[java-idp-plugin-oidc-rp] branch main updated: Cleanup test, move clientAuthenticationMethods to existing profile config
Phil Smart
philip.smart at jisc.ac.uk
Tue Jun 14 09:20:17 UTC 2022
This is an automated email from the git hooks/post-receive script.
philsmart pushed a commit to branch main
in repository java-idp-plugin-oidc-rp.
View the commit online:
http://git.shibboleth.net/view/?p=java-idp-plugin-oidc-rp.git;a=commit;h=0b0dc3adca39c742292cf40aab9e015207e0f4d1
The following commit(s) were added to refs/heads/main by this push:
new 0b0dc3a Cleanup test, move clientAuthenticationMethods to existing profile config
0b0dc3a is described below
commit 0b0dc3adca39c742292cf40aab9e015207e0f4d1
Author: Phil Smart <philip.smart at jisc.ac.uk>
AuthorDate: Tue Jun 14 10:20:11 2022 +0100
Cleanup test, move clientAuthenticationMethods to existing profile
config
---
.../oidc/rp/impl/AddOIDCAuthenticationRequest.java | 1 -
...nitializeOAuth2ClientAuthenticationContext.java | 14 +-
.../impl/PopulateResponseTypeAndModeContext.java | 4 +-
.../rp/impl/ValidateOAuthAccessTokenResponse.java | 3 +-
.../oidc-relying-party-authn-beans.xml | 1 +
.../idp/service/relying-party/postconfig.xml | 2 +-
.../plugin/authn/oidc/rp/impl/OIDCRPFlowTest.java | 170 ++++++---------------
7 files changed, 60 insertions(+), 135 deletions(-)
diff --git a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/AddOIDCAuthenticationRequest.java b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/AddOIDCAuthenticationRequest.java
index 96e3ea5..078d132 100644
--- a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/AddOIDCAuthenticationRequest.java
+++ b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/AddOIDCAuthenticationRequest.java
@@ -173,7 +173,6 @@ public class AddOIDCAuthenticationRequest extends AbstractAuthenticationAction {
}
- // TODO we need to do something with the rpCtx.
final RelyingPartyContext rpCtx = profileRequestContext.getSubcontext(RelyingPartyContext.class);
if (rpCtx != null && rpCtx.getConfiguration() != null &&
rpCtx.getProfileConfig() instanceof OIDCAuthorizationConfiguration) {
diff --git a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/InitializeOAuth2ClientAuthenticationContext.java b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/InitializeOAuth2ClientAuthenticationContext.java
index 804b867..fbdb63c 100644
--- a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/InitializeOAuth2ClientAuthenticationContext.java
+++ b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/InitializeOAuth2ClientAuthenticationContext.java
@@ -21,6 +21,7 @@ import java.nio.charset.StandardCharsets;
import java.time.Duration;
import java.time.Instant;
import java.util.Date;
+import java.util.Set;
import java.util.function.Function;
import javax.annotation.Nonnull;
@@ -163,13 +164,18 @@ public class InitializeOAuth2ClientAuthenticationContext extends AbstractProfile
protected void doExecute(@Nonnull final ProfileRequestContext profileRequestContext) {
super.doExecute(profileRequestContext);
- final String clientAuthMethod =
- profileConfiguration.getClientAuthenticationMethod(profileRequestContext);
- if (clientAuthMethod == null) {
+ final Set<String> clientAuthMethods =
+ profileConfiguration.getTokenEndpointAuthMethods(profileRequestContext);
+ if (clientAuthMethods == null || clientAuthMethods.isEmpty()) {
log.error("{} No client authentication mode found from profile configuration", getLogPrefix());
ActionSupport.buildEvent(profileRequestContext, IdPEventIds.INVALID_RELYING_PARTY_CONFIG);
return;
}
+ if (clientAuthMethods.size() > 1) {
+ log.error("{} Must specify only one client authentication mode", getLogPrefix());
+ ActionSupport.buildEvent(profileRequestContext, IdPEventIds.INVALID_RELYING_PARTY_CONFIG);
+ return;
+ }
final String clientId =
profileConfiguration.getClientId(profileRequestContext);
@@ -188,7 +194,7 @@ public class InitializeOAuth2ClientAuthenticationContext extends AbstractProfile
}
final ClientAuthentication clientAuthentication =
- constructClientAuthentication(clientId, clientAuthMethod, clientCredential);
+ constructClientAuthentication(clientId, clientAuthMethods.iterator().next(), clientCredential);
if (clientAuthentication == null) {
log.error("{} No client authentication could be constructed", getLogPrefix());
diff --git a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/PopulateResponseTypeAndModeContext.java b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/PopulateResponseTypeAndModeContext.java
index b8f4f99..f4148bd 100644
--- a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/PopulateResponseTypeAndModeContext.java
+++ b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/PopulateResponseTypeAndModeContext.java
@@ -37,8 +37,8 @@ import net.shibboleth.utilities.java.support.component.ComponentSupport;
import net.shibboleth.utilities.java.support.logic.Constraint;
/**
- * Action that populates the outbound ResponseTypeContext from client metadata or
- * profile configuration...
