[java-idp-plugin-oidc-rp] branch main updated: Add more lookup function tests
Phil Smart
philip.smart at jisc.ac.uk
Mon Apr 24 14:31:57 UTC 2023
This is an automated email from the git hooks/post-receive script.
philsmart pushed a commit to branch main
in repository java-idp-plugin-oidc-rp.
View the commit online:
http://git.shibboleth.net/view/?p=java-idp-plugin-oidc-rp.git;a=commit;h=923c6826530a8762e7a5130a2f4b20feebcb1555
The following commit(s) were added to refs/heads/main by this push:
new 923c682 Add more lookup function tests
923c682 is described below
commit 923c6826530a8762e7a5130a2f4b20feebcb1555
Author: Phil Smart <philip.smart at jisc.ac.uk>
AuthorDate: Mon Apr 24 15:31:51 2023 +0100
Add more lookup function tests
- Fix a few unlikely NPEs
---
.../navigate/RequestObjectTokenUpdateStrategy.java | 2 +-
.../navigate/SubFromIDTokenLookupFunction.java | 5 +-
...lientIDFromOAuth2ClientContextFunctionTest.java | 65 +++++++++++
.../DefaulUserInfoJWTLookupStrategyTest.java | 78 +++++++++++++
.../DefaultEndUserClaimsLookupStrategyTest.java | 69 +++++++++++
.../navigate/DefaultIDTokenLookupStrategyTest.java | 80 +++++++++++++
.../EncryptedIDTokenLookupStrategyTest.java | 126 +++++++++++++++++++++
.../EncryptedUserInfoJWTLookupStrategyTest.java | 84 ++++++++++++++
.../IDTokenInAccessTokenUpdateStrategyTest.java | 19 +++-
.../navigate/SubFromIDTokenLookupFunctionTest.java | 117 +++++++++++++++++++
...RequiresSignatureVerificationPredicateTest.java | 19 +++-
.../OIDCRPFlowFromAuthenticationResponseTest.java | 3 +-
12 files changed, 659 insertions(+), 8 deletions(-)
diff --git a/idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/context/navigate/RequestObjectTokenUpdateStrategy.java b/idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/context/navigate/RequestObjectTokenUpdateStrategy.java
index 8321805..a2cc682 100644
--- a/idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/context/navigate/RequestObjectTokenUpdateStrategy.java
+++ b/idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/context/navigate/RequestObjectTokenUpdateStrategy.java
@@ -36,7 +36,7 @@ public class RequestObjectTokenUpdateStrategy implements BiConsumer<JWT, Message
/** Class logger. */
@Nonnull
- private final Logger log = LoggerFactory.getLogger(AccessTokenLookupStrategy.class);
+ private final Logger log = LoggerFactory.getLogger(RequestObjectTokenUpdateStrategy.class);
/** Strategy used to locate the {@link OIDCAuthenticationRequest} to sign. */
@Nonnull private Function<MessageContext, OIDCAuthenticationRequest> authenticationRequestLookupStrategy;
diff --git a/idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/context/navigate/SubFromIDTokenLookupFunction.java b/idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/context/navigate/SubFromIDTokenLookupFunction.java
index 78a1c79..5c3dafd 100644
--- a/idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/context/navigate/SubFromIDTokenLookupFunction.java
+++ b/idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/context/navigate/SubFromIDTokenLookupFunction.java
@@ -72,12 +72,13 @@ public class SubFromIDTokenLookupFunction extends AbstractTokenResponseLookupStr
@Nullable
public String apply(@Nonnull final ProfileRequestContext prc, @Nullable final JWTClaimsSet claimsSet) {
final AccessTokenResponseContext tokenContext = getTokenResponseContextLookupStrategy().apply(prc);
- if (tokenContext == null || tokenContext.getTokenResponse().getOIDCTokens().getIDToken() == null) {
+ if (tokenContext == null || tokenContext.getTokenResponse() == null ||
+ tokenContext.getTokenResponse().getOIDCTokens().getIDToken() == null) {
return null;
}
try {
