[java-idp-oidc] branch main updated: JOIDC-148 - Improve support for request_uris in dynamic client registration
Henri Mikkonen
henri.mikkonen at iki.fi
Fri Apr 7 10:44:48 UTC 2023
This is an automated email from the git hooks/post-receive script.
hjmikkon pushed a commit to branch main
in repository java-idp-oidc.
View the commit online:
http://git.shibboleth.net/view/?p=java-idp-oidc.git;a=commit;h=4ec3372372a421cdd61ded094a8249e849ab94d1
The following commit(s) were added to refs/heads/main by this push:
new 4ec33723 JOIDC-148 - Improve support for request_uris in dynamic client registration
4ec33723 is described below
commit 4ec3372372a421cdd61ded094a8249e849ab94d1
Author: Henri Mikkonen <henri.mikkonen at iki.fi>
AuthorDate: Fri Apr 7 13:43:26 2023 +0300
JOIDC-148 - Improve support for request_uris in dynamic client registration
https://shibboleth.atlassian.net/browse/JOIDC-148
A new action 'AddRequestUrisToClientMetadata' stores the request_uris from the
request, if the claim was included.
---
.../impl/AddRequestUrisToClientMetadata.java | 44 ++++++++++++
.../idp/flows/oidc/register/register-beans.xml | 5 +-
.../idp/flows/oidc/register/register-flow.xml | 1 +
.../oidc/op/profile/flow/RegistrationFlowTest.java | 5 +-
.../impl/AddRequestUrisToClientMetadataTest.java | 78 ++++++++++++++++++++++
5 files changed, 131 insertions(+), 2 deletions(-)
diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/AddRequestUrisToClientMetadata.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/AddRequestUrisToClientMetadata.java
new file mode 100644
index 00000000..2367205c
--- /dev/null
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/AddRequestUrisToClientMetadata.java
@@ -0,0 +1,44 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.idp.plugin.oidc.op.profile.impl;
+
+import javax.annotation.Nonnull;
+
+import org.opensaml.profile.context.ProfileRequestContext;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+import com.nimbusds.openid.connect.sdk.rp.OIDCClientMetadata;
+
+/**
+ * Adds the pre-registered request_uri values to the output {@link OIDCClientMetadata}. The values are expected to be
+ * already validated. The validation can be done via metadata policy.
+ */
+public class AddRequestUrisToClientMetadata extends AbstractOIDCClientMetadataPopulationAction {
+
+ /** Class logger. */
+ @Nonnull
+ private final Logger log = LoggerFactory.getLogger(AddRequestUrisToClientMetadata.class);
+
+ /** {@inheritDoc} */
+ @Override
+ protected void doExecute(@Nonnull final ProfileRequestContext profileRequestContext) {
+ getOutputMetadata().setRequestObjectURIs(getInputMetadata().getRequestObjectURIs());
+ }
+
+}
\ No newline at end of file
diff --git a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/register/register-beans.xml b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/register/register-beans.xml
index de7f7a33..89f37f79 100644
--- a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/register/register-beans.xml
+++ b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/register/register-beans.xml
@@ -151,7 +151,10 @@
class="net.shibboleth.idp.plugin.oidc.op.profile.impl.AddRequestObjectSecurityConfigurationToClientMetadata"
p:allowSignatureNone="%{idp.oidc.dynreg.allowNoneForRequestSigning:true}" scope="prototype" />
- <bean id="AddRemainingClaimsToClientMetadata"
+ <bean id="AddRequestUrisToClientMetadata" scope="prototype"
+ class="net.shibboleth.idp.plugin.oidc.op.profile.impl.AddRequestUrisToClientMetadata" />
+
+ <bean id="AddRemainingClaimsToClientMetadata" scope="prototype"
class="net.shibboleth.idp.plugin.oidc.op.profile.impl.AddRemainingClaimsToClientMetadata" />
<bean id="StoreClientInformation"
diff --git a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/register/register-flow.xml b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/register/register-flow.xml
index 22f1e438..5483d3ad 100644
--- a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/register/register-flow.xml
+++ b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/register/register-flow.xml
@@ -61,6 +61,7 @@
<evaluate expression="AddClientNameToClientMetadata" />
<evaluate expression="AddSecurityConfigurationToClientMetadata" />
<evaluate expression="AddRequestObjectSecurityConfigurationToClientMetadata" />
+ <evaluate expression="AddRequestUrisToClientMetadata" />
<evaluate expression="AddRemainingClaimsToClientMetadata" />
<evaluate expression="'proceed'" />
