[java-idp-plugin-oidc-rp] branch main updated: Add more tests
Phil Smart
philip.smart at jisc.ac.uk
Thu Sep 29 10:43:01 UTC 2022
This is an automated email from the git hooks/post-receive script.
philsmart pushed a commit to branch main
in repository java-idp-plugin-oidc-rp.
View the commit online:
http://git.shibboleth.net/view/?p=java-idp-plugin-oidc-rp.git;a=commit;h=6bbf4176f43c39c841abf79f04d68556d12201a5
The following commit(s) were added to refs/heads/main by this push:
new 6bbf417 Add more tests
6bbf417 is described below
commit 6bbf4176f43c39c841abf79f04d68556d12201a5
Author: Phil Smart <philip.smart at jisc.ac.uk>
AuthorDate: Thu Sep 29 11:42:56 2022 +0100
Add more tests
---
.../rp/impl/ValidateOAuthAccessTokenResponse.java | 13 +-
.../oidc/rp/impl/ProcessEndUserClaimsTest.java | 209 +++++++++++++++++++++
.../oidc/rp/impl/UserInfoEndpointLookupTest.java | 1 -
.../ValidateAuthenticationResponseResultTest.java | 99 ++++++++++
.../impl/ValidateOAuthAccessTokenResponseTest.java | 198 +++++++++++++++++++
5 files changed, 516 insertions(+), 4 deletions(-)
diff --git a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/ValidateOAuthAccessTokenResponse.java b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/ValidateOAuthAccessTokenResponse.java
index 3c69f12..014f3f3 100644
--- a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/ValidateOAuthAccessTokenResponse.java
+++ b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/ValidateOAuthAccessTokenResponse.java
@@ -37,8 +37,10 @@ import net.shibboleth.utilities.java.support.annotation.constraint.NotEmpty;
import net.shibboleth.utilities.java.support.component.ComponentSupport;
import net.shibboleth.utilities.java.support.logic.Constraint;
-/** Validation action that validates the OAuth Access Token Response against RFC 6749 section 5.1
- * and OpenID Connect Core 1.0 section 3.1.3.3.*/
+/**
+ * Validation action that validates the OAuth Access Token Response against RFC 6749 section 5.1
+ * and OpenID Connect Core 1.0 section 3.1.3.3.
+ */
public class ValidateOAuthAccessTokenResponse extends AbstractOIDCAuthenticationResponseAction {
/** Class logger. */
@@ -86,11 +88,16 @@ public class ValidateOAuthAccessTokenResponse extends AbstractOIDCAuthentication
}
// Look for an error response. This may never get here depending on the upflow response decoder used.
if (rawTokenResponse.containsKey("error")) {
- log.debug("{} Error response found instead of access token, error is '{}'", getLogPrefix(),
+ log.debug("{} Error response found instead of access token: '{}'", getLogPrefix(),
rawTokenResponse.get("error"));
ActionSupport.buildEvent(profileRequestContext, OidcEventIds.INVALID_ACCESS_TOKEN);
return;
}
+ if (!rawTokenResponse.containsKey("id_token")) {
+ log.warn("{} Access token response is invalid, no id_token found", getLogPrefix());
+ ActionSupport.buildEvent(profileRequestContext, OidcEventIds.INVALID_ACCESS_TOKEN);
+ return;
+ }
// Otherwise check is valid success response
if (!rawTokenResponse.containsKey("access_token")) {
log.warn("{} Access token response is invalid, no access_token found", getLogPrefix());
diff --git a/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/ProcessEndUserClaimsTest.java b/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/ProcessEndUserClaimsTest.java
new file mode 100644
index 0000000..fde38ec
--- /dev/null
+++ b/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/ProcessEndUserClaimsTest.java
@@ -0,0 +1,209 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.idp.plugin.authn.oidc.rp.impl;
+
+
+import static org.testng.Assert.assertEquals;
+import static org.testng.Assert.assertNotNull;
+import static org.testng.Assert.assertNull;
+import static org.testng.Assert.fail;
