[java-idp-oidc] branch maint-3.1 updated: JOIDC-102 Introspection endpoint authentication failing with private_key_jwt
Henri Mikkonen
henri.mikkonen at iki.fi
Mon May 16 13:27:32 UTC 2022
This is an automated email from the git hooks/post-receive script.
hjmikkon pushed a commit to branch maint-3.1
in repository java-idp-oidc.
View the commit online:
http://git.shibboleth.net/view/?p=java-idp-oidc.git;a=commit;h=2182320bd001b79c47149ca3fa2adb62f1b4fe09
The following commit(s) were added to refs/heads/maint-3.1 by this push:
new 2182320b JOIDC-102 Introspection endpoint authentication failing with private_key_jwt
2182320b is described below
commit 2182320bd001b79c47149ca3fa2adb62f1b4fe09
Author: Henri Mikkonen <henri.mikkonen at iki.fi>
AuthorDate: Fri May 13 12:38:58 2022 +0300
JOIDC-102 Introspection endpoint authentication failing with private_key_jwt
https://shibboleth.atlassian.net/browse/JOIDC-102
Moved the PopulateTokenEndpointJwtSignatureValidationParameters and its dependencies from
the token flow into the OAuth2Client authentication flow. Now the JWT validation
parameters are populated for all endpoints exploiting JWT client authentication: token,
introspection and revocation.
Also improved flow testing related to JWT authentication: jti replay is now tested together
with success cases for both private_key_jwt and client_secret_jwt.
---
.../authn/OAuth2Client/OAuth2Client-beans.xml | 28 ++++++++
.../flows/authn/OAuth2Client/OAuth2Client-flow.xml | 1 +
.../idp/flows/oidc/token/token-beans.xml | 28 --------
.../shibboleth/idp/flows/oidc/token/token-flow.xml | 1 -
.../AbstractOidcClientAuthenticationFlowTest.java | 76 ++++++++++++++++++++--
.../oidc/op/profile/flow/AbstractOidcFlowTest.java | 2 +-
.../flow/ClientCredentialsTokenFlowTest.java | 9 ++-
.../op/profile/flow/IntrospectionFlowTest.java | 17 +++--
.../oidc/op/profile/flow/RevocationFlowTest.java | 13 ++--
.../plugin/oidc/op/profile/flow/TokenFlowTest.java | 8 ++-
.../plugin/oidc/op/profile/flow/UserInfoTest.java | 6 ++
11 files changed, 141 insertions(+), 48 deletions(-)
diff --git a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/OAuth2Client/OAuth2Client-beans.xml b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/OAuth2Client/OAuth2Client-beans.xml
index 8510baa3..572e863a 100644
--- a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/OAuth2Client/OAuth2Client-beans.xml
+++ b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/OAuth2Client/OAuth2Client-beans.xml
@@ -33,6 +33,34 @@
class="net.shibboleth.idp.plugin.oidc.op.authn.impl.ExtractClientAuthenticationFromRequest" scope="prototype"
p:httpServletRequest-ref="shibboleth.HttpServletRequest" />
+ <bean id="PopulateTokenEndpointJwtSignatureValidationParameters"
+ class="net.shibboleth.idp.plugin.oidc.op.profile.impl.PopulateOIDCSignatureSigningParameters"
+ scope="prototype"
+ c:strategy-ref="shibboleth.MessageContextLookup.Inbound"
+ p:configurationLookupStrategy-ref="shibboleth.oidc.SignatureValidationConfigurationLookup"
+ p:signatureSigningParametersResolver-ref="shibboleth.oidc.TokenEndpointJwtSignatureValidationParametersResolver">
+ <property name="securityParametersContextLookupStrategy">
+ <bean parent="shibboleth.Functions.Compose"
+ c:g-ref="shibboleth.ChildLookupOrCreate.SecurityParameters"
+ c:f-ref="shibboleth.ChildLookup.RelyingParty" />
+ </property>
+ <property name="existingParametersContextLookupStrategy">
+ <bean parent="shibboleth.Functions.Compose"
+ c:g-ref="shibboleth.ChildLookup.SecurityParameters"
+ c:f-ref="shibboleth.MessageContextLookup.Outbound" />
+ </property>
+ </bean>
+
