[java-idp-plugin-oidc-rp] branch main updated: Add and update strategy tests
Phil Smart
philip.smart at jisc.ac.uk
Mon Apr 24 16:26:02 UTC 2023
This is an automated email from the git hooks/post-receive script.
philsmart pushed a commit to branch main
in repository java-idp-plugin-oidc-rp.
View the commit online:
http://git.shibboleth.net/view/?p=java-idp-plugin-oidc-rp.git;a=commit;h=fcd8dd96adad217d3e883dc79ee57d26595fd537
The following commit(s) were added to refs/heads/main by this push:
new fcd8dd9 Add and update strategy tests
fcd8dd9 is described below
commit fcd8dd96adad217d3e883dc79ee57d26595fd537
Author: Phil Smart <philip.smart at jisc.ac.uk>
AuthorDate: Mon Apr 24 17:25:57 2023 +0100
Add and update strategy tests
---
.../IDTokenInAccessTokenUpdateStrategyTest.java | 1 +
...va => IDTokenJOSEHeaderLookupStrategyTest.java} | 97 ++++++++++++----------
...nUserInfoResponseContextUpdateStrategyTest.java | 86 +++++++++++++++++++
3 files changed, 138 insertions(+), 46 deletions(-)
diff --git a/idp-oidc-rp-api/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/context/navigate/IDTokenInAccessTokenUpdateStrategyTest.java b/idp-oidc-rp-api/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/context/navigate/IDTokenInAccessTokenUpdateStrategyTest.java
index 6086b17..af5ff91 100644
--- a/idp-oidc-rp-api/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/context/navigate/IDTokenInAccessTokenUpdateStrategyTest.java
+++ b/idp-oidc-rp-api/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/context/navigate/IDTokenInAccessTokenUpdateStrategyTest.java
@@ -43,6 +43,7 @@ import net.shibboleth.idp.plugin.authn.oidc.rp.context.AccessTokenResponseContex
import net.shibboleth.idp.plugin.authn.oidc.rp.test.TestTokenHelper;
import net.shibboleth.oidc.security.credential.DefaultClientSecretCredential;
+/** Tests for {@link IDTokenInAccessTokenUpdateStrategy}.*/
public class IDTokenInAccessTokenUpdateStrategyTest {
/** The client_secret.*/
diff --git a/idp-oidc-rp-api/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/context/navigate/IDTokenInAccessTokenUpdateStrategyTest.java b/idp-oidc-rp-api/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/context/navigate/IDTokenJOSEHeaderLookupStrategyTest.java
similarity index 51%
copy from idp-oidc-rp-api/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/context/navigate/IDTokenInAccessTokenUpdateStrategyTest.java
copy to idp-oidc-rp-api/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/context/navigate/IDTokenJOSEHeaderLookupStrategyTest.java
index 6086b17..3279300 100644
--- a/idp-oidc-rp-api/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/context/navigate/IDTokenInAccessTokenUpdateStrategyTest.java
+++ b/idp-oidc-rp-api/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/context/navigate/IDTokenJOSEHeaderLookupStrategyTest.java
@@ -17,14 +17,15 @@
package net.shibboleth.idp.plugin.authn.oidc.rp.context.navigate;
+import static org.testng.Assert.assertEquals;
import static org.testng.Assert.assertNotNull;
-import static org.testng.Assert.assertTrue;
-import static org.testng.Assert.fail;
+import static org.testng.Assert.assertNull;
import java.util.Collections;
import java.util.Map;
import org.opensaml.profile.context.ProfileRequestContext;
+import org.testng.annotations.BeforeMethod;
import org.testng.annotations.Test;
import com.fasterxml.jackson.core.type.TypeReference;
@@ -32,10 +33,6 @@ import com.fasterxml.jackson.databind.ObjectMapper;
import com.nimbusds.jose.EncryptionMethod;
import com.nimbusds.jose.JWEAlgorithm;
import com.nimbusds.jose.JWSAlgorithm;
-import com.nimbusds.jwt.EncryptedJWT;
-import com.nimbusds.jwt.JWT;
-import com.nimbusds.jwt.SignedJWT;
-import com.nimbusds.oauth2.sdk.ParseException;
import com.nimbusds.openid.connect.sdk.OIDCTokenResponse;
import net.minidev.json.JSONObject;
@@ -43,23 +40,59 @@ import net.shibboleth.idp.plugin.authn.oidc.rp.context.AccessTokenResponseContex
import net.shibboleth.idp.plugin.authn.oidc.rp.test.TestTokenHelper;
import net.shibboleth.oidc.security.credential.DefaultClientSecretCredential;
-public class IDTokenInAccessTokenUpdateStrategyTest {
+/** Tests for {@link IDTokenJOSEHeaderLookupStrategy}.*/
+public class IDTokenJOSEHeaderLookupStrategyTest {
/** The client_secret.*/
private static final String CLIENT_SECRET = "Xp2s5v8y/B?E(H+MbQeThWmYq3t6w9z$";
- /** The strategy to test.*/
- private IDTokenInAccessTokenUpdateStrategy strategy;
+ private IDTokenJOSEHeaderLookupStrategy function;
+ private ProfileRequestContext prc;
+
+ private AccessTokenResponseContext testContext;
+
+ @BeforeMethod
+ public void setup() throws Exception {
+ prc = new ProfileRequestContext();
+ testContext = new AccessTokenResponseContext();
+ function = new IDTokenJOSEHeaderLookupStrategy(prc -> testContext);
+ }
- /**
- * Set an encrypted token into the context and update it with a signed token. Leaving all the other tokens in place.