+
+import java.util.Map;
+import java.util.Set;
+import java.util.stream.Collectors;
+
+import org.opensaml.messaging.context.navigate.ChildContextLookup;
+import org.opensaml.messaging.context.navigate.ParentContextLookup;
+import org.opensaml.profile.action.EventIds;
+import org.opensaml.profile.context.ProfileRequestContext;
+import org.springframework.webflow.execution.Event;
+import org.testng.annotations.BeforeMethod;
+import org.testng.annotations.Test;
+
+import com.nimbusds.jwt.JWTClaimsSet;
+import com.nimbusds.jwt.PlainJWT;
+import com.nimbusds.oauth2.sdk.ParseException;
+import com.nimbusds.openid.connect.sdk.claims.ClaimsSet;
+
+import net.shibboleth.idp.authn.context.AuthenticationContext;
+import net.shibboleth.idp.plugin.authn.oidc.rp.context.AccessTokenResponseContext;
+import net.shibboleth.idp.plugin.authn.oidc.rp.context.EndUserClaimsContext;
+import net.shibboleth.idp.plugin.authn.oidc.rp.context.UserInfoResponseContext;
+import net.shibboleth.idp.plugin.authn.oidc.rp.messaging.PlainUserInfoResponse;
+import net.shibboleth.idp.profile.context.RelyingPartyContext;
+import net.shibboleth.idp.profile.context.navigate.WebflowRequestContextProfileRequestContextLookup;
+import net.shibboleth.idp.relyingparty.RelyingPartyConfiguration;
+import net.shibboleth.oidc.profile.config.OIDCAuthorizationConfiguration;
+import net.shibboleth.oidc.security.jwt.claims.impl.JWTClaims;
+
+/** Tests for {@link ProcessEndUserClaims}.*/
+public class ProcessEndUserClaimsTest extends AbstractOIDCTest {
+
+ /** The action to test.*/
+ private ProcessEndUserClaims action;
+
+ /** The RPC.*/
+ private RelyingPartyContext rpc;
+
+ /** The profile config.*/
+ private OIDCAuthorizationConfiguration oidcAuthzConfig;
+
+
+ @Override
+ @BeforeMethod
+ public void setup() throws Exception {
+ super.setup();
+ action = new ProcessEndUserClaims();
+
+ rpc = prc.getSubcontext(RelyingPartyContext.class, true);
+ oidcAuthzConfig = new OIDCAuthorizationConfiguration();
+ final RelyingPartyConfiguration rpConfig = new RelyingPartyConfiguration();
+ rpc.setProfileConfig(oidcAuthzConfig);
+ rpc.setConfiguration(rpConfig);
+
+ action.setProfileContextLookupStrategy(new ChildContextLookup<>(ProfileRequestContext.class).compose(
+ new ChildContextLookup<>(AuthenticationContext.class)
+ .compose(new WebflowRequestContextProfileRequestContextLookup())));
+
+ action.setAuthenticationContextLookupStrategy(new ParentContextLookup<>(AuthenticationContext.class));
+
+ // Merge by putting all from each
+ action.setClaimMergingStrategy((idToken, userInfo) -> {
+ final ClaimsSet out = new ClaimsSet();
+ out.putAll(idToken.toJSONObject());
+ out.putAll(userInfo.toJSONObject());
+ return out;
+ });
+
+ //remove some validation claims
+ action.setClaimSanitizationStrategy(claims -> {
+ final Set<String> validationClaims = Set.of(
+ JWTClaims.ISSUER_CLAIM.getClaimName(),
+ JWTClaims.AUDIENCE_CLAIM.getClaimName());
+
+ final ClaimsSet sanitizedClaims = new ClaimsSet();
+ final Map<String, Object> filteredMap = claims.toJSONObject().entrySet()
+ .stream()
+ .filter(c -> !validationClaims.contains(c.getKey()))
+ .collect(Collectors.toMap(Map.Entry::getKey, Map.Entry::getValue));
+ sanitizedClaims.putAll(filteredMap);
+ return sanitizedClaims;
+ });
+
+ action.setAccessTokenResponseContextLookupStrategy(prc -> {
+ final AccessTokenResponseContext atrc = new AccessTokenResponseContext();
+ final JWTClaimsSet claimsSet = new JWTClaimsSet.Builder()
+ .issuer("https://op.example.com")
+ .audience("https://rp.example.com")
+ .subject("joe")
+ .claim("family_name", "blogs")
+ .build();
+ atrc.setIdToken(new PlainJWT(claimsSet));
+ return atrc;
+ });
+
+ action.setUserInfoResponseContextLookupStrategy(prc -> {