final JWTClaimsSet claims = tokenContext.getTokenResponse().getOIDCTokens().getIDToken().getJWTClaimsSet();
- if (claims.getSubject() != null) {
+ if (claims != null && claims.getSubject() != null) {
return claims.getSubject();
}
} catch (final ParseException e) {
diff --git a/idp-oidc-rp-api/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/context/navigate/ClientIDFromOAuth2ClientContextFunctionTest.java b/idp-oidc-rp-api/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/context/navigate/ClientIDFromOAuth2ClientContextFunctionTest.java
new file mode 100644
index 0000000..c89ab37
--- /dev/null
+++ b/idp-oidc-rp-api/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/context/navigate/ClientIDFromOAuth2ClientContextFunctionTest.java
@@ -0,0 +1,65 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.idp.plugin.authn.oidc.rp.context.navigate;
+
+import static org.testng.Assert.assertEquals;
+
+import org.opensaml.profile.context.ProfileRequestContext;
+import org.testng.annotations.BeforeMethod;
+import org.testng.annotations.Test;
+
+import com.nimbusds.jwt.JWTClaimsSet;
+
+import net.shibboleth.idp.plugin.authn.oidc.rp.context.OAuth2ClientContext;
+
+/** Tests for {@link ClientIDFromOAuth2ClientContextFunctionTest}.*/
+public class ClientIDFromOAuth2ClientContextFunctionTest {
+
+ private static final String CLIENT_ID = "test_client";
+
+ private ClientIDFromOAuth2ClientContextFunction function;
+
+ private ProfileRequestContext prc;
+
+ private OAuth2ClientContext testContext;
+
+ @BeforeMethod
+ public void setup() {
+ prc = new ProfileRequestContext();
+ testContext = new OAuth2ClientContext();
+ function = new ClientIDFromOAuth2ClientContextFunction(prc -> testContext);
+ }
+
+ @Test
+ public void testGetClientID() {
+ testContext.setClientId(CLIENT_ID);
+ assertEquals(function.apply(prc, new JWTClaimsSet.Builder().build()),CLIENT_ID);
+ }
+
+ @Test
+ public void testGetClientID_NoClientID() {
+ assertEquals(function.apply(prc, new JWTClaimsSet.Builder().build()),null);
+ }
+
+ @Test
+ public void testGetClientID_NoClientContext() {
+ function = new ClientIDFromOAuth2ClientContextFunction(prc -> null);
+ assertEquals(function.apply(prc, new JWTClaimsSet.Builder().build()),null);
+ }
+
+}
diff --git a/idp-oidc-rp-api/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/context/navigate/DefaulUserInfoJWTLookupStrategyTest.java b/idp-oidc-rp-api/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/context/navigate/DefaulUserInfoJWTLookupStrategyTest.java
new file mode 100644
index 0000000..104fe12
--- /dev/null
+++ b/idp-oidc-rp-api/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/context/navigate/DefaulUserInfoJWTLookupStrategyTest.java
@@ -0,0 +1,78 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.idp.plugin.authn.oidc.rp.context.navigate;
+
+import static org.testng.Assert.assertEquals;
+
+import java.text.ParseException;
+
+import org.opensaml.profile.context.ProfileRequestContext;
+import org.testng.annotations.BeforeMethod;
+import org.testng.annotations.Test;
+
+import com.nimbusds.jwt.JWTClaimsSet;
+import com.nimbusds.jwt.PlainJWT;
+import com.nimbusds.openid.connect.sdk.UserInfoSuccessResponse;
+import com.nimbusds.openid.connect.sdk.claims.ClaimsSet;
+import com.nimbusds.openid.connect.sdk.claims.UserInfo;
+
+import net.shibboleth.idp.plugin.authn.oidc.rp.context.UserInfoResponseContext;
+
+/** Tests for {@link DefaultUserInfoJWTLookupStrategy}.*/
+public class DefaulUserInfoJWTLookupStrategyTest {
+
+ private static final String SUBJECT = "test_client";
+
+ private DefaultUserInfoJWTLookupStrategy function;
+
+ private ProfileRequestContext prc;
+
