[java-idp-oidc] branch main updated: Relocate UserInfo-specific impl code and add access tok audience check.
Scott Cantor
cantor.2 at osu.edu
Thu Jan 20 20:22:54 UTC 2022
This is an automated email from the git hooks/post-receive script.
scantor pushed a commit to branch main
in repository java-idp-oidc.
View the commit online:
http://git.shibboleth.net/view/?p=java-idp-oidc.git;a=commit;h=f9374e527199950b2d20502e06e2d6298ecf7b23
The following commit(s) were added to refs/heads/main by this push:
new f9374e52 Relocate UserInfo-specific impl code and add access tok audience check.
f9374e52 is described below
commit f9374e527199950b2d20502e06e2d6298ecf7b23
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Thu Jan 20 15:22:51 2022 -0500
Relocate UserInfo-specific impl code and add access tok audience check.
---
.../oidc/op/token/support/TokenClaimsSet.java | 8 ++--
.../impl/AbstractOIDCUserInfoRequestAction.java | 4 +-
.../impl/AbstractOIDCUserInfoResponseAction.java | 2 +-
...stractOIDCUserInfoValidationResponseAction.java | 2 +-
.../profile/impl/AddUserInfoShell.java | 31 +++++++++++--
.../profile/impl/ValidateAccessToken.java | 45 ++++++++++++-------
.../profile/impl/package-info.java} | 23 +---------
.../idp/flows/oidc/userinfo/userinfo-beans.xml | 15 +++----
.../plugin/oidc/op/profile/flow/UserInfoTest.java | 7 +--
.../profile/impl/BaseOIDCResponseActionTest.java | 2 +-
.../AbstractOIDCUserInfoResponseActionTest.java | 4 +-
.../profile/impl/AddUserInfoShellTest.java | 5 ++-
.../profile/impl/ValidateAccessTokenTest.java | 52 +++++++++++++++++++---
13 files changed, 126 insertions(+), 74 deletions(-)
diff --git a/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/token/support/TokenClaimsSet.java b/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/token/support/TokenClaimsSet.java
index acad0887..0c3b1790 100644
--- a/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/token/support/TokenClaimsSet.java
+++ b/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/token/support/TokenClaimsSet.java
@@ -552,9 +552,9 @@ public class TokenClaimsSet {
}
/**
- * Get scope of the token request.
+ * Get scope of the token.
*
- * @return scope of the token request.
+ * @return scope of the token
*/
@Nullable public Scope getScope() {
Constraint.isNotNull(tokenClaimsSet, "JWTClaimsSet cannot be null");
@@ -568,9 +568,9 @@ public class TokenClaimsSet {
}
/**
- * Get audience of the token request.
+ * Get audience of the token.
*
- * @return audience of the token request
+ * @return audience of the token
*
* @since 3.1.0
*/
diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/AbstractOIDCUserInfoRequestAction.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/userinfo/profile/impl/AbstractOIDCUserInfoRequestAction.java
similarity index 91%
copy from idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/AbstractOIDCUserInfoRequestAction.java
copy to idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/userinfo/profile/impl/AbstractOIDCUserInfoRequestAction.java
index 7bcc7938..2fc88b30 100644
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/AbstractOIDCUserInfoRequestAction.java
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/userinfo/profile/impl/AbstractOIDCUserInfoRequestAction.java
@@ -15,13 +15,15 @@
* limitations under the License.
