[java-idp-oidc] branch main updated: JOIDC-124 - refresh_token & audience
Henri Mikkonen
henri.mikkonen at iki.fi
Fri Sep 2 05:35:15 UTC 2022
This is an automated email from the git hooks/post-receive script.
hjmikkon pushed a commit to branch main
in repository java-idp-oidc.
View the commit online:
http://git.shibboleth.net/view/?p=java-idp-oidc.git;a=commit;h=8d760bc68beaa62b4c91c34e38efa0b760e74b2a
The following commit(s) were added to refs/heads/main by this push:
new 8d760bc6 JOIDC-124 - refresh_token & audience
8d760bc6 is described below
commit 8d760bc68beaa62b4c91c34e38efa0b760e74b2a
Author: Henri Mikkonen <henri.mikkonen at iki.fi>
AuthorDate: Fri Sep 2 08:32:38 2022 +0300
JOIDC-124 - refresh_token & audience
https://shibboleth.atlassian.net/browse/JOIDC-124
Included audience in refresh token & updated tests. Thank you Florian
Ritterhoff for providing the patch!
---
.../op/token/support/RefreshTokenClaimsSet.java | 1 +
.../plugin/oidc/op/profile/flow/TokenFlowTest.java | 33 +++++++++++++++++-----
.../oidc/op/profile/impl/ValidateGrantTest.java | 25 ++++++++++++----
3 files changed, 47 insertions(+), 12 deletions(-)
diff --git a/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/token/support/RefreshTokenClaimsSet.java b/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/token/support/RefreshTokenClaimsSet.java
index 682363e9..b060659b 100644
--- a/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/token/support/RefreshTokenClaimsSet.java
+++ b/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/token/support/RefreshTokenClaimsSet.java
@@ -140,6 +140,7 @@ public final class RefreshTokenClaimsSet extends TokenClaimsSet {
setNonce(existing.getNonce());
setRedirectURI(existing.getRedirectURI());
setScope(existing.getScope());
+ setAudience(existing.getAudience());
setClaimsRequest(existing.getClaimsRequest());
setDlClaims(existing.getDeliveryClaims());
setDlClaimsUI(existing.getUserinfoDeliveryClaims());
diff --git a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/TokenFlowTest.java b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/TokenFlowTest.java
index ec57697f..8e53ef2e 100644
--- a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/TokenFlowTest.java
+++ b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/TokenFlowTest.java
@@ -21,7 +21,9 @@ import java.io.IOException;
import java.text.ParseException;
import java.time.Duration;
import java.time.Instant;
+import java.util.Collection;
import java.util.HashMap;
+import java.util.List;
import java.util.Map;
import org.opensaml.storage.RevocationCache;
@@ -413,9 +415,9 @@ public class TokenFlowTest extends AbstractOidcClientAuthenticationFlowTest {
}
protected String buildRefreshToken(final String clientId, final String id, final String rootId,
- final String... consentedClaims) throws Exception {
+ final Collection<String> aud, final String... consentedClaims) throws Exception {
final TokenClaimsSet acClaims = ValidateGrantTest.buildTokenClaimsSet(clientId, "https://op.example.org", "jdoe", "mock", redirectUri,
- null, null, null, null, scope.toString());
+ null, null, null, null, scope.toString(), aud);
final RefreshTokenClaimsSet rtClaims = new RefreshTokenClaimsSet.Builder(acClaims, Instant.now(),
Instant.now().plus(Duration.ofHours(1)))
.setRootTokenIdentifier(rootId)
@@ -646,7 +648,7 @@ public class TokenFlowTest extends AbstractOidcClientAuthenticationFlowTest {
final String id = idGenerator.generateIdentifier();
final String rootId = idGenerator.generateIdentifier();
initializeGrantAndRequest(clientId, createRequestParameters(redirectUri, "refresh_token",
- buildRefreshToken(clientId, id, rootId), clientId));
+ buildRefreshToken(clientId, id, rootId, null), clientId));
final FlowExecutionResult result = flowExecutor.launchExecution(FLOW_ID, null, externalContext);
final OIDCTokenResponse response = parseSuccessResponse(result, OIDCTokenResponse.class);
final AccessToken accessToken = response.getTokens().getAccessToken();
@@ -657,12 +659,29 @@ public class TokenFlowTest extends AbstractOidcClientAuthenticationFlowTest {
Assert.assertFalse(revocationCache.isRevoked(RevocationCacheContexts.AUTHORIZATION_CODE, rootId));
}
+ @Test
+ public void testValidRefreshTokenGrantWithResource() throws Exception {
+ final String id = idGenerator.generateIdentifier();
+ final String rootId = idGenerator.generateIdentifier();