+ private UserInfoResponseContext testContext;
+
+ @BeforeMethod
+ public void setup() {
+ prc = new ProfileRequestContext();
+ testContext = new UserInfoResponseContext();
+ function = new DefaultUserInfoJWTLookupStrategy(prc -> testContext);
+
+ final var idToken = new PlainJWT(new JWTClaimsSet.Builder().subject(SUBJECT).build());
+ final UserInfoSuccessResponse response = new UserInfoSuccessResponse(idToken);
+ testContext.setUserInfo(response);
+ }
+
+ @Test
+ public void testGetUserInfoToken() throws ParseException {
+ assertEquals(function.apply(prc).getJWTClaimsSet().getSubject(), SUBJECT);
+ }
+
+ @Test
+ public void testGetUserInfoToken_NoContext() {
+ function = new DefaultUserInfoJWTLookupStrategy(prc -> null);
+ assertEquals(function.apply(prc), null);
+ }
+
+ @Test
+ public void testGetUserInfo_NotJWTType() throws ParseException {
+ final ClaimsSet set = new ClaimsSet();
+ set.setClaim("sub", SUBJECT);
+ final var response = new UserInfoSuccessResponse(new UserInfo(set.toJSONObject()));
+ testContext.setUserInfo(response);
+ assertEquals(function.apply(prc), null);
+ }
+
+}
diff --git a/idp-oidc-rp-api/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/context/navigate/DefaultEndUserClaimsLookupStrategyTest.java b/idp-oidc-rp-api/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/context/navigate/DefaultEndUserClaimsLookupStrategyTest.java
new file mode 100644
index 0000000..28d0bc7
--- /dev/null
+++ b/idp-oidc-rp-api/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/context/navigate/DefaultEndUserClaimsLookupStrategyTest.java
@@ -0,0 +1,69 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.idp.plugin.authn.oidc.rp.context.navigate;
+
+import static org.testng.Assert.assertEquals;
+
+import org.opensaml.profile.context.ProfileRequestContext;
+import org.testng.annotations.BeforeMethod;
+import org.testng.annotations.Test;
+
+import com.nimbusds.openid.connect.sdk.claims.ClaimsSet;
+
+import net.shibboleth.idp.plugin.authn.oidc.rp.context.EndUserClaimsContext;
+
+/** Tests for {@link DefaultEndUserClaimsLookupStrategy}.*/
+public class DefaultEndUserClaimsLookupStrategyTest {
+
+ private static final String SUBJECT = "test_client";
+
+ private DefaultEndUserClaimsLookupStrategy function;
+
+ private ProfileRequestContext prc;
+
+ private EndUserClaimsContext testContext;
+
+ @BeforeMethod
+ public void setup() {
+ prc = new ProfileRequestContext();
+ testContext = new EndUserClaimsContext();
+ function = new DefaultEndUserClaimsLookupStrategy(prc -> testContext);
+
+ final var claims = new ClaimsSet();
+ claims.setClaim("sub", SUBJECT);
+ testContext.setEndUserClaims(claims);
+ }
+
+ @Test
+ public void testEndUserClaims() {
+ assertEquals(function.apply(prc).getStringClaim("sub"), SUBJECT);
+ }
+
+ @Test
+ public void testEndUserClaims_NoContext() {
+ function = new DefaultEndUserClaimsLookupStrategy(prc -> null);
+ assertEquals(function.apply(prc), null);
+ }
+
+ @Test
+ public void testEndUserClaims_NoClaims() {
+ testContext.setEndUserClaims(null);
+ assertEquals(function.apply(prc), null);
+ }
+
+}
diff --git a/idp-oidc-rp-api/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/context/navigate/DefaultIDTokenLookupStrategyTest.java b/idp-oidc-rp-api/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/context/navigate/DefaultIDTokenLookupStrategyTest.java
new file mode 100644
index 0000000..a280e48
--- /dev/null
+++ b/idp-oidc-rp-api/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/context/navigate/DefaultIDTokenLookupStrategyTest.java
@@ -0,0 +1,80 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.idp.plugin.authn.oidc.rp.context.navigate;
+
+import static org.testng.Assert.assertEquals;