+ * Action that populates the outbound ResponseTypeContext from various stratagies, by default from the
+ * profile configuration.
*
* TODO finish
*/
diff --git a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/ValidateOAuthAccessTokenResponse.java b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/ValidateOAuthAccessTokenResponse.java
index 7e1b373..6460116 100644
--- a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/ValidateOAuthAccessTokenResponse.java
+++ b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/ValidateOAuthAccessTokenResponse.java
@@ -105,7 +105,7 @@ public class ValidateOAuthAccessTokenResponse extends AbstractOIDCAuthentication
// Only support Bearer type
final Object tokenTypeObject = rawTokenResponse.get("token_type");
if (tokenTypeObject instanceof String) {
- if (!"Bearer".equals((String)tokenTypeObject)) {
+ if (!"Bearer".equals(tokenTypeObject)) {
log.warn("{} Access token response is invalid, bearer token_type required", getLogPrefix());
ActionSupport.buildEvent(profileRequestContext, OidcEventIds.INVALID_ACCESS_TOKEN);
return;
@@ -116,6 +116,7 @@ public class ValidateOAuthAccessTokenResponse extends AbstractOIDCAuthentication
return;
}
}
+ // Is recomended, but we do not use it
if (!rawTokenResponse.containsKey("expires_in")) {
log.trace("{} Expires_in not found in access token, is recomended ", getLogPrefix());
}
diff --git a/idp-oidc-rp-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/OIDCRelyingParty/oidc-relying-party-authn-beans.xml b/idp-oidc-rp-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/OIDCRelyingParty/oidc-relying-party-authn-beans.xml
index 9b7da49..6459687 100644
--- a/idp-oidc-rp-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/OIDCRelyingParty/oidc-relying-party-authn-beans.xml
+++ b/idp-oidc-rp-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/OIDCRelyingParty/oidc-relying-party-authn-beans.xml
@@ -477,6 +477,7 @@
<ref bean="NotBeforeClaimsValidator" />
<ref bean="NonceClaimValidator" />
<!-- missing ACR? and auth_time, access_token at_hash. -->
+ <!-- TODO at_hash if contained in id_token should exact match (via some steps) a derivation of the access_token-->
</util:list>
diff --git a/idp-oidc-rp-impl/src/main/resources/META-INF/net/shibboleth/idp/service/relying-party/postconfig.xml b/idp-oidc-rp-impl/src/main/resources/META-INF/net/shibboleth/idp/service/relying-party/postconfig.xml
index 01b4531..682f61c 100644
--- a/idp-oidc-rp-impl/src/main/resources/META-INF/net/shibboleth/idp/service/relying-party/postconfig.xml
+++ b/idp-oidc-rp-impl/src/main/resources/META-INF/net/shibboleth/idp/service/relying-party/postconfig.xml
@@ -33,7 +33,7 @@
p:deniedUserInfoAttributes="%{idp.authn.oidc.rp.deniedUserInfoAttributes:}"
p:clientId="#{%{idp.authn.oidc.rp.discoveryRequired:false} == true ? null : '%{idp.authn.oidc.rp.client.clientId:}'}"
p:clientCredential="#{%{idp.authn.oidc.rp.discoveryRequired:false} == true ? {null} : getObject('shibboleth.authn.oidc.rp.DefaultCredential')}"
- p:clientAuthenticationMethod="%{idp.authn.oidc.rp.clientAuthenticationMethod:client_secret_basic}" />
+ p:tokenEndpointAuthMethods="%{idp.authn.oidc.rp.clientAuthenticationMethod:client_secret_basic}" />
