[java-idp-plugin-oidc-rp] branch main updated: Add test
Phil Smart
philip.smart at jisc.ac.uk
Wed Apr 26 14:37:30 UTC 2023
This is an automated email from the git hooks/post-receive script.
philsmart pushed a commit to branch main
in repository java-idp-plugin-oidc-rp.
View the commit online:
http://git.shibboleth.net/view/?p=java-idp-plugin-oidc-rp.git;a=commit;h=b6b36a819ed56e44566a5854c5b49f6caa59207b
The following commit(s) were added to refs/heads/main by this push:
new b6b36a8 Add test
b6b36a8 is described below
commit b6b36a819ed56e44566a5854c5b49f6caa59207b
Author: Phil Smart <philip.smart at jisc.ac.uk>
AuthorDate: Wed Apr 26 15:37:28 2023 +0100
Add test
---
.../rp/impl/ValidateUserInfoJSONObjectClaims.java | 5 +-
.../impl/ValidateUserInfoJSONObjectClaimsTest.java | 194 +++++++++++++++++++++
2 files changed, 197 insertions(+), 2 deletions(-)
diff --git a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/ValidateUserInfoJSONObjectClaims.java b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/ValidateUserInfoJSONObjectClaims.java
index 4b940a0..d257af5 100644
--- a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/ValidateUserInfoJSONObjectClaims.java
+++ b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/ValidateUserInfoJSONObjectClaims.java
@@ -111,7 +111,7 @@ public class ValidateUserInfoJSONObjectClaims extends AbstractAuthenticationActi
userInfoCtx =
userInfoResponseContextLookupStrategy.apply(profileRequestContext);
- if (userInfoCtx == null) {
+ if (userInfoCtx == null || userInfoCtx.getUserInfo() == null) {
log.debug("{} No UserInfo response context returned by lookup strategy", getLogPrefix());
ActionSupport.buildEvent(profileRequestContext, EventIds.INVALID_PROFILE_CTX);
return false;
@@ -124,7 +124,8 @@ public class ValidateUserInfoJSONObjectClaims extends AbstractAuthenticationActi
ActionSupport.buildEvent(profileRequestContext, EventIds.INVALID_PROFILE_CTX);
return false;
}
- if (tokenResponseCtx.getTokenResponse().getOIDCTokens().getIDToken() == null) {
+ if (tokenResponseCtx.getTokenResponse() == null ||
+ tokenResponseCtx.getTokenResponse().getOIDCTokens().getIDToken() == null) {
log.debug("{} AccessTokenResponseContext did not contain an id_token", getLogPrefix());
ActionSupport.buildEvent(profileRequestContext, EventIds.INVALID_PROFILE_CTX);
return false;
diff --git a/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/ValidateUserInfoJSONObjectClaimsTest.java b/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/ValidateUserInfoJSONObjectClaimsTest.java
new file mode 100644
index 0000000..c98d66c
--- /dev/null
+++ b/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/ValidateUserInfoJSONObjectClaimsTest.java
@@ -0,0 +1,194 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.idp.plugin.authn.oidc.rp.impl;
+
+import static org.junit.Assert.assertNotNull;
+import static org.junit.Assert.assertNull;
+import static org.testng.Assert.assertEquals;
+
+import java.time.Instant;
+import java.util.Date;
+
+import org.mockito.Mockito;
+import org.opensaml.profile.action.EventIds;
+import org.springframework.webflow.execution.Event;
+import org.testng.annotations.BeforeMethod;
+import org.testng.annotations.Test;
+
+import com.nimbusds.jwt.JWTClaimsSet;
+import com.nimbusds.jwt.PlainJWT;
+import com.nimbusds.oauth2.sdk.token.BearerAccessToken;
+import com.nimbusds.oauth2.sdk.token.RefreshToken;
+import com.nimbusds.openid.connect.sdk.OIDCTokenResponse;
+import com.nimbusds.openid.connect.sdk.UserInfoSuccessResponse;
+import com.nimbusds.openid.connect.sdk.claims.ClaimsSet;
+import com.nimbusds.openid.connect.sdk.claims.UserInfo;
+import com.nimbusds.openid.connect.sdk.token.OIDCTokens;
+
+import net.shibboleth.idp.plugin.authn.oidc.rp.context.AccessTokenResponseContext;
+import net.shibboleth.idp.plugin.authn.oidc.rp.context.UserInfoResponseContext;
+import net.shibboleth.oidc.profile.core.OidcEventIds;
+
+/** Tests for {@link ValidateUserInfoJSONObjectClaims}.*/
+public class ValidateUserInfoJSONObjectClaimsTest extends AbstractOIDCTest {
+
+ /** The action to test*/
+ private ValidateUserInfoJSONObjectClaims action;
+
+ private UserInfoResponseContext userInfoCtx;
+
+ private AccessTokenResponseContext accessTokenCtx;
+
+ @Override
+ @BeforeMethod
+ public void setup() throws Exception {
+ super.setup();
+ action = new ValidateUserInfoJSONObjectClaims();
+ userInfoCtx = new UserInfoResponseContext();
+ accessTokenCtx = new AccessTokenResponseContext();
+
+ action.setTokenResponseContextLookupStrategy(prc -> {
+ final AccessTokenResponseContext atrc = new AccessTokenResponseContext();