*/
-package net.shibboleth.idp.plugin.oidc.op.profile.impl;
+package net.shibboleth.idp.plugin.oidc.op.userinfo.profile.impl;
import org.opensaml.messaging.context.MessageContext;
import org.opensaml.profile.context.ProfileRequestContext;
import com.nimbusds.openid.connect.sdk.UserInfoRequest;
+import net.shibboleth.idp.plugin.oidc.op.profile.impl.AbstractOIDCRequestAction;
+
/**
* Abstract class for actions performing actions on {@link UserInfoRequest} found via
* {@link ProfileRequestContext#getInboundMessageContext()} and {@link MessageContext#getMessage()}.
diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/AbstractOIDCUserInfoResponseAction.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/userinfo/profile/impl/AbstractOIDCUserInfoResponseAction.java
similarity index 97%
rename from idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/AbstractOIDCUserInfoResponseAction.java
rename to idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/userinfo/profile/impl/AbstractOIDCUserInfoResponseAction.java
index 8c4c62ab..0a3d8989 100644
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/AbstractOIDCUserInfoResponseAction.java
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/userinfo/profile/impl/AbstractOIDCUserInfoResponseAction.java
@@ -15,7 +15,7 @@
* limitations under the License.
*/
-package net.shibboleth.idp.plugin.oidc.op.profile.impl;
+package net.shibboleth.idp.plugin.oidc.op.userinfo.profile.impl;
import javax.annotation.Nonnull;
diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/AbstractOIDCUserInfoValidationResponseAction.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/userinfo/profile/impl/AbstractOIDCUserInfoValidationResponseAction.java
similarity index 97%
rename from idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/AbstractOIDCUserInfoValidationResponseAction.java
rename to idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/userinfo/profile/impl/AbstractOIDCUserInfoValidationResponseAction.java
index d68b1e46..6a85531a 100644
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/AbstractOIDCUserInfoValidationResponseAction.java
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/userinfo/profile/impl/AbstractOIDCUserInfoValidationResponseAction.java
@@ -15,7 +15,7 @@
* limitations under the License.
*/
-package net.shibboleth.idp.plugin.oidc.op.profile.impl;
+package net.shibboleth.idp.plugin.oidc.op.userinfo.profile.impl;
import javax.annotation.Nonnull;
diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/AddUserInfoShell.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/userinfo/profile/impl/AddUserInfoShell.java
similarity index 84%
rename from idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/AddUserInfoShell.java
rename to idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/userinfo/profile/impl/AddUserInfoShell.java
index ff003a7b..5a0fede3 100644
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/AddUserInfoShell.java
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/userinfo/profile/impl/AddUserInfoShell.java
@@ -15,7 +15,7 @@
* limitations under the License.
*/
-package net.shibboleth.idp.plugin.oidc.op.profile.impl;
+package net.shibboleth.idp.plugin.oidc.op.userinfo.profile.impl;
import java.util.function.Function;
@@ -24,8 +24,11 @@ import javax.annotation.Nullable;
import net.shibboleth.idp.plugin.oidc.op.messaging.context.OIDCAuthenticationResponseContext;
import net.shibboleth.idp.plugin.oidc.op.profile.context.navigate.DefaultUserInfoSigningAlgLookupFunction;
+import net.shibboleth.idp.plugin.oidc.op.profile.impl.AbstractOIDCResponseAction;
import net.shibboleth.idp.profile.IdPEventIds;
import net.shibboleth.idp.profile.context.RelyingPartyContext;
+import net.shibboleth.utilities.java.support.annotation.constraint.NonnullAfterInit;
+import net.shibboleth.utilities.java.support.component.ComponentInitializationException;
import net.shibboleth.utilities.java.support.component.ComponentSupport;
import net.shibboleth.utilities.java.support.logic.Constraint;
@@ -53,8 +56,7 @@ public class AddUserInfoShell extends AbstractOIDCResponseAction {
