[java-idp-oidc] 01/02: JCOMOIDC-41 - Move OIDC Signature Validation resolvers and parameter classes to commons
Henri Mikkonen
henri.mikkonen at iki.fi
Tue Apr 4 11:27:12 UTC 2023
This is an automated email from the git hooks/post-receive script.
hjmikkon pushed a commit to branch main
in repository java-idp-oidc.
View the commit online:
http://git.shibboleth.net/view/?p=java-idp-oidc.git;a=commit;h=f08bab98488c8c028a739d5571cc4ca6003ec78d
commit f08bab98488c8c028a739d5571cc4ca6003ec78d
Author: Henri Mikkonen <henri.mikkonen at iki.fi>
AuthorDate: Tue Apr 4 14:19:45 2023 +0300
JCOMOIDC-41 - Move OIDC Signature Validation resolvers and parameter classes to commons
https://shibboleth.atlassian.net/browse/JCOMOIDC-41
Fixed authorization code and access token hash calculation configuration and improved tests.
---
.../idp/flows/oidc/authorize/authorize-beans.xml | 6 +++---
.../shibboleth/idp/flows/oidc/token/token-beans.xml | 2 +-
.../oidc/op/profile/flow/AuthorizeFlowTest.java | 12 ++++++++++--
.../plugin/oidc/op/profile/flow/TokenFlowTest.java | 20 ++++++++++++++++++++
4 files changed, 34 insertions(+), 6 deletions(-)
diff --git a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/authorize/authorize-beans.xml b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/authorize/authorize-beans.xml
index 5ab3c083..c3d2edf5 100644
--- a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/authorize/authorize-beans.xml
+++ b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/authorize/authorize-beans.xml
@@ -792,7 +792,7 @@
<property name="securityParametersLookupStrategy">
<bean parent="shibboleth.Functions.Compose"
c:g-ref="shibboleth.oidc.ChildLookup.JWTSecurityParameters"
- c:f-ref="shibboleth.ChildLookup.RelyingParty" />
+ c:f-ref="shibboleth.MessageContextLookup.Outbound" />
</property>
</bean>
@@ -802,14 +802,14 @@
<property name="securityParametersLookupStrategy">
<bean parent="shibboleth.Functions.Compose"
c:g-ref="shibboleth.oidc.ChildLookup.JWTSecurityParameters"
- c:f-ref="shibboleth.ChildLookup.RelyingParty" />
+ c:f-ref="shibboleth.MessageContextLookup.Outbound" />
</property>
<property name="codeHashCalculationStrategy">
<bean class="net.shibboleth.idp.plugin.oidc.op.profile.context.navigate.DefaultComputeAuthorizationCodeHashFunction">
<property name="securityParametersLookupStrategy">
<bean parent="shibboleth.Functions.Compose"
c:g-ref="shibboleth.oidc.ChildLookup.JWTSecurityParameters"
- c:f-ref="shibboleth.ChildLookup.RelyingParty" />
+ c:f-ref="shibboleth.MessageContextLookup.Outbound" />
</property>
<property name="authorizationCodeLookupStrategy">
<bean class="net.shibboleth.idp.plugin.oidc.op.profile.context.navigate.ResponseContextAuthorizationCodeLookupFunction" />
diff --git a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/token/token-beans.xml b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/token/token-beans.xml
index 982a8764..2d603ca2 100644
--- a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/token/token-beans.xml
+++ b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/token/token-beans.xml
@@ -480,7 +480,7 @@
<property name="securityParametersLookupStrategy">
<bean parent="shibboleth.Functions.Compose"
c:g-ref="shibboleth.oidc.ChildLookupOrCreate.JWTSecurityParameters"
- c:f-ref="shibboleth.ChildLookup.RelyingParty" />
+ c:f-ref="shibboleth.MessageContextLookup.Outbound" />
</property>
</bean>
