTime(), tokenClaimsSet.getRedirectURI(),
- tokenClaimsSet.getScope(), tokenClaimsSet.getClaimsRequest(), tokenClaimsSet.getDeliveryClaims(), null,
- tokenClaimsSet.getUserinfoDeliveryClaims(), tokenClaimsSet.getConsentedClaims(), null,
- tokenClaimsSet.isConsentEnabled());
+
+ final Builder builder = new Builder(tokenClaimsSet);
+ builder.setIssuedAt(iat);
+ builder.setExpiresAt(exp);
+
+ setClaimsSet(builder.buildJWTClaimsSet(VALUE_TYPE_RF));
}
/**
@@ -64,7 +62,7 @@ public final class RefreshTokenClaimsSet extends TokenClaimsSet {
* @param refreshTokenClaimsSet refresh token claims set
*/
private RefreshTokenClaimsSet(final JWTClaimsSet refreshTokenClaimsSet) {
- setClaimsSet(refreshTokenClaimsSet);
+ super(refreshTokenClaimsSet);
}
/**
@@ -96,4 +94,46 @@ public final class RefreshTokenClaimsSet extends TokenClaimsSet {
return parse(dataSealer.unwrap(wrappedAccessToken));
}
-}
+ /**
+ * Builder to create instance of RefreshTokenClaimsSet.
+ *
+ * @since 3.1.0
+ */
+ public static final class Builder extends TokenClaimsSet.Builder<RefreshTokenClaimsSet> {
+
+ /**
+ * Bases a builder on an existing token claims set.
+ *
+ * @param existing existing claim set
+ */
+ private Builder(@Nonnull final TokenClaimsSet existing) {
+ setJWTID(existing.getID());
+ setNotBefore(existing.getNotBefore());
+ setClientID(existing.getClientID());
+ setIssuer(existing.getClaimsSet().getIssuer());
+ setPrincipal(existing.getPrincipal());
+ setSubject(existing.getClaimsSet().getSubject());
+ setACR(existing.getACR() == null ? null : new ACR(existing.getACR()));
+ setNonce(existing.getNonce());
+ setAuthenticationTime(existing.getAuthenticationTime());
+ setRedirectURI(existing.getRedirectURI());
+ setScope(existing.getScope());
+ setClaims(existing.getClaimsRequest());
+ setDlClaims(existing.getDeliveryClaims());
+ setDlClaimsUI(existing.getUserinfoDeliveryClaims());
+ setConsentedClaims(existing.getConsentedClaims());
+ setConsentEnabled(existing.isConsentEnabled());
+ }
+
+ /**
+ * Builds RefreshTokenClaimsSet.
+ *
+ * @return RefreshTokenClaimsSet instance
+ */
+ public RefreshTokenClaimsSet build() {
+ return new RefreshTokenClaimsSet(buildJWTClaimsSet(VALUE_TYPE_RF));
+ }
+
+ }
+
+}
\ No newline at end of file
diff --git a/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/token/support/TokenClaimsSet.java b/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/token/support/TokenClaimsSet.java
index 0d8cb9a2..2c9733cf 100644
--- a/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/token/support/TokenClaimsSet.java
+++ b/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/token/support/TokenClaimsSet.java
@@ -17,12 +17,15 @@
package net.shibboleth.idp.plugin.oidc.op.token.support;
+import java.util.Collection;
+import java.util.Collections;
import java.util.Date;
import java.util.List;
import java.util.Map;
import javax.annotation.Nonnull;
import javax.annotation.Nullable;
+import javax.annotation.concurrent.NotThreadSafe;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
@@ -37,6 +40,11 @@ import com.nimbusds.openid.connect.sdk.claims.ACR;
import com.nimbusds.openid.connect.sdk.claims.ClaimsSet;
import net.minidev.json.JSONObject;
+import net.shibboleth.utilities.java.support.annotation.constraint.NonnullElements;
+import net.shibboleth.utilities.java.support.annotation.constraint.NotEmpty;
+import net.shibboleth.utilities.java.support.annotation.constraint.NotLive;
+import net.shibboleth.utilities.java.support.annotation.constraint.Unmodifiable;
+import net.shibboleth.utilities.java.support.logic.Constraint;
import net.shibboleth.utilities.java.support.security.DataSealer;
import net.shibboleth.utilities.java.support.security.DataSealerException;
import net.shibboleth.utilities.java.support.security.IdentifierGenerationStrategy;
@@ -49,6 +57,7 @@ import java.time.Instant;
* Class to extend for token claims sets. Offers the base functionality to Authorize Code, Refresh Token and Access
* Token.
*/
+ at NotThreadSafe
public class TokenClaimsSet {
/** Identifier for the token. */
@@ -72,6 +81,9 @@ public class TokenClaimsSet {
/** Expiration time of the token. */
public static final String KEY_EXPIRATION_TIME = "exp";
+ /** Not before time of the token. */
+ public static final String KEY_NOTBEFORE_TIME = "nbt";
+
/** Issue time of the token. */
public static final String KEY_ISSUED_AT = "iat";
@@ -87,9 +99,12 @@ public class TokenClaimsSet {
/** Redirect uri of the original authentication request. */
public static final String KEY_REDIRECT_URI = "redirect_uri";
- /** Scope of the original authentication request. */
+ /** Scope of the token request. */
public static final String KEY_SCOPE = "scope";
+ /** Audiences of the token request. */
+ public static final String KEY_AUDIENCE = "aud";
+
/** Claims request of the original authentication request. */
public static final String KEY_CLAIMS = "claims";
@@ -118,80 +133,35 @@ public class TokenClaimsSet {
@Nonnull private Logger log = LoggerFactory.getLogger(TokenClaimsSet.class);
/**
- * Constructor.
+ * Default constructor for some subclasses.
*/
protected TokenClaimsSet() {
-
+
}
-
+
/**
- * Constructor for token claims set.
- *
- * @param tokenType Token type. Must not be NULL.
- * @param tokenID identifier for the token. Must not be NULL.
- * @param clientID Client Id of the rp. Must not be NULL.
- * @param issuer OP issuer value. Must not be NULL.
- * @param userPrincipal User Principal of the authenticated user. Must not be NULL.
- * @param subject subject of the authenticated user. Must not be NULL.
- * @param acr Authentication context class reference value of the authentication. May be NULL.
- * @param iat Issue time of the token. Must not be NULL.
- * @param exp Expiration time of the token. Must not be NULL.
- * @param nonce Nonce of the authentication request. May be NULL.
- * @param authTime Authentication time of the user. Must not be NULL.
- * @param redirectURI Validated redirect URI of the authentication request. Must not be NULL.
- * @param scope Scope of the authentication request. Must not be NULL.
- * @param claims Claims request of the authentication request. May be NULL.
- * @param dlClaims token delivery claims delivered both for id token and userinfo response. May be NULL.
- * @param dlClaimsID token delivery claims delivered for id token. May be NULL.
- * @param dlClaimsUI token delivery claims delivered for userinfo response. May be NULL.
- * @param consentedClaims consented claims. May be NULL.
- * @param codeChallenge Code Challenge. May be NULL.
- * @param consentEnabled Whether consent has been enabled.
- * @throws RuntimeException if called with not allowed null parameters
+ * Constructor.
+ *
+ * @param jwt the claim set to wrap
+ *
+ * @since 3.1.0
*/
- // Checkstyle: CyclomaticComplexity OFF
- // Checkstyle: ParameterNumber OFF
- protected TokenClaimsSet(@Nonnull final String tokenType, @Nonnull final String tokenID,
- @Nonnull final ClientID clientID, @Nonnull final String issuer, @Nonnull final String userPrincipal,
- @Nonnull final String subject, @Nullable final ACR acr, @Nonnull final Instant iat,
- @Nonnull final Instant exp, @Nullable final Nonce nonce, @Nonnull final Instant authTime,
- @Nonnull final URI redirectURI, @Nonnull final Scope scope, @Nullable final OIDCClaimsRequest claims,
- @Nullable final ClaimsSet dlClaims, @Nullable final ClaimsSet dlClaimsID,
- @Nullable final ClaimsSet dlClaimsUI, @Nullable final List<Object> consentedClaims,
- @Nullable final String codeChallenge, final boolean consentEnabled) {
- if (tokenType == null || tokenID == null || clientID == null || issuer == null || userPrincipal == null
- || iat == null || exp == null || authTime == null || redirectURI == null || scope == null
- || subject == null) {
- throw new RuntimeException("Invalid parameters, programming error");
- }
- tokenClaimsSet = new JWTClaimsSet.Builder().claim(KEY_TYPE, tokenType).jwtID(tokenID)
- .claim(KEY_CLIENTID, clientID.getValue()).issuer(issuer).subject(subject)
- .claim(KEY_USER_PRINCIPAL, userPrincipal).claim(KEY_ACR, acr == null ? null : acr.getValue())
- .issueTime(Date.from(iat)).expirationTime(Date.from(exp))
- .claim(KEY_NONCE, nonce == null ? null : nonce.getValue())
- .claim(KEY_AUTH_TIME, Date.from(authTime)).claim(KEY_REDIRECT_URI, redirectURI.toString())
- .claim(KEY_SCOPE, scope.toString()).claim(KEY_CLAIMS, claims == null ? null : claims.toJSONObject())
- .claim(KEY_DELIVERY_CLAIMS, dlClaims == null ? null : dlClaims.toJSONObject())
- .claim(KEY_DELIVERY_CLAIMS_IDTOKEN, dlClaimsID == null ? null : dlClaimsID.toJSONObject())
- .claim(KEY_DELIVERY_CLAIMS_USERINFO, dlClaimsUI == null ? null : dlClaimsUI.toJSONObject())
- .claim(KEY_CONSENTED_CLAIMS, consentedClaims).claim(KEY_CODE_CHALLENGE, codeChallenge)
- .claim(KEY_CONSENT_ENABLED, consentEnabled).build();
-
+ protected TokenClaimsSet(@Nonnull final JWTClaimsSet jwt) {
+ setClaimsSet(Constraint.isNotNull(jwt, "JWTClaimsSet cannot be null"));
}
- // Checkstyle: CyclomaticComplexity ON
- // Checkstyle: ParameterNumber ON
-
/**
* Helper to verify parsed claims are what is expected.
*
- * @param tokenType The type of the expected token. Must not be NULL.
- * @param tokenClaimsSet token claims set Must not be NULL.
+ * @param tokenType The type of the expected token
+ * @param tokenClaimsSet token claims set
+ *
* @throws ParseException if claims set is not expected one.
*/
- // Checkstyle: CyclomaticComplexity OFF
+// Checkstyle: CyclomaticComplexity OFF
protected static void verifyParsedClaims(@Nonnull final String tokenType,
@Nonnull final JWTClaimsSet tokenClaimsSet) throws ParseException {
+
// Check existence and type of mandatory fields and values
if (!tokenType.equals(tokenClaimsSet.getClaims().get(KEY_TYPE))) {
throw new ParseException("claim type value not matching", 0);
@@ -257,7 +227,7 @@ public class TokenClaimsSet {
}
}
- // Checkstyle: CyclomaticComplexity ON
+// Checkstyle: CyclomaticComplexity ON
/**
* Serialize the token as JSON String.
@@ -282,7 +252,7 @@ public class TokenClaimsSet {
/**
* Set the token claims set.
*
- * @param claimsSet What to set.
+ * @param claimsSet What to set
*/
public void setClaimsSet(final @Nonnull JWTClaimsSet claimsSet) {
tokenClaimsSet = claimsSet;
@@ -301,8 +271,13 @@ public class TokenClaimsSet {
/**
* Check if the token is expired.
*
- * @return true if the token is expired, otherwise false.
+ * <p>Replaced by {@link #isTimeValid} method that enforces both bounds.</p>
+ *
+ * @return true if the token is expired, otherwise false
+ *
+ * @deprecated
*/
+ @Deprecated(since="3.1.0", forRemoval=true)
public boolean isExpired() {
return tokenClaimsSet.getExpirationTime().before(new Date());
}
@@ -310,13 +285,42 @@ public class TokenClaimsSet {
/**
* Get expiration time of the token.
*
- * @return expiration time of the token.
+ * @return expiration time of the token
*/
@Nonnull
public Instant getExp() {
return tokenClaimsSet.getExpirationTime().toInstant();
}
+ /**
+ * Check if the token is valid with respect to expiration and not before limits.
+ *
+ * @return true iff token is time valid
+ *
+ * @since 3.1.0
+ */
+ public boolean isTimeValid() {
+ final Instant now = Instant.now();
+ if (getExp().isAfter(now)) {
+ final Instant nbt = getNotBefore();
+ return nbt == null || now == nbt || now.isAfter(nbt);
+ }
+
+ return false;
+ }
+
+ /**
+ * Get not before time of the token, if any.
+ *
+ * @return not before time of the token
+ *
+ * @since 3.1.0
+ */
+ @Nullable public Instant getNotBefore() {
+ final Date d = tokenClaimsSet.getNotBeforeTime();
+ return d != null ? d.toInstant() : null;
+ }
+
/**
* Get redirect uri of the request.
*
@@ -326,7 +330,7 @@ public class TokenClaimsSet {
public URI getRedirectURI() {
try {
return URI.create(tokenClaimsSet.getStringClaim(KEY_REDIRECT_URI));
- } catch (final ParseException e) {
+ } catch (final ParseException|IllegalArgumentException e) {
log.error("error parsing redirect uri from token", e.getMessage());
}
// should never happen, programming error.
@@ -503,9 +507,9 @@ public class TokenClaimsSet {
}
/**
- * Get scope of the authentication request.
+ * Get scope of the token request.
*
- * @return scope of the authentication request.
+ * @return scope of the token request.
*/
@Nonnull
public Scope getScope() {
@@ -517,6 +521,18 @@ public class TokenClaimsSet {
return null;
}
}
+
+ /**
+ * Get audience of the token request.
+ *
+ * @return audience of the token request
+ *
+ * @since 3.1.0
+ */
+ @Nonnull @NonnullElements @NotLive @Unmodifiable
+ public List<String> getAudience() {
+ return tokenClaimsSet.getAudience();
+ }
/**
* Get code challenge of the authentication request.
@@ -560,118 +576,307 @@ public class TokenClaimsSet {
// Checkstyle: VisibilityModifier OFF
- /** Generator for pseudo unique identifier for the claims set. */
- @Nonnull
- protected IdentifierGenerationStrategy idGen;
-
+ /** Token ID. */
+ @Nonnull @NotEmpty protected String jwtid;
+
/** Client Id of the rp. */
- @Nonnull
- protected ClientID rpId;
+ @Nonnull protected ClientID rpId;
/** OP issuer value. */
- @Nonnull
- protected String iss;
+ @Nonnull @NotEmpty protected String iss;
/** User Principal of the authenticated user. */
- @Nonnull
- protected String usrPrincipal;
+ @Nonnull @NotEmpty protected String principal;
/** Subject claim value of the authenticated user. */
- @Nonnull
- protected String sub;
+ @Nonnull @NotEmpty protected String sub;
/** Authentication context class reference value of the authentication. */
- @Nonnull
- protected ACR acr;
+ @Nonnull protected ACR acr;
/** Issue time of the claims set. */
- @Nonnull
- protected Instant iat;
+ @Nonnull protected Instant iat;
/** Expiration time of the claims set. */
- @Nonnull
- protected Instant exp;
+ @Nonnull protected Instant exp;
+ /** Not Before time of the claims set. */
+ @Nullable protected Instant nbt;
+
/** Authentication time of the user. */
- @Nonnull
- protected Instant authTime;
+ @Nonnull protected Instant authTime;
/** Validated redirect URI of the authentication request. */
- @Nonnull
- protected URI redirect;
+ @Nonnull protected URI redirect;
- /** Scope of the authentication request. */
- @Nonnull
- protected Scope reqScope;
+ /** Scope of the token request. */
+ @Nonnull protected Scope reqScope;
+
+ /** Audience of token request. */
+ @Nonnull @NonnullElements protected List<String> audience;
/** Nonce of the authentication request. */
- @Nullable
- protected Nonce nonce;
+ @Nullable protected Nonce nonce;
/** Claims request of the authentication request. */
- @Nullable
- protected OIDCClaimsRequest claims;
+ @Nullable protected OIDCClaimsRequest reqClaims;
/** Token delivery claims delivered both for id token and userinfo response. */
- @Nullable
- protected ClaimsSet dlClaims;
+ @Nullable protected ClaimsSet dlClaims;
/** Token delivery claims delivered for id token. */
- @Nullable
- protected ClaimsSet dlClaimsID;
+ @Nullable protected ClaimsSet dlClaimsID;
/** Token delivery claims delivered for userinfo response. */
- @Nullable
- protected ClaimsSet dlClaimsUI;
+ @Nullable protected ClaimsSet dlClaimsUI;
/** consented claims. */
- @Nullable
- protected List<Object> cnsntdClaims;
+ @Nullable protected List<Object> consentedClaims;
/** Has consent been asked from the end-user. */
- protected boolean cnsntEnabled;
+ protected boolean consentEnabled;
/** Code challenge. */
- @Nullable
- protected String codeChallenge;
+ @Nullable protected String codeChallenge;
+
+ /** Default constructor. */
+ protected Builder() {
+ audience = Collections.emptyList();
+ }
+
+// Checkstyle:CyclomaticComplexity OFF
+ /**
+ * Produce the underlying JWT to pass into the constructor methods.
