[java-oidc-common] branch main updated: Fix test and improve naming
Phil Smart
philip.smart at jisc.ac.uk
Tue Oct 11 08:50:36 UTC 2022
This is an automated email from the git hooks/post-receive script.
philsmart pushed a commit to branch main
in repository java-oidc-common.
View the commit online:
http://git.shibboleth.net/view/?p=java-oidc-common.git;a=commit;h=d3b0311469b77693388ded57794c96234e0a8e27
The following commit(s) were added to refs/heads/main by this push:
new d3b0311 Fix test and improve naming
d3b0311 is described below
commit d3b0311469b77693388ded57794c96234e0a8e27
Author: Phil Smart <philip.smart at jisc.ac.uk>
AuthorDate: Tue Oct 11 09:50:30 2022 +0100
Fix test and improve naming
---
.../impl/ExplicitKeySignedJWTTrustEngineTest.java | 123 ++++++++-------------
1 file changed, 49 insertions(+), 74 deletions(-)
diff --git a/oidc-common-crypto-impl/src/test/java/net/shibboleth/oidc/security/impl/ExplicitKeySignedJWTTrustEngineTest.java b/oidc-common-crypto-impl/src/test/java/net/shibboleth/oidc/security/impl/ExplicitKeySignedJWTTrustEngineTest.java
index 41fb427..c4555de 100644
--- a/oidc-common-crypto-impl/src/test/java/net/shibboleth/oidc/security/impl/ExplicitKeySignedJWTTrustEngineTest.java
+++ b/oidc-common-crypto-impl/src/test/java/net/shibboleth/oidc/security/impl/ExplicitKeySignedJWTTrustEngineTest.java
@@ -23,6 +23,7 @@ import static org.testng.Assert.fail;
import java.net.URI;
import java.net.URISyntaxException;
+import java.security.KeyException;
import java.util.Collections;
import java.util.List;
@@ -58,6 +59,7 @@ import net.shibboleth.oidc.security.credential.impl.BasicJOSEObjectCredentialRes
import net.shibboleth.utilities.java.support.resolver.CriteriaSet;
import net.shibboleth.utilities.java.support.resolver.ResolverException;
+/** Tests for the {@link ExplicitKeySignedJWTTrustEngine}.*/
public class ExplicitKeySignedJWTTrustEngineTest {
private ExplicitKeySignedJWTTrustEngine engine;
@@ -111,7 +113,7 @@ public class ExplicitKeySignedJWTTrustEngineTest {
}
@Test
- public void testSuccess_WithTrustedCredential() throws JOSEException, SecurityException {
+ public void testValid_WithTrustedCredential() throws JOSEException, SecurityException {
final CriteriaSet criteria = new CriteriaSet();
criteria.add(new UsageCriterion(UsageType.SIGNING));
@@ -123,12 +125,35 @@ public class ExplicitKeySignedJWTTrustEngineTest {
}
@Test
- public void testSuccess_WithTrustedSymmetricKeyCredential() throws JOSEException, SecurityException {
+ public void testValid_WithSymmetricKeyCredential() throws JOSEException, SecurityException {
+
+ credResolver = new CredentialResolver() {
+
+ @Override
+ public Credential resolveSingle(final CriteriaSet criteria) throws ResolverException {
+ try {
+ return TestCredentialHelper
+ .createSharedSecretCredential("mockKey", CLIENT_SECRET,
+ JWSAlgorithm.HS256, UsageType.SIGNING);
+ } catch (final KeyException e) {
+ fail(e.getMessage());
+ return null;
+ }
+ }
+
+ @Override
+ public Iterable<Credential> resolve(final CriteriaSet criteria) throws ResolverException {
+ return List.of(resolveSingle(criteria));
+ }
+ };
+
+ engine = new ExplicitKeySignedJWTTrustEngine(credResolver, joseObjectCredResolver);
+
final CriteriaSet criteria = new CriteriaSet();
criteria.add(new UsageCriterion(UsageType.SIGNING));
- final var valid = engine.validate(createMACSignedJWT("SECRET", key.getKeyID(), JWSAlgorithm.HS256,
+ final var valid = engine.validate(createMACSignedJWT(CLIENT_SECRET, key.getKeyID(), JWSAlgorithm.HS256,
"https://op.example.com/", "https://rp.example.com"),
criteria);
assertTrue(valid);
@@ -149,7 +174,7 @@ public class ExplicitKeySignedJWTTrustEngineTest {
* @throws Exception on error.