private Logger log = LoggerFactory.getLogger(AddUserInfoShell.class);
/** Strategy used to obtain the response issuer value. */
- @Nonnull
- private Function<ProfileRequestContext, String> issuerLookupStrategy;
+ @NonnullAfterInit private Function<ProfileRequestContext,String> issuerLookupStrategy;
/** OP ID to populate into Issuer element. */
@Nonnull
@@ -118,18 +120,39 @@ public class AddUserInfoShell extends AbstractOIDCResponseAction {
issuerLookupStrategy = Constraint.isNotNull(strategy, "IssuerLookupStrategy lookup strategy cannot be null");
}
+ /** {@inheritDoc} */
+ @Override
+ protected void doInitialize() throws ComponentInitializationException {
+ super.doInitialize();
+
+ if (issuerLookupStrategy == null) {
+ throw new ComponentInitializationException("Issuer lookup strategy cannot be null");
+ }
+ }
+
/** {@inheritDoc} */
@Override
protected boolean doPreExecute(@Nonnull final ProfileRequestContext profileRequestContext) {
+ if (!super.doPreExecute(profileRequestContext)) {
+ return false;
+ }
+
rpCtx = relyingPartyContextLookupStrategy.apply(profileRequestContext);
if (rpCtx == null) {
log.debug("{} No relying party context associated with this profile request", getLogPrefix());
ActionSupport.buildEvent(profileRequestContext, IdPEventIds.INVALID_RELYING_PARTY_CTX);
return false;
}
+
issuerId = issuerLookupStrategy.apply(profileRequestContext);
- return super.doPreExecute(profileRequestContext);
+ if (issuerId == null) {
+ log.error("{} Unable to determine issuer to check audience", getLogPrefix());
+ ActionSupport.buildEvent(profileRequestContext, IdPEventIds.INVALID_PROFILE_CONFIG);
+ return false;
+ }
+
+ return true;
}
/** {@inheritDoc} */
diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/ValidateAccessToken.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/userinfo/profile/impl/ValidateAccessToken.java
similarity index 77%
rename from idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/ValidateAccessToken.java
rename to idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/userinfo/profile/impl/ValidateAccessToken.java
index d9157438..a72cf6f3 100644
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/ValidateAccessToken.java
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/userinfo/profile/impl/ValidateAccessToken.java
@@ -15,9 +15,10 @@
* limitations under the License.
*/
-package net.shibboleth.idp.plugin.oidc.op.profile.impl;
+package net.shibboleth.idp.plugin.oidc.op.userinfo.profile.impl;
import java.text.ParseException;
+
import javax.annotation.Nonnull;
import org.opensaml.profile.action.ActionSupport;
@@ -30,7 +31,6 @@ import net.shibboleth.idp.plugin.oidc.op.profile.OidcEventIds;
import net.shibboleth.idp.plugin.oidc.op.storage.RevocationCache;
import net.shibboleth.idp.plugin.oidc.op.storage.RevocationCacheContexts;
import net.shibboleth.idp.plugin.oidc.op.token.support.AccessTokenClaimsSet;
-import net.shibboleth.utilities.java.support.annotation.ParameterName;
import net.shibboleth.utilities.java.support.annotation.constraint.NonnullAfterInit;
import net.shibboleth.utilities.java.support.component.ComponentInitializationException;
import net.shibboleth.utilities.java.support.component.ComponentSupport;
@@ -49,24 +49,25 @@ public class ValidateAccessToken extends AbstractOIDCUserInfoValidationResponseA
@Nonnull private Logger log = LoggerFactory.getLogger(ValidateAccessToken.class);
/** Data sealer for unwrapping authorization code. */
- @Nonnull private final DataSealer dataSealer;
+ @NonnullAfterInit private DataSealer dataSealer;
/** Message revocation cache instance to use. */
@NonnullAfterInit private RevocationCache revocationCache;
-
+
/**
- * Constructor.
+ * Set the data sealer instance to use.
*
- * @param sealer sealer to decrypt/hmac access token.
+ * @param sealer sealer to use
*/
- public ValidateAccessToken(@Nonnull @ParameterName(name = "sealer") final DataSealer sealer) {
+ public void setDataSealer(@Nonnull final DataSealer sealer) {
+ ComponentSupport.ifInitializedThrowUnmodifiabledComponentException(this);
dataSealer = Constraint.isNotNull(sealer, "DataSealer cannot be null");
}
-
+
/**
* Set the revocation cache instance to use.