+ final OIDCTokenResponse tokenResponse = Mockito.mock(OIDCTokenResponse.class);
+ atrc.setTokenResponse(tokenResponse);
+ final JWTClaimsSet claimsSet = new JWTClaimsSet.Builder()
+ .issuer("https://op.example.com")
+ .audience("https://rp.example.com")
+ .subject("jdoe")
+ .claim("family_name", "blogs")
+ .claim("name","jdoe")
+ .expirationTime(Date.from(Instant.now().plusSeconds(120)))
+ .build();
+ final OIDCTokens tokens = new OIDCTokens(new PlainJWT(claimsSet),
+ new BearerAccessToken("access_token_value"),
+ new RefreshToken("refresh_token_value"));
+ Mockito.when(tokenResponse.getOIDCTokens()).thenReturn(tokens);
+ return atrc;
+ });
+
+ action.setUserInfoResponseContextLookupStrategy(prc -> {
+ final UserInfoResponseContext uirc = new UserInfoResponseContext();
+ final ClaimsSet claims = new ClaimsSet();
+ claims.setClaim("given_name", "joe");
+ claims.setClaim("email", "joe at example.com");
+ claims.setClaim("sub", "jdoe");
+ final UserInfoSuccessResponse uir = new UserInfoSuccessResponse(new UserInfo(claims.toJSONObject()));
+ uirc.setUserInfo(uir);
+ return uirc;
+ });
+
+ }
+
+ @Test
+ public void testValidate_Fail_NoTokenResponse() throws Exception {
+ action.setTokenResponseContextLookupStrategy(prc -> new AccessTokenResponseContext());
+
+ action.initialize();
+ final Event event = action.execute(src);
+ assertNotNull(event);
+ assertEquals(event.getId(), EventIds.INVALID_PROFILE_CTX);
+ }
+
+ @Test
+ public void testValidate_Fail_NoTokenResponseContext() throws Exception {
+ action.setTokenResponseContextLookupStrategy(prc -> null);
+
+ action.initialize();
+ final Event event = action.execute(src);
+ assertNotNull(event);
+ assertEquals(event.getId(), EventIds.INVALID_PROFILE_CTX);
+ }
+
+ @Test
+ public void testValidate_Fail_NoUserInfoResponseContext() throws Exception {
+ action.setUserInfoResponseContextLookupStrategy(prc -> null);
+
+ action.initialize();
+ final Event event = action.execute(src);
+ assertNotNull(event);
+ assertEquals(event.getId(), EventIds.INVALID_PROFILE_CTX);
+ }
+
+ @Test
+ public void testValidate_Fail_NoUserInfo() throws Exception {
+ action.setUserInfoResponseContextLookupStrategy(prc -> new UserInfoResponseContext());
+ action.initialize();
+ final Event event = action.execute(src);
+ assertNotNull(event);
+ assertEquals(event.getId(), EventIds.INVALID_PROFILE_CTX);
+ }
+
+ @Test
+ public void testValidate_Success() throws Exception {
+ action.initialize();
+ final Event event = action.execute(src);
+ assertNull(event);
+ }
+
+ @Test
+ public void testValidate_Success_UserInfoJWT() throws Exception {
+ action.setUserInfoResponseContextLookupStrategy(prc -> {
+ final UserInfoResponseContext uirc = new UserInfoResponseContext();
+ final JWTClaimsSet claims = new JWTClaimsSet.Builder().subject("jdoe")
+ .claim("given_name", "joe")
+ .claim("email", "joe at example.com").build();
+ final UserInfoSuccessResponse uir = new UserInfoSuccessResponse(new PlainJWT(claims));
+ uirc.setUserInfo(uir);
+ return uirc;
+ });
+ action.initialize();
+ final Event event = action.execute(src);
+ assertNull(event);
+ }
+
+ @Test
+ public void testValidate_Fail_SubDoesNotMatchIdToken_UserInfoJWT() throws Exception {
+ action.setUserInfoResponseContextLookupStrategy(prc -> {
+ final UserInfoResponseContext uirc = new UserInfoResponseContext();
+ final JWTClaimsSet claims = new JWTClaimsSet.Builder().subject("new-sub-does-not-match")
+ .claim("given_name", "joe")
+ .claim("email", "joe at example.com").build();
+ final UserInfoSuccessResponse uir = new UserInfoSuccessResponse(new PlainJWT(claims));
+ uirc.setUserInfo(uir);
+ return uirc;
+ });
+ action.initialize();
+ final Event event = action.execute(src);
+ assertNotNull(event);
+ assertEquals(event.getId(), OidcEventIds.INVALID_USERINFO_CLAIMS);
+ }
+
+ @Test
+ public void testValidate_Fail_SubDoesNotMatchIdToken() throws Exception {
+ action.setUserInfoResponseContextLookupStrategy(prc -> {
+ final UserInfoResponseContext uirc = new UserInfoResponseContext();
+ final ClaimsSet claims = new ClaimsSet();
+ claims.setClaim("given_name", "joe");
+ claims.setClaim("email", "joe at example.com");
+ claims.setClaim("sub", "new-sub-does-not-match");
+ final UserInfoSuccessResponse uir = new UserInfoSuccessResponse(new UserInfo(claims.toJSONObject()));
+ uirc.setUserInfo(uir);
+ return uirc;
+ });
+ action.initialize();
+ final Event event = action.execute(src);
+ assertNotNull(event);
+ assertEquals(event.getId(), OidcEventIds.INVALID_USERINFO_CLAIMS);
+ }
+
+}
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list