- *
- * @throws Exception on error.
- */
@Test
- public void testUpdateEncryptedToSigned() throws Exception {
+ public void testGetJOSEHeader() throws Exception {
+ final String tokenResponse =
+ TestTokenHelper.createAccessTokenResponseJSON(Collections.emptyMap(), JWSAlgorithm.HS256,
+ null,null,
+ new DefaultClientSecretCredential(CLIENT_SECRET).toSigningCredential(),null);
+
+ final Map<String, Object> tokenResponseAsMap = new ObjectMapper().readValue(
+ tokenResponse, new TypeReference<Map<String, Object>>() {});
+
+ testContext.setTokenResponse(OIDCTokenResponse.parse(new JSONObject(tokenResponseAsMap)));
+ final var header = function.apply(prc);
+ assertNotNull(header);
+ assertEquals(header.getAlgorithm(), JWSAlgorithm.HS256);
+ }
+
+ @Test
+ public void testGetJOSEHeader_NoTokenResponse() throws Exception {
+ testContext.setTokenResponse(null);
+ final var header = function.apply(prc);
+ assertNull(header);
+ }
+
+ @Test
+ public void testGetJOSEHeader_NoContext() throws Exception {
+
+ function = new IDTokenJOSEHeaderLookupStrategy(prc -> null);
+ final var header = function.apply(prc);
+ assertNull(header);
+ }
+
+ @Test
+ public void testGetJOSEHeader_JWEType() throws Exception {
final String tokenResponse =
TestTokenHelper.createAccessTokenResponseJSON(Collections.emptyMap(), JWSAlgorithm.HS256,
JWEAlgorithm.DIR, EncryptionMethod.A128CBC_HS256,
@@ -69,39 +102,11 @@ public class IDTokenInAccessTokenUpdateStrategyTest {
final Map<String, Object> tokenResponseAsMap = new ObjectMapper().readValue(
tokenResponse, new TypeReference<Map<String, Object>>() {});
-
-
- final JWT jwtToUpdate = TestTokenHelper.createJWT(TestTokenHelper.createBasicClaims(Collections.emptyMap()),
- JWSAlgorithm.HS256, null, null,
- new DefaultClientSecretCredential(CLIENT_SECRET).toSigningCredential(), null);
-
- final AccessTokenResponseContext ctx = new AccessTokenResponseContext();
- try {
- ctx.setTokenResponse(OIDCTokenResponse.parse(new JSONObject(tokenResponseAsMap)));
- } catch (final ParseException e) {
- fail(e.getMessage());
- }
- strategy = new IDTokenInAccessTokenUpdateStrategy(prc -> ctx);
-
- // assert pre-condition the id token is encrypted and the other tokens exist
- assertNotNull(ctx.getTokenResponse());
- assertNotNull(ctx.getTokenResponse().getTokens());
- assertNotNull(ctx.getTokenResponse().getTokens().getAccessToken());
- assertNotNull(ctx.getTokenResponse().getTokens().getBearerAccessToken());
- assertNotNull(ctx.getTokenResponse().getOIDCTokens());
- assertNotNull(ctx.getTokenResponse().getOIDCTokens().getIDToken());
- assertTrue(ctx.getTokenResponse().getOIDCTokens().getIDToken() instanceof EncryptedJWT);
- strategy.accept(new ProfileRequestContext(), jwtToUpdate);
+ testContext.setTokenResponse(OIDCTokenResponse.parse(new JSONObject(tokenResponseAsMap)));
- // assert post-condition the id token is now signed and the other tokens exist
- assertNotNull(ctx.getTokenResponse());
- assertNotNull(ctx.getTokenResponse().getTokens());
- assertNotNull(ctx.getTokenResponse().getTokens().getAccessToken());
- assertNotNull(ctx.getTokenResponse().getTokens().getBearerAccessToken());
- assertNotNull(ctx.getTokenResponse().getOIDCTokens());
- assertNotNull(ctx.getTokenResponse().getOIDCTokens().getIDToken());
- assertTrue(ctx.getTokenResponse().getOIDCTokens().getIDToken() instanceof SignedJWT);
+ final var header = function.apply(prc);
+ assertNull(header);
}
}