diff --git a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/AuthorizeFlowTest.java b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/AuthorizeFlowTest.java
index ae90c90a..5d133c17 100644
--- a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/AuthorizeFlowTest.java
+++ b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/AuthorizeFlowTest.java
@@ -255,7 +255,7 @@ public class AuthorizeFlowTest extends AbstractOidcFlowTest {
}
@Test
- public void testWithImplicitFlowIssInResponse() throws IOException, SessionException {
+ public void testWithImplicitFlowIssInResponse() throws IOException, SessionException, ParseException {
request.setMethod("GET");
setRequestParameters(List.of(new Pair<>("client_id", "mockClientIdIssInResponse"),
new Pair<>("response_type", "id_token"),
@@ -271,6 +271,8 @@ public class AuthorizeFlowTest extends AbstractOidcFlowTest {
final AuthenticationSuccessResponse successResponse = responseMessage.toSuccessResponse();
Assert.assertEquals(successResponse.getRedirectionURI().toString(), redirectUri);
Assert.assertNotNull(successResponse.getIDToken());
+ Assert.assertNull(successResponse.getIDToken().getJWTClaimsSet().getClaim("c_hash"));
+ Assert.assertNull(successResponse.getIDToken().getJWTClaimsSet().getClaim("at_hash"));
Assert.assertNotNull(getSidFromIDToken(successResponse));
Assert.assertNull(successResponse.getAccessToken());
Assert.assertNull(successResponse.getAuthorizationCode());
@@ -319,6 +321,8 @@ public class AuthorizeFlowTest extends AbstractOidcFlowTest {
final AuthenticationSuccessResponse successResponse = responseMessage.toSuccessResponse();
Assert.assertEquals(successResponse.getRedirectionURI().toString(), redirectUri);
Assert.assertNotNull(successResponse.getIDToken());
+ Assert.assertNull(successResponse.getIDToken().getJWTClaimsSet().getClaim("c_hash"));
+ Assert.assertNotNull(successResponse.getIDToken().getJWTClaimsSet().getClaim("at_hash"));
final String sid1 = getSidFromIDToken(successResponse);
Assert.assertNotNull(sid1);
Assert.assertNotNull(successResponse.getAccessToken());
@@ -461,7 +465,7 @@ public class AuthorizeFlowTest extends AbstractOidcFlowTest {
}
@Test
- public void testWithHybridIdTokenFlow() throws IOException, SessionException {
+ public void testWithHybridIdTokenFlow() throws IOException, SessionException, ParseException {
request.setMethod("GET");
setRequestParameters(List.of(new Pair<>("client_id", "mockClientId"),
new Pair<>("response_type", "code id_token"),
@@ -477,6 +481,8 @@ public class AuthorizeFlowTest extends AbstractOidcFlowTest {
final AuthenticationSuccessResponse successResponse = responseMessage.toSuccessResponse();
Assert.assertEquals(successResponse.getRedirectionURI().toString(), redirectUri);
Assert.assertNotNull(successResponse.getIDToken());
+ Assert.assertNotNull(successResponse.getIDToken().getJWTClaimsSet().getClaim("c_hash"));
+ Assert.assertNull(successResponse.getIDToken().getJWTClaimsSet().getClaim("at_hash"));
final String sid1 = getSidFromIDToken(successResponse);
Assert.assertNotNull(sid1);
Assert.assertNull(successResponse.getAccessToken());
@@ -666,6 +672,8 @@ public class AuthorizeFlowTest extends AbstractOidcFlowTest {
final AuthenticationSuccessResponse successResponse = responseMessage.toSuccessResponse();
Assert.assertEquals(successResponse.getRedirectionURI().toString(), redirectUri);
Assert.assertNotNull(successResponse.getIDToken());
