[java-idp-plugin-oidc-rp] branch main updated: Add more condition predicate tests
Phil Smart
philip.smart at jisc.ac.uk
Mon Apr 24 15:46:29 UTC 2023
This is an automated email from the git hooks/post-receive script.
philsmart pushed a commit to branch main
in repository java-idp-plugin-oidc-rp.
View the commit online:
http://git.shibboleth.net/view/?p=java-idp-plugin-oidc-rp.git;a=commit;h=b40b46848c2c456e8a7227e5dce5785ef3cf4442
The following commit(s) were added to refs/heads/main by this push:
new b40b468 Add more condition predicate tests
b40b468 is described below
commit b40b46848c2c456e8a7227e5dce5785ef3cf4442
Author: Phil Smart <philip.smart at jisc.ac.uk>
AuthorDate: Mon Apr 24 16:46:24 2023 +0100
Add more condition predicate tests
---
.../context/logic/UserInfoLookupCondition.java | 2 +-
.../logic/UserInfoPlainResponseTypeCondition.java | 18 ++++
.../RequestObjectRequiredAndSupportedTest.java | 119 +++++++++++++++++++++
...RequiresSignatureVerificationPredicateTest.java | 16 ---
.../UserInfoPlainResponseTypeConditionTest.java | 86 +++++++++++++++
5 files changed, 224 insertions(+), 17 deletions(-)
diff --git a/idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/context/logic/UserInfoLookupCondition.java b/idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/context/logic/UserInfoLookupCondition.java
index d669b32..7cb71cc 100644
--- a/idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/context/logic/UserInfoLookupCondition.java
+++ b/idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/context/logic/UserInfoLookupCondition.java
@@ -45,7 +45,7 @@ public class UserInfoLookupCondition implements Predicate<ProfileRequestContext>
return profileConfiguration.isRetrieveUserInfoEndpointClaims(prc);
}
- // Perform user input validation by default if no config found
+ // Perform user info lookup by default if no config found
return true;
diff --git a/idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/context/logic/UserInfoPlainResponseTypeCondition.java b/idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/context/logic/UserInfoPlainResponseTypeCondition.java
index eef2f2d..5166244 100644
--- a/idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/context/logic/UserInfoPlainResponseTypeCondition.java
+++ b/idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/context/logic/UserInfoPlainResponseTypeCondition.java
@@ -17,6 +17,8 @@
package net.shibboleth.idp.plugin.authn.oidc.rp.messaging.context.logic;
+import java.util.function.Function;
+
import javax.annotation.Nonnull;
import org.opensaml.profile.context.ProfileRequestContext;
@@ -29,6 +31,22 @@ import net.shibboleth.idp.plugin.authn.oidc.rp.context.UserInfoResponseContext;
* Condition that returns true if the UserInfo response was an plain JSON type i.e. not a signed and or encrypted JWT.
*/
public class UserInfoPlainResponseTypeCondition extends AbstractUserInfoResponseTypeCondition {
+
+ /** Constructor.*/
+ public UserInfoPlainResponseTypeCondition() {
+ super();
+ }
+
+ /**
+ *
+ * Constructor.
+ *
+ * @param strategy the UserInfo response context lookup strategy to use.