+ *
+ * <p>Used by subclasses to manufacture the input required to build the object.</p>
+ *
+ * @param tokenType a type designation
+ *
+ * @return the JWT claims set
+ *
+ * @since 3.1.0
+ */
+ @Nonnull protected JWTClaimsSet buildJWTClaimsSet(@Nonnull @NotEmpty final String tokenType) {
+
+ if (tokenType == null || jwtid == null || rpId == null || iss == null || principal == null
+ || iat == null || exp == null || authTime == null || redirect == null || reqScope == null
+ || sub == null) {
+ throw new RuntimeException("Invalid parameters, programming error");
+ }
+
+ return new JWTClaimsSet.Builder()
+ .claim(KEY_TYPE, tokenType)
+ .jwtID(jwtid)
+ .claim(KEY_CLIENTID, rpId.getValue())
+ .issuer(iss)
+ .subject(sub)
+ .claim(KEY_USER_PRINCIPAL, principal)
+ .claim(KEY_ACR, acr == null ? null : acr.getValue())
+ .issueTime(Date.from(iat))
+ .expirationTime(Date.from(exp))
+ .notBeforeTime(nbt != null ? Date.from(nbt) : null)
+ .audience(audience)
+ .claim(KEY_NONCE, nonce == null ? null : nonce.getValue())
+ .claim(KEY_AUTH_TIME, Date.from(authTime))
+ .claim(KEY_REDIRECT_URI, redirect.toString())
+ .claim(KEY_SCOPE, reqScope.toString())
+ .claim(KEY_CLAIMS, reqClaims == null ? null : reqClaims.toJSONObject())
+ .claim(KEY_DELIVERY_CLAIMS, dlClaims == null ? null : dlClaims.toJSONObject())
+ .claim(KEY_DELIVERY_CLAIMS_IDTOKEN, dlClaimsID == null ? null : dlClaimsID.toJSONObject())
+ .claim(KEY_DELIVERY_CLAIMS_USERINFO, dlClaimsUI == null ? null : dlClaimsUI.toJSONObject())
+ .claim(KEY_CONSENTED_CLAIMS, consentedClaims)
+ .claim(KEY_CODE_CHALLENGE, codeChallenge)
+ .claim(KEY_CONSENT_ENABLED, consentEnabled)
+ .build();
+ }
+// Checkstyle:CyclomaticComplexity ON
- // Checkstyle: VisibilityModifier ON
+ /**
+ * Set JWT ID via generator.
+ *
+ * @param generator ID generator
+ *
+ * @return the builder
+ *
+ * @since 3.1.0
+ */
+ public Builder<T> setJWTID(@Nonnull final IdentifierGenerationStrategy generator) {
+ jwtid = Constraint.isNotNull(generator, "IdentifierGenerationStrategy cannot be null").generateIdentifier();
+ return this;
+ }
+
+ /**
+ * Set JWT ID.
+ *
+ * @param id id
+ *
+ * @return the builder
+ *
+ * @since 3.1.0
+ */
+ public Builder<T> setJWTID(@Nonnull @NotEmpty final String id) {
+ jwtid = Constraint.isNotEmpty(id, "JWT ID cannot be null");
+ return this;
+ }
/**
- * Constructor for authorize code builder.
- *
- * @param idGenerator Generator for pseudo unique identifier for the claims set. Must not be NULL.
- * @param clientID Client Id of the rp. Must not be NULL.
- * @param issuer OP issuer value. Must not be NULL.
- * @param userPrincipal User Principal of the authenticated user. Must not be NULL.
- * @param subject subject of the authenticated user. Must not be NULL
- * @param issuedAt Issue time of the authorize code. Must not be NULL.
- * @param expiresAt Expiration time of the authorize code. Must not be NULL.
- * @param authenticationTime Authentication time of the user. Must not be NULL.
- * @param redirectURI Validated redirect URI of the authentication request. Must not be NULL.
- * @param scope Scope of the authentication request. Must not be NULL.
+ * Set client ID.
+ *
+ * @param id client ID
+ *
+ * @return the builder
+ *
+ * @since 3.1.0
*/
- // Checkstyle: ParameterNumber OFF
- protected Builder(@Nonnull final IdentifierGenerationStrategy idGenerator, @Nonnull final ClientID clientID,
- @Nonnull final String issuer, @Nonnull final String userPrincipal, @Nonnull final String subject,
- @Nonnull final Instant issuedAt, @Nonnull final Instant expiresAt,
- @Nonnull final Instant authenticationTime, @Nonnull final URI redirectURI, @Nonnull final Scope scope) {
+ public Builder<T> setClientID(@Nonnull final ClientID id) {
+ rpId = id;
+ return this;
+ }
- idGen = idGenerator;
- rpId = clientID;
- iss = issuer;
- usrPrincipal = userPrincipal;
- sub = subject;
- iat = issuedAt;
- exp = expiresAt;
- authTime = authenticationTime;
- redirect = redirectURI;
- reqScope = scope;
+ /**
+ * Set issuer.
+ *
+ * @param s issuer
+ *
+ * @return the builder
+ *
+ * @since 3.1.0
+ */
+ public Builder<T> setIssuer(@Nonnull final String s) {
+ iss = Constraint.isNotEmpty(s, "Issuer cannot be null or empty");
+ return this;
+ }
+ /**
+ * Set user principal name.
+ *
+ * @param s principal name
+ *
+ * @return the builder
+ *
+ * @since 3.1.0
+ */
+ public Builder<T> setPrincipal(@Nonnull final String s) {
+ principal = Constraint.isNotEmpty(s, "Principal name cannot be null or empty");
+ return this;
}
- // Checkstyle: ParameterNumber ON
+ /**
+ * Set subject name.
+ *
+ * @param s subject name
+ *
+ * @return the builder
+ *
+ * @since 3.1.0
+ */
+ public Builder<T> setSubject(@Nonnull final String s) {
+ sub = Constraint.isNotEmpty(s, "Subject name cannot be null or empty");
+ return this;
+ }
+
+ /**
+ * Set issue time.
+ *
+ * @param i time
+ *
+ * @return the builder
+ *
+ * @since 3.1.0
+ */
+ public Builder<T> setIssuedAt(@Nonnull final Instant i) {
+ iat = Constraint.isNotNull(i, "Issue time cannot be null");
+ return this;
+ }
+
+ /**
+ * Set expiration time.
+ *
+ * @param i time
+ *
+ * @return the builder
+ *
+ * @since 3.1.0
+ */
+ public Builder<T> setExpiresAt(@Nonnull final Instant i) {
+ exp = Constraint.isNotNull(i, "Expiration time cannot be null");
+ return this;
+ }
+
+ /**
+ * Set not before time.
+ *
+ * @param i time
+ *
+ * @return the builder
+ *
+ * @since 3.1.0
+ */
+ public Builder<T> setNotBefore(@Nonnull final Instant i) {
+ nbt = i;
+ return this;
+ }
+ /**
+ * Set redirect URI.
+ *
+ * @param uri redirect URI
+ *
+ * @return the builder
+ *
+ * @since 3.1.0
+ */
+ public Builder<T> setRedirectURI(@Nonnull final URI uri) {
+ redirect = Constraint.isNotNull(uri, "Redirect URI cannot be null");
+ return this;
+ }
+
+ /**
+ * Set scope.
+ *
+ * @param s scope
+ *
+ * @return the builder
+ *
+ * @since 3.1.0
+ */
+ public Builder<T> setScope(@Nonnull final Scope s) {
+ reqScope = Constraint.isNotNull(s, "Scope cannot be null");
+ return this;
+ }
+
+ /**
+ * Set audience.
+ *
+ * @param aud audience
+ *
+ * @return the builder
+ *
+ * @since 3.1.0
+ */
+ public Builder<T> setAudience(@Nullable @NonnullElements final Collection<String> aud) {
+ if (aud != null) {
+ audience = List.copyOf(aud);
+ } else {
+ audience = Collections.emptyList();
+ }
+ return this;
+ }
+
+ /**
+ * Set authentication time.
+ *
+ * @param i time
+ *
+ * @return the builder
+ *
+ * @since 3.1.0
+ */
+ public Builder<T> setAuthenticationTime(@Nonnull final Instant i) {
+ authTime = Constraint.isNotNull(i, "Authentication time cannot be null");
+ return this;
+ }
+
/**
* Set authentication context class reference value of the authentication.
*
@@ -699,72 +904,72 @@ public class TokenClaimsSet {
/**
* Set claims request of the authentication request.
*
- * @param requestedClaims claims request of the authentication request.
+ * @param claimsRequest claims request of the authentication request.
*
* @return the builder
*/
- public Builder<T> setClaims(@Nullable final OIDCClaimsRequest requestedClaims) {
- claims = requestedClaims;
+ public Builder<T> setClaims(@Nullable final OIDCClaimsRequest claimsRequest) {
+ reqClaims = claimsRequest;
return this;
}
/**
* Set token delivery claims delivered both for id token and userinfo response.
*
- * @param deliveryClaims token delivery claims delivered both for id token and userinfo response.
+ * @param claims token delivery claims delivered both for id token and userinfo response.
*
* @return the builder
*/
- public Builder<T> setDlClaims(@Nullable final ClaimsSet deliveryClaims) {
- dlClaims = deliveryClaims;
+ public Builder<T> setDlClaims(@Nullable final ClaimsSet claims) {
+ dlClaims = claims;
return this;
}
/**
* Set token delivery claims delivered for id token.
*
- * @param deliveryClaimsIDToken token delivery claims delivered for id token
+ * @param claims token delivery claims delivered for id token
*
* @return the builder
*/
- public Builder<T> setDlClaimsID(@Nullable final ClaimsSet deliveryClaimsIDToken) {
- dlClaimsID = deliveryClaimsIDToken;
+ public Builder<T> setDlClaimsID(@Nullable final ClaimsSet claims) {
+ dlClaimsID = claims;
return this;
}
/**
* Set token delivery claims delivered for userinfo response.
*
- * @param deliveryClaimsUserInfo token delivery claims delivered for userinfo response
+ * @param claims token delivery claims delivered for userinfo response
*
* @return the builder
*/
- public Builder<T> setDlClaimsUI(@Nullable final ClaimsSet deliveryClaimsUserInfo) {
- dlClaimsUI = deliveryClaimsUserInfo;
+ public Builder<T> setDlClaimsUI(@Nullable final ClaimsSet claims) {
+ dlClaimsUI = claims;
return this;
}
/**
* Set consented claims.
*
- * @param consentedClaims consented claims
+ * @param claims consented claims
*
* @return the builder
*/
- public Builder<T> setConsentedClaims(@Nullable final List<Object> consentedClaims) {
- cnsntdClaims = consentedClaims;
+ public Builder<T> setConsentedClaims(@Nullable final List<Object> claims) {
+ consentedClaims = claims;
return this;
}
/**
* Set whether consent has been enabled.
*
- * @param consentEnabled whether consent has been enabled.
+ * @param flag whether consent has been enabled.
*
* @return the builder
*/
- public Builder<T> setConsentEnabled(final boolean consentEnabled) {
- cnsntEnabled = consentEnabled;
+ public Builder<T> setConsentEnabled(final boolean flag) {
+ consentEnabled = flag;
return this;
}
diff --git a/idp-oidc-extension-api/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/AbstractTokenClaimsLookupFunctionTest.java b/idp-oidc-extension-api/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/AbstractTokenClaimsLookupFunctionTest.java
index 1b88804f..966bb7da 100644
--- a/idp-oidc-extension-api/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/AbstractTokenClaimsLookupFunctionTest.java
+++ b/idp-oidc-extension-api/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/AbstractTokenClaimsLookupFunctionTest.java
@@ -52,10 +52,20 @@ public class AbstractTokenClaimsLookupFunctionTest {
prc.setOutboundMessageContext(new MessageContext());
oidcCtx = new OIDCAuthenticationResponseContext();
prc.getOutboundMessageContext().addSubcontext(oidcCtx);
- oidcCtx.setTokenClaimsSet(
- new AccessTokenClaimsSet.Builder(new SecureRandomIdentifierGenerationStrategy(), new ClientID(),
- "issuer", "userPrin", "subject", Instant.now(), Instant.now().plusSeconds(1),
- Instant.now(), new URI("http://example.com"), new Scope()).build());
+ oidcCtx.setAuthorizationGrantClaimsSet(
+ new AccessTokenClaimsSet.Builder()
+ .setJWTID(new SecureRandomIdentifierGenerationStrategy())
+ .setClientID(new ClientID())
+ .setIssuer("issuer")
+ .setPrincipal("userPrin")
+ .setSubject("subject")
+ .setIssuedAt(Instant.now())
+ .setExpiresAt(Instant.now().plusSeconds(1))
+ .setAuthenticationTime(Instant.now())
+ .setRedirectURI(new URI("http://example.com"))
+ .setScope(new Scope())
+ .build()
+ );
}
@Test
diff --git a/idp-oidc-extension-api/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/BaseTokenRequestLookupFunctionTest.java b/idp-oidc-extension-api/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/BaseTokenRequestLookupFunctionTest.java
index fdefb3a6..863af2f0 100644
--- a/idp-oidc-extension-api/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/BaseTokenRequestLookupFunctionTest.java
+++ b/idp-oidc-extension-api/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/BaseTokenRequestLookupFunctionTest.java
@@ -51,7 +51,7 @@ public class BaseTokenRequestLookupFunctionTest {
protected OIDCAuthenticationResponseContext oidcCtx;
- protected ClientID cliendID = new ClientID();
+ protected ClientID clientID = new ClientID();
protected String issuer = "issuer";
@@ -108,13 +108,27 @@ public class BaseTokenRequestLookupFunctionTest {
oidcCtx = new OIDCAuthenticationResponseContext();
prc.getOutboundMessageContext().addSubcontext(oidcCtx);
oidcCtx.setAuthorizationGrantClaimsSet(
- new AuthorizeCodeClaimsSet.Builder(new SecureRandomIdentifierGenerationStrategy(),
- cliendID, issuer, userPrin, subject, iat, exp, authTime, redirectUri, scope).setACR(acr)
- .setNonce(nonce).setClaims(claimsRequest)
- .setDlClaims(tokenDeliveryClaims)
- .setDlClaimsID(tokenToIdTokenDeliveryClaims)
- .setDlClaimsUI(tokenToUserInfoTokenDeliveryClaims)
- .setConsentedClaims(consentedClaims).build());
+ new AuthorizeCodeClaimsSet.Builder()
+ .setJWTID(new SecureRandomIdentifierGenerationStrategy())
+ .setClientID(clientID)
+ .setIssuer(issuer)
+ .setPrincipal(userPrin)
+ .setSubject(subject)
+ .setIssuedAt(iat)
+ .setExpiresAt(exp)
+ .setAuthenticationTime(authTime)
+ .setRedirectURI(redirectUri)
+ .setScope(scope)
+ .setACR(acr)
+ .setACR(acr)
+ .setNonce(nonce)
+ .setClaims(claimsRequest)
+ .setDlClaims(tokenDeliveryClaims)
+ .setDlClaimsID(tokenToIdTokenDeliveryClaims)
+ .setDlClaimsUI(tokenToUserInfoTokenDeliveryClaims)
+ .setConsentedClaims(consentedClaims)
+ .build()
+ );
}
}
\ No newline at end of file
diff --git a/idp-oidc-extension-api/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/TokenRequestNonceLookupFunctionTest.java b/idp-oidc-extension-api/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/TokenRequestNonceLookupFunctionTest.java
index 842e32c4..463880e9 100644
--- a/idp-oidc-extension-api/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/TokenRequestNonceLookupFunctionTest.java
+++ b/idp-oidc-extension-api/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/TokenRequestNonceLookupFunctionTest.java
@@ -19,8 +19,6 @@ package net.shibboleth.idp.plugin.oidc.op.profile.context.navigate;
import org.testng.annotations.Test;
-import net.shibboleth.idp.plugin.oidc.op.profile.context.navigate.TokenRequestNonceLookupFunction;
-
import org.testng.Assert;
/** Test for {@link TokenRequestNonceLookupFunction}. */
diff --git a/idp-oidc-extension-api/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/TokenRequestUserInfoDeliveryClaimsLookupFunctionTest.java b/idp-oidc-extension-api/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/TokenRequestUserInfoDeliveryClaimsLookupFunctionTest.java
index 52d54991..6c83b347 100644
--- a/idp-oidc-extension-api/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/TokenRequestUserInfoDeliveryClaimsLookupFunctionTest.java
+++ b/idp-oidc-extension-api/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/TokenRequestUserInfoDeliveryClaimsLookupFunctionTest.java
@@ -19,8 +19,6 @@ package net.shibboleth.idp.plugin.oidc.op.profile.context.navigate;
import org.testng.annotations.Test;
-import net.shibboleth.idp.plugin.oidc.op.profile.context.navigate.TokenRequestUserInfoDeliveryClaimsLookupFunction;
-
import org.testng.Assert;
/** Test for {@link TokenRequestUserInfoDeliveryClaimsLookupFunction}. */
diff --git a/idp-oidc-extension-api/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/UserInfoRequestClientIDLookupFunctionTest.java b/idp-oidc-extension-api/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/UserInfoRequestClientIDLookupFunctionTest.java
index b3ffbdd2..802ebd14 100644
--- a/idp-oidc-extension-api/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/UserInfoRequestClientIDLookupFunctionTest.java
+++ b/idp-oidc-extension-api/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/UserInfoRequestClientIDLookupFunctionTest.java
@@ -36,11 +36,11 @@ public class UserInfoRequestClientIDLookupFunctionTest extends BaseTokenRequestL
// No message ctx
Assert.assertNull(lookup.apply(null));
// No token claims set
- oidcCtx.setTokenClaimsSet(null);
+ oidcCtx.setAuthorizationGrantClaimsSet(null);
Assert.assertNull(lookup.apply(prc.getInboundMessageContext()));
// No response context
prc.getOutboundMessageContext().removeSubcontext(OIDCAuthenticationResponseContext.class);
- oidcCtx.setTokenClaimsSet(null);
+ oidcCtx.setAuthorizationGrantClaimsSet(null);
Assert.assertNull(lookup.apply(prc.getInboundMessageContext()));
// No outbound message context
prc.setInboundMessageContext(new MessageContext());
@@ -51,7 +51,7 @@ public class UserInfoRequestClientIDLookupFunctionTest extends BaseTokenRequestL
@Test
public void testSuccess() {
lookup = new UserInfoRequestClientIDLookupFunction();
- Assert.assertEquals(cliendID, lookup.apply(prc.getOutboundMessageContext()));
+ Assert.assertEquals(clientID, lookup.apply(prc.getOutboundMessageContext()));
}
}
\ No newline at end of file
diff --git a/idp-oidc-extension-api/src/test/java/net/shibboleth/idp/plugin/oidc/op/token/support/AccessTokenClaimsSetTest.java b/idp-oidc-extension-api/src/test/java/net/shibboleth/idp/plugin/oidc/op/token/support/AccessTokenClaimsSetTest.java
index 80bc96ed..db00845b 100644
--- a/idp-oidc-extension-api/src/test/java/net/shibboleth/idp/plugin/oidc/op/token/support/AccessTokenClaimsSetTest.java
+++ b/idp-oidc-extension-api/src/test/java/net/shibboleth/idp/plugin/oidc/op/token/support/AccessTokenClaimsSetTest.java
@@ -19,8 +19,6 @@ package net.shibboleth.idp.plugin.oidc.op.token.support;
import org.testng.annotations.Test;
-import net.shibboleth.idp.plugin.oidc.op.token.support.AccessTokenClaimsSet;
-import net.shibboleth.idp.plugin.oidc.op.token.support.AuthorizeCodeClaimsSet;
import net.shibboleth.idp.plugin.oidc.op.token.support.testing.BaseTokenClaimsSetTest;
import net.shibboleth.utilities.java.support.security.DataSealerException;
import net.shibboleth.utilities.java.support.security.impl.SecureRandomIdentifierGenerationStrategy;
@@ -29,22 +27,42 @@ import java.text.ParseException;
import org.testng.Assert;
/**
- * Tests for {@link AccessTokenClaimsSetTest}
+ * Tests for {@link AccessTokenClaimsSetTest}.