+
+import java.text.ParseException;
+
+import org.opensaml.profile.context.ProfileRequestContext;
+import org.testng.annotations.BeforeMethod;
+import org.testng.annotations.Test;
+
+import com.nimbusds.jwt.JWTClaimsSet;
+import com.nimbusds.jwt.PlainJWT;
+import com.nimbusds.oauth2.sdk.token.BearerAccessToken;
+import com.nimbusds.oauth2.sdk.token.RefreshToken;
+import com.nimbusds.openid.connect.sdk.OIDCTokenResponse;
+import com.nimbusds.openid.connect.sdk.token.OIDCTokens;
+
+import net.shibboleth.idp.plugin.authn.oidc.rp.context.AccessTokenResponseContext;
+
+/** Tests for {@link DefaultIDTokenLookupStrategy}.*/
+public class DefaultIDTokenLookupStrategyTest {
+
+ private static final String SUBJECT = "test_client";
+
+ private DefaultIDTokenLookupStrategy function;
+
+ private ProfileRequestContext prc;
+
+ private AccessTokenResponseContext testContext;
+
+ @BeforeMethod
+ public void setup() {
+ prc = new ProfileRequestContext();
+ testContext = new AccessTokenResponseContext();
+ function = new DefaultIDTokenLookupStrategy(prc -> testContext);
+
+ final var idToken = new PlainJWT(new JWTClaimsSet.Builder().subject(SUBJECT).build());
+ final OIDCTokenResponse response = new OIDCTokenResponse(
+ new OIDCTokens(idToken, new BearerAccessToken(), new RefreshToken()));
+ testContext.setTokenResponse(response);
+ }
+
+ @Test
+ public void testGetIDToken() throws ParseException {
+ assertEquals(function.apply(prc).getJWTClaimsSet().getSubject(), SUBJECT);
+ }
+
+ @Test
+ public void testGetIDToken_NoContext() {
+ function = new DefaultIDTokenLookupStrategy(prc -> null);
+ assertEquals(function.apply(prc), null);
+ }
+
+ @Test
+ public void testGetIDTokens_emptyIDToken() throws ParseException {
+ final OIDCTokenResponse response = new OIDCTokenResponse(
+ new OIDCTokens(
+ new PlainJWT(new JWTClaimsSet.Builder().build()), new BearerAccessToken(), new RefreshToken()));
+ testContext.setTokenResponse(response);
+ assertEquals(function.apply(prc).getJWTClaimsSet().getSubject(), null);
+ }
+
+}
diff --git a/idp-oidc-rp-api/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/context/navigate/EncryptedIDTokenLookupStrategyTest.java b/idp-oidc-rp-api/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/context/navigate/EncryptedIDTokenLookupStrategyTest.java
new file mode 100644
index 0000000..ce6b803
--- /dev/null
+++ b/idp-oidc-rp-api/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/context/navigate/EncryptedIDTokenLookupStrategyTest.java
@@ -0,0 +1,126 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.idp.plugin.authn.oidc.rp.context.navigate;
+
+import static org.testng.Assert.assertNotNull;
+import static org.testng.Assert.assertNull;
+import static org.testng.Assert.fail;
+
+import java.util.Collections;
+import java.util.Map;
+
+import org.opensaml.profile.context.ProfileRequestContext;
+import org.testng.annotations.BeforeMethod;
+import org.testng.annotations.Test;
+
+import com.fasterxml.jackson.core.type.TypeReference;
+import com.fasterxml.jackson.databind.ObjectMapper;
+import com.nimbusds.jose.EncryptionMethod;
+import com.nimbusds.jose.JWEAlgorithm;
+import com.nimbusds.jose.JWSAlgorithm;
+import com.nimbusds.oauth2.sdk.ParseException;
+import com.nimbusds.openid.connect.sdk.OIDCTokenResponse;
+
+import net.minidev.json.JSONObject;
+import net.shibboleth.idp.plugin.authn.oidc.rp.context.AccessTokenResponseContext;
+import net.shibboleth.idp.plugin.authn.oidc.rp.test.TestTokenHelper;
+import net.shibboleth.oidc.security.credential.DefaultClientSecretCredential;
+
+/** Tests for {@link EncryptedIDTokenLookupStrategy}.*/
+public class EncryptedIDTokenLookupStrategyTest {