+ final UserInfoResponseContext uirc = new UserInfoResponseContext();
+ final ClaimsSet claims = new ClaimsSet();
+ claims.setClaim("given_name", "joe");
+ claims.setClaim("email", "joe at example.com");
+ final PlainUserInfoResponse uir = new PlainUserInfoResponse(claims);
+ uirc.setUserInfo(uir);
+ return uirc;
+ });
+ }
+
+ @Test
+ public void testSuccess() throws Exception {
+ action.initialize();
+ action.execute(src);
+
+ assertNotNull(prc.getInboundMessageContext().getSubcontext(EndUserClaimsContext.class));
+ final EndUserClaimsContext claimsContext =
+ prc.getInboundMessageContext().getSubcontext(EndUserClaimsContext.class);
+ assertNull(claimsContext.getEndUserClaims().getClaim("iss"));
+ assertNull(claimsContext.getEndUserClaims().getClaim("aud"));
+ assertEquals(claimsContext.getEndUserClaims().getClaim("sub"), "joe");
+ assertEquals(claimsContext.getEndUserClaims().getClaim("family_name"), "blogs");
+ assertEquals(claimsContext.getEndUserClaims().getClaim("given_name"), "joe");
+ assertEquals(claimsContext.getEndUserClaims().getClaim("email"), "joe at example.com");
+ }
+
+ @Test
+ public void testSuccess_NoUserInfoClaims() throws Exception {
+
+ action.setUserInfoResponseContextLookupStrategy(prc -> null);
+
+ action.initialize();
+ action.execute(src);
+
+ assertNotNull(prc.getInboundMessageContext().getSubcontext(EndUserClaimsContext.class));
+ final EndUserClaimsContext claimsContext =
+ prc.getInboundMessageContext().getSubcontext(EndUserClaimsContext.class);
+ assertNull(claimsContext.getEndUserClaims().getClaim("iss"));
+ assertNull(claimsContext.getEndUserClaims().getClaim("aud"));
+ assertEquals(claimsContext.getEndUserClaims().getClaim("sub"), "joe");
+ assertEquals(claimsContext.getEndUserClaims().getClaim("family_name"), "blogs");
+ assertNull(claimsContext.getEndUserClaims().getClaim("given_name"), "joe");
+ assertNull(claimsContext.getEndUserClaims().getClaim("email"), "joe at example.com");
+ }
+
+ @Test
+ public void testSuccess_NoIDToken() throws Exception {
+
+ action.setAccessTokenResponseContextLookupStrategy(prc -> {
+ final AccessTokenResponseContext atrc = new AccessTokenResponseContext();
+ atrc.setIdToken(null);
+ return atrc;
+ });
+
+ action.initialize();
+ final Event event = action.execute(src);
+
+ assertEquals(event.getId(), EventIds.INVALID_PROFILE_CTX);
+
+ }
+
+ @Test
+ public void testSuccess_NoIDTokenClaims() throws Exception {
+
+ action.setAccessTokenResponseContextLookupStrategy(prc -> {
+ final AccessTokenResponseContext atrc = new AccessTokenResponseContext();
+ try {
+ atrc.setIdToken(new PlainJWT(new ClaimsSet().toJWTClaimsSet()));
+ } catch (final ParseException e) {
+ fail(e.getMessage());
+ }
+ return atrc;
+ });
+
+ action.initialize();
+ action.execute(src);
+
+ assertNotNull(prc.getInboundMessageContext().getSubcontext(EndUserClaimsContext.class));
+ final EndUserClaimsContext claimsContext =
+ prc.getInboundMessageContext().getSubcontext(EndUserClaimsContext.class);
+ assertNull(claimsContext.getEndUserClaims().getClaim("iss"));
+ assertNull(claimsContext.getEndUserClaims().getClaim("aud"));
+ assertEquals(claimsContext.getEndUserClaims().getClaim("given_name"), "joe");
+ assertEquals(claimsContext.getEndUserClaims().getClaim("email"), "joe at example.com");
+
+ }
+
+
+}
diff --git a/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/UserInfoEndpointLookupTest.java b/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/UserInfoEndpointLookupTest.java
index 3746325..45c7694 100644
--- a/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/UserInfoEndpointLookupTest.java
+++ b/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/UserInfoEndpointLookupTest.java