*/
public class AccessTokenClaimsSetTest extends BaseTokenClaimsSetTest {
private AccessTokenClaimsSet atClaimsSet;
protected void init() {
- atClaimsSet = new AccessTokenClaimsSet.Builder(new SecureRandomIdentifierGenerationStrategy(), clientID, issuer,
- userPrincipal, subject, iat, exp, authTime, redirectURI, scope).setACR(acr).build();
-
+ atClaimsSet = new AccessTokenClaimsSet.Builder()
+ .setJWTID(new SecureRandomIdentifierGenerationStrategy())
+ .setClientID(clientID)
+ .setIssuer(issuer)
+ .setPrincipal(userPrincipal)
+ .setSubject(subject)
+ .setIssuedAt(iat)
+ .setExpiresAt(exp)
+ .setAuthenticationTime(authTime)
+ .setRedirectURI(redirectURI)
+ .setScope(scope)
+ .setACR(acr)
+ .build();
}
protected void init2() {
- final AuthorizeCodeClaimsSet acClaimsSet =
- new AuthorizeCodeClaimsSet.Builder(new SecureRandomIdentifierGenerationStrategy(), clientID, issuer,
- userPrincipal, subject, iat, exp, authTime, redirectURI, scope).setACR(acr).build();
+ final AuthorizeCodeClaimsSet acClaimsSet = new AuthorizeCodeClaimsSet.Builder()
+ .setJWTID(new SecureRandomIdentifierGenerationStrategy())
+ .setClientID(clientID)
+ .setIssuer(issuer)
+ .setPrincipal(userPrincipal)
+ .setSubject(subject)
+ .setIssuedAt(iat)
+ .setExpiresAt(exp)
+ .setAuthenticationTime(authTime)
+ .setRedirectURI(redirectURI)
+ .setScope(scope)
+ .setACR(acr)
+ .build();
atClaimsSet = new AccessTokenClaimsSet(acClaimsSet, scope, dlClaims, dlClaimsUI, iat, exp);
}
@@ -68,9 +86,19 @@ public class AccessTokenClaimsSetTest extends BaseTokenClaimsSetTest {
@Test(expectedExceptions = ParseException.class)
public void testSerializationWrongType() throws ParseException {
- final AuthorizeCodeClaimsSet accessnClaimsSet =
- new AuthorizeCodeClaimsSet.Builder(new SecureRandomIdentifierGenerationStrategy(), clientID, issuer,
- userPrincipal, subject, iat, exp, authTime, redirectURI, scope).setACR(acr).build();
+ final AuthorizeCodeClaimsSet accessnClaimsSet = new AuthorizeCodeClaimsSet.Builder()
+ .setJWTID(new SecureRandomIdentifierGenerationStrategy())
+ .setClientID(clientID)
+ .setIssuer(issuer)
+ .setPrincipal(userPrincipal)
+ .setSubject(subject)
+ .setIssuedAt(iat)
+ .setExpiresAt(exp)
+ .setAuthenticationTime(authTime)
+ .setRedirectURI(redirectURI)
+ .setScope(scope)
+ .setACR(acr)
+ .build();
atClaimsSet = AccessTokenClaimsSet.parse(accessnClaimsSet.serialize());
}
diff --git a/idp-oidc-extension-api/src/test/java/net/shibboleth/idp/plugin/oidc/op/token/support/AuthorizeCodeClaimsSetTest.java b/idp-oidc-extension-api/src/test/java/net/shibboleth/idp/plugin/oidc/op/token/support/AuthorizeCodeClaimsSetTest.java
index e0f2838e..477caf0a 100644
--- a/idp-oidc-extension-api/src/test/java/net/shibboleth/idp/plugin/oidc/op/token/support/AuthorizeCodeClaimsSetTest.java
+++ b/idp-oidc-extension-api/src/test/java/net/shibboleth/idp/plugin/oidc/op/token/support/AuthorizeCodeClaimsSetTest.java
@@ -19,8 +19,6 @@ package net.shibboleth.idp.plugin.oidc.op.token.support;
import org.testng.annotations.Test;
-import net.shibboleth.idp.plugin.oidc.op.token.support.AccessTokenClaimsSet;
-import net.shibboleth.idp.plugin.oidc.op.token.support.AuthorizeCodeClaimsSet;
import net.shibboleth.idp.plugin.oidc.op.token.support.testing.BaseTokenClaimsSetTest;
import net.shibboleth.utilities.java.support.security.DataSealerException;
import net.shibboleth.utilities.java.support.security.impl.SecureRandomIdentifierGenerationStrategy;
@@ -37,8 +35,21 @@ public class AuthorizeCodeClaimsSetTest extends BaseTokenClaimsSetTest {
private AuthorizeCodeClaimsSet acClaimsSet;
protected void init() {
- acClaimsSet = new AuthorizeCodeClaimsSet.Builder(new SecureRandomIdentifierGenerationStrategy(), clientID,
- issuer, userPrincipal, subject, iat, exp, authTime, redirectURI, scope).setACR(acr).build();
+ //acClaimsSet = new AuthorizeCodeClaimsSet.Builder(, ,
+ //, redirectURI, scope)
+ acClaimsSet = new AuthorizeCodeClaimsSet.Builder()
+ .setJWTID(new SecureRandomIdentifierGenerationStrategy())
+ .setClientID(clientID)
+ .setIssuer(issuer)
+ .setPrincipal(userPrincipal)
+ .setSubject(subject)
+ .setIssuedAt(iat)
+ .setExpiresAt(exp)
+ .setAuthenticationTime(authTime)
+ .setRedirectURI(redirectURI)
+ .setScope(scope)
+ .setACR(acr)
+ .build();
}
@Test
@@ -53,9 +64,19 @@ public class AuthorizeCodeClaimsSetTest extends BaseTokenClaimsSetTest {
@Test(expectedExceptions = ParseException.class)
public void testSerializationWrongType() throws ParseException {
- final AccessTokenClaimsSet accessnClaimsSet =
- new AccessTokenClaimsSet.Builder(new SecureRandomIdentifierGenerationStrategy(), clientID, issuer,
- userPrincipal, subject, iat, exp, authTime, redirectURI, scope).build();
+ final AccessTokenClaimsSet accessnClaimsSet = new AccessTokenClaimsSet.Builder()
+ .setJWTID(new SecureRandomIdentifierGenerationStrategy())
+ .setClientID(clientID)
+ .setIssuer(issuer)
+ .setPrincipal(userPrincipal)
+ .setSubject(subject)
+ .setIssuedAt(iat)
+ .setExpiresAt(exp)
+ .setAuthenticationTime(authTime)
+ .setRedirectURI(redirectURI)
+ .setScope(scope)
+ .build();
acClaimsSet = AuthorizeCodeClaimsSet.parse(accessnClaimsSet.serialize());
}
+
}
\ No newline at end of file
diff --git a/idp-oidc-extension-api/src/test/java/net/shibboleth/idp/plugin/oidc/op/token/support/RefreshTokenClaimsSetTest.java b/idp-oidc-extension-api/src/test/java/net/shibboleth/idp/plugin/oidc/op/token/support/RefreshTokenClaimsSetTest.java
index 5f291056..7a11a260 100644
--- a/idp-oidc-extension-api/src/test/java/net/shibboleth/idp/plugin/oidc/op/token/support/RefreshTokenClaimsSetTest.java
+++ b/idp-oidc-extension-api/src/test/java/net/shibboleth/idp/plugin/oidc/op/token/support/RefreshTokenClaimsSetTest.java
@@ -19,8 +19,6 @@ package net.shibboleth.idp.plugin.oidc.op.token.support;
import org.testng.annotations.Test;
-import net.shibboleth.idp.plugin.oidc.op.token.support.AuthorizeCodeClaimsSet;
-import net.shibboleth.idp.plugin.oidc.op.token.support.RefreshTokenClaimsSet;
import net.shibboleth.idp.plugin.oidc.op.token.support.testing.BaseTokenClaimsSetTest;
import net.shibboleth.utilities.java.support.security.DataSealerException;
import net.shibboleth.utilities.java.support.security.impl.SecureRandomIdentifierGenerationStrategy;
@@ -30,7 +28,7 @@ import java.text.ParseException;
import org.testng.Assert;
/**
- * Tests for {@link RefreshTokenClaimsSetTest}
+ * Tests for {@link RefreshTokenClaimsSetTest}.
*/
public class RefreshTokenClaimsSetTest extends BaseTokenClaimsSetTest {
@@ -38,8 +36,20 @@ public class RefreshTokenClaimsSetTest extends BaseTokenClaimsSetTest {
protected void init() {
final AuthorizeCodeClaimsSet acClaimsSet =
- new AuthorizeCodeClaimsSet.Builder(new SecureRandomIdentifierGenerationStrategy(), clientID, issuer,
- userPrincipal, subject, iat, exp, authTime, redirectURI, scope).setACR(acr).build();
+ new AuthorizeCodeClaimsSet.Builder()
+ .setJWTID(new SecureRandomIdentifierGenerationStrategy())
+ .setClientID(clientID)
+ .setIssuer(issuer)
+ .setPrincipal(userPrincipal)
+ .setSubject(subject)
+ .setIssuedAt(iat)
+ .setExpiresAt(exp)
+ .setAuthenticationTime(authTime)
+ .setRedirectURI(redirectURI)
+ .setScope(scope)
+ .setACR(acr)
+ .build();
+
rfClaimsSet = new RefreshTokenClaimsSet(acClaimsSet, iat, exp);
}
@@ -55,8 +65,19 @@ public class RefreshTokenClaimsSetTest extends BaseTokenClaimsSetTest {
@Test(expectedExceptions = ParseException.class)
public void testSerializationWrongType() throws ParseException {
final AuthorizeCodeClaimsSet accessnClaimsSet =
- new AuthorizeCodeClaimsSet.Builder(new SecureRandomIdentifierGenerationStrategy(), clientID, issuer,
- userPrincipal, subject, iat, exp, authTime, redirectURI, scope).build();
+ new AuthorizeCodeClaimsSet.Builder()
+ .setJWTID(new SecureRandomIdentifierGenerationStrategy())
+ .setClientID(clientID)
+ .setIssuer(issuer)
+ .setPrincipal(userPrincipal)
+ .setSubject(subject)
+ .setIssuedAt(iat)
+ .setExpiresAt(exp)
+ .setAuthenticationTime(authTime)
+ .setRedirectURI(redirectURI)
+ .setScope(scope)
+ .setACR(acr)
+ .build();
rfClaimsSet = RefreshTokenClaimsSet.parse(accessnClaimsSet.serialize());
}
diff --git a/idp-oidc-extension-api/src/test/java/net/shibboleth/idp/plugin/oidc/op/token/support/TokenClaimsSetTest.java b/idp-oidc-extension-api/src/test/java/net/shibboleth/idp/plugin/oidc/op/token/support/TokenClaimsSetTest.java
deleted file mode 100644
index f76ec979..00000000
--- a/idp-oidc-extension-api/src/test/java/net/shibboleth/idp/plugin/oidc/op/token/support/TokenClaimsSetTest.java
+++ /dev/null
@@ -1,83 +0,0 @@
-/*
- * Licensed to the University Corporation for Advanced Internet Development,
- * Inc. (UCAID) under one or more contributor license agreements. See the
- * NOTICE file distributed with this work for additional information regarding
- * copyright ownership. The UCAID licenses this file to You under the Apache
- * License, Version 2.0 (the "License"); you may not use this file except in
- * compliance with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.plugin.oidc.op.token.support;
-
-import org.testng.annotations.Test;
-
-import net.shibboleth.idp.plugin.oidc.op.token.support.testing.BaseTokenClaimsSetTest;
-
-import java.time.temporal.ChronoUnit;
-
-import org.testng.Assert;
-
-/**
- * Tests for {@link TokenClaimsSet}
- */
-public class TokenClaimsSetTest extends BaseTokenClaimsSetTest {
-
- private TokenClaimsSet tokenClaimsSet;
-
- private String tokenType = "myType";
-
- private String tokenID = "1";
-
- protected void init() {
- tokenClaimsSet = new TokenClaimsSet(tokenType, tokenID, clientID, issuer, userPrincipal, subject, acr, iat, exp,
- nonce, authTime, redirectURI, scope, claims, dlClaims, dlClaimsID, dlClaimsUI, consentedClaims,
- codeChallenge, consentEnabled);
- }
-
- @Test
- public void testGetters() {
- init();
- Assert.assertEquals(tokenClaimsSet.getACR(), acr.getValue());
- Assert.assertEquals(tokenClaimsSet.getID(), tokenID);
- Assert.assertEquals(tokenClaimsSet.getPrincipal(), userPrincipal);
- Assert.assertEquals(tokenClaimsSet.isExpired(), false);
- Assert.assertEquals(tokenClaimsSet.getAuthenticationTime(), authTime.truncatedTo(ChronoUnit.MILLIS));
- Assert.assertTrue(tokenClaimsSet.getClaimsRequest().getIDTokenClaimsRequest().getClaimNames(false)
- .contains("email"));
- Assert.assertEquals(tokenClaimsSet.getDeliveryClaims().getClaim("tokenDelivery"), "value");
- Assert.assertEquals(tokenClaimsSet.getIDTokenDeliveryClaims().getClaim("tokenToIdtokenDeliveryClaim"), "value");
- Assert.assertEquals(tokenClaimsSet.getUserinfoDeliveryClaims().getClaim("tokenToUserInfotokenDeliveryClaim"),
- "value");
- Assert.assertEquals(tokenClaimsSet.getClientID(), clientID);
- Assert.assertTrue(tokenClaimsSet.getConsentedClaims().contains("consentedClaim"));
- Assert.assertEquals(tokenClaimsSet.getExp(), exp.truncatedTo(ChronoUnit.MILLIS));
- Assert.assertEquals(tokenClaimsSet.getNonce(), nonce);
- Assert.assertEquals(tokenClaimsSet.getRedirectURI(), redirectURI);
- Assert.assertEquals(tokenClaimsSet.getScope(), scope);
- Assert.assertEquals(tokenClaimsSet.getCodeChallenge(), codeChallenge);
- Assert.assertEquals(tokenClaimsSet.isConsentEnabled(), consentEnabled);
- }
-
- @Test
- public void testNullGetters() {
- tokenClaimsSet = new TokenClaimsSet(tokenType, tokenID, clientID, issuer, userPrincipal, subject, null, iat,
- exp, null, authTime, redirectURI, scope, null, null, null, null, null, null, false);
- Assert.assertNull(tokenClaimsSet.getACR());
- Assert.assertNull(tokenClaimsSet.getClaimsRequest());
- Assert.assertNull(tokenClaimsSet.getDeliveryClaims());
- Assert.assertNull(tokenClaimsSet.getIDTokenDeliveryClaims());
- Assert.assertNull(tokenClaimsSet.getUserinfoDeliveryClaims());
- Assert.assertNull(tokenClaimsSet.getConsentedClaims());
- Assert.assertNull(tokenClaimsSet.getNonce());
- Assert.assertFalse(tokenClaimsSet.isConsentEnabled());
- }
-
-}
\ No newline at end of file
diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oauth2/profile/impl/FormOutboundIntrospectionResponseMessage.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oauth2/profile/impl/FormOutboundIntrospectionResponseMessage.java
index 6a9cd2af..61577c16 100644
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oauth2/profile/impl/FormOutboundIntrospectionResponseMessage.java
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oauth2/profile/impl/FormOutboundIntrospectionResponseMessage.java
@@ -152,7 +152,8 @@ public class FormOutboundIntrospectionResponseMessage extends AbstractOIDCReques
return RefreshTokenClaimsSet.parse(token.getValue(), dataSealer);
}
} catch (final DataSealerException | ParseException e) {
-
+ log.debug("{} Token to introspect is invalid or unknown", getLogPrefix());
+ return null;
}
// Token type hint missing, have to try both.
diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/InitializeSubjectContext.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/InitializeSubjectContext.java
index 5435d27e..f1bcb1a2 100644
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/InitializeSubjectContext.java
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/InitializeSubjectContext.java
@@ -20,15 +20,16 @@ package net.shibboleth.idp.plugin.oidc.op.profile.impl;
import javax.annotation.Nonnull;
import net.shibboleth.idp.authn.context.SubjectContext;
+import net.shibboleth.idp.plugin.oidc.op.profile.OidcEventIds;
+
import org.opensaml.profile.action.ActionSupport;
-import org.opensaml.profile.action.EventIds;
import org.opensaml.profile.context.ProfileRequestContext;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
/**
- * An action that creates an {@link SubjectContext} and attaches it to the current {@link ProfileRequestContext}. The
- * principal is set by the information provided by Authorization Code / Access Token.