+
+private static final String CLIENT_ID = "test_client";
+
+ /** The client_secret.*/
+ private static final String CLIENT_SECRET = "Xp2s5v8y/B?E(H+MbQeThWmYq3t6w9z$";
+
+ private EncryptedIDTokenLookupStrategy function;
+
+ private ProfileRequestContext prc;
+
+ @BeforeMethod
+ public void setup() {
+ prc = new ProfileRequestContext();
+ }
+
+ @Test
+ public void testGetEncryptedIDToken() throws Exception {
+ final String tokenResponse =
+ TestTokenHelper.createAccessTokenResponseJSON(Collections.emptyMap(), JWSAlgorithm.HS256,
+ JWEAlgorithm.DIR, EncryptionMethod.A128CBC_HS256,
+ new DefaultClientSecretCredential(CLIENT_SECRET).toSigningCredential(),
+ new DefaultClientSecretCredential(CLIENT_SECRET)
+ .toEncryptionCredential(JWEAlgorithm.DIR, EncryptionMethod.A128CBC_HS256));
+
+ final Map<String, Object> tokenResponseAsMap = new ObjectMapper().readValue(
+ tokenResponse, new TypeReference<Map<String, Object>>() {});
+
+ final AccessTokenResponseContext ctx = new AccessTokenResponseContext();
+ try {
+ ctx.setTokenResponse(OIDCTokenResponse.parse(new JSONObject(tokenResponseAsMap)));
+ } catch (final ParseException e) {
+ fail(e.getMessage());
+ }
+ function = new EncryptedIDTokenLookupStrategy(prc -> ctx);
+
+ assertNotNull(function.apply(prc));
+ }
+
+ @Test
+ public void testGetEncryptedIDToken_NotEncrypted() throws Exception {
+ final String tokenResponse =
+ TestTokenHelper.createAccessTokenResponseJSON(Collections.emptyMap(), JWSAlgorithm.HS256,
+ null,null,
+ new DefaultClientSecretCredential(CLIENT_SECRET).toSigningCredential(), null);
+
+ final Map<String, Object> tokenResponseAsMap = new ObjectMapper().readValue(
+ tokenResponse, new TypeReference<Map<String, Object>>() {});
+
+ final AccessTokenResponseContext ctx = new AccessTokenResponseContext();
+ try {
+ ctx.setTokenResponse(OIDCTokenResponse.parse(new JSONObject(tokenResponseAsMap)));
+ } catch (final ParseException e) {
+ fail(e.getMessage());
+ }
+ function = new EncryptedIDTokenLookupStrategy(prc -> ctx);
+
+ assertNull(function.apply(prc));
+ }
+
+ @Test
+ public void testGetEncryptedIDToken_NoIDToken() throws Exception {
+ final String tokenResponse =
+ TestTokenHelper.createAccessTokenResponseJSON(Collections.emptyMap(), JWSAlgorithm.HS256,
+ null,null,
+ new DefaultClientSecretCredential(CLIENT_SECRET).toSigningCredential(), null);
+
+ final Map<String, Object> tokenResponseAsMap = new ObjectMapper().readValue(
+ tokenResponse, new TypeReference<Map<String, Object>>() {});
+ tokenResponseAsMap.remove("id_token");
+
+ final AccessTokenResponseContext ctx = new AccessTokenResponseContext();
+ try {
+ ctx.setTokenResponse(OIDCTokenResponse.parse(new JSONObject(tokenResponseAsMap)));
+ } catch (final ParseException e) {
+ fail(e.getMessage());
+ }
+ function = new EncryptedIDTokenLookupStrategy(prc -> ctx);
+
+ assertNull(function.apply(prc));
+ }
+}
diff --git a/idp-oidc-rp-api/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/context/navigate/EncryptedUserInfoJWTLookupStrategyTest.java b/idp-oidc-rp-api/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/context/navigate/EncryptedUserInfoJWTLookupStrategyTest.java
new file mode 100644
index 0000000..3223370
--- /dev/null
+++ b/idp-oidc-rp-api/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/context/navigate/EncryptedUserInfoJWTLookupStrategyTest.java
@@ -0,0 +1,84 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.idp.plugin.authn.oidc.rp.context.navigate;
+
+import static org.testng.Assert.assertNotNull;
+import static org.testng.Assert.assertNull;
+
+import java.util.List;
+import java.util.Map;
+
+import org.opensaml.profile.context.ProfileRequestContext;