+ */
+ public UserInfoPlainResponseTypeCondition(
+ @Nonnull final Function<ProfileRequestContext, UserInfoResponseContext> strategy) {
+ super(strategy);
+ }
@Override
protected boolean doTest(@Nonnull final ProfileRequestContext prc,
diff --git a/idp-oidc-rp-api/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/context/logic/RequestObjectRequiredAndSupportedTest.java b/idp-oidc-rp-api/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/context/logic/RequestObjectRequiredAndSupportedTest.java
new file mode 100644
index 0000000..391bdf0
--- /dev/null
+++ b/idp-oidc-rp-api/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/context/logic/RequestObjectRequiredAndSupportedTest.java
@@ -0,0 +1,119 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.idp.plugin.authn.oidc.rp.messaging.context.logic;
+
+import static org.testng.Assert.assertFalse;
+import static org.testng.Assert.assertTrue;
+import static org.testng.Assert.fail;
+
+import java.net.URI;
+import java.net.URISyntaxException;
+import java.util.List;
+
+import org.opensaml.profile.context.ProfileRequestContext;
+import org.testng.annotations.BeforeMethod;
+import org.testng.annotations.Test;
+
+import com.nimbusds.oauth2.sdk.id.Issuer;
+import com.nimbusds.openid.connect.sdk.SubjectType;
+import com.nimbusds.openid.connect.sdk.op.OIDCProviderMetadata;
+
+import net.shibboleth.idp.profile.context.RelyingPartyContext;
+import net.shibboleth.oidc.metadata.context.OIDCProviderMetadataContext;
+import net.shibboleth.oidc.profile.config.impl.DefaultOIDCAuthorizationConfiguration;
+
+/** Tests for the {@link RequestObjectRequiredAndSupported}.*/
+public class RequestObjectRequiredAndSupportedTest {
+
+ /** The predicate to test*/
+ private RequestObjectRequiredAndSupported predicate;
+
+ private ProfileRequestContext prc;
+
+ private RelyingPartyContext rpc;
+
+ private DefaultOIDCAuthorizationConfiguration config;
+
+ private OIDCProviderMetadataContext providerCtx;
+
+ @BeforeMethod
+ public void setup() {
+ prc = new ProfileRequestContext();
+ rpc = new RelyingPartyContext();
+ config = new DefaultOIDCAuthorizationConfiguration();
+ rpc.setProfileConfig(config);
+ providerCtx = new OIDCProviderMetadataContext();
+ }
+
+ @Test
+ public void testRequestObjectEnabled_NoProviderContext() {
+ config.setUseRequestObject(true);
+ predicate = new RequestObjectRequiredAndSupported();
+ predicate.setOidcProviderMetadataContextLookupStrategy(msg -> null);
+ assertFalse(predicate.test(prc));
+ }
+
+ @Test
+ public void testRequestObjectEnabled_NoMetadata() {
+ config.setUseRequestObject(true);
+ predicate = new RequestObjectRequiredAndSupported();
+ predicate.setOidcProviderMetadataContextLookupStrategy(msg -> providerCtx);
+ assertFalse(predicate.test(prc));
+ }
+
+ @Test
+ public void testRequestObjectEnabledAndSupported() {
+ config.setUseRequestObject(true);
+ predicate = new RequestObjectRequiredAndSupported();
+ try {
+ final var metadata =
+ new OIDCProviderMetadata(new Issuer("test"), List.of(SubjectType.PUBLIC), new URI("nowhere"));
+ metadata.setSupportsRequestParam(true);
+ providerCtx.setProviderInformation(metadata);
+ } catch (final URISyntaxException e) {
+ fail(e.getLocalizedMessage());
+ }
+ predicate.setOidcProviderMetadataContextLookupStrategy(msg -> providerCtx);
+ predicate.setRelyingPartyContextLookupStrategy(mc -> {
+ config.setUseRequestObject(true);
+ return rpc;
+ });
+ assertTrue(predicate.test(prc));
+ }
+
+ @Test
+ public void testRequestObjectNotEnabledAndSupported() {
+ config.setUseRequestObject(true);
+ predicate = new RequestObjectRequiredAndSupported();
+ try {
+ final var metadata =
+ new OIDCProviderMetadata(new Issuer("test"), List.of(SubjectType.PUBLIC), new URI("nowhere"));
+ metadata.setSupportsRequestParam(false);
+ providerCtx.setProviderInformation(metadata);
+ } catch (final URISyntaxException e) {
+ fail(e.getLocalizedMessage());
+ }
+ predicate.setOidcProviderMetadataContextLookupStrategy(msg -> providerCtx);
+ predicate.setRelyingPartyContextLookupStrategy(mc -> {
+ config.setUseRequestObject(true);
+ return rpc;
+ });
+ assertFalse(predicate.test(prc));
+ }
+
+}
diff --git a/idp-oidc-rp-api/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/context/logic/RequiresSignatureVerificationPredicateTest.java b/idp-oidc-rp-api/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/context/logic/RequiresSignatureVerificationPredicateTest.java
index 9149447..342d6c5 100644
--- a/idp-oidc-rp-api/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/context/logic/RequiresSignatureVerificationPredicateTest.java
+++ b/idp-oidc-rp-api/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/context/logic/RequiresSignatureVerificationPredicateTest.java
@@ -14,22 +14,6 @@
* See the License for the specific language governing permissions and
* limitations under the License.