+ * An action that creates an {@link SubjectContext} and attaches it to the current {@link ProfileRequestContext}.
+ * The principal is set by the information provided by the Authorization Code / Access Token.
*/
public class InitializeSubjectContext extends AbstractOIDCTokenResponseAction {
@@ -44,8 +45,8 @@ public class InitializeSubjectContext extends AbstractOIDCTokenResponseAction {
}
if (getOidcResponseContext().getAuthorizationGrantClaimsSet() == null) {
- log.warn("{} user principal not resolved from prior authorization grant", getLogPrefix());
- ActionSupport.buildEvent(profileRequestContext, EventIds.INVALID_MESSAGE);
+ log.warn("{} Subject principal not resolved from prior authorization grant", getLogPrefix());
+ ActionSupport.buildEvent(profileRequestContext, OidcEventIds.INVALID_SUBJECT);
return false;
}
@@ -55,10 +56,16 @@ public class InitializeSubjectContext extends AbstractOIDCTokenResponseAction {
/** {@inheritDoc} */
@Override
protected void doExecute(@Nonnull final ProfileRequestContext profileRequestContext) {
- final SubjectContext subCtx = profileRequestContext.getSubcontext(SubjectContext.class, true);
+
+ final SubjectContext subCtx = new SubjectContext();
subCtx.setPrincipalName(getOidcResponseContext().getAuthorizationGrantClaimsSet().getPrincipal());
- log.debug("{} Created subject context for user {}", getLogPrefix(), subCtx,
- subCtx.getPrincipalName());
+
+ // Replace existing context. Generally there will already be a prior context representing
+ // authentication of the client, so this replacement happens when the client is not the
+ // subject of the authorization grant and claims.
+ profileRequestContext.addSubcontext(subCtx, true);
+
+ log.debug("{} Created subject context for principal '{}'", getLogPrefix(), subCtx.getPrincipalName());
}
}
\ No newline at end of file
diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/SetAccessTokenToResponseContext.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/SetAccessTokenToResponseContext.java
index 807fea1f..87f03fb3 100644
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/SetAccessTokenToResponseContext.java
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/SetAccessTokenToResponseContext.java
@@ -279,16 +279,27 @@ public class SetAccessTokenToResponseContext extends AbstractOIDCResponseAction
consentContextLookupStrategy.apply(profileRequestContext);
final JSONArray consented = consentCtx != null ? consentCtx.getConsentedAttributes() : null;
// "token id_token" response type. Access token is not derived from Authorization code / Refresh token..
- claimsSet = new AccessTokenClaimsSet.Builder(idGenerator, authenticationRequest.getClientID(),
- issuerLookupStrategy.apply(profileRequestContext), subjectCtx.getPrincipalName(),
- getOidcResponseContext().getSubject(), Instant.now(), dateExp,
- getOidcResponseContext().getAuthTime(), getOidcResponseContext().getRedirectURI(),
- getOidcResponseContext().getScope())
- .setACR(getOidcResponseContext().getAcr()).setClaims(authenticationRequest.getOIDCClaims())
- .setConsentedClaims(consented).setDlClaims(claims)
- .setDlClaimsUI(claimsUI).setNonce(authenticationRequest.getNonce())
- .setConsentEnabled(consentEnabledPredicate.test(profileRequestContext)).build();
+ claimsSet = new AccessTokenClaimsSet.Builder()
+ .setJWTID(idGenerator)
+ .setClientID(authenticationRequest.getClientID())
+ .setIssuer(issuerLookupStrategy.apply(profileRequestContext))
+ .setPrincipal(subjectCtx.getPrincipalName())
+ .setSubject(getOidcResponseContext().getSubject())
+ .setIssuedAt(Instant.now())
+ .setExpiresAt(dateExp)
+ .setAuthenticationTime(getOidcResponseContext().getAuthTime())
+ .setRedirectURI(getOidcResponseContext().getRedirectURI())
+ .setScope(getOidcResponseContext().getScope())
+ .setACR(getOidcResponseContext().getAcr())
+ .setNonce(authenticationRequest.getNonce())
+ .setClaims(authenticationRequest.getOIDCClaims())
+ .setDlClaims(claims)
+ .setDlClaimsUI(claimsUI)
+ .setConsentedClaims(consented)
+ .setConsentEnabled(consentEnabledPredicate.test(profileRequestContext))
+ .build();
}
+
try {
getOidcResponseContext().setAccessToken(claimsSet.serialize(dataSealer), accessTokenLifetime);
log.debug("{} Setting access token {} as {} to response context ", getLogPrefix(), claimsSet.serialize(),
diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/SetAuthorizationCodeToResponseContext.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/SetAuthorizationCodeToResponseContext.java
index a409130e..bf477e4a 100644
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/SetAuthorizationCodeToResponseContext.java
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/SetAuthorizationCodeToResponseContext.java
@@ -286,16 +286,27 @@ public class SetAuthorizationCodeToResponseContext extends AbstractOIDCAuthentic
}
final Instant dateExp = Instant.now().plus(authzCodeLifetime);
final Scope scope = getOidcResponseContext().getScope();
- final AuthorizeCodeClaimsSet claimsSet = new AuthorizeCodeClaimsSet.Builder(idGenerator,
- getAuthenticationRequest().getClientID(), issuerLookupStrategy.apply(profileRequestContext),
- subjectCtx.getPrincipalName(), getOidcResponseContext().getSubject(), Instant.now(), dateExp,
- getOidcResponseContext().getAuthTime(), getOidcResponseContext().getRedirectURI(),
- scope != null ? scope : new Scope()).setACR(getOidcResponseContext().getAcr())
- .setNonce(new DefaultRequestNonceLookupFunction().apply(profileRequestContext))
- .setClaims(getOidcResponseContext().getRequestedClaims()).setDlClaims(claims)
- .setDlClaimsID(claimsID).setDlClaimsUI(claimsUI).setConsentedClaims(consented)
- .setCodeChallenge(codeChallenge)
- .setConsentEnabled(consentEnabledPredicate.test(profileRequestContext)).build();
+ final AuthorizeCodeClaimsSet claimsSet = new AuthorizeCodeClaimsSet.Builder()
+ .setJWTID(idGenerator)
+ .setClientID(getAuthenticationRequest().getClientID())
+ .setIssuer(issuerLookupStrategy.apply(profileRequestContext))
+ .setPrincipal(subjectCtx.getPrincipalName())
+ .setSubject(getOidcResponseContext().getSubject())
+ .setIssuedAt(Instant.now())
+ .setExpiresAt(dateExp)
+ .setAuthenticationTime(getOidcResponseContext().getAuthTime())
+ .setRedirectURI(getOidcResponseContext().getRedirectURI())
+ .setScope(scope != null ? scope : new Scope())
+ .setACR(getOidcResponseContext().getAcr())
+ .setNonce(new DefaultRequestNonceLookupFunction().apply(profileRequestContext))
+ .setCodeChallenge(codeChallenge)
+ .setClaims(getOidcResponseContext().getRequestedClaims())
+ .setDlClaims(claims)
+ .setDlClaimsID(claimsID)
+ .setDlClaimsUI(claimsUI)
+ .setConsentedClaims(consented)
+ .setConsentEnabled(consentEnabledPredicate.test(profileRequestContext))
+ .build();
// We set token claims set to response context for possible access token generation.
getOidcResponseContext().setAuthorizationGrantClaimsSet(claimsSet);
try {
diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/SetSubjectToResponseContext.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/SetSubjectToResponseContext.java
index a0b728a4..4a071d18 100644
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/SetSubjectToResponseContext.java
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/SetSubjectToResponseContext.java
@@ -28,7 +28,6 @@ import net.shibboleth.utilities.java.support.component.ComponentSupport;
import net.shibboleth.utilities.java.support.logic.Constraint;
import org.opensaml.profile.action.ActionSupport;
-import org.opensaml.profile.action.EventIds;
import org.opensaml.profile.context.ProfileRequestContext;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
@@ -76,7 +75,7 @@ public class SetSubjectToResponseContext extends AbstractOIDCResponseAction {
*/
public void setSubjectLookupStrategy(@Nonnull final Function<ProfileRequestContext, String> strategy) {
ComponentSupport.ifInitializedThrowUnmodifiabledComponentException(this);
- subjectLookupStrategy = Constraint.isNotNull(strategy, "SubjectLookupStrategy lookup strategy cannot be null");
+ subjectLookupStrategy = Constraint.isNotNull(strategy, "Subject lookup strategy cannot be null");
}
/** {@inheritDoc} */
diff --git a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/oauth2/profile/impl/RevokeTokenTest.java b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/oauth2/profile/impl/RevokeTokenTest.java
index e35589a9..4113146f 100644
--- a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/oauth2/profile/impl/RevokeTokenTest.java
+++ b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/oauth2/profile/impl/RevokeTokenTest.java
@@ -92,9 +92,18 @@ public class RevokeTokenTest extends BaseTokenClaimsSetTest {
protected void init()
throws ComponentInitializationException, NoSuchAlgorithmException, DataSealerException, URISyntaxException {
// init tokens
- final AuthorizeCodeClaimsSet acClaimsSet =
- new AuthorizeCodeClaimsSet.Builder(new SecureRandomIdentifierGenerationStrategy(), clientID, issuer,
- userPrincipal, subject, iat, exp, authTime, redirectURI, scope).build();
+ final AuthorizeCodeClaimsSet acClaimsSet = new AuthorizeCodeClaimsSet.Builder()
+ .setJWTID(new SecureRandomIdentifierGenerationStrategy())
+ .setClientID(clientID)
+ .setIssuer(issuer)
+ .setPrincipal(userPrincipal)
+ .setSubject(subject)
+ .setIssuedAt(iat)
+ .setExpiresAt(exp)
+ .setAuthenticationTime(authTime)
+ .setRedirectURI(redirectURI)
+ .setScope(scope).
+ build();
atClaimsSet = new AccessTokenClaimsSet(acClaimsSet, scope, dlClaims, dlClaimsUI, iat, exp);
rfClaimsSet = new RefreshTokenClaimsSet(acClaimsSet, iat, exp);
// init action
diff --git a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/AbstractOidcApiFlowTest.java b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/AbstractOidcApiFlowTest.java
index 7f737cad..91bcb45a 100644
--- a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/AbstractOidcApiFlowTest.java
+++ b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/AbstractOidcApiFlowTest.java
@@ -56,15 +56,24 @@ public class AbstractOidcApiFlowTest extends AbstractOidcFlowTest {
protected BearerAccessToken buildToken(final String clientId, final String subject, final Scope scope,
final ClaimsSet userInfoDeliverySet)
throws URISyntaxException, NoSuchAlgorithmException, DataSealerException, ComponentInitializationException {
- TokenClaimsSet claims = new AccessTokenClaimsSet.Builder(idGenerator, new ClientID(clientId),
- "https://op.example.org",
- "jdoe", subject, Instant.now(), Instant.now().plusSeconds(30), Instant.now(),
- new URI("https://example.org/cb"), scope).setDlClaimsUI(userInfoDeliverySet).build();
+ final TokenClaimsSet claims = new AccessTokenClaimsSet.Builder()
+ .setJWTID(idGenerator)
+ .setClientID(new ClientID(clientId))
+ .setIssuer("https://op.example.org")
+ .setPrincipal("jdoe")
+ .setSubject(subject)
+ .setIssuedAt(Instant.now())
+ .setExpiresAt(Instant.now().plusSeconds(30))
+ .setAuthenticationTime(Instant.now())
+ .setRedirectURI(new URI("https://example.org/cb"))
+ .setScope(scope)
+ .setDlClaimsUI(userInfoDeliverySet)
+ .build();
return new BearerAccessToken(claims.serialize(BaseOIDCResponseActionTest.initializeDataSealer()));
}
protected BearerAccessToken buildLegacyToken(final String clientId, final String subject, final Scope scope,
- final ClaimsSet userInfoDeliverySet, String... consentedClaims)
+ final ClaimsSet userInfoDeliverySet, final String... consentedClaims)
throws URISyntaxException, NoSuchAlgorithmException, DataSealerException, ComponentInitializationException {
final String json = buildJsonForLegacyToken(subject, clientId, scope, "at", consentedClaims);
diff --git a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/InitializeSubjectContextTest.java b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/InitializeSubjectContextTest.java
index ed926811..613e8f83 100644
--- a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/InitializeSubjectContextTest.java
+++ b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/InitializeSubjectContextTest.java
@@ -18,16 +18,16 @@
package net.shibboleth.idp.plugin.oidc.op.profile.impl;
import net.shibboleth.idp.authn.context.SubjectContext;
-import net.shibboleth.idp.plugin.oidc.op.profile.impl.InitializeSubjectContext;
+import net.shibboleth.idp.plugin.oidc.op.profile.OidcEventIds;
import net.shibboleth.idp.plugin.oidc.op.token.support.AuthorizeCodeClaimsSet;
import net.shibboleth.idp.plugin.oidc.op.token.support.TokenClaimsSet;
import net.shibboleth.idp.profile.testing.ActionTestingSupport;
import net.shibboleth.utilities.java.support.component.ComponentInitializationException;
+
import java.net.URI;
import java.net.URISyntaxException;
import java.time.Instant;
-import org.opensaml.profile.action.EventIds;
import org.springframework.webflow.execution.Event;
import org.testng.annotations.Test;
import com.nimbusds.oauth2.sdk.Scope;
@@ -38,6 +38,7 @@ import org.testng.Assert;
/** {@link InitializeSubjectContext} unit test. */
public class InitializeSubjectContextTest extends BaseOIDCResponseActionTest {
+ /** Action bean. */
private InitializeSubjectContext action;
private void init() throws ComponentInitializationException {
@@ -47,28 +48,43 @@ public class InitializeSubjectContextTest extends BaseOIDCResponseActionTest {
/**
* Test that action copes with no token claims set.
+ *
+ * @throws ComponentInitializationException
*/
@Test
public void testNoClaimsSet() throws ComponentInitializationException {
init();
final Event event = action.execute(requestCtx);
- ActionTestingSupport.assertEvent(event, EventIds.INVALID_MESSAGE);
+ ActionTestingSupport.assertEvent(event, OidcEventIds.INVALID_SUBJECT);
}
/**
* Test success case.