@@ -55,7 +55,6 @@ import net.shibboleth.idp.authn.AuthnEventIds;
import net.shibboleth.idp.authn.context.AuthenticationContext;
import net.shibboleth.idp.plugin.authn.oidc.rp.context.UserInfoResponseContext;
import net.shibboleth.idp.plugin.authn.oidc.rp.messaging.PlainUserInfoResponse;
-import net.shibboleth.idp.plugin.authn.oidc.rp.messaging.UserInfoResponse;
import net.shibboleth.idp.profile.context.navigate.WebflowRequestContextProfileRequestContextLookup;
/**
diff --git a/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/ValidateAuthenticationResponseResultTest.java b/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/ValidateAuthenticationResponseResultTest.java
new file mode 100644
index 0000000..a81473d
--- /dev/null
+++ b/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/ValidateAuthenticationResponseResultTest.java
@@ -0,0 +1,99 @@
+package net.shibboleth.idp.plugin.authn.oidc.rp.impl;
+
+import static org.testng.Assert.assertEquals;
+import static org.testng.Assert.assertNull;
+
+import java.net.URI;
+
+import org.opensaml.messaging.context.MessageContext;
+import org.opensaml.messaging.context.navigate.ChildContextLookup;
+import org.opensaml.messaging.context.navigate.ParentContextLookup;
+import org.opensaml.profile.action.EventIds;
+import org.opensaml.profile.context.ProfileRequestContext;
+import org.springframework.webflow.execution.Event;
+import org.testng.annotations.BeforeMethod;
+import org.testng.annotations.Test;
+
+import com.nimbusds.openid.connect.sdk.AuthenticationResponseParser;
+
+import net.shibboleth.idp.authn.context.AuthenticationContext;
+import net.shibboleth.idp.profile.context.navigate.WebflowRequestContextProfileRequestContextLookup;
+
+/** Tests for the {@link ValidateAuthenticationResponseResult} action.*/
+public class ValidateAuthenticationResponseResultTest extends AbstractOIDCTest {
+
+ /** The action to test.*/
+ private ValidateAuthenticationResponseResult action;
+
+ @Override
+ @BeforeMethod
+ public void setup() throws Exception {
+ super.setup();
+
+ action = new ValidateAuthenticationResponseResult();
+
+ action.setProfileContextLookupStrategy(new ChildContextLookup<>(ProfileRequestContext.class).compose(
+ new ChildContextLookup<>(AuthenticationContext.class)
+ .compose(new WebflowRequestContextProfileRequestContextLookup())));
+
+ action.setAuthenticationContextLookupStrategy(new ParentContextLookup<>(AuthenticationContext.class));
+ }
+
+ @Test
+ public void testSuccessfulResponse() throws Exception{
+ //Set the inbound response.
+ final MessageContext inMsgCtx = new MessageContext();
+ inMsgCtx.setMessage(AuthenticationResponseParser.parse(
+ new URI("/idp/profile/Authn/OIDC/RP/callback"
+ + "?state=8df98fd63a53fa5b5433d6f8754bca5d.65317332&"
+ + "code=z8C2DCp6sn0D9aGbEqlrFesdPVRXPtDX")));
+
+ prc.setInboundMessageContext(inMsgCtx);
+
+ action.initialize();
+ final Event event = action.execute(src);
+ assertNull(event);
+
+ }
+
+ @Test
+ public void testErrorNoMessageContext() throws Exception{
+
+ prc.setInboundMessageContext(null);
+
+ action.initialize();
+ final Event event = action.execute(src);
+ assertEquals(event.getId(), EventIds.INVALID_MSG_CTX);
+
+ }
+
+ @Test
+ public void testErrorNoAuthenticationResponse() throws Exception{
+
+ final MessageContext inMsgCtx = new MessageContext();
+ prc.setInboundMessageContext(inMsgCtx);
+
+ action.initialize();
+ final Event event = action.execute(src);
+ assertEquals(event.getId(), EventIds.INVALID_MSG_CTX);
+
+ }
+
+ @Test
+ public void testErrorResponse() throws Exception{
+ //Set the inbound response.
+ final MessageContext inMsgCtx = new MessageContext();
+ inMsgCtx.setMessage(AuthenticationResponseParser.parse(
+ new URI("/idp/profile/Authn/OIDC/RP/callback?"
