[java-idp-oidc] 02/02: JOIDC-61 - Support metadata policies in the dyn. reg. profile configuration

[Henri Mikkonen]

This is an automated email from the git hooks/post-receive script.

hjmikkon pushed a commit to branch main
in repository java-idp-oidc.

View the commit online:
http://git.shibboleth.net/view/?p=java-idp-oidc.git;a=commit;h=8945d0aa366cd357adb6c5d726a82d42ba9102a6

commit 8945d0aa366cd357adb6c5d726a82d42ba9102a6
Author: Henri Mikkonen <henri.mikkonen at iki.fi>
AuthorDate: Wed Mar 9 15:31:59 2022 +0200

    JOIDC-61 - Support metadata policies in the dyn. reg. profile configuration
    
    https://shibboleth.atlassian.net/browse/JOIDC-61
    
    Added testing of another metadata policy setup via shibboleth.RelyingPartyOverrides
---
 .../oidc/op/profile/flow/RegistrationFlowTest.java | 31 +++++++++++++++++++---
 .../src/test/resources/conf/metadata-policy2.json  |  5 ++++
 .../src/test/resources/conf/relying-party.xml      | 14 +++++++++-
 3 files changed, 46 insertions(+), 4 deletions(-)

diff --git a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/RegistrationFlowTest.java b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/RegistrationFlowTest.java
index 8ef9d7b1..c3472714 100644
--- a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/RegistrationFlowTest.java
+++ b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/RegistrationFlowTest.java
@@ -34,6 +34,7 @@ import org.testng.annotations.Test;
 
 import com.nimbusds.langtag.LangTag;
 import com.nimbusds.langtag.LangTagException;
+import com.nimbusds.oauth2.sdk.GrantType;
 import com.nimbusds.oauth2.sdk.ParseException;
 import com.nimbusds.oauth2.sdk.token.BearerAccessToken;
 import com.nimbusds.openid.connect.sdk.rp.OIDCClientInformation;
@@ -157,12 +158,36 @@ public class RegistrationFlowTest extends AbstractOidcFlowTest {
     public void testAccessToken_noPolicyNoRedirectUri() throws NoSuchAlgorithmException, DataSealerException,
             ComponentInitializationException {
         setJsonRequest("POST", "{ \"test\":false }");
-        request.addHeader("Authorization", buildRegistrationAccessToken("mockDynRegClient", (String) null, (String[]) null)
-                .toAuthorizationHeader());
+        request.addHeader("Authorization", buildRegistrationAccessToken("mockDynRegClientNoProfilePolicy",
+                (String) null, (String[]) null).toAuthorizationHeader());
         final FlowExecutionResult result = flowExecutor.launchExecution(FLOW_ID, null, externalContext);
         assertErrorCode(result, "invalid_redirect_uri");
     }
-    
+
+    @Test
+    public void testAccessToken_nonDefaultPolicyActive_failsWhenIncompatibleRequest()
+            throws NoSuchAlgorithmException, DataSealerException, ComponentInitializationException {
+        // the policy for mockDynRegClientAnotherProfilePolicy shouldn't accept other grant_types than implicit
+        setJsonRequest("POST", buildRequestMessage(redirectUri, "\"grant_types\":[\"authorization_code\"]"));
+        request.addHeader("Authorization", buildRegistrationAccessToken("mockDynRegClientAnotherProfilePolicy",
+                (String) null, (String[]) null).toAuthorizationHeader());
+        final FlowExecutionResult result = flowExecutor.launchExecution(FLOW_ID, null, externalContext);
+        assertErrorCode(result, "invalid_client_metadata");
+    }
+
+    @Test
+    public void testAccessToken_nonDefaultPolicyActive_successWithCompatibleRequest()
+            throws NoSuchAlgorithmException, DataSealerException, ComponentInitializationException, ParseException, IOException, net.minidev.json.parser.ParseException {
+        setJsonRequest("POST", buildRequestMessage(redirectUri, "\"grant_types\":[\"implicit\"]"));
+        request.addHeader("Authorization", buildRegistrationAccessToken("mockDynRegClientAnotherProfilePolicy",
+                (String) null, (String[]) null).toAuthorizationHeader());
+        final FlowExecutionResult result = flowExecutor.launchExecution(FLOW_ID, null, externalContext);
+        assertSuccessfulResponse(result);
+        final OIDCClientInformationResponse parsedResponse = 
+                parseSuccessResponse(result, OIDCClientInformationResponse.class);
+        Assert.assertTrue(parsedResponse.getOIDCClientInformation().getOIDCMetadata().getGrantTypes().contains(GrantType.IMPLICIT));
+    }
+
     protected void assertSuccessfulResponse(final FlowExecutionResult result) throws IOException, ParseException, net.minidev.json.parser.ParseException {
         final OIDCClientInformationResponse parsedResponse =
                 parseSuccessResponse(result, OIDCClientInformationResponse.class);
diff --git a/idp-oidc-extension-impl/src/test/resources/conf/metadata-policy2.json b/idp-oidc-extension-impl/src/test/resources/conf/metadata-policy2.json
new file mode 100644
index 00000000..f69df6a9
--- /dev/null
+++ b/idp-oidc-extension-impl/src/test/resources/conf/metadata-policy2.json
@@ -0,0 +1,5 @@
+{
+    "grant_types": {
+        "one_of": ["implicit"]
+    }
+}
\ No newline at end of file
diff --git a/idp-oidc-extension-impl/src/test/resources/conf/relying-party.xml b/idp-oidc-extension-impl/src/test/resources/conf/relying-party.xml
index 98c7928b..8e6d1c45 100644
--- a/idp-oidc-extension-impl/src/test/resources/conf/relying-party.xml
+++ b/idp-oidc-extension-impl/src/test/resources/conf/relying-party.xml
@@ -90,13 +90,25 @@
                  </list>
             </property>
         </bean>
-        <bean parent="RelyingPartyByName" c:relyingPartyIds="mockDynRegClient">
+        <bean parent="RelyingPartyByName" c:relyingPartyIds="mockDynRegClientNoProfilePolicy">
             <property name="profileConfigurations">
                 <list>
                     <bean parent="OIDC.Registration" p:metadataPolicy="#{null}"/>
                 </list>
             </property>
         </bean>
+        <bean parent="RelyingPartyByName" c:relyingPartyIds="mockDynRegClientAnotherProfilePolicy">
+            <property name="profileConfigurations">
+                <list>
+                    <bean parent="OIDC.Registration" p:metadataPolicyLookupStrategy-ref="shibboleth.oidc.dynreg.AnotherMetadataPolicyLookupStrategy"/>
+                </list>
+            </property>
+        </bean>
     </util:list>
 
+    <bean id="shibboleth.oidc.dynreg.AnotherMetadataPolicyLookupStrategy"
+        parent="shibboleth.oidc.dynreg.MetadataPolicyLookupStrategy"
+        c:resource="classpath:conf/metadata-policy2.json"
+        c:id="AnotherProfileMetadataPolicyCache" />
+
 </beans>

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.