+ initializeGrantAndRequest(clientId, createRequestParameters(redirectUri, "refresh_token",
+ buildRefreshToken(clientId, id, rootId, List.of("https://rp.example.org")), clientId));
+ final FlowExecutionResult result = flowExecutor.launchExecution(FLOW_ID, null, externalContext);
+ final OIDCTokenResponse response = parseSuccessResponse(result, OIDCTokenResponse.class);
+ final AccessToken accessToken = response.getTokens().getAccessToken();
+ Assert.assertNotNull(accessToken);
+ Assert.assertTrue(unwrapAccessToken(response).getClaimsSet().getAudience().contains("https://rp.example.org"));
+ Assert.assertNotNull(response.getOIDCTokens().getIDToken());
+ validateConsentFromAccessToken(response, false);
+ Assert.assertFalse(revocationCache.isRevoked(RevocationCacheContexts.SINGLE_ACCESS_OR_REFRESH_TOKENS, id));
+ Assert.assertFalse(revocationCache.isRevoked(RevocationCacheContexts.AUTHORIZATION_CODE, rootId));
+ }
+
@Test
public void testValidRefreshTokenGrantRefreshTokenRotation() throws Exception {
final String id = idGenerator.generateIdentifier();
final String rootId = idGenerator.generateIdentifier();
initializeGrantAndRequest(clientIdRefreshTokenRotation, createRequestParameters(redirectUri, "refresh_token",
- buildRefreshToken(clientIdRefreshTokenRotation, id, rootId), clientIdRefreshTokenRotation));
+ buildRefreshToken(clientIdRefreshTokenRotation, id, rootId, null), clientIdRefreshTokenRotation));
final FlowExecutionResult result = flowExecutor.launchExecution(FLOW_ID, null, externalContext);
final OIDCTokenResponse response = parseSuccessResponse(result, OIDCTokenResponse.class);
final AccessToken accessToken = response.getTokens().getAccessToken();
@@ -679,7 +698,7 @@ public class TokenFlowTest extends AbstractOidcClientAuthenticationFlowTest {
final String rootId = idGenerator.generateIdentifier();
Assert.assertTrue(revocationCache.revoke(RevocationCacheContexts.SINGLE_ACCESS_OR_REFRESH_TOKENS, id));
initializeGrantAndRequest(clientIdRefreshTokenRotation, createRequestParameters(redirectUri, "refresh_token",
- buildRefreshToken(clientIdRefreshTokenRotation, id, rootId), clientIdRefreshTokenRotation));
+ buildRefreshToken(clientIdRefreshTokenRotation, id, rootId, null), clientIdRefreshTokenRotation));
final FlowExecutionResult result = flowExecutor.launchExecution(FLOW_ID, null, externalContext);
assertErrorCode(result, OAuth2Error.INVALID_GRANT_CODE);
Assert.assertTrue(revocationCache.isRevoked(RevocationCacheContexts.SINGLE_ACCESS_OR_REFRESH_TOKENS, id));
@@ -692,7 +711,7 @@ public class TokenFlowTest extends AbstractOidcClientAuthenticationFlowTest {
final String rootId = idGenerator.generateIdentifier();
Assert.assertTrue(revocationCache.revoke(RevocationCacheContexts.AUTHORIZATION_CODE, rootId));
initializeGrantAndRequest(clientIdRefreshTokenRotation, createRequestParameters(redirectUri, "refresh_token",
- buildRefreshToken(clientIdRefreshTokenRotation, id, rootId), clientIdRefreshTokenRotation));
+ buildRefreshToken(clientIdRefreshTokenRotation, id, rootId, null), clientIdRefreshTokenRotation));
final FlowExecutionResult result = flowExecutor.launchExecution(FLOW_ID, null, externalContext);
assertErrorCode(result, OAuth2Error.INVALID_GRANT_CODE);
Assert.assertTrue(revocationCache.isRevoked(RevocationCacheContexts.AUTHORIZATION_CODE, rootId));
@@ -703,7 +722,7 @@ public class TokenFlowTest extends AbstractOidcClientAuthenticationFlowTest {
final String id = idGenerator.generateIdentifier();
Assert.assertTrue(revocationCache.revoke(RevocationCacheContexts.AUTHORIZATION_CODE, id));
initializeGrantAndRequest(clientIdRefreshTokenRotation, createRequestParameters(redirectUri, "refresh_token",
- buildRefreshToken(clientIdRefreshTokenRotation, id, null), clientIdRefreshTokenRotation));
+ buildRefreshToken(clientIdRefreshTokenRotation, id, null, null), clientIdRefreshTokenRotation));
final FlowExecutionResult result = flowExecutor.launchExecution(FLOW_ID, null, externalContext);
assertErrorCode(result, OAuth2Error.INVALID_GRANT_CODE);
Assert.assertTrue(revocationCache.isRevoked(RevocationCacheContexts.AUTHORIZATION_CODE, id));
diff --git a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/ValidateGrantTest.java b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/ValidateGrantTest.java
index 76e91a6e..6da5aad0 100644