+ *
+ * @throws ComponentInitializationException
+ * @throws URISyntaxException
*/
@Test
public void testSuccess() throws ComponentInitializationException, URISyntaxException {
init();
- TokenClaimsSet claims = new AuthorizeCodeClaimsSet.Builder(idGenerator, new ClientID(), "issuer", "userPrin",
- "subject", Instant.now(), Instant.now(), Instant.now(), new URI("http://example.com"), new Scope()).build();
- respCtx.setTokenClaimsSet(claims);
+ final TokenClaimsSet claims = new AuthorizeCodeClaimsSet.Builder()
+ .setJWTID(idGenerator)
+ .setClientID(new ClientID())
+ .setIssuer("issuer")
+ .setPrincipal("userPrin")
+ .setSubject(subject)
+ .setIssuedAt(Instant.now())
+ .setExpiresAt(Instant.now())
+ .setAuthenticationTime(Instant.now())
+ .setRedirectURI(new URI("http://example.com"))
+ .setScope(new Scope())
+ .build();
+ respCtx.setAuthorizationGrantClaimsSet(claims);
final Event event = action.execute(requestCtx);
- SubjectContext ctx = profileRequestCtx.getSubcontext(SubjectContext.class);
+ final SubjectContext ctx = profileRequestCtx.getSubcontext(SubjectContext.class);
ActionTestingSupport.assertProceedEvent(event);
Assert.assertEquals(ctx.getPrincipalName(), "userPrin");
-
}
+
}
\ No newline at end of file
diff --git a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/SetAccessTokenToResponseContextTest.java b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/SetAccessTokenToResponseContextTest.java
index b5168a66..ff0b3726 100644
--- a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/SetAccessTokenToResponseContextTest.java
+++ b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/SetAccessTokenToResponseContextTest.java
@@ -54,12 +54,22 @@ public class SetAccessTokenToResponseContextTest extends BaseOIDCResponseActionT
private void init() throws ComponentInitializationException, NoSuchAlgorithmException, URISyntaxException {
respCtx.setScope(new Scope());
- TokenClaimsSet claims = new AuthorizeCodeClaimsSet.Builder(idGenerator, new ClientID(), "issuer", "userPrin",
- "subject", Instant.now(), Instant.now(), Instant.now(), new URI("http://example.com"),
- new Scope()).setACR(new ACR("0")).build();
+ final TokenClaimsSet claims = new AuthorizeCodeClaimsSet.Builder()
+ .setJWTID(idGenerator)
+ .setClientID(new ClientID())
+ .setIssuer("issuer")
+ .setPrincipal("userPrin")
+ .setSubject("subject")
+ .setIssuedAt(Instant.now())
+ .setExpiresAt(Instant.now())
+ .setAuthenticationTime(Instant.now())
+ .setRedirectURI(new URI("http://example.com"))
+ .setScope(new Scope())
+ .setACR(new ACR("0"))
+ .build();
respCtx.setSubject("subject");
respCtx.setAuthTime(Instant.now());
- respCtx.setTokenClaimsSet(claims);
+ respCtx.setAuthorizationGrantClaimsSet(claims);
respCtx.setAcr("0");
respCtx.setRedirectURI(new URI("http://example.com"));
action = new SetAccessTokenToResponseContext(getDataSealer());
@@ -70,6 +80,12 @@ public class SetAccessTokenToResponseContextTest extends BaseOIDCResponseActionT
/**
* Basic success case.
+ *
+ * @throws ComponentInitializationException
+ * @throws NoSuchAlgorithmException
+ * @throws URISyntaxException
+ * @throws ParseException
+ * @throws DataSealerException
*/
@Test
public void testSuccess() throws ComponentInitializationException, NoSuchAlgorithmException, URISyntaxException,
@@ -78,63 +94,84 @@ public class SetAccessTokenToResponseContextTest extends BaseOIDCResponseActionT
final Event event = action.execute(requestCtx);
ActionTestingSupport.assertProceedEvent(event);
Assert.assertNotNull(respCtx.getAccessToken());
- AccessTokenClaimsSet at = AccessTokenClaimsSet.parse(respCtx.getAccessToken().getValue(), getDataSealer());
+ final AccessTokenClaimsSet at =
+ AccessTokenClaimsSet.parse(respCtx.getAccessToken().getValue(), getDataSealer());
Assert.assertNotNull(at);
}
/**
* Basic success case for non derived token.
*
+ * @throws ComponentInitializationException
+ * @throws NoSuchAlgorithmException
+ * @throws URISyntaxException
+ * @throws ParseException
+ * @throws DataSealerException
*/
@Test
public void testSuccess2() throws ComponentInitializationException, NoSuchAlgorithmException, URISyntaxException,
ParseException, DataSealerException {
init();
- respCtx.setTokenClaimsSet(null);
+ respCtx.setAuthorizationGrantClaimsSet(null);
final Event event = action.execute(requestCtx);
ActionTestingSupport.assertProceedEvent(event);
Assert.assertNotNull(respCtx.getAccessToken());
- AccessTokenClaimsSet at = AccessTokenClaimsSet.parse(respCtx.getAccessToken().getValue(), getDataSealer());
+ final AccessTokenClaimsSet at =
+ AccessTokenClaimsSet.parse(respCtx.getAccessToken().getValue(), getDataSealer());
Assert.assertNotNull(at);
}
/**
* Basic success case for non derived token. Test for consent.
*
+ * @throws ComponentInitializationException
+ * @throws NoSuchAlgorithmException
+ * @throws URISyntaxException
+ * @throws ParseException
+ * @throws DataSealerException
*/
@Test
public void testSuccess2Consent() throws ComponentInitializationException, NoSuchAlgorithmException,
URISyntaxException, ParseException, DataSealerException {
init();
- respCtx.setTokenClaimsSet(null);
- OIDCAuthenticationResponseConsentContext consCtx = (OIDCAuthenticationResponseConsentContext) respCtx
- .addSubcontext(new OIDCAuthenticationResponseConsentContext());
+ respCtx.setAuthorizationGrantClaimsSet(null);
+ final OIDCAuthenticationResponseConsentContext consCtx =
+ (OIDCAuthenticationResponseConsentContext) respCtx.addSubcontext(
+ new OIDCAuthenticationResponseConsentContext());
consCtx.getConsentedAttributes().add("3");
final Event event = action.execute(requestCtx);
ActionTestingSupport.assertProceedEvent(event);
Assert.assertNotNull(respCtx.getAccessToken());
- AccessTokenClaimsSet at = AccessTokenClaimsSet.parse(respCtx.getAccessToken().getValue(), getDataSealer());
+ final AccessTokenClaimsSet at =
+ AccessTokenClaimsSet.parse(respCtx.getAccessToken().getValue(), getDataSealer());
Assert.assertNotNull(at);
Assert.assertEquals(at.getConsentedClaims(), consCtx.getConsentedAttributes());
}
/**
- * Basic success case with delivery claims
+ * Basic success case with delivery claims.
*
+ * @throws ComponentInitializationException
+ * @throws NoSuchAlgorithmException
+ * @throws URISyntaxException
+ * @throws ParseException
+ * @throws DataSealerException
*/
@Test
public void testSuccessWithTokenDelivery() throws ComponentInitializationException, NoSuchAlgorithmException,
URISyntaxException, ParseException, DataSealerException {
init();
- OIDCAuthenticationResponseTokenClaimsContext tokenCtx = (OIDCAuthenticationResponseTokenClaimsContext) respCtx
- .addSubcontext(new OIDCAuthenticationResponseTokenClaimsContext());
+ final OIDCAuthenticationResponseTokenClaimsContext tokenCtx =
+ (OIDCAuthenticationResponseTokenClaimsContext) respCtx.addSubcontext(
+ new OIDCAuthenticationResponseTokenClaimsContext());
tokenCtx.getClaims().setClaim("1", "1");
tokenCtx.getIdtokenClaims().setClaim("2", "2");
tokenCtx.getUserinfoClaims().setClaim("3", "3");
final Event event = action.execute(requestCtx);
ActionTestingSupport.assertProceedEvent(event);
Assert.assertNotNull(respCtx.getAccessToken());
- AccessTokenClaimsSet at = AccessTokenClaimsSet.parse(respCtx.getAccessToken().getValue(), getDataSealer());
+ final AccessTokenClaimsSet at =
+ AccessTokenClaimsSet.parse(respCtx.getAccessToken().getValue(), getDataSealer());
Assert.assertNotNull(at);
Assert.assertNotNull(at.getDeliveryClaims().getClaim("1"));
Assert.assertNotNull(at.getUserinfoDeliveryClaims().getClaim("3"));
@@ -144,13 +181,16 @@ public class SetAccessTokenToResponseContextTest extends BaseOIDCResponseActionT
/**
* fails as request is of wrong type.
*
+ * @throws NoSuchAlgorithmException
+ * @throws ComponentInitializationException
+ * @throws URISyntaxException
*/
@Test
public void testFailNoAuthnReqCase2()
throws NoSuchAlgorithmException, ComponentInitializationException, URISyntaxException {
init();
- respCtx.setTokenClaimsSet(null);
- TokenRequest req =
+ respCtx.setAuthorizationGrantClaimsSet(null);
+ final TokenRequest req =
new TokenRequest(new URI("http://example.com"), new RefreshTokenGrant(new RefreshToken()), null);
setTokenRequest(req);
final Event event = action.execute(requestCtx);
@@ -160,12 +200,15 @@ public class SetAccessTokenToResponseContextTest extends BaseOIDCResponseActionT
/**
* fails as there is no subject ctx.
*
+ * @throws NoSuchAlgorithmException
+ * @throws ComponentInitializationException
+ * @throws URISyntaxException
*/
@Test
public void testFailNoSubjectCtxCase2()
throws NoSuchAlgorithmException, ComponentInitializationException, URISyntaxException {
init();
- respCtx.setTokenClaimsSet(null);
+ respCtx.setAuthorizationGrantClaimsSet(null);
profileRequestCtx.removeSubcontext(SubjectContext.class);
final Event event = action.execute(requestCtx);
ActionTestingSupport.assertEvent(event, EventIds.INVALID_PROFILE_CTX);
@@ -174,6 +217,9 @@ public class SetAccessTokenToResponseContextTest extends BaseOIDCResponseActionT
/**
* fails as there is no rp ctx.
*
+ * @throws NoSuchAlgorithmException
+ * @throws ComponentInitializationException
+ * @throws URISyntaxException
*/
@Test
public void testFailNoRPCtx()
@@ -187,12 +233,15 @@ public class SetAccessTokenToResponseContextTest extends BaseOIDCResponseActionT
/**
* fails as there is no profile conf.
*
+ * @throws NoSuchAlgorithmException
+ * @throws ComponentInitializationException
+ * @throws URISyntaxException
*/
@Test
public void testFailNoProfileConf()
throws NoSuchAlgorithmException, ComponentInitializationException, URISyntaxException {
init();
- RelyingPartyContext rpCtx = profileRequestCtx.getSubcontext(RelyingPartyContext.class, false);
+ final RelyingPartyContext rpCtx = profileRequestCtx.getSubcontext(RelyingPartyContext.class, false);
rpCtx.setProfileConfig(null);
final Event event = action.execute(requestCtx);
ActionTestingSupport.assertEvent(event, IdPEventIds.INVALID_PROFILE_CONFIG);
@@ -201,15 +250,30 @@ public class SetAccessTokenToResponseContextTest extends BaseOIDCResponseActionT
/**
* fails as the token is of wrong type.
*
+ * @throws NoSuchAlgorithmException
+ * @throws ComponentInitializationException
+ * @throws URISyntaxException
*/
@Test
public void testFailTokenNotCodeOrRefresh()
throws NoSuchAlgorithmException, ComponentInitializationException, URISyntaxException {
init();
- TokenClaimsSet claims = new AccessTokenClaimsSet.Builder(idGenerator, new ClientID(), "issuer",
- "userPrin", "subject", Instant.now(), Instant.now(), Instant.now(), new URI("http://example.com"), new Scope()).build();
- respCtx.setTokenClaimsSet(claims);
+ final TokenClaimsSet claims = new AccessTokenClaimsSet.Builder()
+ .setJWTID(idGenerator)
+ .setClientID(new ClientID())
+ .setIssuer("issuer")
+ .setPrincipal("userPrin")
+ .setSubject("subject")
+ .setIssuedAt(Instant.now())
+ .setExpiresAt(Instant.now())
+ .setAuthenticationTime(Instant.now())
+ .setRedirectURI(new URI("http://example.com"))
+ .setScope(new Scope())
+ .build();
+
+ respCtx.setAuthorizationGrantClaimsSet(claims);
final Event event = action.execute(requestCtx);
ActionTestingSupport.assertEvent(event, EventIds.INVALID_PROFILE_CTX);
}
+
}
\ No newline at end of file
diff --git a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/SetAuthenticationContextClassReferenceFromAuthzCodeToResponseContextTest.java b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/SetAuthenticationContextClassReferenceFromAuthzCodeToResponseContextTest.java
index 3b276b02..1ee2cf24 100644
--- a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/SetAuthenticationContextClassReferenceFromAuthzCodeToResponseContextTest.java
+++ b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/SetAuthenticationContextClassReferenceFromAuthzCodeToResponseContextTest.java
@@ -17,9 +17,7 @@
package net.shibboleth.idp.plugin.oidc.op.profile.impl;
-import net.shibboleth.idp.plugin.oidc.op.profile.impl.SetAuthenticationContextClassReferenceFromAuthzCodeToResponseContext;
import net.shibboleth.idp.plugin.oidc.op.token.support.AuthorizeCodeClaimsSet;
-import net.shibboleth.idp.plugin.oidc.op.token.support.TokenClaimsSet;
import net.shibboleth.idp.profile.testing.ActionTestingSupport;
import net.shibboleth.utilities.java.support.component.ComponentInitializationException;
import net.shibboleth.utilities.java.support.security.DataSealerException;
@@ -46,16 +44,32 @@ public class SetAuthenticationContextClassReferenceFromAuthzCodeToResponseContex
@BeforeMethod
private void init() throws ComponentInitializationException, NoSuchAlgorithmException, URISyntaxException {
- TokenClaimsSet claims = new AuthorizeCodeClaimsSet.Builder(idGenerator, new ClientID(), "issuer", "userPrin",
- "subject", Instant.now(), Instant.now(), Instant.now(), new URI("http://example.com"),
- new Scope()).setACR(new ACR("0")).build();
- respCtx.setTokenClaimsSet(claims);
+ final AuthorizeCodeClaimsSet claims = new AuthorizeCodeClaimsSet.Builder()
+ .setJWTID(idGenerator)
+ .setClientID(new ClientID())
+ .setIssuer("issuer")
+ .setPrincipal("userPrin")
+ .setSubject(subject)
+ .setIssuedAt(Instant.now())
+ .setExpiresAt(Instant.now())
+ .setAuthenticationTime(Instant.now())
+ .setRedirectURI(new URI("http://example.com"))
+ .setScope(new Scope())
+ .setACR(new ACR("0"))
+ .build();
+ respCtx.setAuthorizationGrantClaimsSet(claims);
action = new SetAuthenticationContextClassReferenceFromAuthzCodeToResponseContext();
action.initialize();
}
/**
* Basic success case.
+ *
+ * @throws ComponentInitializationException
+ * @throws NoSuchAlgorithmException
+ * @throws URISyntaxException
+ * @throws ParseException
+ * @throws DataSealerException
*/
@Test
public void testSuccess() throws ComponentInitializationException, NoSuchAlgorithmException, URISyntaxException,
@@ -68,11 +82,17 @@ public class SetAuthenticationContextClassReferenceFromAuthzCodeToResponseContex
/**
* Fails due to missing input.
+ *
+ * @throws ComponentInitializationException
+ * @throws NoSuchAlgorithmException
+ * @throws URISyntaxException
+ * @throws ParseException
+ * @throws DataSealerException
*/
@Test
public void testFailsNoToken() throws ComponentInitializationException, NoSuchAlgorithmException,
URISyntaxException, ParseException, DataSealerException {
- respCtx.setTokenClaimsSet(null);
+ respCtx.setAuthorizationGrantClaimsSet(null);
final Event event = action.execute(requestCtx);
ActionTestingSupport.assertEvent(event, EventIds.INVALID_PROFILE_CTX);
}
diff --git a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/SetConsentFromTokenToResponseContextTest.java b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/SetConsentFromTokenToResponseContextTest.java
index 1cb32427..bec93d20 100644
--- a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/SetConsentFromTokenToResponseContextTest.java
+++ b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/SetConsentFromTokenToResponseContextTest.java
@@ -38,6 +38,7 @@ import com.nimbusds.oauth2.sdk.id.ClientID;
/** {@link SetConsentFromTokenToResponseContext} unit test. */
public class SetConsentFromTokenToResponseContextTest extends BaseOIDCResponseActionTest {
+ /** Action. */
private SetConsentFromTokenToResponseContext action;
@BeforeMethod
@@ -50,7 +51,7 @@ public class SetConsentFromTokenToResponseContextTest extends BaseOIDCResponseAc
* Test that action handles no consent being available.
*/
@Test
- public void testSuccessNoConsent() throws ComponentInitializationException {
+ public void testSuccessNoConsent() {
final Event event = action.execute(requestCtx);
respCtx.removeSubcontext(OIDCAuthenticationResponseConsentContext.class);
ActionTestingSupport.assertProceedEvent(event);
@@ -59,15 +60,27 @@ public class SetConsentFromTokenToResponseContextTest extends BaseOIDCResponseAc
/**
* Test basic success case.