*/
-/*
- * Licensed to the University Corporation for Advanced Internet Development,
- * Inc. (UCAID) under one or more contributor license agreements. See the
- * NOTICE file distributed with this work for additional information regarding
- * copyright ownership. The UCAID licenses this file to You under the Apache
- * License, Version 2.0 (the "License"); you may not use this file except in
- * compliance with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
package net.shibboleth.idp.plugin.authn.oidc.rp.messaging.context.logic;
diff --git a/idp-oidc-rp-api/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/context/logic/UserInfoPlainResponseTypeConditionTest.java b/idp-oidc-rp-api/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/context/logic/UserInfoPlainResponseTypeConditionTest.java
new file mode 100644
index 0000000..117ca69
--- /dev/null
+++ b/idp-oidc-rp-api/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/context/logic/UserInfoPlainResponseTypeConditionTest.java
@@ -0,0 +1,86 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.idp.plugin.authn.oidc.rp.messaging.context.logic;
+
+import static org.testng.Assert.assertFalse;
+import static org.testng.Assert.assertTrue;
+
+import java.text.ParseException;
+import java.util.List;
+import java.util.Map;
+
+import org.opensaml.profile.context.ProfileRequestContext;
+import org.testng.annotations.BeforeMethod;
+import org.testng.annotations.Test;
+
+import com.nimbusds.jose.EncryptionMethod;
+import com.nimbusds.jose.JOSEException;
+import com.nimbusds.oauth2.sdk.id.Subject;
+import com.nimbusds.openid.connect.sdk.UserInfoSuccessResponse;
+import com.nimbusds.openid.connect.sdk.claims.UserInfo;
+
+import net.shibboleth.idp.plugin.authn.oidc.rp.context.UserInfoResponseContext;
+import net.shibboleth.idp.plugin.authn.oidc.rp.test.TestTokenHelper;
+import net.shibboleth.oidc.security.credential.DefaultClientSecretCredential;
+
+/** Tests for the {@link UserInfoPlainResponseTypeCondition}.*/
+public class UserInfoPlainResponseTypeConditionTest {
+
+ /** The client_secret.*/
+ private static final String CLIENT_SECRET = "Xp2s5v8y/B?E(H+MbQeThWmYq3t6w9z$";
+
+ /** The condition to test*/
+ private UserInfoPlainResponseTypeCondition condition;
+
+ private UserInfoResponseContext ctx;
+
+ private ProfileRequestContext prc;
+
+ @BeforeMethod
+ public void setup() {
+ prc = new ProfileRequestContext();
+ ctx = new UserInfoResponseContext();
+ }
+
+ @Test
+ public void testUserInfoIsPlain() {
+ ctx.setUserInfo(new UserInfoSuccessResponse(new UserInfo(new Subject("subject"))));
+ condition = new UserInfoPlainResponseTypeCondition(prcIn -> ctx);
+ assertTrue(condition.test(prc));
+ }
+
+ @Test
+ public void testUserInfoNoResponse() {
+ ctx.setUserInfo(null);
+ condition = new UserInfoPlainResponseTypeCondition(prcIn -> ctx);
+ assertFalse(condition.test(prc));
+ }
+
+ @Test
+ public void testUserInfoIsJWT() throws JOSEException, ParseException {
+ final var userInfoResp = TestTokenHelper.createJWTUserInfoResponse(
+ Map.of("iss", "issuer", "aud", List.of("client_id")), null, null,
+ EncryptionMethod.A128CBC_HS256, new DefaultClientSecretCredential(CLIENT_SECRET).toSigningCredential(),
+ null);
+
+ ctx.setUserInfo(new UserInfoSuccessResponse(userInfoResp));
+ condition = new UserInfoPlainResponseTypeCondition(prcIn -> ctx);
+ assertFalse(condition.test(prc));
+ }
+
+}
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list