+ + "error=login_required&error_description=Login%20required&"
+ + "state=d0c455126e9078aaf5a8e84c0e1910ad.65317332")));
+
+ prc.setInboundMessageContext(inMsgCtx);
+
+ action.initialize();
+ final Event event = action.execute(src);
+ assertEquals(event.getId(), EventIds.MESSAGE_PROC_ERROR);
+
+ }
+
+}
diff --git a/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/ValidateOAuthAccessTokenResponseTest.java b/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/ValidateOAuthAccessTokenResponseTest.java
new file mode 100644
index 0000000..0c1dbbf
--- /dev/null
+++ b/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/ValidateOAuthAccessTokenResponseTest.java
@@ -0,0 +1,198 @@
+package net.shibboleth.idp.plugin.authn.oidc.rp.impl;
+
+import static org.testng.Assert.assertEquals;
+import static org.testng.Assert.assertNull;
+
+import org.opensaml.messaging.context.navigate.ChildContextLookup;
+import org.opensaml.messaging.context.navigate.ParentContextLookup;
+import org.opensaml.profile.context.ProfileRequestContext;
+import org.springframework.webflow.execution.Event;
+import org.testng.annotations.BeforeMethod;
+import org.testng.annotations.Test;
+
+import com.nimbusds.jwt.JWTClaimsSet;
+import com.nimbusds.jwt.PlainJWT;
+
+import net.shibboleth.idp.authn.context.AuthenticationContext;
+import net.shibboleth.idp.plugin.authn.oidc.rp.context.AccessTokenResponseContext;
+import net.shibboleth.idp.profile.context.navigate.WebflowRequestContextProfileRequestContextLookup;
+import net.shibboleth.oidc.profile.core.OidcEventIds;
+
+public class ValidateOAuthAccessTokenResponseTest extends AbstractOIDCTest {
+
+ private ValidateOAuthAccessTokenResponse action;
+
+
+ @Override
+ @BeforeMethod
+ public void setup() throws Exception {
+ super.setup();
+ action = new ValidateOAuthAccessTokenResponse();
+
+ action.setProfileContextLookupStrategy(new ChildContextLookup<>(ProfileRequestContext.class).compose(
+ new ChildContextLookup<>(AuthenticationContext.class)
+ .compose(new WebflowRequestContextProfileRequestContextLookup())));
+
+ action.setAuthenticationContextLookupStrategy(new ParentContextLookup<>(AuthenticationContext.class));
+
+ }
+
+ @Test
+ public void testSuccesfulTokenResponse() throws Exception {
+ action.setTokenResponseContextLookupStrategy(prc -> {
+ final AccessTokenResponseContext atrc = new AccessTokenResponseContext();
+ final JWTClaimsSet claimsSet = new JWTClaimsSet.Builder()
+ .issuer("https://op.example.com")
+ .audience("https://rp.example.com")
+ .subject("joe")
+ .claim("family_name", "blogs")
+ .build();
+ atrc.setIdToken(new PlainJWT(claimsSet));
+ atrc.setRawTokenResponse(claimsSet.toJSONObject());
+ atrc.getRawTokenResponse().put("access_token", "access-token");
+ atrc.getRawTokenResponse().put("token_type","Bearer");
+ atrc.getRawTokenResponse().put("expires_in","3600");
+ atrc.getRawTokenResponse().put("id_token",new PlainJWT(claimsSet).serialize());
+ return atrc;
+ });
+
+ action.initialize();
+ final Event event = action.execute(src);
+
+ //Null event means response valid
+ assertNull(event);
+ }
+
+ @Test
+ public void testError_NoAccessToken() throws Exception {
+ action.setTokenResponseContextLookupStrategy(prc -> {
+ final AccessTokenResponseContext atrc = new AccessTokenResponseContext();
+ final JWTClaimsSet claimsSet = new JWTClaimsSet.Builder()
+ .issuer("https://op.example.com")
+ .audience("https://rp.example.com")
+ .subject("joe")
+ .claim("family_name", "blogs")
+ .build();
+ atrc.setIdToken(new PlainJWT(claimsSet));
+ atrc.setRawTokenResponse(claimsSet.toJSONObject());
+ atrc.getRawTokenResponse().put("token_type","Bearer");
+ atrc.getRawTokenResponse().put("expires_in","3600");
+ atrc.getRawTokenResponse().put("id_token",new PlainJWT(claimsSet).serialize());
+ return atrc;
+ });
+
+ action.initialize();
+ final Event event = action.execute(src);