<transition on="proceed" to="PopulateOutboundInterceptContext" />
diff --git a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/RegistrationFlowTest.java b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/RegistrationFlowTest.java
index b86faa7e..db599eb5 100644
--- a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/RegistrationFlowTest.java
+++ b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/RegistrationFlowTest.java
@@ -21,6 +21,7 @@ import java.io.IOException;
import java.net.URI;
import java.net.URISyntaxException;
import java.time.Instant;
+import java.util.Set;
import org.opensaml.storage.StorageService;
import org.springframework.beans.factory.annotation.Autowired;
@@ -102,7 +103,8 @@ public class RegistrationFlowTest extends AbstractOidcFlowTest {
@Test
public void testUnauthenticated_success() throws Exception {
- setJsonRequest("POST", "{ \"redirect_uris\":[\"" + redirectUri + "\"] }");
+ final String requestUri = "https://client.example.org/rf.txt#qpXaRLh_n93TTR9F252ValdatUQvQiJi5BDub2BeznA";
+ setJsonRequest("POST", "{ \"redirect_uris\":[\"" + redirectUri + "\"], \"request_uris\":[\"" + requestUri + "\"] }");
final FlowExecutionResult result = flowExecutor.launchExecution(FLOW_ID, null, externalContext);
final OIDCClientInformationResponse parsedResponse =
parseSuccessResponse(result, OIDCClientInformationResponse.class);
@@ -116,6 +118,7 @@ public class RegistrationFlowTest extends AbstractOidcFlowTest {
Assert.assertEquals(storedInfo.getID(), clientInfo.getID());
Assert.assertEquals(storedInfo.getSecret(), clientInfo.getSecret());
Assert.assertEquals(storedInfo.getOIDCMetadata().getRedirectionURIStrings(), metadata.getRedirectionURIStrings());
+ Assert.assertEquals(storedInfo.getOIDCMetadata().getRequestObjectURIs(), Set.of(new URI(requestUri)));
Assert.assertTrue(metadata.getRedirectionURIStrings().contains(redirectUri));
}
diff --git a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/AddRequestUrisToClientMetadataTest.java b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/AddRequestUrisToClientMetadataTest.java
new file mode 100644
index 00000000..37a480c5
--- /dev/null
+++ b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/AddRequestUrisToClientMetadataTest.java
@@ -0,0 +1,78 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.idp.plugin.oidc.op.profile.impl;
+
+import java.net.URI;
+import java.net.URISyntaxException;
+import java.util.Set;
+
+import org.testng.Assert;
+import org.testng.annotations.BeforeMethod;
+import org.testng.annotations.Test;
+
+import com.nimbusds.openid.connect.sdk.rp.OIDCClientMetadata;
+
+import net.shibboleth.utilities.java.support.component.ComponentInitializationException;
+
+/**
+ * Unit tests for {@link AddRequestUrisToClientMetadata}.
+ */
+public class AddRequestUrisToClientMetadataTest extends BaseOIDCClientMetadataPopulationTest {
+
+ AddRequestUrisToClientMetadata action;
+
+ URI requestUri1;
+ URI requestUri2;
+
+ @BeforeMethod
+ public void setUp() throws ComponentInitializationException, URISyntaxException {
+ action = new AddRequestUrisToClientMetadata();
+ action.initialize();
+ requestUri1 = new URI("https://example.org/object1");
+ requestUri2 = new URI("https://example.org/object2");
+ }
+
+ @Override
+ protected AbstractOIDCClientMetadataPopulationAction constructAction() {
+ return new AddRequestUrisToClientMetadata();
+ }
+
+ @Test
+ public void testOne() throws ComponentInitializationException {
+ final OIDCClientMetadata input = new OIDCClientMetadata();
+ input.setRequestObjectURIs(Set.of(requestUri1));
+ final OIDCClientMetadata output = new OIDCClientMetadata();
+ setUpContext(input, output);
+ Assert.assertNull(action.execute(requestCtx));
+ final Set<URI> resultUris = output.getRequestObjectURIs();
+ Assert.assertEquals(resultUris.size(), 1);
+ Assert.assertEquals(resultUris.iterator().next(), requestUri1);
+ }
+
+ @Test
+ public void testSet() throws ComponentInitializationException {
+ final OIDCClientMetadata input = new OIDCClientMetadata();
+ input.setRequestObjectURIs(Set.of(requestUri1, requestUri2));
+ final OIDCClientMetadata output = new OIDCClientMetadata();
+ setUpContext(input, output);
+ Assert.assertNull(action.execute(requestCtx));
+ final Set<URI> resultUris = output.getRequestObjectURIs();
+ Assert.assertEquals(resultUris, Set.of(requestUri1, requestUri2));
+ }
+
+}
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list