<!-- Security Configuration Defaults. These settings establish the default security configurations for signatures and
diff --git a/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/OIDCRPFlowTest.java b/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/OIDCRPFlowTest.java
index fc89950..13e6fa1 100644
--- a/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/OIDCRPFlowTest.java
+++ b/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/OIDCRPFlowTest.java
@@ -20,13 +20,11 @@ package net.shibboleth.idp.plugin.authn.oidc.rp.impl;
import java.net.InetAddress;
import java.net.URI;
import java.net.UnknownHostException;
-import java.nio.charset.StandardCharsets;
import java.time.Duration;
-import java.time.Instant;
-import java.util.Date;
import java.util.HashMap;
import java.util.List;
import java.util.Map;
+import java.util.Set;
import javax.annotation.Nonnull;
import javax.annotation.Nullable;
@@ -52,35 +50,14 @@ import org.springframework.webflow.engine.impl.FlowExecutionImpl;
import org.springframework.webflow.execution.FlowExecution;
import org.springframework.webflow.test.MockFlowBuilderContext;
-import com.nimbusds.jose.Algorithm;
import com.nimbusds.jose.EncryptionMethod;
import com.nimbusds.jose.JOSEException;
-import com.nimbusds.jose.JOSEObjectType;
import com.nimbusds.jose.JWEAlgorithm;
-import com.nimbusds.jose.JWEHeader;
-import com.nimbusds.jose.JWEObject;
-import com.nimbusds.jose.JWSAlgorithm;
-import com.nimbusds.jose.JWSHeader;
-import com.nimbusds.jose.Payload;
-import com.nimbusds.jose.crypto.DirectEncrypter;
-import com.nimbusds.jose.crypto.ECDSASigner;
-import com.nimbusds.jose.crypto.MACSigner;
-import com.nimbusds.jose.crypto.RSAEncrypter;
-import com.nimbusds.jose.jwk.Curve;
-import com.nimbusds.jose.jwk.ECKey;
-import com.nimbusds.jose.jwk.KeyUse;
import com.nimbusds.jose.jwk.RSAKey;
-import com.nimbusds.jose.jwk.gen.ECKeyGenerator;
-import com.nimbusds.jose.jwk.gen.RSAKeyGenerator;
-import com.nimbusds.jwt.EncryptedJWT;
-import com.nimbusds.jwt.JWTClaimsSet;
-import com.nimbusds.jwt.PlainJWT;
import com.nimbusds.jwt.SignedJWT;
import com.nimbusds.oauth2.sdk.ParseException;
import com.nimbusds.oauth2.sdk.ResponseMode;
import com.nimbusds.oauth2.sdk.ResponseType;
-import com.nimbusds.oauth2.sdk.auth.ClientSecretBasic;
-import com.nimbusds.oauth2.sdk.auth.Secret;
import com.nimbusds.oauth2.sdk.id.ClientID;
import com.nimbusds.oauth2.sdk.id.State;
import com.nimbusds.openid.connect.sdk.AuthenticationResponse;
@@ -93,6 +70,7 @@ import net.shibboleth.idp.authn.context.AuthenticationContext;
import net.shibboleth.idp.authn.context.ExternalAuthenticationContext;
import net.shibboleth.idp.authn.context.SubjectCanonicalizationContext;
import net.shibboleth.idp.authn.impl.ExternalAuthenticationImpl;
+import net.shibboleth.idp.authn.principal.UsernamePrincipal;
import net.shibboleth.idp.plugin.authn.oidc.rp.context.OAuth2ClientContext;
import net.shibboleth.idp.plugin.authn.oidc.rp.context.OIDCPeerEntityContext;
import net.shibboleth.idp.plugin.authn.oidc.rp.context.ResponseTypeAndModeContext;
@@ -554,6 +532,20 @@ public class OIDCRPFlowTest extends AbstractAuthnXmlFlowExecutionTests {
return securityConfig;
}
+ private void assertStandardSuccessConditions(final ProfileRequestContext prc) {
+ //assert success conditions.