+ <bean id="shibboleth.oidc.SignatureValidationConfigurationLookup"
+ class="net.shibboleth.oidc.profile.config.navigate.TokenEndpointJwtSignatureValidationConfigurationLookupFunction"
+ p:relyingPartyConfigurationResolver-ref="shibboleth.RelyingPartyConfigurationResolver" />
+
+ <bean id="shibboleth.oidc.TokenEndpointJwtSignatureValidationParametersResolver"
+ class="net.shibboleth.idp.plugin.oidc.op.security.impl.OIDCClientInformationSignatureValidationParametersResolver"
+ p:remoteJwkSetCache-ref="shibboleth.oidc.RemoteJwkSetCache"
+ p:keyFetchInterval="%{idp.oidc.jwksuri.fetchInterval:PT30M}"
+ p:parameterType="#{T(net.shibboleth.idp.plugin.oidc.op.security.impl.OIDCClientInformationSignatureValidationParametersResolver.ParameterType).TOKEN_ENDPOINT_JWT_VALIDATION}" />
+
<bean id="ValidateClientAuthenticationType"
class="net.shibboleth.idp.plugin.oidc.op.authn.impl.ValidateClientAuthenticationType" scope="prototype" />
diff --git a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/OAuth2Client/OAuth2Client-flow.xml b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/OAuth2Client/OAuth2Client-flow.xml
index 76c264f8..d5ace10c 100644
--- a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/OAuth2Client/OAuth2Client-flow.xml
+++ b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/OAuth2Client/OAuth2Client-flow.xml
@@ -9,6 +9,7 @@
-->
<action-state id="OAuth2Client">
+ <evaluate expression="PopulateTokenEndpointJwtSignatureValidationParameters"/>
<evaluate expression="ExtractClientAuthenticationFromRequest" />
<evaluate expression="ValidateClientAuthenticationType" />
<evaluate expression="ValidateCredentials" />
diff --git a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/token/token-beans.xml b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/token/token-beans.xml
index 2ce9c598..9f4b9bb4 100644
--- a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/token/token-beans.xml
+++ b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/token/token-beans.xml
@@ -39,34 +39,6 @@
<bean id="ValidateGrantType" class="net.shibboleth.idp.plugin.oidc.op.profile.impl.ValidateGrantType"
scope="prototype" />
- <bean id="PopulateTokenEndpointJwtSignatureValidationParameters"
- class="net.shibboleth.idp.plugin.oidc.op.profile.impl.PopulateOIDCSignatureSigningParameters"
- scope="prototype"
- c:strategy-ref="shibboleth.MessageContextLookup.Inbound"
- p:configurationLookupStrategy-ref="shibboleth.oidc.SignatureValidationConfigurationLookup"
- p:signatureSigningParametersResolver-ref="shibboleth.oidc.TokenEndpointJwtSignatureValidationParametersResolver">
- <property name="securityParametersContextLookupStrategy">
- <bean parent="shibboleth.Functions.Compose"
- c:g-ref="shibboleth.ChildLookupOrCreate.SecurityParameters"
- c:f-ref="shibboleth.ChildLookup.RelyingParty" />
- </property>
- <property name="existingParametersContextLookupStrategy">
- <bean parent="shibboleth.Functions.Compose"
- c:g-ref="shibboleth.ChildLookup.SecurityParameters"
- c:f-ref="shibboleth.MessageContextLookup.Outbound" />
- </property>
- </bean>
-
- <bean id="shibboleth.oidc.SignatureValidationConfigurationLookup"
- class="net.shibboleth.oidc.profile.config.navigate.TokenEndpointJwtSignatureValidationConfigurationLookupFunction"
- p:relyingPartyConfigurationResolver-ref="shibboleth.RelyingPartyConfigurationResolver" />
-
- <bean id="shibboleth.oidc.TokenEndpointJwtSignatureValidationParametersResolver"
- class="net.shibboleth.idp.plugin.oidc.op.security.impl.OIDCClientInformationSignatureValidationParametersResolver"
- p:remoteJwkSetCache-ref="shibboleth.oidc.RemoteJwkSetCache"
