[java-idp-plugin-oidc-rp] branch main updated: Add test to assert failure condition if UserInfo JWT is not signed

[Phil Smart]

This is an automated email from the git hooks/post-receive script.

philsmart pushed a commit to branch main
in repository java-idp-plugin-oidc-rp.

View the commit online:
http://git.shibboleth.net/view/?p=java-idp-plugin-oidc-rp.git;a=commit;h=8456c6c9b801dfcfb9fe39eded9e09ed2d3efe94

The following commit(s) were added to refs/heads/main by this push:
     new 8456c6c  Add test to assert failure condition if UserInfo JWT is not signed
8456c6c is described below

commit 8456c6c9b801dfcfb9fe39eded9e09ed2d3efe94
Author: Phil Smart <philip.smart at jisc.ac.uk>
AuthorDate: Mon Apr 24 14:13:01 2023 +0100

    Add test to assert failure condition if UserInfo JWT is not signed
---
 .../OIDCRPFlowFromAuthenticationResponseTest.java  | 33 ++++++++++++++++++++++
 1 file changed, 33 insertions(+)

diff --git a/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/OIDCRPFlowFromAuthenticationResponseTest.java b/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/OIDCRPFlowFromAuthenticationResponseTest.java
index 98d6858..315df14 100644
--- a/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/OIDCRPFlowFromAuthenticationResponseTest.java
+++ b/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/OIDCRPFlowFromAuthenticationResponseTest.java
@@ -36,6 +36,7 @@ import com.nimbusds.jose.jwk.KeyUse;
 import com.nimbusds.jose.jwk.RSAKey;
 import com.nimbusds.jose.jwk.gen.ECKeyGenerator;
 import com.nimbusds.jose.jwk.gen.RSAKeyGenerator;
+import com.nimbusds.jwt.PlainJWT;
 import com.nimbusds.oauth2.sdk.ResponseType;
 import com.nimbusds.oauth2.sdk.id.ClientID;
 import com.nimbusds.openid.connect.sdk.AuthenticationResponseParser;
@@ -181,6 +182,38 @@ public class OIDCRPFlowFromAuthenticationResponseTest extends OIDCRPFlowTest {
         assertEndUserClaimsVerified(nestedPrc);     
     }
     
+    @Test 
+    public void test_IDTokenHS256_UserInfo_JWT_NotSigned() throws Exception {
+        
+        basicSetup();
+        
+        final MockWebServer mockOPServer = createSimpleServer();
+        final var accessTokenResp = TestTokenHelper.createAccessTokenResponseJSON(
+                Map.of("iss", OP_ISSUER_ID, "azp", CLIENT_ID, "aud", List.of(CLIENT_ID)),
+                JWSAlgorithm.HS256, null, null, new DefaultClientSecretCredential(CLIENT_SECRET).toSigningCredential(), 
+                null);     
+        
+        final var userInfoRespClaims = TestTokenHelper.createBasicUserInfoClaims(
+                Map.of("iss", OP_ISSUER_ID, "aud", List.of(CLIENT_ID)));
+        
+        final var userInfoResp = new PlainJWT(userInfoRespClaims);
+        
+        // First is token exchange
+        queueMockServerResponse(mockOPServer, 200, accessTokenResp, "application/json");
+        // Second is plain userInfo
+        queueMockServerResponse(mockOPServer, 200, userInfoResp.serialize(), "application/jwt");
+        
+        mockOPServer.start(9918);        
+
+        final var prc = resumeBasicFlow();
+        
+        mockOPServer.shutdown();
+        
+        // Assert test conditions
+        assertFlowEndedInErrorConditions(prc, "InvalidMessage");
+ 
+    }
+    
     @Test 
     public void test_IDTokenHS256_DirA128CBC_HS256_UserInfoES256_RSA_OAEP_256A256GCM() 
             throws Exception {

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.