+ assertFlowExecutionEnded();
+ assertNotNull(prc.getSubcontext(AuthenticationContext.class));
+ assertNotNull(prc.getSubcontext(SubjectCanonicalizationContext.class));
+ assertNotNull(prc.getSubcontext(SubjectCanonicalizationContext.class).getSubject().getPrincipals());
+ //As SimpleSubjectCanonicalization has not been run, we pull out the subject
+ final UsernamePrincipal usernamePrincipal =
+ prc.getSubcontext(SubjectCanonicalizationContext.class).getSubject()
+ .getPrincipals(UsernamePrincipal.class).iterator().next();
+ assertNotNull(usernamePrincipal);
+ assertEquals(usernamePrincipal.getName(),"jdoe");
+ }
+
/**
* Test the flow from the external authorization request to the end of the flow.
@@ -602,11 +594,7 @@ public class OIDCRPFlowTest extends AbstractAuthnXmlFlowExecutionTests {
mockOPServer.shutdown();
- //assert success conditions
- assertFlowExecutionEnded();
- assertNotNull(prc.getSubcontext(AuthenticationContext.class));
- assertNotNull(prc.getSubcontext(SubjectCanonicalizationContext.class));
- assertEquals(prc.getSubcontext(SubjectCanonicalizationContext.class).getPrincipalName(),"jdoe");
+ assertStandardSuccessConditions(prc);
}
@@ -710,11 +698,7 @@ public class OIDCRPFlowTest extends AbstractAuthnXmlFlowExecutionTests {
mockOPServer.shutdown();
- //assert success conditions
- assertFlowExecutionEnded();
- assertNotNull(prc.getSubcontext(AuthenticationContext.class));
- assertNotNull(prc.getSubcontext(SubjectCanonicalizationContext.class));
- assertEquals("jdoe", prc.getSubcontext(SubjectCanonicalizationContext.class).getPrincipalName());
+ assertStandardSuccessConditions(prc);
}
@@ -752,19 +736,15 @@ public class OIDCRPFlowTest extends AbstractAuthnXmlFlowExecutionTests {
final FlowExecutionImpl flowExecution = (FlowExecutionImpl)getFlowExecutionFactory()
.createFlowExecution(getFlowDefinition());
- final ProfileRequestContext prc = buildProfileRequestContext("authn/OIDCRelyingParty", false,false);
- prc.getSubcontext(AuthenticationContext.class).setAuthenticatingAuthority(OP_ISSUER_ID);
- // create a nested PRC under the authentication context
- final ProfileRequestContext nestPrc = (ProfileRequestContext)
- prc.getSubcontext(AuthenticationContext.class).addSubcontext(new ProfileRequestContext(), true);
+ final ProfileRequestContext prc = populateBasicContextTreeFromAuthnResponse(flowExecution);
+
+ final OIDCAuthorizationConfiguration partyConfig =
+ (OIDCAuthorizationConfiguration) prc.getSubcontext(AuthenticationContext.class)
+ .getSubcontext(ProfileRequestContext.class)
+ .getSubcontext(RelyingPartyContext.class)
+ .getProfileConfig();
- // Add under nest PRC
- final RelyingPartyContext partyContext = new RelyingPartyContext();
- final OIDCAuthorizationConfiguration partyConfig = new OIDCAuthorizationConfiguration();
- partyContext.setProfileConfig(partyConfig);
- partyConfig.setClientAuthenticationMethod("client_secret_basic");
- partyConfig.setClientId(CLIENT_ID);
partyConfig.setClientCredential(createDirectEncryptionCredentialFromSharedSecret(CLIENT_SECRET));
// Set a default security config for the profile config
final OIDCSecurityConfiguration secConfig = new OIDCSecurityConfiguration();
@@ -832,33 +812,7 @@ public class OIDCRPFlowTest extends AbstractAuthnXmlFlowExecutionTests {
secConfig.setUserInfoTokenJwtSignatureValidationConfig(sigValidationUserInfo);
- partyConfig.setSecurityConfiguration(secConfig);
-
-
- final RelyingPartyConfiguration rPartyConfig = new RelyingPartyConfiguration();
- rPartyConfig.setResponderId("http://idp.example.com/");
- partyContext.setConfiguration(rPartyConfig);
- nestPrc.addSubcontext(partyContext);
-
-
- // Setup outbound context
- final MessageContext outMsgCtx = new MessageContext();
- outMsgCtx.setMessage(createAuthenticationRequest());
- outMsgCtx.addSubcontext(createPeerContext());
- outMsgCtx.addSubcontext(createResponseTypeAndModeContext());
- nestPrc.setOutboundMessageContext(outMsgCtx);
- outMsgCtx.getSubcontext(OIDCPeerEntityContext.class).addSubcontext(createOAuth2ClientContext(CLIENT_ID,null));
-
- // Setup inbound context.