+ Assert.assertNotNull(successResponse.getIDToken().getJWTClaimsSet().getClaim("c_hash"));
+ Assert.assertNotNull(successResponse.getIDToken().getJWTClaimsSet().getClaim("at_hash"));
Assert.assertNotNull(successResponse.getAccessToken());
Assert.assertNotNull(successResponse.getAuthorizationCode());
Assert.assertNull(successResponse.getIssuer());
diff --git a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/TokenFlowTest.java b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/TokenFlowTest.java
index 214cff7c..7b0e54bb 100644
--- a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/TokenFlowTest.java
+++ b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/TokenFlowTest.java
@@ -224,6 +224,7 @@ public class TokenFlowTest extends AbstractOidcClientAuthenticationFlowTest {
Assert.assertNotNull(response.getTokens().getAccessToken());
Assert.assertNotNull(response.getTokens().getRefreshToken());
Assert.assertNotNull(response.getOIDCTokens().getIDToken());
+ Assert.assertNotNull(response.getOIDCTokens().getIDToken().getJWTClaimsSet().getClaim("at_hash"));
Assert.assertNull(getSidFromAccessToken(response.getTokens().getAccessToken()));
Assert.assertNull(getSidFromRefreshToken(response.getTokens().getRefreshToken()));
Assert.assertNull(getSidFromJWT(response.getOIDCTokens().getIDToken()));
@@ -240,6 +241,7 @@ public class TokenFlowTest extends AbstractOidcClientAuthenticationFlowTest {
Assert.assertNotNull(response.getTokens().getAccessToken());
Assert.assertNotNull(response.getTokens().getRefreshToken());
Assert.assertNotNull(response.getOIDCTokens().getIDToken());
+ Assert.assertNotNull(response.getOIDCTokens().getIDToken().getJWTClaimsSet().getClaim("at_hash"));
Assert.assertEquals(getSidFromAccessToken(response.getTokens().getAccessToken()), sid);
Assert.assertEquals(getSidFromRefreshToken(response.getTokens().getRefreshToken()), sid);
Assert.assertEquals(getSidFromJWT(response.getOIDCTokens().getIDToken()), sid);
@@ -263,6 +265,7 @@ public class TokenFlowTest extends AbstractOidcClientAuthenticationFlowTest {
Assert.assertNotNull(response.getTokens().getAccessToken());
Assert.assertNotNull(response.getTokens().getRefreshToken());
Assert.assertNotNull(response.getOIDCTokens().getIDToken());
+ Assert.assertNotNull(response.getOIDCTokens().getIDToken().getJWTClaimsSet().getClaim("at_hash"));
}
@Test
@@ -297,6 +300,7 @@ public class TokenFlowTest extends AbstractOidcClientAuthenticationFlowTest {
Assert.assertNotNull(response.getTokens().getAccessToken());
Assert.assertNotNull(response.getTokens().getRefreshToken());
Assert.assertNotNull(response.getOIDCTokens().getIDToken());
+ Assert.assertNotNull(response.getOIDCTokens().getIDToken().getJWTClaimsSet().getClaim("at_hash"));
final IDTokenClaimsSet idToken = new IDTokenClaimsSet(response.getOIDCTokens().getIDToken().getJWTClaimsSet());
Assert.assertNotNull(idToken);
@@ -351,6 +355,7 @@ public class TokenFlowTest extends AbstractOidcClientAuthenticationFlowTest {
Assert.assertNotNull(response.getTokens().getAccessToken());
Assert.assertNull(response.getTokens().getRefreshToken());
Assert.assertNotNull(response.getOIDCTokens().getIDToken());
+ Assert.assertNotNull(response.getOIDCTokens().getIDToken().getJWTClaimsSet().getClaim("at_hash"));
}
@Test
@@ -365,6 +370,7 @@ public class TokenFlowTest extends AbstractOidcClientAuthenticationFlowTest {
Assert.assertNotNull(response.getTokens().getAccessToken());
Assert.assertNull(response.getTokens().getRefreshToken());