*
- * @param cache The revocationCache to set.
+ * @param cache revocation cache to set
*/
public void setRevocationCache(@Nonnull final RevocationCache cache) {
ComponentSupport.ifInitializedThrowUnmodifiabledComponentException(this);
@@ -78,36 +79,46 @@ public class ValidateAccessToken extends AbstractOIDCUserInfoValidationResponseA
protected void doInitialize() throws ComponentInitializationException {
super.doInitialize();
- if (revocationCache == null) {
- throw new ComponentInitializationException("RevocationCache cannot be null");
+ if (revocationCache == null || dataSealer == null) {
+ throw new ComponentInitializationException("RevocationCache and DataSealer cannot be null");
}
}
-
+
/** {@inheritDoc} */
@Override
protected void doExecute(@Nonnull final ProfileRequestContext profileRequestContext) {
+
final AccessTokenClaimsSet accessTokenClaimsSet;
try {
accessTokenClaimsSet =
AccessTokenClaimsSet.parse(getUserInfoRequest().getAccessToken().getValue(), dataSealer);
- log.debug("{} access token unwrapped {}", getLogPrefix(), accessTokenClaimsSet.serialize());
+ log.debug("{} Access token unwrapped: {}", getLogPrefix(), accessTokenClaimsSet.serialize());
} catch (final DataSealerException | ParseException e) {
- log.error("{} Obtaining access token failed {}", getLogPrefix(), e.getMessage());
+ log.warn("{} Parsing access token failed: {}", getLogPrefix(), e.getMessage());
ActionSupport.buildEvent(profileRequestContext, OidcEventIds.INVALID_GRANT);
return;
}
+
if (!accessTokenClaimsSet.isTimeValid()) {
- log.error("{} access token is expired or future dated {}", getLogPrefix(), accessTokenClaimsSet.getExp());
+ log.warn("{} Access token is expired or future dated", getLogPrefix());
ActionSupport.buildEvent(profileRequestContext, OidcEventIds.INVALID_GRANT);
return;
}
+
+ if (!accessTokenClaimsSet.getAudience().isEmpty()) {
+ log.warn("{} Access token was not issued for use by this OP");
+ ActionSupport.buildEvent(profileRequestContext, OidcEventIds.INVALID_GRANT);
+ return;
+ }
+
if (revocationCache.isRevoked(RevocationCacheContexts.AUTHORIZATION_CODE, accessTokenClaimsSet.getID())) {
- log.error("{} authorize code {} and all derived tokens have been revoked", getLogPrefix(),
+ log.warn("{} Authorization code {} and all derived tokens have been revoked", getLogPrefix(),
accessTokenClaimsSet.getID());
ActionSupport.buildEvent(profileRequestContext, OidcEventIds.INVALID_GRANT);
return;
}
- log.debug("{} access token {} validated", getLogPrefix(), accessTokenClaimsSet.getID());
+
+ log.debug("{} Access token {} validated", getLogPrefix(), accessTokenClaimsSet.getID());
getOidcResponseContext().setAuthorizationGrantClaimsSet(accessTokenClaimsSet);
}
diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/AbstractOIDCUserInfoRequestAction.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/userinfo/profile/impl/package-info.java
similarity index 54%
rename from idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/AbstractOIDCUserInfoRequestAction.java
rename to idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/userinfo/profile/impl/package-info.java
index 7bcc7938..dc8359c0 100644
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/AbstractOIDCUserInfoRequestAction.java
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/userinfo/profile/impl/package-info.java
@@ -15,26 +15,7 @@
* limitations under the License.