+import org.testng.annotations.BeforeMethod;
+import org.testng.annotations.Test;
+
+import com.nimbusds.jose.EncryptionMethod;
+import com.nimbusds.jose.JWEAlgorithm;
+import com.nimbusds.jose.JWSAlgorithm;
+import com.nimbusds.openid.connect.sdk.UserInfoSuccessResponse;
+
+import net.shibboleth.idp.plugin.authn.oidc.rp.context.UserInfoResponseContext;
+import net.shibboleth.idp.plugin.authn.oidc.rp.test.TestTokenHelper;
+import net.shibboleth.oidc.security.credential.DefaultClientSecretCredential;
+
+/** Tests for {@link EncryptedUserInfoJWTLookupStrategy}.*/
+public class EncryptedUserInfoJWTLookupStrategyTest {
+
+private static final String CLIENT_ID = "test_client";
+
+ /** The client_secret.*/
+ private static final String CLIENT_SECRET = "Xp2s5v8y/B?E(H+MbQeThWmYq3t6w9z$";
+
+ private EncryptedUserInfoJWTLookupStrategy function;
+
+ private ProfileRequestContext prc;
+
+ @BeforeMethod
+ public void setup() {
+ prc = new ProfileRequestContext();
+ }
+
+ @Test
+ public void testGetEncryptedUserInfoToken() throws Exception {
+ final var userInfoResp = TestTokenHelper.createJWTUserInfoResponse(
+ Map.of("iss", "issuer", "aud", List.of(CLIENT_ID)), JWSAlgorithm.HS256, JWEAlgorithm.DIR,
+ EncryptionMethod.A128CBC_HS256, new DefaultClientSecretCredential(CLIENT_SECRET).toSigningCredential(),
+ new DefaultClientSecretCredential(CLIENT_SECRET)
+ .toEncryptionCredential(JWEAlgorithm.DIR, EncryptionMethod.A128CBC_HS256));
+
+ final UserInfoResponseContext ctx = new UserInfoResponseContext();
+ ctx.setUserInfo(new UserInfoSuccessResponse(userInfoResp));
+ function = new EncryptedUserInfoJWTLookupStrategy(prc -> ctx);
+
+ assertNotNull(function.apply(prc));
+ }
+
+ @Test
+ public void testGetEncryptedUserInfoToken_NotEncrypted() throws Exception {
+ final var userInfoResp = TestTokenHelper.createJWTUserInfoResponse(
+ Map.of("iss", "issuer", "aud", List.of(CLIENT_ID)), JWSAlgorithm.HS256, null,
+ null, new DefaultClientSecretCredential(CLIENT_SECRET).toSigningCredential(),null);
+
+ final UserInfoResponseContext ctx = new UserInfoResponseContext();
+ ctx.setUserInfo(new UserInfoSuccessResponse(userInfoResp));
+ function = new EncryptedUserInfoJWTLookupStrategy(prc -> ctx);
+
+ assertNull(function.apply(prc));
+ }
+
+}
diff --git a/idp-oidc-rp-api/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/config/navigate/IDTokenInAccessTokenUpdateStrategyTest.java b/idp-oidc-rp-api/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/context/navigate/IDTokenInAccessTokenUpdateStrategyTest.java
similarity index 81%
rename from idp-oidc-rp-api/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/config/navigate/IDTokenInAccessTokenUpdateStrategyTest.java
rename to idp-oidc-rp-api/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/context/navigate/IDTokenInAccessTokenUpdateStrategyTest.java
index 6f67a2d..6086b17 100644
--- a/idp-oidc-rp-api/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/config/navigate/IDTokenInAccessTokenUpdateStrategyTest.java
+++ b/idp-oidc-rp-api/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/context/navigate/IDTokenInAccessTokenUpdateStrategyTest.java
@@ -1,5 +1,21 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
-package net.shibboleth.idp.plugin.authn.oidc.rp.config.navigate;
+package net.shibboleth.idp.plugin.authn.oidc.rp.context.navigate;
import static org.testng.Assert.assertNotNull;
import static org.testng.Assert.assertTrue;
@@ -24,7 +40,6 @@ import com.nimbusds.openid.connect.sdk.OIDCTokenResponse;
import net.minidev.json.JSONObject;
import net.shibboleth.idp.plugin.authn.oidc.rp.context.AccessTokenResponseContext;