*/
@Test
- public void test_CVE_2016_10555() throws Exception {
+ public void testInvalid_CVE_2016_10555() throws Exception {
credResolver = new CredentialResolver() {
@@ -193,7 +218,7 @@ public class ExplicitKeySignedJWTTrustEngineTest {
}
@Test
- public void testSuccess_WithInlineJWK() throws JOSEException, SecurityException {
+ public void testValid_WithInlineJWK() throws JOSEException, SecurityException {
final CriteriaSet criteria = new CriteriaSet();
criteria.add(new UsageCriterion(UsageType.SIGNING));
@@ -212,7 +237,7 @@ public class ExplicitKeySignedJWTTrustEngineTest {
* @throws Exception on error.
*/
@Test
- public void testSuccess_WithInlineSharedSecretJWK() throws Exception {
+ public void testInvalid_WithInlineSharedSecretJWK() throws Exception {
final CriteriaSet criteria = new CriteriaSet();
criteria.add(new UsageCriterion(UsageType.SIGNING));
@@ -242,7 +267,7 @@ public class ExplicitKeySignedJWTTrustEngineTest {
/* JKU resolution not currently supported by the joseObjectCredResolver.*/
@Test(enabled = false)
- public void testSuccess_WithInlineJKU() throws JOSEException, SecurityException, URISyntaxException {
+ public void testValid_WithInlineJKU() throws JOSEException, SecurityException, URISyntaxException {
// Create a new resolver which does not resolve any creds, the JKU ones need to be resolved.
credResolver = new CredentialResolver() {
@@ -270,7 +295,7 @@ public class ExplicitKeySignedJWTTrustEngineTest {
}
@Test
- public void testFailure_InlineJWKWrongKid() throws JOSEException, SecurityException {
+ public void testInvalid_InlineJWKWrongKid() throws JOSEException, SecurityException {
// Create a new resolver which does not resolve any creds, the kid JOSE headers are different
// than the one in the JWK, and should fail.
@@ -297,7 +322,7 @@ public class ExplicitKeySignedJWTTrustEngineTest {
}
@Test
- public void testFailure_InlineJWKInvalidSignature() throws JOSEException, SecurityException {
+ public void testInvalid_InlineJWKInvalidSignature() throws JOSEException, SecurityException {
final CriteriaSet criteria = new CriteriaSet();
criteria.add(new UsageCriterion(UsageType.SIGNING));
@@ -309,39 +334,25 @@ public class ExplicitKeySignedJWTTrustEngineTest {
assertFalse(valid);
}
-
-
/**
- * Create an RSA signed JWS without a JKU or inline JWK.
+ * Build a basic claims set using the audience and issuer provided.
*
- * @param key the key to sign the JWT.
- * @param keyId the keyId to describe the key to use in the header.
- * @param algo the key algorithm.
- * @param issuer the issuer.
- * @param audience the audience.
- * @return the signed JWT
- * @throws JOSEException on error.