- final MessageContext inMsgCtx = new MessageContext();
- inMsgCtx.setMessage(createAuthenticationResponse());
- nestPrc.setInboundMessageContext(inMsgCtx);
-
- // Add prc to flow.
- prc.getSubcontext(AuthenticationContext.class)
- .addSubcontext(new ExternalAuthenticationContext(new ExternalAuthenticationImpl(false)));
- flowExecution.getConversationScope().put("opensamlProfileRequestContext",prc);
-
+ partyConfig.setSecurityConfiguration(secConfig);
updateFlowExecution(flowExecution);
@@ -869,11 +823,7 @@ public class OIDCRPFlowTest extends AbstractAuthnXmlFlowExecutionTests {
mockOPServer.shutdown();
- //assert success conditions
- assertFlowExecutionEnded();
- assertNotNull(prc.getSubcontext(AuthenticationContext.class));
- assertNotNull(prc.getSubcontext(SubjectCanonicalizationContext.class));
- assertEquals(prc.getSubcontext(SubjectCanonicalizationContext.class).getPrincipalName(),"jdoe");
+ assertStandardSuccessConditions(prc);
}
@@ -916,21 +866,15 @@ public class OIDCRPFlowTest extends AbstractAuthnXmlFlowExecutionTests {
final FlowExecutionImpl flowExecution = (FlowExecutionImpl)getFlowExecutionFactory()
.createFlowExecution(getFlowDefinition());
- final ProfileRequestContext prc = buildProfileRequestContext("authn/OIDCRelyingParty", false,false);
- prc.getSubcontext(AuthenticationContext.class).setAuthenticatingAuthority(OP_ISSUER_ID);
- // create a nested PRC under the authentication context
- final ProfileRequestContext nestPrc = (ProfileRequestContext)
- prc.getSubcontext(AuthenticationContext.class).addSubcontext(new ProfileRequestContext(), true);
+ final ProfileRequestContext prc = populateBasicContextTreeFromAuthnResponse(flowExecution);
- // Add under nest PRC
- final RelyingPartyContext partyContext = new RelyingPartyContext();
- final OIDCAuthorizationConfiguration partyConfig = new OIDCAuthorizationConfiguration();
- partyContext.setProfileConfig(partyConfig);
- partyConfig.setClientAuthenticationMethod("client_secret_basic");
- partyConfig.setClientId(CLIENT_ID);
- partyConfig.setClientCredential(createDirectEncryptionCredentialFromSharedSecret(CLIENT_SECRET));
- // Set a default security config for the profile config
+ final OIDCAuthorizationConfiguration partyConfig =
+ (OIDCAuthorizationConfiguration) prc.getSubcontext(AuthenticationContext.class)
+ .getSubcontext(ProfileRequestContext.class)
+ .getSubcontext(RelyingPartyContext.class)
+ .getProfileConfig();
+
final OIDCSecurityConfiguration secConfig = new OIDCSecurityConfiguration();
final BasicSignatureValidationConfiguration<SignedJWT> sigValidation =
new BasicSignatureValidationConfiguration<>();
@@ -963,33 +907,8 @@ public class OIDCRPFlowTest extends AbstractAuthnXmlFlowExecutionTests {
secConfig.setIdTokenJwtDecryptionConfig(idTokenDecryptConfig);
partyConfig.setSecurityConfiguration(secConfig);
-
-
- final RelyingPartyConfiguration rPartyConfig = new RelyingPartyConfiguration();
- rPartyConfig.setResponderId("http://idp.example.com/");