*/
-package net.shibboleth.idp.plugin.oidc.op.profile.impl;
-
-import org.opensaml.messaging.context.MessageContext;
-import org.opensaml.profile.context.ProfileRequestContext;
-
-import com.nimbusds.openid.connect.sdk.UserInfoRequest;
-
/**
- * Abstract class for actions performing actions on {@link UserInfoRequest} found via
- * {@link ProfileRequestContext#getInboundMessageContext()} and {@link MessageContext#getMessage()}.
+ * Classes supporting the implementation of the UserInfo endpoint.
*/
-public abstract class AbstractOIDCUserInfoRequestAction extends AbstractOIDCRequestAction<UserInfoRequest> {
-
- /**
- * Returns OIDC user info request.
- *
- * @return request
- */
- public UserInfoRequest getUserInfoRequest() {
- return getRequest();
- }
-
-}
+package net.shibboleth.idp.plugin.oidc.op.userinfo.profile.impl;
\ No newline at end of file
diff --git a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/userinfo/userinfo-beans.xml b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/userinfo/userinfo-beans.xml
index e9c95406..ffe6b9b5 100644
--- a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/userinfo/userinfo-beans.xml
+++ b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/userinfo/userinfo-beans.xml
@@ -22,8 +22,8 @@
scope="prototype" />
<bean id="ValidateAccessToken"
- class="net.shibboleth.idp.plugin.oidc.op.profile.impl.ValidateAccessToken" scope="prototype"
- c:sealer-ref="#{'%{idp.oidc.tokenSealer:shibboleth.oidc.TokenSealer}'.trim()}"
+ class="net.shibboleth.idp.plugin.oidc.op.userinfo.profile.impl.ValidateAccessToken" scope="prototype"
+ p:dataSealer-ref="#{'%{idp.oidc.tokenSealer:shibboleth.oidc.TokenSealer}'.trim()}"
p:revocationCache-ref="shibboleth.RevocationCache" />
<bean id="shibboleth.ClientIDLookupStrategy"
@@ -94,7 +94,7 @@
<bean id="SetSubjectToResponseContext"
class="net.shibboleth.idp.plugin.oidc.op.profile.impl.SetSubjectToResponseContext" scope="prototype" />
- <bean id="AddUserInfoShell" class="net.shibboleth.idp.plugin.oidc.op.profile.impl.AddUserInfoShell" scope="prototype"
+ <bean id="AddUserInfoShell" class="net.shibboleth.idp.plugin.oidc.op.userinfo.profile.impl.AddUserInfoShell" scope="prototype"
p:issuerLookupStrategy-ref="shibboleth.ResponderIdLookup.Simple" />
<bean id="AddAttributeClaimsToUserInfo"
@@ -127,16 +127,11 @@
<bean id="BuildErrorResponseFromEvent"
class="net.shibboleth.idp.plugin.oidc.op.profile.impl.BuildUserInfoErrorResponseFromEvent" scope="prototype"
- p:httpServletResponse-ref="shibboleth.HttpServletResponse">
+ p:httpServletResponse-ref="shibboleth.HttpServletResponse"
+ p:mappedErrors-ref="shibboleth.oidc.ErrorMappings">
<property name="eventContextLookupStrategy">
<bean class="net.shibboleth.idp.profile.context.navigate.WebFlowCurrentEventLookupFunction" />
</property>
- <property name="mappedErrors">
- <map value-type="com.nimbusds.oauth2.sdk.ErrorObject">
- <entry key="#{T(net.shibboleth.idp.plugin.oidc.op.profile.OidcEventIds).INVALID_GRANT}"
- value="#{T(com.nimbusds.oauth2.sdk.OAuth2Error).INVALID_GRANT}" />
- </map>
- </property>
</bean>
</beans>
diff --git a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/UserInfoTest.java b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/UserInfoTest.java
index 41dc6206..cbdc9d0d 100644