+ * @param issuer the issuer
+ * @param audience the audience
+ *
+ * @return the constructed claims set
*/
- private SignedJWT createRSASignedJWT(final RSAKey key, final String keyId,
- final JWSAlgorithm algo, final String issuer,
- final String audience) throws JOSEException {
-
- final var header = new JWSHeader.Builder(algo)
- .type(JOSEObjectType.JWT)
- .keyID(keyId)
- .build();
- final var payload = new JWTClaimsSet.Builder()
+ private JWTClaimsSet buildStandardClaims( final String issuer, final String audience) {
+
+ return new JWTClaimsSet.Builder()
.issuer(issuer)
.audience(audience)
.subject("jdoe")
.claim("preferred_username", "jdoe")
.claim("name", "J Doe")
.build();
-
- final var signedJWT = new SignedJWT(header, payload);
- signedJWT.sign(new RSASSASigner(key.toPrivateKey()));
- return signedJWT;
}
+
/**
* Create an MAC signed JWS with inline JWK. This should never be a thing
@@ -369,13 +380,7 @@ public class ExplicitKeySignedJWTTrustEngineTest {
.keyID(keyId)
.jwk(key)
.build();
- final var payload = new JWTClaimsSet.Builder()
- .issuer(issuer)
- .audience(audience)
- .subject("jdoe")
- .claim("preferred_username", "jdoe")
- .claim("name", "J Doe")
- .build();
+ final var payload = buildStandardClaims(issuer, audience);
final var signedJWT = new SignedJWT(header, payload);
signedJWT.sign(new MACSigner(secret.getBytes(StandardCharset.UTF_8)));
@@ -401,13 +406,7 @@ public class ExplicitKeySignedJWTTrustEngineTest {
.type(JOSEObjectType.JWT)
.keyID(keyId)
.build();
- final var payload = new JWTClaimsSet.Builder()
- .issuer(issuer)
- .audience(audience)
- .subject("jdoe")
- .claim("preferred_username", "jdoe")
- .claim("name", "J Doe")
- .build();
+ final var payload =buildStandardClaims(issuer, audience);
final var signedJWT = new SignedJWT(header, payload);
signedJWT.sign(new ECDSASigner(key.toECPrivateKey()));
@@ -434,13 +433,7 @@ public class ExplicitKeySignedJWTTrustEngineTest {
.type(JOSEObjectType.JWT)
.keyID(keyId)
.build();
- final var payload = new JWTClaimsSet.Builder()
- .issuer(issuer)
- .audience(audience)
- .subject("jdoe")
- .claim("preferred_username", "jdoe")
- .claim("name", "J Doe")
- .build();
+ final var payload = buildStandardClaims(issuer, audience);
final var signedJWT = new SignedJWT(header, payload);
signedJWT.sign(new MACSigner(key));
@@ -468,13 +461,7 @@ public class ExplicitKeySignedJWTTrustEngineTest {
.keyID(keyId)
.jwkURL(jku)
.build();
- final var payload = new JWTClaimsSet.Builder()
- .issuer(issuer)
- .audience(audience)
- .subject("jdoe")
- .claim("preferred_username", "jdoe")
- .claim("name", "J Doe")
- .build();
+ final var payload = buildStandardClaims(issuer, audience);
final var signedJWT = new SignedJWT(header, payload);
signedJWT.sign(new ECDSASigner(key.toECPrivateKey()));
@@ -501,13 +488,7 @@ public class ExplicitKeySignedJWTTrustEngineTest {
.keyID(keyId)
.jwk(key)
.build();
- final var payload = new JWTClaimsSet.Builder()
- .issuer(issuer)
- .audience(audience)
- .subject("jdoe")
- .claim("preferred_username", "jdoe")
- .claim("name", "J Doe")
- .build();
+ final var payload = buildStandardClaims(issuer, audience);
final var signedJWT = new SignedJWT(header, payload);
signedJWT.sign(new ECDSASigner(key.toECPrivateKey()));
@@ -536,13 +517,7 @@ public class ExplicitKeySignedJWTTrustEngineTest {
.keyID(keyId)
.jwk(key)
.build();
- final var payload = new JWTClaimsSet.Builder()
- .issuer(issuer)
- .audience(audience)
- .subject("jdoe")
- .claim("preferred_username", "jdoe")
- .claim("name", "J Doe")
- .build();
+ final var payload = buildStandardClaims(issuer, audience);
final var signedJWT = new SignedJWT(header, payload);
signedJWT.sign(new ECDSASigner(signingKey.toECPrivateKey()));
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list