Assert.assertNotNull(response.getOIDCTokens().getIDToken());
+ Assert.assertNotNull(response.getOIDCTokens().getIDToken().getJWTClaimsSet().getClaim("at_hash"));
}
//mockClientIdPKCEPlainUnforced
@@ -379,6 +385,7 @@ public class TokenFlowTest extends AbstractOidcClientAuthenticationFlowTest {
final OIDCTokenResponse response = parseSuccessResponse(result, OIDCTokenResponse.class);
Assert.assertNotNull(response.getTokens().getAccessToken());
Assert.assertNotNull(response.getOIDCTokens().getIDToken());
+ Assert.assertNotNull(response.getOIDCTokens().getIDToken().getJWTClaimsSet().getClaim("at_hash"));
final AccessTokenClaimsSet token =
AccessTokenClaimsSet.parse(response.getTokens().getAccessToken().getValue(), getDataSealer());
@@ -396,6 +403,7 @@ public class TokenFlowTest extends AbstractOidcClientAuthenticationFlowTest {
final AccessToken accessToken = response.getTokens().getAccessToken();
Assert.assertNotNull(accessToken);
Assert.assertNotNull(response.getOIDCTokens().getIDToken());
+ Assert.assertNotNull(response.getOIDCTokens().getIDToken().getJWTClaimsSet().getClaim("at_hash"));
Assert.assertNull(getSidFromAccessToken(accessToken));
Assert.assertNull(getSidFromJWT(response.getOIDCTokens().getIDToken()));
validateConsentFromAccessToken(response, false);
@@ -410,6 +418,7 @@ public class TokenFlowTest extends AbstractOidcClientAuthenticationFlowTest {
final AccessToken accessToken = response.getTokens().getAccessToken();
Assert.assertNotNull(accessToken);
Assert.assertNotNull(response.getOIDCTokens().getIDToken());
+ Assert.assertNotNull(response.getOIDCTokens().getIDToken().getJWTClaimsSet().getClaim("at_hash"));
Assert.assertNull(getSidFromAccessToken(accessToken));
Assert.assertNull(getSidFromJWT(response.getOIDCTokens().getIDToken()));
validateConsentFromAccessToken(response, true);
@@ -437,6 +446,7 @@ public class TokenFlowTest extends AbstractOidcClientAuthenticationFlowTest {
final JWT idToken = response.getOIDCTokens().getIDToken();
Assert.assertNotNull(idToken);
Assert.assertEquals(idToken.getJWTClaimsSet().getClaim("email"), "jdoe at example.org");
+ Assert.assertNotNull(idToken.getJWTClaimsSet().getClaim("at_hash"));
}
protected String buildAuthorizationCode(final String clientId) throws Exception {
@@ -546,6 +556,7 @@ public class TokenFlowTest extends AbstractOidcClientAuthenticationFlowTest {
final OIDCTokenResponse response = parseSuccessResponse(result, OIDCTokenResponse.class);
Assert.assertNotNull(response.getTokens().getAccessToken());
Assert.assertNotNull(response.getOIDCTokens().getIDToken());
+ Assert.assertNotNull(response.getOIDCTokens().getIDToken().getJWTClaimsSet().getClaim("at_hash"));
}
@Test
@@ -555,6 +566,7 @@ public class TokenFlowTest extends AbstractOidcClientAuthenticationFlowTest {
final OIDCTokenResponse response = parseSuccessResponse(result, OIDCTokenResponse.class);
Assert.assertNotNull(response.getTokens().getAccessToken());
Assert.assertNotNull(response.getOIDCTokens().getIDToken());
+ Assert.assertNotNull(response.getOIDCTokens().getIDToken().getJWTClaimsSet().getClaim("at_hash"));
}
@Test
@@ -607,6 +619,7 @@ public class TokenFlowTest extends AbstractOidcClientAuthenticationFlowTest {
Assert.assertNotNull(response.getTokens().getAccessToken());
Assert.assertNotNull(response.getTokens().getRefreshToken());
Assert.assertNotNull(response.getOIDCTokens().getIDToken());