- p:keyFetchInterval="%{idp.oidc.jwksuri.fetchInterval:PT30M}"
- p:parameterType="#{T(net.shibboleth.idp.plugin.oidc.op.security.impl.OIDCClientInformationSignatureValidationParametersResolver.ParameterType).TOKEN_ENDPOINT_JWT_VALIDATION}" />
-
<!-- Condition signaling that request was NOT for client_credentials grant. -->
<bean id="NotClientCredentialsGrantCondition" parent="shibboleth.Conditions.NOT">
<constructor-arg>
diff --git a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/token/token-flow.xml b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/token/token-flow.xml
index 0f6afca5..ef39434d 100644
--- a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/token/token-flow.xml
+++ b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/token/token-flow.xml
@@ -25,7 +25,6 @@
<evaluate expression="SelectRelyingPartyConfiguration" />
<evaluate expression="SelectProfileConfiguration" />
<evaluate expression="PostLookupPopulateAuditContext" />
- <evaluate expression="PopulateTokenEndpointJwtSignatureValidationParameters"/>
<evaluate expression="PopulateInboundInterceptContext" />
<evaluate expression="'proceed'" />
diff --git a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/AbstractOidcClientAuthenticationFlowTest.java b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/AbstractOidcClientAuthenticationFlowTest.java
index 647a678b..91c4d65a 100644
--- a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/AbstractOidcClientAuthenticationFlowTest.java
+++ b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/AbstractOidcClientAuthenticationFlowTest.java
@@ -144,6 +144,24 @@ public abstract class AbstractOidcClientAuthenticationFlowTest extends AbstractO
assertErrorDescriptionContains(result, getErrorDetaisForJWTValidation().getSecond());
}
+ @Test
+ public void testInvalidSecretJWT_replayJti() throws Exception {
+ final SignedJWT jwt = createSecretJWT(validClaimsSet(), clientSecret);
+ launchWithJwtAuthentication(jwt, JWSAlgorithm.HS256, ClientAuthenticationMethod.CLIENT_SECRET_JWT);
+ final FlowExecutionResult result = launchWithJwtAuthentication(jwt, JWSAlgorithm.HS256,
+ ClientAuthenticationMethod.CLIENT_SECRET_JWT);
+ assertErrorCode(result, getErrorDetaisForJWTValidation().getFirst());
+ assertErrorDescriptionContains(result, getErrorDetaisForJWTValidation().getSecond());
+ }
+
+ @Test
+ public void testValidSecretJWT() throws Exception {
+ final SignedJWT jwt = createSecretJWT(validClaimsSet(), clientSecret);
+ final FlowExecutionResult result = launchWithJwtAuthentication(jwt, JWSAlgorithm.HS256,
+ ClientAuthenticationMethod.CLIENT_SECRET_JWT);
+ assertSuccessResponse(result);
+ }
+
@Test
public void testInvalidPrivateKeyJWT_missingSub() throws Exception {
final SignedJWT jwt = createPrivateKeyJWT(claimsSetMissingSub(), rsaPrivateKey);
@@ -206,12 +224,31 @@ public abstract class AbstractOidcClientAuthenticationFlowTest extends AbstractO
assertErrorCode(result, getErrorDetaisForJWTValidation().getFirst());
assertErrorDescriptionContains(result, getErrorDetaisForJWTValidation().getSecond());
}
-
+
+ @Test
+ public void testInvalidPrivateKeyJWT_replayJti() throws Exception {
+ final SignedJWT jwt = createPrivateKeyJWT(validClaimsSet(), rsaPrivateKey);
+ launchWithJwtAuthentication(jwt, JWSAlgorithm.RS256, ClientAuthenticationMethod.PRIVATE_KEY_JWT);
+ final FlowExecutionResult result = launchWithJwtAuthentication(jwt, JWSAlgorithm.RS256,
+ ClientAuthenticationMethod.PRIVATE_KEY_JWT);
+ assertErrorCode(result, getErrorDetaisForJWTValidation().getFirst());
+ assertErrorDescriptionContains(result, getErrorDetaisForJWTValidation().getSecond());