+
+ assertEquals(event.getId(), OidcEventIds.INVALID_ACCESS_TOKEN);
+ }
+
+ @Test
+ public void testError_NoIDToken() throws Exception {
+ action.setTokenResponseContextLookupStrategy(prc -> {
+ final AccessTokenResponseContext atrc = new AccessTokenResponseContext();
+ final JWTClaimsSet claimsSet = new JWTClaimsSet.Builder()
+ .issuer("https://op.example.com")
+ .audience("https://rp.example.com")
+ .subject("joe")
+ .claim("family_name", "blogs")
+ .build();
+ atrc.setIdToken(new PlainJWT(claimsSet));
+ atrc.setRawTokenResponse(claimsSet.toJSONObject());
+ atrc.getRawTokenResponse().put("access_token", "access-token");
+ atrc.getRawTokenResponse().put("token_type","Bearer");
+ atrc.getRawTokenResponse().put("expires_in","3600");
+ return atrc;
+ });
+
+ action.initialize();
+ final Event event = action.execute(src);
+
+ assertEquals(event.getId(), OidcEventIds.INVALID_ACCESS_TOKEN);
+ }
+
+ @Test
+ public void testError_NoTokenType() throws Exception {
+ action.setTokenResponseContextLookupStrategy(prc -> {
+ final AccessTokenResponseContext atrc = new AccessTokenResponseContext();
+ final JWTClaimsSet claimsSet = new JWTClaimsSet.Builder()
+ .issuer("https://op.example.com")
+ .audience("https://rp.example.com")
+ .subject("joe")
+ .claim("family_name", "blogs")
+ .build();
+ atrc.setIdToken(new PlainJWT(claimsSet));
+ atrc.setRawTokenResponse(claimsSet.toJSONObject());
+ atrc.getRawTokenResponse().put("access_token", "access-token");
+ atrc.getRawTokenResponse().put("expires_in","3600");
+ atrc.getRawTokenResponse().put("id_token",new PlainJWT(claimsSet).serialize());
+ return atrc;
+ });
+
+ action.initialize();
+ final Event event = action.execute(src);
+
+ assertEquals(event.getId(), OidcEventIds.INVALID_ACCESS_TOKEN);
+ }
+
+ @Test
+ public void testError_NoRawTokenResponse() throws Exception {
+ action.setTokenResponseContextLookupStrategy(prc -> {
+ final AccessTokenResponseContext atrc = new AccessTokenResponseContext();
+ return atrc;
+ });
+
+ action.initialize();
+ final Event event = action.execute(src);
+
+ assertEquals(event.getId(), OidcEventIds.INVALID_ACCESS_TOKEN);
+ }
+
+ @Test
+ public void testError_WrongTokenType() throws Exception {
+ action.setTokenResponseContextLookupStrategy(prc -> {
+ final AccessTokenResponseContext atrc = new AccessTokenResponseContext();
+ final JWTClaimsSet claimsSet = new JWTClaimsSet.Builder()
+ .issuer("https://op.example.com")
+ .audience("https://rp.example.com")
+ .subject("joe")
+ .claim("family_name", "blogs")
+ .build();
+ atrc.setIdToken(new PlainJWT(claimsSet));
+ atrc.setRawTokenResponse(claimsSet.toJSONObject());
+ atrc.getRawTokenResponse().put("access_token", "access-token");
+ atrc.getRawTokenResponse().put("token_type","WrongType");
+ atrc.getRawTokenResponse().put("expires_in","3600");
+ atrc.getRawTokenResponse().put("id_token",new PlainJWT(claimsSet).serialize());
+ return atrc;
+ });
+
+ action.initialize();
+ final Event event = action.execute(src);
+
+ assertEquals(event.getId(), OidcEventIds.INVALID_ACCESS_TOKEN);
+ }
+
+ @Test
+ public void testError_ErrorResponse() throws Exception {
+ action.setTokenResponseContextLookupStrategy(prc -> {
+ final AccessTokenResponseContext atrc = new AccessTokenResponseContext();
+ final JWTClaimsSet claimsSet = new JWTClaimsSet.Builder()
+ .issuer("https://op.example.com")
+ .audience("https://rp.example.com")
+ .subject("joe")
+ .claim("family_name", "blogs")
+ .build();
+ atrc.setIdToken(new PlainJWT(claimsSet));
+ atrc.setRawTokenResponse(claimsSet.toJSONObject());
+ atrc.getRawTokenResponse().put("error", "invalid_request");
+ return atrc;
+ });
+
+ action.initialize();
+ final Event event = action.execute(src);
+
+ assertEquals(event.getId(), OidcEventIds.INVALID_ACCESS_TOKEN);
+ }
+
+}
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list