+ *
+ * @throws URISyntaxException
*/
@Test
- public void testSuccess() throws ComponentInitializationException, URISyntaxException {
+ public void testSuccess() throws URISyntaxException {
final JSONArray consentedClaims = new JSONArray();
consentedClaims.add("1");
- final TokenClaimsSet claims = new AuthorizeCodeClaimsSet.Builder(idGenerator, new ClientID(), "issuer", "userPrin",
- "subject", Instant.now(), Instant.now(), Instant.now(), new URI("http://example.com"), new Scope())
- .setConsentedClaims(consentedClaims).build();
- respCtx.setTokenClaimsSet(claims);
+ final TokenClaimsSet claims = new AuthorizeCodeClaimsSet.Builder()
+ .setJWTID(idGenerator)
+ .setClientID(new ClientID())
+ .setIssuer("issuer")
+ .setPrincipal("userPrin")
+ .setSubject(subject)
+ .setIssuedAt(Instant.now())
+ .setExpiresAt(Instant.now())
+ .setAuthenticationTime(Instant.now())
+ .setRedirectURI(new URI("http://example.com"))
+ .setScope(new Scope())
+ .setConsentedClaims(consentedClaims)
+ .build();
+ respCtx.setAuthorizationGrantClaimsSet(claims);
final Event event = action.execute(requestCtx);
ActionTestingSupport.assertProceedEvent(event);
final OIDCAuthenticationResponseConsentContext ctx =
diff --git a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/SetRefreshTokenToResponseContextTest.java b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/SetRefreshTokenToResponseContextTest.java
index c7866766..3f44e8f6 100644
--- a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/SetRefreshTokenToResponseContextTest.java
+++ b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/SetRefreshTokenToResponseContextTest.java
@@ -17,7 +17,6 @@
package net.shibboleth.idp.plugin.oidc.op.profile.impl;
-import net.shibboleth.idp.plugin.oidc.op.profile.impl.SetRefreshTokenToResponseContext;
import net.shibboleth.idp.plugin.oidc.op.token.support.AccessTokenClaimsSet;
import net.shibboleth.idp.plugin.oidc.op.token.support.AuthorizeCodeClaimsSet;
import net.shibboleth.idp.plugin.oidc.op.token.support.RefreshTokenClaimsSet;
@@ -53,16 +52,32 @@ public class SetRefreshTokenToResponseContextTest extends BaseOIDCResponseAction
final Scope scope = new Scope();
scope.add(OIDCScopeValue.OFFLINE_ACCESS);
respCtx.setScope(scope);
- final TokenClaimsSet claims = new AuthorizeCodeClaimsSet.Builder(idGenerator, new ClientID(), "issuer",
- "userPrin", "subject", Instant.now(), Instant.now(), Instant.now(), new URI("http://example.com"),
- new Scope()).setACR(new ACR("0")).build();
- respCtx.setTokenClaimsSet(claims);
+ final TokenClaimsSet claims = new AuthorizeCodeClaimsSet.Builder()
+ .setJWTID(idGenerator)
+ .setClientID(new ClientID())
+ .setIssuer("issuer")
+ .setPrincipal("userPrin")
+ .setSubject("subject")
+ .setIssuedAt(Instant.now())
+ .setExpiresAt(Instant.now())
+ .setAuthenticationTime(Instant.now())
+ .setRedirectURI(new URI("http://example.com"))
+ .setScope(new Scope())
+ .setACR(new ACR("0"))
+ .build();
+ respCtx.setAuthorizationGrantClaimsSet(claims);
action = new SetRefreshTokenToResponseContext(getDataSealer());
action.initialize();
}
/**
* Basic success case.
+ *
+ * @throws ComponentInitializationException
+ * @throws NoSuchAlgorithmException
+ * @throws URISyntaxException
+ * @throws ParseException
+ * @throws DataSealerException
*/
@Test
public void testSuccess() throws ComponentInitializationException, NoSuchAlgorithmException, URISyntaxException,
@@ -70,12 +85,19 @@ public class SetRefreshTokenToResponseContextTest extends BaseOIDCResponseAction
final Event event = action.execute(requestCtx);
ActionTestingSupport.assertProceedEvent(event);
Assert.assertNotNull(respCtx.getRefreshToken());
- final RefreshTokenClaimsSet rt = RefreshTokenClaimsSet.parse(respCtx.getRefreshToken().getValue(), getDataSealer());
+ final RefreshTokenClaimsSet rt =
+ RefreshTokenClaimsSet.parse(respCtx.getRefreshToken().getValue(), getDataSealer());
Assert.assertNotNull(rt);
}
/**
* There is no offline_access scope.
+ *
+ * @throws ComponentInitializationException
+ * @throws NoSuchAlgorithmException
+ * @throws URISyntaxException
+ * @throws ParseException
+ * @throws DataSealerException
*/
@Test
public void testNoToken() throws ComponentInitializationException, NoSuchAlgorithmException, URISyntaxException,
@@ -88,6 +110,10 @@ public class SetRefreshTokenToResponseContextTest extends BaseOIDCResponseAction
/**
* fails as there is no rp ctx.
+ *
+ * @throws NoSuchAlgorithmException
+ * @throws ComponentInitializationException
+ * @throws URISyntaxException
*/
@Test
public void testFailNoRPCtx()
@@ -99,6 +125,10 @@ public class SetRefreshTokenToResponseContextTest extends BaseOIDCResponseAction
/**
* fails as there is no profile conf.
+ *
+ * @throws NoSuchAlgorithmException
+ * @throws ComponentInitializationException
+ * @throws URISyntaxException
*/
@Test
public void testFailNoProfileConf()
@@ -111,25 +141,42 @@ public class SetRefreshTokenToResponseContextTest extends BaseOIDCResponseAction
/**
* fails as the token is of wrong type.
+ *
+ * @throws NoSuchAlgorithmException
+ * @throws ComponentInitializationException
+ * @throws URISyntaxException
*/
@Test
public void testFailTokenNotCodeOrRefresh()
throws NoSuchAlgorithmException, ComponentInitializationException, URISyntaxException {
- final TokenClaimsSet claims = new AccessTokenClaimsSet.Builder(idGenerator, new ClientID(),
- "issuer", "userPrin", "subject", Instant.now(), Instant.now(), Instant.now(),
- new URI("http://example.com"), new Scope()).build();
- respCtx.setTokenClaimsSet(claims);
+ final TokenClaimsSet claims = new AccessTokenClaimsSet.Builder()
+ .setJWTID(idGenerator)
+ .setClientID(new ClientID())
+ .setIssuer("issuer")
+ .setPrincipal("userPrin")
+ .setSubject("subject")
+ .setIssuedAt(Instant.now())
+ .setExpiresAt(Instant.now())
+ .setAuthenticationTime(Instant.now())
+ .setRedirectURI(new URI("http://example.com"))
+ .setScope(new Scope())
+ .build();
+ respCtx.setAuthorizationGrantClaimsSet(claims);
final Event event = action.execute(requestCtx);
ActionTestingSupport.assertEvent(event, EventIds.INVALID_PROFILE_CTX);
}
/**
* fails as there no token to derive refresh token from.
+ *
+ * @throws NoSuchAlgorithmException
+ * @throws ComponentInitializationException
+ * @throws URISyntaxException
*/
@Test
public void testFailNoToken()
throws NoSuchAlgorithmException, ComponentInitializationException, URISyntaxException {
- respCtx.setTokenClaimsSet(null);
+ respCtx.setAuthorizationGrantClaimsSet(null);
final Event event = action.execute(requestCtx);
ActionTestingSupport.assertEvent(event, EventIds.INVALID_PROFILE_CTX);
}
diff --git a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/SetRequestedClaimsToResponseContextTest.java b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/SetRequestedClaimsToResponseContextTest.java
index f13e29aa..dad6db25 100644
--- a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/SetRequestedClaimsToResponseContextTest.java
+++ b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/SetRequestedClaimsToResponseContextTest.java
@@ -34,9 +34,7 @@ import com.nimbusds.openid.connect.sdk.claims.ACR;
import net.minidev.json.JSONObject;
import net.shibboleth.idp.authn.context.SubjectContext;
import net.shibboleth.idp.plugin.oidc.op.profile.context.navigate.TokenRequestRequestedClaimsLookupFunction;
-import net.shibboleth.idp.plugin.oidc.op.profile.impl.SetRequestedClaimsToResponseContext;
import net.shibboleth.idp.plugin.oidc.op.token.support.AuthorizeCodeClaimsSet;
-import net.shibboleth.idp.plugin.oidc.op.token.support.TokenClaimsSet;
import net.shibboleth.idp.profile.testing.ActionTestingSupport;
import net.shibboleth.utilities.java.support.component.ComponentInitializationException;
import net.shibboleth.utilities.java.support.test.service.MockReloadableService;
@@ -48,12 +46,26 @@ public class SetRequestedClaimsToResponseContextTest extends BaseOIDCResponseAct
private SetRequestedClaimsToResponseContext action;
- private void init() throws ComponentInitializationException, NoSuchAlgorithmException, URISyntaxException, com.nimbusds.oauth2.sdk.ParseException {
+ private void init() throws ComponentInitializationException, NoSuchAlgorithmException, URISyntaxException,
+ com.nimbusds.oauth2.sdk.ParseException {
respCtx.setScope(new Scope());
- TokenClaimsSet claims = new AuthorizeCodeClaimsSet.Builder(idGenerator, new ClientID(), "issuer", "userPrin",
- "subject", Instant.now(), Instant.now(), Instant.now(), new URI("http://example.com"),
- new Scope()).setACR(new ACR("0")).setClaims(OIDCClaimsRequest.parse("{\"id_token\":{\"email\":{\"essential\":true}},\"userinfo\":{\"name\":{\"essential\":true}}}")).build();
+ final AuthorizeCodeClaimsSet claims = new AuthorizeCodeClaimsSet.Builder()
+ .setJWTID(idGenerator)
+ .setClientID(new ClientID())
+ .setIssuer("issuer")
+ .setPrincipal("userPrin")
+ .setSubject(subject)
+ .setIssuedAt(Instant.now())
+ .setExpiresAt(Instant.now())
+ .setAuthenticationTime(Instant.now())
+ .setRedirectURI(new URI("http://example.com"))
+ .setScope(new Scope())
+ .setACR(new ACR("0"))
+ .setClaims(OIDCClaimsRequest.parse(
+ "{\"id_token\":{\"email\":{\"essential\":true}},\"userinfo\":{\"name\":{\"essential\":true}}}"))
+ .build();
+
respCtx.setSubject("subject");
respCtx.setAuthTime(Instant.now());
respCtx.setAuthorizationGrantClaimsSet(claims);
@@ -68,11 +80,13 @@ public class SetRequestedClaimsToResponseContextTest extends BaseOIDCResponseAct
}
@Test
- public void testTokenClaimsRemainsTheSame() throws NoSuchAlgorithmException, com.nimbusds.oauth2.sdk.ParseException, ComponentInitializationException, URISyntaxException {
+ public void testTokenClaimsRemainsTheSame() throws NoSuchAlgorithmException, com.nimbusds.oauth2.sdk.ParseException,
+ ComponentInitializationException, URISyntaxException {
init();
final Event event = action.execute(requestCtx);
ActionTestingSupport.assertProceedEvent(event);
- final JSONObject claims = (JSONObject) respCtx.getAuthorizationGrantClaimsSet().getClaimsSet().getClaim("claims");
+ final JSONObject claims =
+ (JSONObject) respCtx.getAuthorizationGrantClaimsSet().getClaimsSet().getClaim("claims");
Assert.assertTrue(isEssential(claims, "id_token", "email"));
Assert.assertTrue(isEssential(claims, "userinfo", "name"));
}
diff --git a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/SetSubjectToResponseContextTest.java b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/SetSubjectToResponseContextTest.java
index 1ca8c150..366c25ec 100644
--- a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/SetSubjectToResponseContextTest.java
+++ b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/SetSubjectToResponseContextTest.java
@@ -39,6 +39,7 @@ import com.nimbusds.oauth2.sdk.id.ClientID;
/** {@link SetSubjectToResponseContext} unit test. */
public class SetSubjectToResponseContextTest extends BaseOIDCResponseActionTest {
+ /** Action. */
private SetSubjectToResponseContext action;
private void init() throws ComponentInitializationException {
@@ -48,6 +49,8 @@ public class SetSubjectToResponseContextTest extends BaseOIDCResponseActionTest
/**
* Test that action handles case of no subject available.
+ *
+ * @throws ComponentInitializationException
*/
@Test
public void testNoSubject() throws ComponentInitializationException {
@@ -60,13 +63,16 @@ public class SetSubjectToResponseContextTest extends BaseOIDCResponseActionTest
* Test that action throws error when null strategy is set.
*/
@Test(expectedExceptions = ConstraintViolationException.class)
- public void testNoStrategy() throws NoSuchAlgorithmException, ComponentInitializationException {
+ public void testNoStrategy() {
action = new SetSubjectToResponseContext();
action.setSubjectLookupStrategy(null);
}
/**
* Test that action throws error when strategy is being set when already initialized.
+ *
+ * @throws NoSuchAlgorithmException
+ * @throws ComponentInitializationException
*/
@Test(expectedExceptions = UnmodifiableComponentException.class)
public void testInitialized() throws NoSuchAlgorithmException, ComponentInitializationException {
@@ -76,14 +82,26 @@ public class SetSubjectToResponseContextTest extends BaseOIDCResponseActionTest
/**
* Test that action copies subject to response ctx.
+ *
+ * @throws ComponentInitializationException
+ * @throws URISyntaxException
*/
@Test
public void testSuccess() throws ComponentInitializationException, URISyntaxException {
init();
- final TokenClaimsSet claims = new AccessTokenClaimsSet.Builder(idGenerator, new ClientID(),
- "issuer", "userPrin", "subject", Instant.now(), Instant.now(), Instant.now(),
- new URI("http://example.com"), new Scope()).build();
- respCtx.setTokenClaimsSet(claims);
+ final TokenClaimsSet claims = new AccessTokenClaimsSet.Builder()
+ .setJWTID(idGenerator)
+ .setClientID(new ClientID())
+ .setIssuer("issuer")
+ .setPrincipal("userPrin")
+ .setSubject("subject")
+ .setIssuedAt(Instant.now())
+ .setExpiresAt(Instant.now())
+ .setAuthenticationTime(Instant.now())
+ .setRedirectURI(new URI("http://example.com"))
+ .setScope(new Scope())
+ .build();
+ respCtx.setAuthorizationGrantClaimsSet(claims);
final Event event = action.execute(requestCtx);
ActionTestingSupport.assertProceedEvent(event);
Assert.assertEquals(respCtx.getSubject(), "subject");
diff --git a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/SetTokenDeliveryAttributesFromTokenToResponseContextTest.java b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/SetTokenDeliveryAttributesFromTokenToResponseContextTest.java
index 501744aa..762c17e7 100644
--- a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/SetTokenDeliveryAttributesFromTokenToResponseContextTest.java
+++ b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/SetTokenDeliveryAttributesFromTokenToResponseContextTest.java
@@ -18,7 +18,6 @@
package net.shibboleth.idp.plugin.oidc.op.profile.impl;
import net.shibboleth.idp.plugin.oidc.op.messaging.context.OIDCAuthenticationResponseTokenClaimsContext;
-import net.shibboleth.idp.plugin.oidc.op.profile.impl.SetTokenDeliveryAttributesFromTokenToResponseContext;
import net.shibboleth.idp.plugin.oidc.op.token.support.AuthorizeCodeClaimsSet;
import net.shibboleth.idp.plugin.oidc.op.token.support.TokenDeliveryClaimsClaimsSet;
import net.shibboleth.idp.profile.testing.ActionTestingSupport;
@@ -40,23 +39,34 @@ import com.nimbusds.openid.connect.sdk.claims.ClaimsSet;
/** {@link SetTokenDeliveryAttributesFromTokenToResponseContext} unit test. */
public class SetTokenDeliveryAttributesFromTokenToResponseContextTest extends BaseOIDCResponseActionTest {
+ /** Action. */
private SetTokenDeliveryAttributesFromTokenToResponseContext action;
private void init() throws ComponentInitializationException, URISyntaxException {
action = new SetTokenDeliveryAttributesFromTokenToResponseContext();
action.initialize();
- final Instant now = Instant.now();
final ClaimsSet dlClaims = new TokenDeliveryClaimsClaimsSet();
dlClaims.setClaim("deliveryClaim", "deliveryClaimValue");
final ClaimsSet dlClaimsUI = new TokenDeliveryClaimsClaimsSet();
dlClaimsUI.setClaim("deliveryClaimUI", "deliveryClaimUIValue");
final ClaimsSet dlClaimsID = new TokenDeliveryClaimsClaimsSet();
dlClaimsID.setClaim("deliveryClaimID", "deliveryClaimIDValue");
- final AuthorizeCodeClaimsSet acClaims =
- new AuthorizeCodeClaimsSet.Builder(idGenerator, new ClientID(clientId), "issuer", "userPrin", "subject",
- now, now.plusSeconds(100), now, new URI("http://example.com"), new Scope())
- .setDlClaims(dlClaims).setDlClaimsID(dlClaimsID).setDlClaimsUI(dlClaimsUI).build();
- respCtx.setTokenClaimsSet(acClaims);
+ final AuthorizeCodeClaimsSet acClaims = new AuthorizeCodeClaimsSet.Builder()
+ .setJWTID(idGenerator)
+ .setClientID(new ClientID())
+ .setIssuer("issuer")
+ .setPrincipal("userPrin")
+ .setSubject(subject)
+ .setIssuedAt(Instant.now())
+ .setExpiresAt(Instant.now().plusSeconds(100))
+ .setAuthenticationTime(Instant.now())
+ .setRedirectURI(new URI("http://example.com"))
+ .setScope(new Scope())
+ .setDlClaims(dlClaims)
+ .setDlClaimsID(dlClaimsID)
+ .setDlClaimsUI(dlClaimsUI)
+ .build();
+ respCtx.setAuthorizationGrantClaimsSet(acClaims);
}
/**
@@ -70,7 +80,7 @@ public class SetTokenDeliveryAttributesFromTokenToResponseContextTest extends Ba
init();
final Event event = action.execute(requestCtx);
ActionTestingSupport.assertProceedEvent(event);
- OIDCAuthenticationResponseTokenClaimsContext respTokenClaims =
+ final OIDCAuthenticationResponseTokenClaimsContext respTokenClaims =
respCtx.getSubcontext(OIDCAuthenticationResponseTokenClaimsContext.class);
Assert.assertNotNull(respTokenClaims);
Assert.assertEquals(respTokenClaims.getUserinfoClaims().getClaim("deliveryClaimUI"), "deliveryClaimUIValue");
@@ -87,7 +97,7 @@ public class SetTokenDeliveryAttributesFromTokenToResponseContextTest extends Ba
@Test
public void testSuccessNoInput() throws ComponentInitializationException, URISyntaxException {
init();
- respCtx.setTokenClaimsSet(null);
+ respCtx.setAuthorizationGrantClaimsSet(null);
final Event event = action.execute(requestCtx);
ActionTestingSupport.assertProceedEvent(event);
final OIDCAuthenticationResponseTokenClaimsContext respTokenClaims =
@@ -106,6 +116,9 @@ public class SetTokenDeliveryAttributesFromTokenToResponseContextTest extends Ba
/**
* Test setting null strategy for id token delivery claims.