+ }
+
+ @Test
+ public void testValidPrivateKeyJWT() throws Exception {
+ final SignedJWT jwt = createPrivateKeyJWT(validClaimsSet(), rsaPrivateKey);
+ final FlowExecutionResult result = launchWithJwtAuthentication(jwt, JWSAlgorithm.RS256,
+ ClientAuthenticationMethod.PRIVATE_KEY_JWT);
+ assertSuccessResponse(result);
+ }
+
protected JWTClaimsSet claimsSetMissingSub() {
return new JWTClaimsSet.Builder()
.issuer(clientId)
.audience(jwtAud)
.expirationTime(Date.from(Instant.now().plusSeconds(600)))
+ .jwtID(idGenerator.generateIdentifier())
.build();
}
@@ -220,7 +257,7 @@ public abstract class AbstractOidcClientAuthenticationFlowTest extends AbstractO
.subject(clientId)
.audience(jwtAud)
.expirationTime(Date.from(Instant.now().plusSeconds(600)))
- .jwtID("mockId")
+ .jwtID(idGenerator.generateIdentifier())
.build();
}
@@ -229,7 +266,7 @@ public abstract class AbstractOidcClientAuthenticationFlowTest extends AbstractO
.subject(clientId)
.issuer(clientId)
.expirationTime(Date.from(Instant.now().plusSeconds(600)))
- .jwtID("mockId")
+ .jwtID(idGenerator.generateIdentifier())
.build();
}
@@ -238,7 +275,7 @@ public abstract class AbstractOidcClientAuthenticationFlowTest extends AbstractO
.subject(clientId)
.issuer(clientId)
.audience(jwtAud)
- .jwtID("mockId")
+ .jwtID(idGenerator.generateIdentifier())
.build();
}
@@ -248,7 +285,7 @@ public abstract class AbstractOidcClientAuthenticationFlowTest extends AbstractO
.issuer(clientId)
.audience(jwtAud)
.expirationTime(Date.from(Instant.now().minusSeconds(600)))
- .jwtID("mockId")
+ .jwtID(idGenerator.generateIdentifier())
.build();
}
@@ -259,7 +296,7 @@ public abstract class AbstractOidcClientAuthenticationFlowTest extends AbstractO
.audience(jwtAud)
.expirationTime(Date.from(Instant.now().plusSeconds(600)))
.issueTime(Date.from(Instant.now().plusSeconds(600)))
- .jwtID("mockId")
+ .jwtID(idGenerator.generateIdentifier())
.build();
}
@@ -272,6 +309,16 @@ public abstract class AbstractOidcClientAuthenticationFlowTest extends AbstractO
.build();
}
+ protected JWTClaimsSet validClaimsSet() {
+ return new JWTClaimsSet.Builder()
+ .subject(clientId)
+ .issuer(clientId)
+ .audience(jwtAud)
+ .expirationTime(Date.from(Instant.now().plusSeconds(600)))
+ .jwtID(idGenerator.generateIdentifier())
+ .build();
+ }
+
protected ClientSecretJWT buildSecretJwtAuth(String secret) throws JOSEException, URISyntaxException {
return new ClientSecretJWT(new ClientID(clientId), new URI(jwtAud),
JWSAlgorithm.HS256, new Secret(secret));
@@ -288,7 +335,15 @@ public abstract class AbstractOidcClientAuthenticationFlowTest extends AbstractO
requestParameters.put("client_assertion_type", "urn:ietf:params:oauth:client-assertion-type:jwt-bearer");
}
-
+ /**
+ * Launch the flow with the JWT client authentication method.
+ *
+ * @param jwt The JWT to be used for client authentication.
+ * @param algorithm The algorithm to be used in the client authentication.
+ * @param method The client authentication method.
+ * @return The flow execution result.
+ * @throws Exception
+ */
protected abstract FlowExecutionResult launchWithJwtAuthentication(final SignedJWT jwt,
final JWSAlgorithm algorithm, final ClientAuthenticationMethod method) throws Exception;
@@ -300,4 +355,11 @@ public abstract class AbstractOidcClientAuthenticationFlowTest extends AbstractO
* @return The pair of error code and error description.
*/
protected abstract Pair<String, String> getErrorDetaisForJWTValidation();
+
+ /**
+ * Verify that the given result is a success response.
+ *
+ * @param result The flow execution result to be verified.