--- a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/UserInfoTest.java
+++ b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/UserInfoTest.java
@@ -34,6 +34,7 @@ import com.nimbusds.jose.JWSAlgorithm;
import com.nimbusds.jwt.JWT;
import com.nimbusds.jwt.JWTClaimsSet;
import com.nimbusds.jwt.SignedJWT;
+import com.nimbusds.oauth2.sdk.OAuth2Error;
import com.nimbusds.oauth2.sdk.Scope;
import com.nimbusds.oauth2.sdk.auth.ClientAuthenticationMethod;
import com.nimbusds.oauth2.sdk.token.BearerAccessToken;
@@ -74,7 +75,7 @@ public class UserInfoTest extends AbstractOidcApiFlowTest {
@Test
public void testNoAccessToken() {
final FlowExecutionResult result = flowExecutor.launchExecution(FLOW_ID, null, externalContext);
- assertErrorCode(result, "invalid_request");
+ assertErrorCode(result, OAuth2Error.INVALID_REQUEST_CODE);
assertErrorDescriptionContains(result, "UnableToDecode");
}
@@ -82,7 +83,7 @@ public class UserInfoTest extends AbstractOidcApiFlowTest {
public void testUnparseableAccessToken() {
request.addHeader("Authorization", "Bearer mockAccessToken");
final FlowExecutionResult result = flowExecutor.launchExecution(FLOW_ID, null, externalContext);
- assertErrorCode(result, "invalid_grant");
+ assertErrorCode(result, OAuth2Error.INVALID_GRANT_CODE);
}
@Test
@@ -91,7 +92,7 @@ public class UserInfoTest extends AbstractOidcApiFlowTest {
final BearerAccessToken token = buildToken(idGenerator.generateIdentifier(), subject, new Scope());
request.addHeader("Authorization", token.toAuthorizationHeader());
final FlowExecutionResult result = flowExecutor.launchExecution(FLOW_ID, null, externalContext);
- assertErrorCode(result, "invalid_request");
+ assertErrorCode(result, OAuth2Error.UNAUTHORIZED_CLIENT_CODE);
}
@Test
diff --git a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/BaseOIDCResponseActionTest.java b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/BaseOIDCResponseActionTest.java
index 9d4e2109..a77c2325 100644
--- a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/BaseOIDCResponseActionTest.java
+++ b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/BaseOIDCResponseActionTest.java
@@ -231,7 +231,7 @@ public abstract class BaseOIDCResponseActionTest {
boolean isRevoked;
- MockRevocationCache(boolean revocationQueryOutcome, boolean revokeActionStatus) {
+ public MockRevocationCache(final boolean revocationQueryOutcome, final boolean revokeActionStatus) {
revoke = revokeActionStatus;
isRevoked = revocationQueryOutcome;
}
diff --git a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/AbstractOIDCUserInfoResponseActionTest.java b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/userinfo/profile/impl/AbstractOIDCUserInfoResponseActionTest.java
similarity index 96%
rename from idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/AbstractOIDCUserInfoResponseActionTest.java
rename to idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/userinfo/profile/impl/AbstractOIDCUserInfoResponseActionTest.java
index 0ef33142..c879ea2d 100644
--- a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/AbstractOIDCUserInfoResponseActionTest.java
+++ b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/userinfo/profile/impl/AbstractOIDCUserInfoResponseActionTest.java
@@ -15,11 +15,11 @@
* limitations under the License.