--- a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/ValidateGrantTest.java
+++ b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/ValidateGrantTest.java
@@ -34,6 +34,7 @@ import java.net.URI;
import java.security.NoSuchAlgorithmException;
import java.time.Duration;
import java.time.Instant;
+import java.util.Collection;
import java.util.function.Function;
import org.mockito.Mockito;
@@ -151,22 +152,33 @@ public class ValidateGrantTest extends BaseOIDCResponseActionTest {
static public AuthorizationCode buildAuthorizationCode(final String clientId, final String issuer,
final String userPrincipal, final String sub, final String callbackUrl, final String codeChallenge,
final String scope) throws Exception {
- return buildAuthorizationCode(clientId, issuer, userPrincipal, sub, callbackUrl, codeChallenge, null, null, null, scope);
+ return buildAuthorizationCode(clientId, issuer, userPrincipal, sub, callbackUrl, codeChallenge, null, null,
+ null, scope);
}
static public AuthorizationCode buildAuthorizationCode(final String clientId, final String issuer,
final String userPrincipal, final String sub, final String callbackUrl, final String codeChallenge,
final JSONObject deliveryClaims, final JSONObject deliveryClaimsIDToken,
final JSONObject deliveryClaimsUserInfo, final String scope) throws Exception {
+ return buildAuthorizationCode(clientId, issuer, userPrincipal, sub, callbackUrl, codeChallenge, deliveryClaims,
+ deliveryClaimsIDToken, deliveryClaimsUserInfo, scope, null);
+ }
+
+ static public AuthorizationCode buildAuthorizationCode(final String clientId, final String issuer,
+ final String userPrincipal, final String sub, final String callbackUrl, final String codeChallenge,
+ final JSONObject deliveryClaims, final JSONObject deliveryClaimsIDToken,
+ final JSONObject deliveryClaimsUserInfo, final String scope, final Collection<String> aud)
+ throws Exception {
final TokenClaimsSet acClaims = buildTokenClaimsSet(clientId, issuer, userPrincipal, sub, callbackUrl,
- codeChallenge, deliveryClaims, deliveryClaimsIDToken, deliveryClaimsUserInfo, scope);
+ codeChallenge, deliveryClaims, deliveryClaimsIDToken, deliveryClaimsUserInfo, scope, aud);
return new AuthorizationCode(acClaims.serialize(new ValidateGrantTest().getDataSealer()));
}
static public TokenClaimsSet buildTokenClaimsSet(final String clientId, final String issuer,
final String userPrincipal, final String sub, final String callbackUrl, final String codeChallenge,
final JSONObject deliveryClaims, final JSONObject deliveryClaimsIDToken,
- final JSONObject deliveryClaimsUserInfo, final String scope) throws Exception {
+ final JSONObject deliveryClaimsUserInfo, final String scope, final Collection<String> aud)
+ throws Exception {
final Instant now = Instant.now();
final AuthorizeCodeClaimsSet.Builder builder = new AuthorizeCodeClaimsSet.Builder();
builder.setJWTID(new SecureRandomIdentifierGenerationStrategy())
@@ -178,6 +190,7 @@ public class ValidateGrantTest extends BaseOIDCResponseActionTest {
.setExpiresAt(now.plusSeconds(100))
.setAuthenticationTime(now)
.setRedirectURI(new URI(callbackUrl))
+ .setAudience(aud)
.setScope(scope == null ? new Scope() : Scope.parse(scope));
if (codeChallenge != null) {
@@ -280,8 +293,10 @@ public class ValidateGrantTest extends BaseOIDCResponseActionTest {
@Test
public void testTokenRevocationViaRevokedTokenFailsReturnsInvalidProfileConfig() throws Exception {
RevocationCache revocationCache = Mockito.mock(RevocationCache.class);
- Mockito.when(revocationCache.isRevoked(Mockito.matches(RevocationCacheContexts.AUTHORIZATION_CODE), Mockito.anyString())).thenReturn(false);
- Mockito.when(revocationCache.isRevoked(Mockito.matches(RevocationCacheContexts.SINGLE_ACCESS_OR_REFRESH_TOKENS), Mockito.anyString())).thenReturn(true);
+ Mockito.when(revocationCache.isRevoked(Mockito.matches(RevocationCacheContexts.AUTHORIZATION_CODE),
+ Mockito.anyString())).thenReturn(false);
+ Mockito.when(revocationCache.isRevoked(Mockito.matches(RevocationCacheContexts.SINGLE_ACCESS_OR_REFRESH_TOKENS),
+ Mockito.anyString())).thenReturn(true);
Mockito.when(revocationCache.revoke(Mockito.anyString(), Mockito.anyString())).thenReturn(false);
init(true, revocationCache, prc -> null);
final TokenRequest req = new TokenRequest(callback, new ClientID(clientId), rfGrant);
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list