+ *
+ * @throws ComponentInitializationException
+ * @throws URISyntaxException
*/
@Test
public void testNullStrategyIDTokenDClaims() throws ComponentInitializationException, URISyntaxException {
@@ -125,6 +138,9 @@ public class SetTokenDeliveryAttributesFromTokenToResponseContextTest extends Ba
/**
* Test setting null strategy for ui delivery claims.
+ *
+ * @throws ComponentInitializationException
+ * @throws URISyntaxException
*/
@Test
public void testNullStrategyUIDClaims() throws ComponentInitializationException, URISyntaxException {
diff --git a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/ValidateAccessTokenTest.java b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/ValidateAccessTokenTest.java
index a896296c..ecd6cb88 100644
--- a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/ValidateAccessTokenTest.java
+++ b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/ValidateAccessTokenTest.java
@@ -18,7 +18,6 @@
package net.shibboleth.idp.plugin.oidc.op.profile.impl;
import net.shibboleth.idp.plugin.oidc.op.profile.OidcEventIds;
-import net.shibboleth.idp.plugin.oidc.op.profile.impl.ValidateAccessToken;
import net.shibboleth.idp.plugin.oidc.op.token.support.AccessTokenClaimsSet;
import net.shibboleth.idp.plugin.oidc.op.token.support.AuthorizeCodeClaimsSet;
import net.shibboleth.idp.plugin.oidc.op.token.support.TokenClaimsSet;
@@ -50,6 +49,9 @@ public class ValidateAccessTokenTest extends BaseOIDCResponseActionTest {
/**
* Test that action throws error if revocation cache is not set.
+ *
+ * @throws NoSuchAlgorithmException
+ * @throws ComponentInitializationException
*/
@Test(expectedExceptions = ComponentInitializationException.class)
public void testNoRevocationCache() throws NoSuchAlgorithmException, ComponentInitializationException {
@@ -60,14 +62,28 @@ public class ValidateAccessTokenTest extends BaseOIDCResponseActionTest {
/**
* Basic success case.
+ *
+ * @throws NoSuchAlgorithmException
+ * @throws ComponentInitializationException
+ * @throws URISyntaxException
+ * @throws DataSealerException
*/
@Test
public void testSuccess()
throws NoSuchAlgorithmException, ComponentInitializationException, URISyntaxException, DataSealerException {
init();
- final TokenClaimsSet claims = new AccessTokenClaimsSet.Builder(idGenerator, new ClientID(), "issuer",
- "userPrin", "subject", Instant.now(), Instant.now().plusSeconds(1), Instant.now(),
- new URI("http://example.com"), new Scope()).build();
+ final TokenClaimsSet claims = new AccessTokenClaimsSet.Builder()
+ .setJWTID(idGenerator)
+ .setClientID(new ClientID())
+ .setIssuer("issuer")
+ .setPrincipal("userPrin")
+ .setSubject("subject")
+ .setIssuedAt(Instant.now())
+ .setExpiresAt(Instant.now().plusSeconds(1))
+ .setAuthenticationTime(Instant.now())
+ .setRedirectURI(new URI("http://example.com"))
+ .setScope(new Scope())
+ .build();
final BearerAccessToken token = new BearerAccessToken(claims.serialize(getDataSealer()));
final UserInfoRequest req = new UserInfoRequest(new URI("http://example.com"), token);
setUserInfoRequest(req);
@@ -77,15 +93,28 @@ public class ValidateAccessTokenTest extends BaseOIDCResponseActionTest {
/**
* Fails due to access token being substituted with authorize code.
+ *
+ * @throws NoSuchAlgorithmException
+ * @throws ComponentInitializationException
+ * @throws URISyntaxException
+ * @throws DataSealerException
*/
@Test
public void testFailsNotAccessToken()
throws NoSuchAlgorithmException, ComponentInitializationException, URISyntaxException, DataSealerException {
init();
- final TokenClaimsSet claims =
- new AuthorizeCodeClaimsSet.Builder(idGenerator, new ClientID(clientId), "issuer", "userPrin", "subject",
- Instant.now(), Instant.now(), Instant.now(), new URI("http://example.com"),
- new Scope()).build();
+ final TokenClaimsSet claims = new AuthorizeCodeClaimsSet.Builder()
+ .setJWTID(idGenerator)
+ .setClientID(new ClientID())
+ .setIssuer("issuer")
+ .setPrincipal("userPrin")
+ .setSubject("subject")
+ .setIssuedAt(Instant.now())
+ .setExpiresAt(Instant.now().plusSeconds(1))
+ .setAuthenticationTime(Instant.now())
+ .setRedirectURI(new URI("http://example.com"))
+ .setScope(new Scope())
+ .build();
final BearerAccessToken token = new BearerAccessToken(claims.serialize(getDataSealer()));
final UserInfoRequest req = new UserInfoRequest(new URI("http://example.com"), token);
setUserInfoRequest(req);
@@ -95,14 +124,28 @@ public class ValidateAccessTokenTest extends BaseOIDCResponseActionTest {
/**
* Fails due token expiration.
+ *
+ * @throws NoSuchAlgorithmException
+ * @throws ComponentInitializationException
+ * @throws URISyntaxException
+ * @throws DataSealerException
*/
@Test
public void testFailsExpired()
throws NoSuchAlgorithmException, ComponentInitializationException, URISyntaxException, DataSealerException {
init();
- final TokenClaimsSet claims = new AccessTokenClaimsSet.Builder(idGenerator, new ClientID(), "issuer",
- "userPrin", "subject", Instant.now(), Instant.now().minusMillis(1), Instant.now(),
- new URI("http://example.com"), new Scope()).build();
+ final TokenClaimsSet claims = new AccessTokenClaimsSet.Builder()
+ .setJWTID(idGenerator)
+ .setClientID(new ClientID())
+ .setIssuer("issuer")
+ .setPrincipal("userPrin")
+ .setSubject("subject")
+ .setIssuedAt(Instant.now())
+ .setExpiresAt(Instant.now().minusMillis(1))
+ .setAuthenticationTime(Instant.now())
+ .setRedirectURI(new URI("http://example.com"))
+ .setScope(new Scope())
+ .build();
final BearerAccessToken token = new BearerAccessToken(claims.serialize(getDataSealer()));
final UserInfoRequest req = new UserInfoRequest(new URI("http://example.com"), token);
setUserInfoRequest(req);
@@ -112,6 +155,11 @@ public class ValidateAccessTokenTest extends BaseOIDCResponseActionTest {
/**
* Fails due token authz code is revoked. Test not 100% as it really does not test passing id to revocation cache.
+ *
+ * @throws NoSuchAlgorithmException
+ * @throws ComponentInitializationException
+ * @throws URISyntaxException
+ * @throws DataSealerException
*/
@Test
public void testFailsRevoked()
@@ -119,9 +167,18 @@ public class ValidateAccessTokenTest extends BaseOIDCResponseActionTest {
action = new ValidateAccessToken(getDataSealer());
action.setRevocationCache(new MockRevocationCache(true, true));
action.initialize();
- final TokenClaimsSet claims = new AccessTokenClaimsSet.Builder(idGenerator, new ClientID(), "issuer",
- "userPrin", "subject", Instant.now(), Instant.now().plusSeconds(1), Instant.now(),
- new URI("http://example.com"), new Scope()).build();
+ final TokenClaimsSet claims = new AccessTokenClaimsSet.Builder()
+ .setJWTID(idGenerator)
+ .setClientID(new ClientID())
+ .setIssuer("issuer")
+ .setPrincipal("userPrin")
+ .setSubject("subject")
+ .setIssuedAt(Instant.now())
+ .setExpiresAt(Instant.now().plusSeconds(1))
+ .setAuthenticationTime(Instant.now())
+ .setRedirectURI(new URI("http://example.com"))
+ .setScope(new Scope())
+ .build();
final BearerAccessToken token = new BearerAccessToken(claims.serialize(getDataSealer()));
final UserInfoRequest req = new UserInfoRequest(new URI("http://example.com"), token);
setUserInfoRequest(req);
diff --git a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/ValidateGrantTest.java b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/ValidateGrantTest.java
index d2fd0c96..246c5f40 100644
--- a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/ValidateGrantTest.java
+++ b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/ValidateGrantTest.java
@@ -66,9 +66,19 @@ public class ValidateGrantTest extends BaseOIDCResponseActionTest {
private void init() throws Exception {
final Instant now = Instant.now();
- acClaims =
- new AuthorizeCodeClaimsSet.Builder(idGenerator, new ClientID(clientId), "issuer", "userPrin", "subject",
- now, now.plusSeconds(100), now, new URI("http://example.com"), new Scope()).build();
+ acClaims = new AuthorizeCodeClaimsSet.Builder()
+ .setJWTID(idGenerator)
+ .setClientID(new ClientID(clientId))
+ .setIssuer("issuer")
+ .setPrincipal("userPrin")
+ .setSubject("subject")
+ .setIssuedAt(Instant.now())
+ .setExpiresAt(Instant.now().plusSeconds(100))
+ .setAuthenticationTime(Instant.now())
+ .setRedirectURI(new URI("http://example.com"))
+ .setScope(new Scope())
+ .build();
+
rfClaims = new RefreshTokenClaimsSet(acClaims, now, now.plusSeconds(100));
final AuthorizationCode code = new AuthorizationCode(acClaims.serialize(getDataSealer()));
final RefreshToken rfToken = new RefreshToken(rfClaims.serialize(getDataSealer()));
@@ -112,9 +122,18 @@ public class ValidateGrantTest extends BaseOIDCResponseActionTest {
final JSONObject deliveryClaimsUserInfo, final String scope) throws Exception {
final Instant now = Instant.now();
final ValidateGrantTest test = new ValidateGrantTest();
- final AuthorizeCodeClaimsSet.Builder builder = new AuthorizeCodeClaimsSet.Builder(
- new SecureRandomIdentifierGenerationStrategy(), new ClientID(clientId), issuer, userPrincipal, sub,
- now, now.plusSeconds(100), now, new URI(callbackUrl), scope == null ? new Scope() : Scope.parse(scope));
+ final AuthorizeCodeClaimsSet.Builder builder = new AuthorizeCodeClaimsSet.Builder();
+ builder.setJWTID(new SecureRandomIdentifierGenerationStrategy())
+ .setClientID(new ClientID(clientId))
+ .setIssuer(issuer)
+ .setPrincipal(userPrincipal)
+ .setSubject(sub)
+ .setIssuedAt(now)
+ .setExpiresAt(now.plusSeconds(100))
+ .setAuthenticationTime(now)
+ .setRedirectURI(new URI(callbackUrl))
+ .setScope(scope == null ? new Scope() : Scope.parse(scope));
+
if (codeChallenge != null) {
builder.setCodeChallenge(codeChallenge);
}
diff --git a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/ValidatePKCETest.java b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/ValidatePKCETest.java
index 100cc309..84b7e56e 100644
--- a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/ValidatePKCETest.java
+++ b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/ValidatePKCETest.java
@@ -21,10 +21,8 @@ import java.net.URI;
import java.net.URISyntaxException;
import java.time.Instant;
-import net.shibboleth.idp.plugin.oidc.op.profile.impl.ValidatePKCE;
import net.shibboleth.idp.plugin.oidc.op.token.support.AuthorizeCodeClaimsSet;
import net.shibboleth.idp.plugin.oidc.op.token.support.RefreshTokenClaimsSet;
-import net.shibboleth.idp.plugin.oidc.op.token.support.TokenClaimsSet;
import net.shibboleth.idp.profile.testing.ActionTestingSupport;
import net.shibboleth.oidc.profile.config.OIDCAuthorizationConfiguration;
import net.shibboleth.utilities.java.support.component.ComponentInitializationException;
@@ -50,8 +48,10 @@ import com.nimbusds.openid.connect.sdk.claims.ACR;
/** {@link ValidatePKCE} unit test. */
public class ValidatePKCETest extends BaseOIDCResponseActionTest {
+ /** Action. */
private ValidatePKCE action;
+ /** Code verifier. */
private String codeVerifier = "1234567812345678123456781234567812345678123456781234567812345678";
@BeforeMethod
@@ -60,25 +60,33 @@ public class ValidatePKCETest extends BaseOIDCResponseActionTest {
action.initialize();
// We may use mock code as the actions does not access it directly from request. What we need the request for is
// to pass the code verifier value.
- TokenRequest req = new TokenRequest(new URI("https://client.com/callback"), new ClientID(clientId),
+ final TokenRequest req = new TokenRequest(new URI("https://client.com/callback"), new ClientID(clientId),
new AuthorizationCodeGrant(new AuthorizationCode("mockCode"), new URI("https://client.com/callback"),
new CodeVerifier(codeVerifier)));
setTokenRequest(req);
- TokenClaimsSet claims =
- new AuthorizeCodeClaimsSet.Builder(idGenerator, new ClientID(), "issuer", "userPrin", "subject",
- Instant.now(), Instant.now(), Instant.now(), new URI("http://example.com"), new Scope())
- .setACR(new ACR("0"))
- .setCodeChallenge("S256" + CodeChallenge
- .compute(CodeChallengeMethod.S256, new CodeVerifier(codeVerifier)).getValue())
- .build();
- respCtx.setTokenClaimsSet(claims);
+ final AuthorizeCodeClaimsSet claims = new AuthorizeCodeClaimsSet.Builder()
+ .setJWTID(idGenerator)
+ .setClientID(new ClientID())
+ .setIssuer("issuer")
+ .setPrincipal("userPrin")
+ .setSubject("subject")
+ .setIssuedAt(Instant.now())
+ .setExpiresAt(Instant.now())
+ .setAuthenticationTime(Instant.now())
+ .setRedirectURI(new URI("http://example.com"))
+ .setScope(new Scope())
+ .setACR(new ACR("0"))
+ .setCodeChallenge("S256" + CodeChallenge.compute(CodeChallengeMethod.S256,
+ new CodeVerifier(codeVerifier)).getValue())
+ .build();
+ respCtx.setAuthorizationGrantClaimsSet(claims);
}
/**
* Test success case of using "S256".
*/
@Test
- public void testSuccess() throws ComponentInitializationException {
+ public void testSuccess() {
final Event event = action.execute(requestCtx);
ActionTestingSupport.assertProceedEvent(event);
}
@@ -89,8 +97,8 @@ public class ValidatePKCETest extends BaseOIDCResponseActionTest {
* @throws URISyntaxException
*/
@Test
- public void testWrongValue() throws ComponentInitializationException, URISyntaxException {
- TokenRequest req = new TokenRequest(new URI("https://client.com/callback"), new ClientID(clientId),
+ public void testWrongValue() throws URISyntaxException {
+ final TokenRequest req = new TokenRequest(new URI("https://client.com/callback"), new ClientID(clientId),
new AuthorizationCodeGrant(new AuthorizationCode("mockCode"), new URI("https://client.com/callback"),
new CodeVerifier(codeVerifier + "someWrongValue")));
setTokenRequest(req);
@@ -100,96 +108,152 @@ public class ValidatePKCETest extends BaseOIDCResponseActionTest {
/**
* Test fail case of using "plain" as it is not allowed by default.