+ */
+ protected abstract void assertSuccessResponse(final FlowExecutionResult result);
}
diff --git a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/AbstractOidcFlowTest.java b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/AbstractOidcFlowTest.java
index b5a6b294..67d557e1 100644
--- a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/AbstractOidcFlowTest.java
+++ b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/AbstractOidcFlowTest.java
@@ -205,7 +205,7 @@ public abstract class AbstractOidcFlowTest extends AbstractFlowTest {
final ClientAuthenticationMethod tokenEndpointMethod, final JWSAlgorithm userInfoSigAlg,
final RSAPublicKey publicKey, final String... redirectUri) throws IOException {
storeMetadata(storageService, clientId, secret, scope, tokenEndpointSigAlg, null, null, tokenEndpointMethod,
- userInfoSigAlg, null, redirectUri);
+ userInfoSigAlg, publicKey, redirectUri);
}
protected void storeMetadata(final StorageService storageService, final String clientId, final String secret,
diff --git a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/ClientCredentialsTokenFlowTest.java b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/ClientCredentialsTokenFlowTest.java
index f9adef1b..dbac6db9 100644
--- a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/ClientCredentialsTokenFlowTest.java
+++ b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/ClientCredentialsTokenFlowTest.java
@@ -403,5 +403,12 @@ public class ClientCredentialsTokenFlowTest extends AbstractOidcClientAuthentica
}
}
}
-
+
+ protected void assertSuccessResponse(final FlowExecutionResult result) {
+ final AccessTokenResponse response = parseSuccessResponse(result, AccessTokenResponse.class);
+ Assert.assertNotNull(response.getTokens().getBearerAccessToken());
+ Assert.assertEquals(response.getTokens().getBearerAccessToken().getLifetime(), 600);
+ Assert.assertEquals(response.getTokens().getBearerAccessToken().getScope(), scope);
+
+ }
}
\ No newline at end of file
diff --git a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/IntrospectionFlowTest.java b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/IntrospectionFlowTest.java
index a3a3d37e..d9cfb6ac 100644
--- a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/IntrospectionFlowTest.java
+++ b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/IntrospectionFlowTest.java
@@ -31,7 +31,7 @@ import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.beans.factory.annotation.Qualifier;
import org.springframework.webflow.executor.FlowExecutionResult;
import org.testng.Assert;
-import org.testng.annotations.BeforeMethod;
+import org.testng.annotations.AfterMethod;
import org.testng.annotations.Test;
import com.nimbusds.jose.JOSEException;
@@ -74,8 +74,8 @@ public class IntrospectionFlowTest extends AbstractOidcClientAuthenticationFlowT
super(FLOW_ID);
}
- @BeforeMethod
- public void setup() throws IOException {
+ @AfterMethod
+ public void tearDown() throws IOException {
removeMetadata(storageService, clientId);
}
@@ -355,7 +355,7 @@ public class IntrospectionFlowTest extends AbstractOidcClientAuthenticationFlowT
storeMetadata(storageService, clientId, null, scope, algorithm, method, null, rsaPublicKey);
}
final String accessToken =
- buildToken(clientId, "sub", Scope.parse("openid")).toJSONObject().getAsString("access_token");
+ buildToken(clientId, "sub", scope).toJSONObject().getAsString("access_token");
final Map<String, String> requestParameters = createRequestParameters(accessToken, clientId);
populateClientAssertionParams(requestParameters, jwt);
setHttpFormRequest("POST", requestParameters);
@@ -373,4 +373,13 @@ public class IntrospectionFlowTest extends AbstractOidcClientAuthenticationFlowT
return new Pair<>("invalid_client", "Client authentication failed");
}
+ protected void assertSuccessResponse(final FlowExecutionResult result) {
+ final TokenIntrospectionSuccessResponse resp =
+ parseSuccessResponse(result, TokenIntrospectionSuccessResponse.class);
+ Assert.assertTrue(resp.isActive());
+ Assert.assertEquals(resp.getClientID().getValue(), clientId);
+ Assert.assertEquals(resp.getScope(), scope);
+ Assert.assertNull(resp.getAudience());
+ }
+
}
\ No newline at end of file
diff --git a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/RevocationFlowTest.java b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/RevocationFlowTest.java
index 83265876..8b2ce8e2 100644
--- a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/RevocationFlowTest.java