- partyContext.setConfiguration(rPartyConfig);
- nestPrc.addSubcontext(partyContext);
-
-
- // Setup outbound context
- final MessageContext outMsgCtx = new MessageContext();
- outMsgCtx.setMessage(createAuthenticationRequest());
- outMsgCtx.addSubcontext(createPeerContext());
- outMsgCtx.addSubcontext(createResponseTypeAndModeContext());
- nestPrc.setOutboundMessageContext(outMsgCtx);
- outMsgCtx.getSubcontext(OIDCPeerEntityContext.class).addSubcontext(createOAuth2ClientContext(CLIENT_ID,null));
-
- // Setup inbound context.
- final MessageContext inMsgCtx = new MessageContext();
- inMsgCtx.setMessage(createAuthenticationResponse());
- nestPrc.setInboundMessageContext(inMsgCtx);
-
- // Add prc to flow.
- prc.getSubcontext(AuthenticationContext.class)
- .addSubcontext(new ExternalAuthenticationContext(new ExternalAuthenticationImpl(false)));
- flowExecution.getConversationScope().put("opensamlProfileRequestContext",prc);
-
-
+
+
updateFlowExecution(flowExecution);
//set start view and ending event to transition on.
@@ -999,16 +918,16 @@ public class OIDCRPFlowTest extends AbstractAuthnXmlFlowExecutionTests {
mockOPServer.shutdown();
- //assert success conditions
- assertFlowExecutionEnded();
- assertNotNull(prc.getSubcontext(AuthenticationContext.class));
- assertNotNull(prc.getSubcontext(SubjectCanonicalizationContext.class));
- assertEquals(prc.getSubcontext(SubjectCanonicalizationContext.class).getPrincipalName(),"jdoe");
+ assertStandardSuccessConditions(prc);
}
- //FIXME why are we testing a plain UserInfo JWT? is this permissible
+ /**
+ * Test a plain UserInfo JWT type. This can not happen, and should trigger an error.
+ *
+ * @throws Exception on error.
+ */
@Test
public void testAuthnFlowFromAuthorizationCallback_UsingPlainJSONObjectUserInfoResponse()
throws Exception {
@@ -1055,8 +974,7 @@ public class OIDCRPFlowTest extends AbstractAuthnXmlFlowExecutionTests {
//assert success conditions
assertFlowExecutionEnded();
assertNotNull(prc.getSubcontext(AuthenticationContext.class));
- assertNotNull(prc.getSubcontext(SubjectCanonicalizationContext.class));
- assertEquals(prc.getSubcontext(SubjectCanonicalizationContext.class).getPrincipalName(),"jdoe");
+ assertNull(prc.getSubcontext(SubjectCanonicalizationContext.class));
}
@@ -1076,7 +994,7 @@ public class OIDCRPFlowTest extends AbstractAuthnXmlFlowExecutionTests {
final OIDCAuthorizationConfiguration partyConfig = new OIDCAuthorizationConfiguration();
partyContext.setProfileConfig(partyConfig);
partyConfig.setClientCredential(createClientSecretCredential(CLIENT_SECRET));
- partyConfig.setClientAuthenticationMethod("client_secret_basic");
+ partyConfig.setTokenEndpointAuthMethods(Set.of("client_secret_basic"));
partyConfig.setClientId(CLIENT_ID);
final RelyingPartyConfiguration rPartyConfig = new RelyingPartyConfiguration();
rPartyConfig.setResponderId("http://idp.example.com/");
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list