*/
-package net.shibboleth.idp.plugin.oidc.op.profile.impl;
+package net.shibboleth.idp.plugin.oidc.op.userinfo.profile.impl;
import net.shibboleth.idp.plugin.oidc.op.messaging.context.OIDCAuthenticationResponseContext;
import net.shibboleth.idp.plugin.oidc.op.messaging.context.OIDCMetadataContext;
-import net.shibboleth.idp.plugin.oidc.op.profile.impl.AbstractOIDCUserInfoResponseAction;
+import net.shibboleth.idp.plugin.oidc.op.userinfo.profile.impl.AbstractOIDCUserInfoResponseAction;
import net.shibboleth.idp.profile.context.navigate.WebflowRequestContextProfileRequestContextLookup;
import net.shibboleth.idp.profile.testing.ActionTestingSupport;
import net.shibboleth.idp.profile.testing.RequestContextBuilder;
diff --git a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/AddUserInfoShellTest.java b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/userinfo/profile/impl/AddUserInfoShellTest.java
similarity index 94%
rename from idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/AddUserInfoShellTest.java
rename to idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/userinfo/profile/impl/AddUserInfoShellTest.java
index 13fc825e..a64e4ab0 100644
--- a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/AddUserInfoShellTest.java
+++ b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/userinfo/profile/impl/AddUserInfoShellTest.java
@@ -15,9 +15,10 @@
* limitations under the License.
*/
-package net.shibboleth.idp.plugin.oidc.op.profile.impl;
+package net.shibboleth.idp.plugin.oidc.op.userinfo.profile.impl;
-import net.shibboleth.idp.plugin.oidc.op.profile.impl.AddUserInfoShell;
+import net.shibboleth.idp.plugin.oidc.op.profile.impl.BaseOIDCResponseActionTest;
+import net.shibboleth.idp.plugin.oidc.op.userinfo.profile.impl.AddUserInfoShell;
import net.shibboleth.idp.profile.IdPEventIds;
import net.shibboleth.idp.profile.context.RelyingPartyContext;
import net.shibboleth.idp.profile.context.navigate.ResponderIdLookupFunction;
diff --git a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/ValidateAccessTokenTest.java b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/userinfo/profile/impl/ValidateAccessTokenTest.java
similarity index 80%
rename from idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/ValidateAccessTokenTest.java
rename to idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/userinfo/profile/impl/ValidateAccessTokenTest.java
index ecd6cb88..47020517 100644
--- a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/ValidateAccessTokenTest.java
+++ b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/userinfo/profile/impl/ValidateAccessTokenTest.java
@@ -15,9 +15,10 @@
* limitations under the License.
*/
-package net.shibboleth.idp.plugin.oidc.op.profile.impl;
+package net.shibboleth.idp.plugin.oidc.op.userinfo.profile.impl;
import net.shibboleth.idp.plugin.oidc.op.profile.OidcEventIds;
+import net.shibboleth.idp.plugin.oidc.op.profile.impl.BaseOIDCResponseActionTest;
import net.shibboleth.idp.plugin.oidc.op.token.support.AccessTokenClaimsSet;
import net.shibboleth.idp.plugin.oidc.op.token.support.AuthorizeCodeClaimsSet;
import net.shibboleth.idp.plugin.oidc.op.token.support.TokenClaimsSet;
@@ -28,21 +29,28 @@ import java.net.URI;
import java.net.URISyntaxException;
import java.security.NoSuchAlgorithmException;
import java.time.Instant;
+import java.util.Collections;
import org.springframework.webflow.execution.Event;
+import org.testng.annotations.BeforeMethod;
import org.testng.annotations.Test;
import com.nimbusds.oauth2.sdk.Scope;
import com.nimbusds.oauth2.sdk.id.ClientID;
import com.nimbusds.oauth2.sdk.token.BearerAccessToken;
import com.nimbusds.openid.connect.sdk.UserInfoRequest;
+// Checkstyle: ThrowsCount OFF
+
/** {@link ValidateAccessToken} unit test. */
public class ValidateAccessTokenTest extends BaseOIDCResponseActionTest {
+ /** Action to test. */
private ValidateAccessToken action;
+ @BeforeMethod
private void init() throws ComponentInitializationException, NoSuchAlgorithmException {
- action = new ValidateAccessToken(getDataSealer());
+ action = new ValidateAccessToken();
+ action.setDataSealer(getDataSealer());
action.setRevocationCache(new MockRevocationCache(false, true));
action.initialize();
}
@@ -55,7 +63,8 @@ public class ValidateAccessTokenTest extends BaseOIDCResponseActionTest {
*/
@Test(expectedExceptions = ComponentInitializationException.class)
public void testNoRevocationCache() throws NoSuchAlgorithmException, ComponentInitializationException {
- action = new ValidateAccessToken(getDataSealer());
+ action = new ValidateAccessToken();
+ action.setDataSealer(getDataSealer());
action.initialize();
action.execute(requestCtx);
}
@@ -71,7 +80,6 @@ public class ValidateAccessTokenTest extends BaseOIDCResponseActionTest {
@Test
public void testSuccess()
throws NoSuchAlgorithmException, ComponentInitializationException, URISyntaxException, DataSealerException {
- init();
final TokenClaimsSet claims = new AccessTokenClaimsSet.Builder()
.setJWTID(idGenerator)
.setClientID(new ClientID())
@@ -91,6 +99,37 @@ public class ValidateAccessTokenTest extends BaseOIDCResponseActionTest {
ActionTestingSupport.assertProceedEvent(event);
}
+ /**
+ * Fails due to access token containing an audience (ours never do).