+ Assert.assertNotNull(response.getOIDCTokens().getIDToken().getJWTClaimsSet().getClaim("at_hash"));
}
@Test
@@ -741,6 +754,7 @@ public class TokenFlowTest extends AbstractOidcClientAuthenticationFlowTest {
final AccessToken accessToken = response.getTokens().getAccessToken();
Assert.assertNotNull(accessToken);
Assert.assertNotNull(response.getOIDCTokens().getIDToken());
+ Assert.assertNotNull(response.getOIDCTokens().getIDToken().getJWTClaimsSet().getClaim("at_hash"));
validateConsentFromAccessToken(response, false);
}
@@ -753,6 +767,7 @@ public class TokenFlowTest extends AbstractOidcClientAuthenticationFlowTest {
final AccessToken accessToken = response.getTokens().getAccessToken();
Assert.assertNotNull(accessToken);
Assert.assertNotNull(response.getOIDCTokens().getIDToken());
+ Assert.assertNotNull(response.getOIDCTokens().getIDToken().getJWTClaimsSet().getClaim("at_hash"));
validateConsentFromAccessToken(response, true);
}
@@ -767,6 +782,7 @@ public class TokenFlowTest extends AbstractOidcClientAuthenticationFlowTest {
final AccessToken accessToken = response.getTokens().getAccessToken();
Assert.assertNotNull(accessToken);
Assert.assertNotNull(response.getOIDCTokens().getIDToken());
+ Assert.assertNotNull(response.getOIDCTokens().getIDToken().getJWTClaimsSet().getClaim("at_hash"));
Assert.assertNull(getSidFromAccessToken(accessToken));
Assert.assertNull(getSidFromJWT(response.getOIDCTokens().getIDToken()));
validateConsentFromAccessToken(response, false);
@@ -786,6 +802,7 @@ public class TokenFlowTest extends AbstractOidcClientAuthenticationFlowTest {
final AccessToken accessToken = response.getTokens().getAccessToken();
Assert.assertNotNull(accessToken);
Assert.assertNotNull(response.getOIDCTokens().getIDToken());
+ Assert.assertNotNull(response.getOIDCTokens().getIDToken().getJWTClaimsSet().getClaim("at_hash"));
Assert.assertEquals(getSidFromAccessToken(accessToken), sid);
Assert.assertEquals(getSidFromJWT(response.getOIDCTokens().getIDToken()), sid);
validateConsentFromAccessToken(response, false);
@@ -805,6 +822,8 @@ public class TokenFlowTest extends AbstractOidcClientAuthenticationFlowTest {
Assert.assertNotNull(accessToken);
Assert.assertTrue(unwrapAccessToken(response).getClaimsSet().getAudience().contains("https://rp.example.org"));
Assert.assertNotNull(response.getOIDCTokens().getIDToken());
+ System.out.println("JWT: " + response.getOIDCTokens().getIDToken().serialize());
+ Assert.assertNotNull(response.getOIDCTokens().getIDToken().getJWTClaimsSet().getClaim("at_hash"));
validateConsentFromAccessToken(response, false);
Assert.assertFalse(revocationCache.isRevoked(RevocationCacheContexts.SINGLE_ACCESS_OR_REFRESH_TOKENS, id));
Assert.assertFalse(revocationCache.isRevoked(RevocationCacheContexts.AUTHORIZATION_CODE, rootId));
@@ -821,6 +840,7 @@ public class TokenFlowTest extends AbstractOidcClientAuthenticationFlowTest {
final AccessToken accessToken = response.getTokens().getAccessToken();
Assert.assertNotNull(accessToken);
Assert.assertNotNull(response.getOIDCTokens().getIDToken());
+ Assert.assertNotNull(response.getOIDCTokens().getIDToken().getJWTClaimsSet().getClaim("at_hash"));
validateConsentFromAccessToken(response, false);
Assert.assertTrue(revocationCache.isRevoked(RevocationCacheContexts.SINGLE_ACCESS_OR_REFRESH_TOKENS, id));
Assert.assertFalse(revocationCache.isRevoked(RevocationCacheContexts.AUTHORIZATION_CODE, rootId));
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list