-import net.shibboleth.idp.plugin.authn.oidc.rp.context.navigate.IDTokenInAccessTokenUpdateStrategy;
import net.shibboleth.idp.plugin.authn.oidc.rp.test.TestTokenHelper;
import net.shibboleth.oidc.security.credential.DefaultClientSecretCredential;
diff --git a/idp-oidc-rp-api/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/context/navigate/SubFromIDTokenLookupFunctionTest.java b/idp-oidc-rp-api/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/context/navigate/SubFromIDTokenLookupFunctionTest.java
new file mode 100644
index 0000000..b1776f3
--- /dev/null
+++ b/idp-oidc-rp-api/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/context/navigate/SubFromIDTokenLookupFunctionTest.java
@@ -0,0 +1,117 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.idp.plugin.authn.oidc.rp.context.navigate;
+
+import static org.testng.Assert.assertEquals;
+import static org.testng.Assert.fail;
+
+import java.util.Map;
+
+import org.opensaml.profile.context.ProfileRequestContext;
+import org.testng.annotations.BeforeMethod;
+import org.testng.annotations.Test;
+
+import com.fasterxml.jackson.core.type.TypeReference;
+import com.fasterxml.jackson.databind.ObjectMapper;
+import com.nimbusds.jose.EncryptionMethod;
+import com.nimbusds.jose.JWEAlgorithm;
+import com.nimbusds.jose.JWSAlgorithm;
+import com.nimbusds.jwt.JWTClaimsSet;
+import com.nimbusds.oauth2.sdk.ParseException;
+import com.nimbusds.openid.connect.sdk.OIDCTokenResponse;
+
+import net.minidev.json.JSONObject;
+import net.shibboleth.idp.plugin.authn.oidc.rp.context.AccessTokenResponseContext;
+import net.shibboleth.idp.plugin.authn.oidc.rp.test.TestTokenHelper;
+import net.shibboleth.oidc.security.credential.DefaultClientSecretCredential;
+
+/** Tests for {@link SubFromIDTokenLookupFunction}.*/
+public class SubFromIDTokenLookupFunctionTest {
+
+ /** The client_secret.*/
+ private static final String CLIENT_SECRET = "Xp2s5v8y/B?E(H+MbQeThWmYq3t6w9z$";
+
+ private static final String SUBJECT = "test_client";
+
+ private SubFromIDTokenLookupFunction function;
+
+ private ProfileRequestContext prc;
+
+
+ @BeforeMethod
+ public void setup() {
+ prc = new ProfileRequestContext();
+ }
+
+ @Test
+ public void getSubInIDToken() throws Exception {
+ final String tokenResponse =
+ TestTokenHelper.createAccessTokenResponseJSON(Map.of("sub", SUBJECT), JWSAlgorithm.HS256,
+ null, null,
+ new DefaultClientSecretCredential(CLIENT_SECRET).toSigningCredential(),null);
+
+ final Map<String, Object> tokenResponseAsMap = new ObjectMapper().readValue(
+ tokenResponse, new TypeReference<Map<String, Object>>() {});
+
+ final AccessTokenResponseContext ctx = new AccessTokenResponseContext();
+ try {
+ ctx.setTokenResponse(OIDCTokenResponse.parse(new JSONObject(tokenResponseAsMap)));
+ } catch (final ParseException e) {
+ fail(e.getMessage());
+ }
+ function = new SubFromIDTokenLookupFunction(prc -> ctx);
+
+ assertEquals(function.apply(prc, new JWTClaimsSet.Builder().build()), SUBJECT);
+ }
+
+ @Test
+ public void getSubInIDToken_Encrypted_NullResponse() throws Exception {
+ final String tokenResponse =
+ TestTokenHelper.createAccessTokenResponseJSON(Map.of("sub",SUBJECT), JWSAlgorithm.HS256,
+ JWEAlgorithm.DIR, EncryptionMethod.A128CBC_HS256,
+ new DefaultClientSecretCredential(CLIENT_SECRET).toSigningCredential(),
+ new DefaultClientSecretCredential(CLIENT_SECRET)
+ .toEncryptionCredential(JWEAlgorithm.DIR, EncryptionMethod.A128CBC_HS256));
+
+ final Map<String, Object> tokenResponseAsMap = new ObjectMapper().readValue(
+ tokenResponse, new TypeReference<Map<String, Object>>() {});
+
+ final AccessTokenResponseContext ctx = new AccessTokenResponseContext();
+ try {