+ *
+ * @throws NoSuchAlgorithmException
+ * @throws ComponentInitializationException
+ * @throws URISyntaxException
+ * @throws DataSealerException
+ */
+ @Test
+ public void testFailsAudience()
+ throws NoSuchAlgorithmException, ComponentInitializationException, URISyntaxException, DataSealerException {
+ final TokenClaimsSet claims = new AccessTokenClaimsSet.Builder()
+ .setJWTID(idGenerator)
+ .setClientID(new ClientID())
+ .setIssuer("issuer")
+ .setPrincipal("userPrin")
+ .setSubject("subject")
+ .setIssuedAt(Instant.now())
+ .setExpiresAt(Instant.now().plusSeconds(1))
+ .setAuthenticationTime(Instant.now())
+ .setRedirectURI(new URI("http://example.com"))
+ .setScope(new Scope())
+ .setAudience(Collections.singletonList("foo"))
+ .build();
+ final BearerAccessToken token = new BearerAccessToken(claims.serialize(getDataSealer()));
+ final UserInfoRequest req = new UserInfoRequest(new URI("http://example.com"), token);
+ setUserInfoRequest(req);
+ final Event event = action.execute(requestCtx);
+ ActionTestingSupport.assertEvent(event, OidcEventIds.INVALID_GRANT);
+ }
+
/**
* Fails due to access token being substituted with authorize code.
*
@@ -102,7 +141,6 @@ public class ValidateAccessTokenTest extends BaseOIDCResponseActionTest {
@Test
public void testFailsNotAccessToken()
throws NoSuchAlgorithmException, ComponentInitializationException, URISyntaxException, DataSealerException {
- init();
final TokenClaimsSet claims = new AuthorizeCodeClaimsSet.Builder()
.setJWTID(idGenerator)
.setClientID(new ClientID())
@@ -133,7 +171,6 @@ public class ValidateAccessTokenTest extends BaseOIDCResponseActionTest {
@Test
public void testFailsExpired()
throws NoSuchAlgorithmException, ComponentInitializationException, URISyntaxException, DataSealerException {
- init();
final TokenClaimsSet claims = new AccessTokenClaimsSet.Builder()
.setJWTID(idGenerator)
.setClientID(new ClientID())
@@ -164,7 +201,8 @@ public class ValidateAccessTokenTest extends BaseOIDCResponseActionTest {
@Test
public void testFailsRevoked()
throws NoSuchAlgorithmException, ComponentInitializationException, URISyntaxException, DataSealerException {
- action = new ValidateAccessToken(getDataSealer());
+ action = new ValidateAccessToken();
+ action.setDataSealer(getDataSealer());
action.setRevocationCache(new MockRevocationCache(true, true));
action.initialize();
final TokenClaimsSet claims = new AccessTokenClaimsSet.Builder()
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list