diff --git a/idp-oidc-rp-api/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/context/navigate/UserInfoInUserInfoResponseContextUpdateStrategyTest.java b/idp-oidc-rp-api/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/context/navigate/UserInfoInUserInfoResponseContextUpdateStrategyTest.java
new file mode 100644
index 0000000..a03e3bc
--- /dev/null
+++ b/idp-oidc-rp-api/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/context/navigate/UserInfoInUserInfoResponseContextUpdateStrategyTest.java
@@ -0,0 +1,86 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.idp.plugin.authn.oidc.rp.context.navigate;
+
+import static org.testng.Assert.assertEquals;
+import static org.testng.Assert.assertNotNull;
+import static org.testng.Assert.assertTrue;
+
+import java.util.List;
+import java.util.Map;
+
+import org.opensaml.profile.context.ProfileRequestContext;
+import org.testng.annotations.Test;
+
+import com.nimbusds.jose.EncryptionMethod;
+import com.nimbusds.jose.JWEAlgorithm;
+import com.nimbusds.jose.JWSAlgorithm;
+import com.nimbusds.jwt.EncryptedJWT;
+import com.nimbusds.jwt.SignedJWT;
+import com.nimbusds.openid.connect.sdk.UserInfoSuccessResponse;
+
+import net.shibboleth.idp.plugin.authn.oidc.rp.context.UserInfoResponseContext;
+import net.shibboleth.idp.plugin.authn.oidc.rp.test.TestTokenHelper;
+import net.shibboleth.oidc.security.credential.DefaultClientSecretCredential;
+
+/** Tests for {@link UserInfoInUserInfoResponseContextUpdateStrategy}.*/
+public class UserInfoInUserInfoResponseContextUpdateStrategyTest {
+
+ /** The client_secret.*/
+ private static final String CLIENT_SECRET = "Xp2s5v8y/B?E(H+MbQeThWmYq3t6w9z$";
+
+ /** The strategy to test.*/
+ private UserInfoInUserInfoResponseContextUpdateStrategy strategy;
+
+ @Test
+ public void testUpdateEncryptedToSigned() throws Exception {
+
+ // Original is signed and encrypted
+ final var userInfoRespOriginal = TestTokenHelper.createJWTUserInfoResponse(
+ Map.of("iss", "issuer", "aud", List.of("client_id")), JWSAlgorithm.HS256, JWEAlgorithm.DIR,
+ EncryptionMethod.A128CBC_HS256, new DefaultClientSecretCredential(CLIENT_SECRET).toSigningCredential(),
+ new DefaultClientSecretCredential(CLIENT_SECRET)
+ .toEncryptionCredential(JWEAlgorithm.DIR, EncryptionMethod.A128CBC_HS256));
+
+
+ final var ctx = new UserInfoResponseContext();
+ ctx.setUserInfo(new UserInfoSuccessResponse(userInfoRespOriginal));
+
+ strategy = new UserInfoInUserInfoResponseContextUpdateStrategy(prc -> ctx);
+
+ // New is only signed, was decrypted (we pretend).
+ final var userInfoRespNew = TestTokenHelper.createJWTUserInfoResponse(
+ Map.of("iss", "issuer", "aud", List.of("client_id")), JWSAlgorithm.HS256, null,
+ null, new DefaultClientSecretCredential(CLIENT_SECRET).toSigningCredential(),
+ null);
+
+ // assert pre-condition the id token is encrypted and the other tokens exist
+ assertNotNull(ctx.getUserInfo());
+ assertNotNull(ctx.getUserInfo().getUserInfoJWT());
+ assertTrue(ctx.getUserInfo().getUserInfoJWT() instanceof EncryptedJWT);
+
+ strategy.accept(new ProfileRequestContext(), userInfoRespNew);
+
+ // assert post-condition the id token is now signed and the other tokens exist
+ assertNotNull(ctx.getUserInfo());
+ assertNotNull(ctx.getUserInfo().getUserInfoJWT());
+ assertTrue(ctx.getUserInfo().getUserInfoJWT() instanceof SignedJWT);
+ assertEquals(ctx.getUserInfo().getUserInfoJWT(),userInfoRespNew);
+ }
+
+}
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list