+++ b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/RevocationFlowTest.java
@@ -30,7 +30,7 @@ import org.opensaml.storage.StorageService;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.beans.factory.annotation.Qualifier;
import org.springframework.webflow.executor.FlowExecutionResult;
-import org.testng.annotations.BeforeMethod;
+import org.testng.annotations.AfterMethod;
import org.testng.annotations.Test;
import com.nimbusds.jose.JOSEException;
@@ -73,8 +73,8 @@ public class RevocationFlowTest extends AbstractOidcClientAuthenticationFlowTest
super(FLOW_ID);
}
- @BeforeMethod
- public void setup() throws IOException {
+ @AfterMethod
+ public void tearDown() throws IOException {
removeMetadata(storageService, clientId);
}
@@ -151,7 +151,7 @@ public class RevocationFlowTest extends AbstractOidcClientAuthenticationFlowTest
final FlowExecutionResult result = flowExecutor.launchExecution(FLOW_ID, null, externalContext);
parseSuccessResponse(result, OAuth2RevocationSuccessResponse.class);
}
-
+
protected FlowExecutionResult launchWithJwtAuthentication(final SignedJWT jwt, final JWSAlgorithm algorithm,
final ClientAuthenticationMethod method) throws Exception {
if (ClientAuthenticationMethod.CLIENT_SECRET_JWT.equals(method)) {
@@ -241,7 +241,7 @@ public class RevocationFlowTest extends AbstractOidcClientAuthenticationFlowTest
final FlowExecutionResult result = flowExecutor.launchExecution(FLOW_ID, null, externalContext);
parseSuccessResponse(result, OAuth2RevocationSuccessResponse.class);
}
-
+
@Test
public void testSuccessJWTWrongKey() throws JOSEException, IOException {
setBasicAuth(clientId, clientSecret);
@@ -256,4 +256,7 @@ public class RevocationFlowTest extends AbstractOidcClientAuthenticationFlowTest
parseSuccessResponse(result, OAuth2RevocationSuccessResponse.class);
}
+ protected void assertSuccessResponse(final FlowExecutionResult result) {
+ parseSuccessResponse(result, OAuth2RevocationSuccessResponse.class);
+ }
}
\ No newline at end of file
diff --git a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/TokenFlowTest.java b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/TokenFlowTest.java
index 01fd363e..b1c66592 100644
--- a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/TokenFlowTest.java
+++ b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/TokenFlowTest.java
@@ -578,7 +578,7 @@ public class TokenFlowTest extends AbstractOidcClientAuthenticationFlowTest {
protected FlowExecutionResult launchWithJwtAuthentication(final SignedJWT jwt, final JWSAlgorithm algorithm,
final ClientAuthenticationMethod method) throws Exception {
final String code = ValidateGrantTest.buildAuthorizationCode(clientId, "https://op.example.org", "jdoe", "mock",
- redirectUri).toString();
+ redirectUri, scope.toString()).toString();
if (ClientAuthenticationMethod.CLIENT_SECRET_JWT.equals(method)) {
storeMetadata(storageService, clientId, clientSecret, scope, algorithm, method);
} else {
@@ -625,4 +625,10 @@ public class TokenFlowTest extends AbstractOidcClientAuthenticationFlowTest {
return new Pair<>("invalid_client", "Client authentication failed");
}
+ protected void assertSuccessResponse(final FlowExecutionResult result) {
+ final OIDCTokenResponse response = parseSuccessResponse(result, OIDCTokenResponse.class);
+ Assert.assertNotNull(response.getTokens().getAccessToken());
+ Assert.assertNotNull(response.getOIDCTokens().getIDToken());
+ }
+
}
diff --git a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/UserInfoTest.java b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/UserInfoTest.java
index cbdc9d0d..74d72e42 100644
--- a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/UserInfoTest.java
+++ b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/UserInfoTest.java
@@ -27,6 +27,7 @@ import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.beans.factory.annotation.Qualifier;
import org.springframework.webflow.executor.FlowExecutionResult;
import org.testng.Assert;
+import org.testng.annotations.AfterMethod;
import org.testng.annotations.BeforeMethod;
import org.testng.annotations.Test;
@@ -72,6 +73,11 @@ public class UserInfoTest extends AbstractOidcApiFlowTest {
removeMetadata(storageService, clientId);
}
+ @AfterMethod
+ public void tearDown() throws IOException {
+ removeMetadata(storageService, clientId);
+ }
+
@Test
public void testNoAccessToken() {
final FlowExecutionResult result = flowExecutor.launchExecution(FLOW_ID, null, externalContext);
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list