+ ctx.setTokenResponse(OIDCTokenResponse.parse(new JSONObject(tokenResponseAsMap)));
+ } catch (final ParseException e) {
+ fail(e.getMessage());
+ }
+ function = new SubFromIDTokenLookupFunction(prc -> ctx);
+
+ assertEquals(function.apply(prc, new JWTClaimsSet.Builder().build()), null);
+ }
+
+ @Test
+ public void getSubInIDToken_NoContext() throws Exception {
+ function = new SubFromIDTokenLookupFunction(prc -> null);
+ assertEquals(function.apply(prc, new JWTClaimsSet.Builder().build()), null);
+ }
+
+ @Test
+ public void getSubInIDToken_NoTokenResponse() throws Exception {
+ final AccessTokenResponseContext ctx = new AccessTokenResponseContext();
+ function = new SubFromIDTokenLookupFunction(prc -> ctx);
+ assertEquals(function.apply(prc, new JWTClaimsSet.Builder().build()), null);
+ }
+}
diff --git a/idp-oidc-rp-api/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/config/logic/RequiresSignatureVerificationPredicateTest.java b/idp-oidc-rp-api/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/context/logic/RequiresSignatureVerificationPredicateTest.java
similarity index 81%
rename from idp-oidc-rp-api/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/config/logic/RequiresSignatureVerificationPredicateTest.java
rename to idp-oidc-rp-api/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/context/logic/RequiresSignatureVerificationPredicateTest.java
index 46351e3..9149447 100644
--- a/idp-oidc-rp-api/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/config/logic/RequiresSignatureVerificationPredicateTest.java
+++ b/idp-oidc-rp-api/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/context/logic/RequiresSignatureVerificationPredicateTest.java
@@ -14,8 +14,24 @@
* See the License for the specific language governing permissions and
* limitations under the License.
*/
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
-package net.shibboleth.idp.plugin.authn.oidc.rp.config.logic;
+package net.shibboleth.idp.plugin.authn.oidc.rp.messaging.context.logic;
import static org.testng.Assert.assertFalse;
import static org.testng.Assert.assertTrue;
@@ -26,7 +42,6 @@ import org.testng.annotations.BeforeMethod;
import org.testng.annotations.Test;
import net.shibboleth.idp.plugin.authn.oidc.rp.context.AbstractAuthenticatableOIDCContext;
-import net.shibboleth.idp.plugin.authn.oidc.rp.messaging.context.logic.RequiresSignatureVerificationPredicate;
import net.shibboleth.idp.profile.context.RelyingPartyContext;
import net.shibboleth.oidc.profile.config.impl.DefaultOIDCAuthorizationConfiguration;
diff --git a/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/OIDCRPFlowFromAuthenticationResponseTest.java b/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/OIDCRPFlowFromAuthenticationResponseTest.java
index b45ef42..b84bf9b 100644
--- a/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/OIDCRPFlowFromAuthenticationResponseTest.java
+++ b/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/OIDCRPFlowFromAuthenticationResponseTest.java
@@ -238,7 +238,8 @@ public class OIDCRPFlowFromAuthenticationResponseTest extends OIDCRPFlowTest {
Map.of("iss", OP_ISSUER_ID, "aud", List.of(CLIENT_ID)), JWSAlgorithm.ES256,
JWEAlgorithm.RSA_OAEP_256,
EncryptionMethod.A256GCM,
- new BasicCredential(sigKey.toPublicKey(), sigKey.toPrivateKey()), new BasicCredential(encKey.toPublicKey(), encKey.toPrivateKey()));
+ new BasicCredential(sigKey.toPublicKey(), sigKey.toPrivateKey()),
+ new BasicCredential(encKey.toPublicKey(), encKey.toPrivateKey()));
// First is token exchange
queueMockServerResponse(mockOPServer, 200, accessTokenResp, "application/json");
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list