+ *
+ * @throws URISyntaxException
*/
@Test
- public void testFailPlainNotAllowed() throws ComponentInitializationException, URISyntaxException {
- TokenClaimsSet claims =
- new AuthorizeCodeClaimsSet.Builder(idGenerator, new ClientID(), "issuer", "userPrin", "subject",
- Instant.now(), Instant.now(), Instant.now(), new URI("http://example.com"), new Scope())
- .setACR(new ACR("0"))
- .setCodeChallenge("plain" + CodeChallenge
- .compute(CodeChallengeMethod.PLAIN, new CodeVerifier(codeVerifier)).getValue())
- .build();
- respCtx.setTokenClaimsSet(claims);
+ public void testFailPlainNotAllowed() throws URISyntaxException {
+ final AuthorizeCodeClaimsSet claims = new AuthorizeCodeClaimsSet.Builder()
+ .setJWTID(idGenerator)
+ .setClientID(new ClientID())
+ .setIssuer("issuer")
+ .setPrincipal("userPrin")
+ .setSubject("subject")
+ .setIssuedAt(Instant.now())
+ .setExpiresAt(Instant.now())
+ .setAuthenticationTime(Instant.now())
+ .setRedirectURI(new URI("http://example.com"))
+ .setScope(new Scope())
+ .setACR(new ACR("0"))
+ .setCodeChallenge("plain" + CodeChallenge.compute(CodeChallengeMethod.PLAIN,
+ new CodeVerifier(codeVerifier)).getValue())
+ .build();
+ respCtx.setAuthorizationGrantClaimsSet(claims);
final Event event = action.execute(requestCtx);
ActionTestingSupport.assertEvent(event, EventIds.INVALID_MESSAGE);
}
/**
* Test success case of using "plain".
+ *
+ * @throws URISyntaxException
*/
@Test
- public void testSuccessPlain() throws ComponentInitializationException, URISyntaxException {
+ public void testSuccessPlain() throws URISyntaxException {
((OIDCAuthorizationConfiguration) rpCtx.getProfileConfig()).setAllowPKCEPlain(true);
- TokenClaimsSet claims =
- new AuthorizeCodeClaimsSet.Builder(idGenerator, new ClientID(), "issuer", "userPrin", "subject",
- Instant.now(), Instant.now(), Instant.now(), new URI("http://example.com"), new Scope())
- .setACR(new ACR("0"))
- .setCodeChallenge("plain" + CodeChallenge
- .compute(CodeChallengeMethod.PLAIN, new CodeVerifier(codeVerifier)).getValue())
- .build();
- respCtx.setTokenClaimsSet(claims);
+ final AuthorizeCodeClaimsSet claims = new AuthorizeCodeClaimsSet.Builder()
+ .setJWTID(idGenerator)
+ .setClientID(new ClientID())
+ .setIssuer("issuer")
+ .setPrincipal("userPrin")
+ .setSubject("subject")
+ .setIssuedAt(Instant.now())
+ .setExpiresAt(Instant.now())
+ .setAuthenticationTime(Instant.now())
+ .setRedirectURI(new URI("http://example.com"))
+ .setScope(new Scope())
+ .setACR(new ACR("0"))
+ .setCodeChallenge("plain" + CodeChallenge.compute(CodeChallengeMethod.PLAIN,
+ new CodeVerifier(codeVerifier)).getValue())
+ .build();
+ respCtx.setAuthorizationGrantClaimsSet(claims);
final Event event = action.execute(requestCtx);
ActionTestingSupport.assertProceedEvent(event);
}
/**
* Test fail case of using "plain" with wrong value.
+ *
+ * @throws URISyntaxException
*/
@Test
- public void testFailPlain() throws ComponentInitializationException, URISyntaxException {
+ public void testFailPlain() throws URISyntaxException {
((OIDCAuthorizationConfiguration) rpCtx.getProfileConfig()).setAllowPKCEPlain(true);
- TokenClaimsSet claims = new AuthorizeCodeClaimsSet.Builder(idGenerator, new ClientID(), "issuer", "userPrin",
- "subject", Instant.now(), Instant.now(), Instant.now(), new URI("http://example.com"), new Scope())
- .setACR(new ACR("0"))
- .setCodeChallenge("plain" + CodeChallenge
- .compute(CodeChallengeMethod.PLAIN, new CodeVerifier(codeVerifier + "someWrongvalue"))
- .getValue())
- .build();
- respCtx.setTokenClaimsSet(claims);
+ final AuthorizeCodeClaimsSet claims = new AuthorizeCodeClaimsSet.Builder()
+ .setJWTID(idGenerator)
+ .setClientID(new ClientID())
+ .setIssuer("issuer")
+ .setPrincipal("userPrin")
+ .setSubject("subject")
+ .setIssuedAt(Instant.now())
+ .setExpiresAt(Instant.now())
+ .setAuthenticationTime(Instant.now())
+ .setRedirectURI(new URI("http://example.com"))
+ .setScope(new Scope())
+ .setACR(new ACR("0"))
+ .setCodeChallenge("plain" + CodeChallenge.compute(CodeChallengeMethod.PLAIN,
+ new CodeVerifier(codeVerifier + "someWrongvalue")).getValue())
+ .build();
+ respCtx.setAuthorizationGrantClaimsSet(claims);
final Event event = action.execute(requestCtx);
ActionTestingSupport.assertEvent(event, EventIds.MESSAGE_AUTHN_ERROR);
}
/**
* Test success in the case of not having forced PKCE and not using the PKCE parameters.
+ *
+ * @throws URISyntaxException
*/
@Test
- public void testSuccessNoPKCE() throws ComponentInitializationException, URISyntaxException {
- TokenRequest req = new TokenRequest(new URI("https://client.com/callback"), new ClientID(clientId),
+ public void testSuccessNoPKCE() throws URISyntaxException {
+ final TokenRequest req = new TokenRequest(new URI("https://client.com/callback"), new ClientID(clientId),
new AuthorizationCodeGrant(new AuthorizationCode("mockCode"), new URI("https://client.com/callback")));
setTokenRequest(req);
- TokenClaimsSet claims = new AuthorizeCodeClaimsSet.Builder(idGenerator, new ClientID(), "issuer", "userPrin",
- "subject", Instant.now(), Instant.now(), Instant.now(), new URI("http://example.com"), new Scope())
- .setACR(new ACR("0")).build();
- respCtx.setTokenClaimsSet(claims);
+ final AuthorizeCodeClaimsSet claims = new AuthorizeCodeClaimsSet.Builder()
+ .setJWTID(idGenerator)
+ .setClientID(new ClientID())
+ .setIssuer("issuer")
+ .setPrincipal("userPrin")
+ .setSubject("subject")
+ .setIssuedAt(Instant.now())
+ .setExpiresAt(Instant.now())
+ .setAuthenticationTime(Instant.now())
+ .setRedirectURI(new URI("http://example.com"))
+ .setScope(new Scope())
+ .setACR(new ACR("0"))
+ .build();
+ respCtx.setAuthorizationGrantClaimsSet(claims);
final Event event = action.execute(requestCtx);
ActionTestingSupport.assertProceedEvent(event);
}
/**
* Test failure in the case of having forced PKCE and not using the PKCE parameters.
+ *
+ * @throws URISyntaxException
*/
@Test
- public void testFailureNoPKCE() throws ComponentInitializationException, URISyntaxException {
+ public void testFailureNoPKCE() throws URISyntaxException {
((OIDCAuthorizationConfiguration) rpCtx.getProfileConfig()).setForcePKCE(true);
- TokenRequest req = new TokenRequest(new URI("https://client.com/callback"), new ClientID(clientId),
+ final TokenRequest req = new TokenRequest(new URI("https://client.com/callback"), new ClientID(clientId),
new AuthorizationCodeGrant(new AuthorizationCode("mockCode"), new URI("https://client.com/callback")));
setTokenRequest(req);
- TokenClaimsSet claims = new AuthorizeCodeClaimsSet.Builder(idGenerator, new ClientID(), "issuer", "userPrin",
- "subject", Instant.now(), Instant.now(), Instant.now(), new URI("http://example.com"), new Scope())
- .setACR(new ACR("0")).build();
- respCtx.setTokenClaimsSet(claims);
+ final AuthorizeCodeClaimsSet claims = new AuthorizeCodeClaimsSet.Builder()
+ .setJWTID(idGenerator)
+ .setClientID(new ClientID())
+ .setIssuer("issuer")
+ .setPrincipal("userPrin")
+ .setSubject("subject")
+ .setIssuedAt(Instant.now())
+ .setExpiresAt(Instant.now())
+ .setAuthenticationTime(Instant.now())
+ .setRedirectURI(new URI("http://example.com"))
+ .setScope(new Scope())
+ .setACR(new ACR("0"))
+ .build();
+ respCtx.setAuthorizationGrantClaimsSet(claims);
final Event event = action.execute(requestCtx);
ActionTestingSupport.assertEvent(event, EventIds.INVALID_MESSAGE);
}
/**
* Test failure in the case of missing code verifier in token request.
+ *
+ * @throws URISyntaxException
*/
@Test
- public void testFailureTokenRequestMissingVerfier() throws ComponentInitializationException, URISyntaxException {
- TokenRequest req = new TokenRequest(new URI("https://client.com/callback"), new ClientID(clientId),
+ public void testFailureTokenRequestMissingVerfier() throws URISyntaxException {
+ final TokenRequest req = new TokenRequest(new URI("https://client.com/callback"), new ClientID(clientId),
new AuthorizationCodeGrant(new AuthorizationCode("mockCode"), new URI("https://client.com/callback")));
setTokenRequest(req);
final Event event = action.execute(requestCtx);
@@ -199,19 +263,31 @@ public class ValidatePKCETest extends BaseOIDCResponseActionTest {
/**
* Test success in the case of having forced PKCE, not using the PKCE parameters but different grant type than Authz
* Code.
+ *
+ * @throws URISyntaxException
*/
@Test
- public void testSuccessNoAuthzCode() throws ComponentInitializationException, URISyntaxException {
+ public void testSuccessNoAuthzCode() throws URISyntaxException {
((OIDCAuthorizationConfiguration) rpCtx.getProfileConfig()).setForcePKCE(true);
- TokenRequest req = new TokenRequest(new URI("https://client.com/callback"), new ClientID(clientId),
+ final TokenRequest req = new TokenRequest(new URI("https://client.com/callback"), new ClientID(clientId),
new RefreshTokenGrant(new RefreshToken()));
setTokenRequest(req);
- TokenClaimsSet claims = new RefreshTokenClaimsSet(
- new AuthorizeCodeClaimsSet.Builder(idGenerator, new ClientID(), "issuer", "userPrin", "subject",
- Instant.now(), Instant.now(), Instant.now(), new URI("http://example.com"), new Scope())
- .setACR(new ACR("0")).build(),
- Instant.now(), Instant.now());
- respCtx.setTokenClaimsSet(claims);
+ final RefreshTokenClaimsSet claims = new RefreshTokenClaimsSet(
+ new AuthorizeCodeClaimsSet.Builder()
+ .setJWTID(idGenerator)
+ .setClientID(new ClientID())
+ .setIssuer("issuer")
+ .setPrincipal("userPrin")
+ .setSubject("subject")
+ .setIssuedAt(Instant.now())
+ .setExpiresAt(Instant.now())
+ .setAuthenticationTime(Instant.now())
+ .setRedirectURI(new URI("http://example.com"))
+ .setScope(new Scope())
+ .setACR(new ACR("0"))
+ .build(),
+ Instant.now(), Instant.now());
+ respCtx.setAuthorizationGrantClaimsSet(claims);
final Event event = action.execute(requestCtx);
ActionTestingSupport.assertProceedEvent(event);
}
@@ -222,15 +298,23 @@ public class ValidatePKCETest extends BaseOIDCResponseActionTest {
* @throws URISyntaxException
*/
@Test
- public void testFailUnknownType() throws ComponentInitializationException, URISyntaxException {
- TokenClaimsSet claims =
- new AuthorizeCodeClaimsSet.Builder(idGenerator, new ClientID(), "issuer", "userPrin", "subject",
- Instant.now(), Instant.now(), Instant.now(), new URI("http://example.com"), new Scope())
- .setACR(new ACR("0"))
- .setCodeChallenge("not_S256" + CodeChallenge
- .compute(CodeChallengeMethod.S256, new CodeVerifier(codeVerifier)).getValue())
- .build();
- respCtx.setTokenClaimsSet(claims);
+ public void testFailUnknownType() throws URISyntaxException {
+ final AuthorizeCodeClaimsSet claims = new AuthorizeCodeClaimsSet.Builder()
+ .setJWTID(idGenerator)
+ .setClientID(new ClientID())
+ .setIssuer("issuer")
+ .setPrincipal("userPrin")
+ .setSubject("subject")
+ .setIssuedAt(Instant.now())
+ .setExpiresAt(Instant.now())
+ .setAuthenticationTime(Instant.now())
+ .setRedirectURI(new URI("http://example.com"))
+ .setScope(new Scope())
+ .setACR(new ACR("0"))
+ .setCodeChallenge("not_S256" + CodeChallenge.compute(CodeChallengeMethod.S256,
+ new CodeVerifier(codeVerifier)).getValue())
+ .build();
+ respCtx.setAuthorizationGrantClaimsSet(claims);
final Event event = action.execute(requestCtx);
ActionTestingSupport.assertEvent(event, EventIds.INVALID_MESSAGE);
}
diff --git a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/ValidateScopeTest.java b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/ValidateScopeTest.java
index 29d23edc..301245ed 100644
--- a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/ValidateScopeTest.java
+++ b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/ValidateScopeTest.java
@@ -25,7 +25,6 @@ import net.shibboleth.idp.plugin.oidc.op.messaging.context.OIDCAuthenticationRes
import net.shibboleth.idp.plugin.oidc.op.messaging.context.OIDCMetadataContext;
import net.shibboleth.idp.plugin.oidc.op.profile.context.navigate.TokenRequestScopeLookupFunction;
import net.shibboleth.idp.plugin.oidc.op.token.support.AuthorizeCodeClaimsSet;
-import net.shibboleth.idp.plugin.oidc.op.token.support.TokenClaimsSet;
import net.shibboleth.idp.profile.testing.ActionTestingSupport;
import net.shibboleth.utilities.java.support.component.ComponentInitializationException;
@@ -176,10 +175,19 @@ public class ValidateScopeTest extends BaseOIDCResponseActionTest {
Scope.parse("openid email profile offline_access"));
setTokenRequest(req);
- final TokenClaimsSet claims =
- new AuthorizeCodeClaimsSet.Builder(idGenerator, new ClientID("s6BhdRkqt3"), "issuer", "userPrin",
- "subject", Instant.now(), Instant.now(), Instant.now(), new URI("http://localhost"),
- new Scope()).setACR(new ACR("0")).build();
+ final AuthorizeCodeClaimsSet claims = new AuthorizeCodeClaimsSet.Builder()
+ .setJWTID(idGenerator)
+ .setClientID(new ClientID("s6BhdRkqt3"))
+ .setIssuer("issuer")
+ .setPrincipal("userPrin")
+ .setSubject("subject")
+ .setIssuedAt(Instant.now())
+ .setExpiresAt(Instant.now())
+ .setAuthenticationTime(Instant.now())
+ .setRedirectURI(new URI("http://localhost"))
+ .setScope(new Scope())
+ .setACR(new ACR("0"))
+ .build();
respCtx.setAuthorizationGrantClaimsSet(claims);
final Event event = action.execute(requestCtx);
@@ -210,10 +218,19 @@ public class ValidateScopeTest extends BaseOIDCResponseActionTest {
Scope.parse("openid email profile offline_access"));
setTokenRequest(req);
- final TokenClaimsSet claims =
- new AuthorizeCodeClaimsSet.Builder(idGenerator, new ClientID("s6BhdRkqt3"), "issuer", "userPrin",
- "subject", Instant.now(), Instant.now(), Instant.now(), new URI("http://localhost"),
- Scope.parse("openid email")).setACR(new ACR("0")).build();
+ final AuthorizeCodeClaimsSet claims = new AuthorizeCodeClaimsSet.Builder()
+ .setJWTID(idGenerator)
+ .setClientID(new ClientID("s6BhdRkqt3"))
+ .setIssuer("issuer")
+ .setPrincipal("userPrin")
+ .setSubject("subject")
+ .setIssuedAt(Instant.now())
+ .setExpiresAt(Instant.now())
+ .setAuthenticationTime(Instant.now())
+ .setRedirectURI(new URI("http://localhost"))
+ .setScope(Scope.parse("openid email"))
+ .setACR(new ACR("0"))
+ .build();
respCtx.setAuthorizationGrantClaimsSet(claims);
final Event event = action.execute(requestCtx);
@@ -248,10 +265,19 @@ public class ValidateScopeTest extends BaseOIDCResponseActionTest {
new UserInfoRequest(new URI("http://localhost"), Method.POST, new BearerAccessToken());
setUserInfoRequest(req);
- final TokenClaimsSet claims =
- new AuthorizeCodeClaimsSet.Builder(idGenerator, new ClientID("s6BhdRkqt3"), "issuer", "userPrin",
- "subject", Instant.now(), Instant.now(), Instant.now(), new URI("http://localhost"),
- Scope.parse("openid email")).setACR(new ACR("0")).build();
+ final AuthorizeCodeClaimsSet claims = new AuthorizeCodeClaimsSet.Builder()
+ .setJWTID(idGenerator)
+ .setClientID(new ClientID("s6BhdRkqt3"))
+ .setIssuer("issuer")
+ .setPrincipal("userPrin")
+ .setSubject("subject")
+ .setIssuedAt(Instant.now())
+ .setExpiresAt(Instant.now())
+ .setAuthenticationTime(Instant.now())
+ .setRedirectURI(new URI("http://localhost"))
+ .setScope(Scope.parse("openid email"))
+ .setACR(new ACR("0"))
+ .build();
respCtx.setAuthorizationGrantClaimsSet(claims);
final Event event = action.execute(requestCtx);
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list