[java-oidc-common] branch main updated: OSJ-354 - Suffix the PROTOCOL_MESSAGE category with .SAML
Phil Smart
philip.smart at jisc.ac.uk
Tue Aug 8 16:24:51 UTC 2023
This is an automated email from the git hooks/post-receive script.
philsmart pushed a commit to branch main
in repository java-oidc-common.
View the commit online:
http://git.shibboleth.net/view/?p=java-oidc-common.git;a=commit;h=0f82d4b831e777066964df11a2b6cf0ceb2399f0
The following commit(s) were added to refs/heads/main by this push:
new 0f82d4b OSJ-354 - Suffix the PROTOCOL_MESSAGE category with .SAML
0f82d4b is described below
commit 0f82d4b831e777066964df11a2b6cf0ceb2399f0
Author: Phil Smart <philip.smart at jisc.ac.uk>
AuthorDate: Tue Aug 8 17:24:48 2023 +0100
OSJ-354 - Suffix the PROTOCOL_MESSAGE category with .SAML
- Added protocol level logging support to the
AbstractOIDCMessageEncoder
- SetProtocolMessageLoggerSubCategory as OIDC.
https://shibboleth.atlassian.net/browse/OSJ-354
---
.../encoding/impl/AbstractOIDCMessageEncoder.java | 21 ++++--
.../encoding/impl/SimpleNimbusResponseEncoder.java | 4 +-
.../impl/HTTPPostAuthnRequestEncoderTest.java | 39 ++++++----
.../impl/HTTPRedirectAuthnRequestEncoderTest.java | 23 ++++++
.../impl/SimpleNimbusResponseEncoderTest.java | 86 ++++++++++++++++++++++
5 files changed, 152 insertions(+), 21 deletions(-)
diff --git a/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/encoding/impl/AbstractOIDCMessageEncoder.java b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/encoding/impl/AbstractOIDCMessageEncoder.java
index fda7f81..69ca70a 100644
--- a/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/encoding/impl/AbstractOIDCMessageEncoder.java
+++ b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/encoding/impl/AbstractOIDCMessageEncoder.java
@@ -51,8 +51,10 @@ public abstract class AbstractOIDCMessageEncoder extends AbstractHttpServletResp
/** A hook to allow additional checking of the authorization parameters after it is built.*/
@Nonnull private Predicate<List<Pair<String, String>>> authorizationParamsAreValidPredicate;
+ /** Constructor. */
protected AbstractOIDCMessageEncoder() {
authorizationParamsAreValidPredicate = Predicates.alwaysTrue();
+ setProtocolMessageLoggerSubCategory("OIDC");
}
/**
@@ -120,7 +122,7 @@ public abstract class AbstractOIDCMessageEncoder extends AbstractHttpServletResp
*
* @throws MessageEncodingException on error building the parameters
*/
- protected List<Pair<String, String>> createParametersFromRequest(
+ @Nonnull protected List<Pair<String, String>> createParametersFromRequest(
@Nonnull final OIDCAuthenticationRequest req) throws MessageEncodingException {
final List<Pair<String, String>> params = new ArrayList<>();
@@ -151,7 +153,7 @@ public abstract class AbstractOIDCMessageEncoder extends AbstractHttpServletResp
if (req.getResponseType() != null) {
params.add(new Pair<>("response_type", req.getResponseType().toString()));
}
- // Must contain openid so the authz server knows it is an OIDC request
+ // Must contain openid so the OAuth AuthZ server knows it is an OIDC request
params.add(new Pair<>("scope", req.getScope().toString()));
// Only set the response_mode if not equal to the default for that response_type
@@ -232,8 +234,7 @@ public abstract class AbstractOIDCMessageEncoder extends AbstractHttpServletResp
if (!req.providerSupportsClaimsParameter() && req.getAcrs() != null && !req.getAcrs().isEmpty()) {
final String acrString =String.join(" ", req.getAcrs()
.stream()
- .map(ACR::getValue)
- .collect(Collectors.toUnmodifiableList()));
+ .map(ACR::getValue).toList());
params.add(new Pair<>("acr_values", acrString));
}
//TODO: requestURI, includedGrantedScopes?, resource_uris?
@@ -320,7 +321,17 @@ public abstract class AbstractOIDCMessageEncoder extends AbstractHttpServletResp
@Override
@Nullable
protected String serializeMessageForLogging(@Nullable Object message) {
- // Returning null disables log output. If want protocol message logging, need to implement this.
+ if (message instanceof OIDCAuthenticationRequest authnRequest) {
+ try {
+ List<Pair<String, String>> params = createParametersFromRequest(authnRequest);
+ final String paramsSerialized =
+ params.stream().map(p -> p.getFirst()+"="+p.getSecond()).collect(Collectors.joining(", "));
+ return "OIDCAuthenticationRequest{" + paramsSerialized + "}";
+
+ } catch (MessageEncodingException e) {
+ log.trace("Unable to generate serialized message for logging '{}'", e.getMessage());
+ }
+ }
return null;
}
diff --git a/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/encoding/impl/SimpleNimbusResponseEncoder.java b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/encoding/impl/SimpleNimbusResponseEncoder.java
index c87ece6..df7a50c 100644
--- a/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/encoding/impl/SimpleNimbusResponseEncoder.java
+++ b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/encoding/impl/SimpleNimbusResponseEncoder.java
@@ -60,7 +60,9 @@ public class SimpleNimbusResponseEncoder extends AbstractHttpServletResponseMess
@Override
@Nullable
protected String serializeMessageForLogging(@Nullable Object message) {
- // Returning null disables log output. If want protocol message logging, need to implement this.
+ if (message instanceof Response response) {
+ return response.toString();
+ }
return null;
}
diff --git a/oidc-common-profile-impl/src/test/java/net/shibboleth/oidc/profile/encoding/impl/HTTPPostAuthnRequestEncoderTest.java b/oidc-common-profile-impl/src/test/java/net/shibboleth/oidc/profile/encoding/impl/HTTPPostAuthnRequestEncoderTest.java
index 337a3d5..bf06347 100644
--- a/oidc-common-profile-impl/src/test/java/net/shibboleth/oidc/profile/encoding/impl/HTTPPostAuthnRequestEncoderTest.java
+++ b/oidc-common-profile-impl/src/test/java/net/shibboleth/oidc/profile/encoding/impl/HTTPPostAuthnRequestEncoderTest.java
@@ -26,6 +26,9 @@ import org.springframework.mock.web.MockHttpServletResponse;
import org.testng.annotations.BeforeMethod;
import org.testng.annotations.Test;
+import com.nimbusds.jwt.JWT;
+import com.nimbusds.jwt.JWTClaimsSet;
+import com.nimbusds.jwt.PlainJWT;
import com.nimbusds.oauth2.sdk.ResponseType;
import com.nimbusds.oauth2.sdk.id.ClientID;
import com.nimbusds.openid.connect.sdk.OIDCClaimsRequest;
@@ -37,20 +40,6 @@ import net.shibboleth.shared.servlet.impl.HttpServletRequestResponseContext;
import net.shibboleth.shared.servlet.impl.ThreadLocalHttpServletResponseSupplier;
import net.shibboleth.shared.testing.VelocityEngine;
-/*
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
/** Test for the HTTPPostAuthnRequestEncoder.*/
public class HTTPPostAuthnRequestEncoderTest {
@@ -95,7 +84,6 @@ public class HTTPPostAuthnRequestEncoderTest {
encoder.initialize();
encoder.encode();
final String response = mockResponse.getContentAsString();
- System.out.println(response);
assertNotNull(response);
// These are all required
assertTrue(response.contains("client_id"));
@@ -106,6 +94,27 @@ public class HTTPPostAuthnRequestEncoderTest {
}
+ @Test
+ public void testSuccesfullEncoding_WithRequestObject() throws Exception {
+
+ request.setRequestObject(new PlainJWT(new JWTClaimsSet.Builder()
+ .claim("response_type", "code")
+ .claim("redirect_uri","https://localhost:8080/callback")
+ .claim("scope", "openid")
+ .claim("state", "somestate")
+ .build()));
+
+ encoder.initialize();
+ encoder.encode();
+ final String response = mockResponse.getContentAsString();
+ assertNotNull(response);
+ // These are all required
+ assertTrue(response.contains("client_id"));
+ assertTrue(response.contains("response_type"));
+ assertTrue(response.contains("request"));
+ assertTrue(response.contains("scope"));
+ }
+
@Test
public void testSuccesfullEncoding() throws Exception {
encoder.initialize();
diff --git a/oidc-common-profile-impl/src/test/java/net/shibboleth/oidc/profile/encoding/impl/HTTPRedirectAuthnRequestEncoderTest.java b/oidc-common-profile-impl/src/test/java/net/shibboleth/oidc/profile/encoding/impl/HTTPRedirectAuthnRequestEncoderTest.java
index f9173ed..5d47807 100644
--- a/oidc-common-profile-impl/src/test/java/net/shibboleth/oidc/profile/encoding/impl/HTTPRedirectAuthnRequestEncoderTest.java
+++ b/oidc-common-profile-impl/src/test/java/net/shibboleth/oidc/profile/encoding/impl/HTTPRedirectAuthnRequestEncoderTest.java
@@ -26,6 +26,8 @@ import org.springframework.mock.web.MockHttpServletResponse;
import org.testng.annotations.BeforeMethod;
import org.testng.annotations.Test;
+import com.nimbusds.jwt.JWTClaimsSet;
+import com.nimbusds.jwt.PlainJWT;
import com.nimbusds.oauth2.sdk.ResponseType;
import com.nimbusds.oauth2.sdk.id.ClientID;
import com.nimbusds.openid.connect.sdk.OIDCClaimsRequest;
@@ -104,6 +106,27 @@ public class HTTPRedirectAuthnRequestEncoderTest {
}
+ @Test
+ public void testSuccesfullEncoding_WithRequestObject() throws Exception {
+
+ request.setRequestObject(new PlainJWT(new JWTClaimsSet.Builder()
+ .claim("response_type", "code")
+ .claim("redirect_uri","https://localhost:8080/callback")
+ .claim("scope", "openid")
+ .claim("state", "somestate")
+ .build()));
+
+ encoder.initialize();
+ encoder.encode();
+ final String response = mockResponse.getRedirectedUrl();
+ assertNotNull(response);
+ // These are all required
+ assertTrue(response.contains("client_id"));
+ assertTrue(response.contains("response_type"));
+ assertTrue(response.contains("request"));
+ assertTrue(response.contains("scope"));
+ }
+
@Test(expectedExceptions = UninitializedComponentException.class)
public void testUninitialized() throws MessageEncodingException {
encoder.encode();
diff --git a/oidc-common-profile-impl/src/test/java/net/shibboleth/oidc/profile/encoding/impl/SimpleNimbusResponseEncoderTest.java b/oidc-common-profile-impl/src/test/java/net/shibboleth/oidc/profile/encoding/impl/SimpleNimbusResponseEncoderTest.java
new file mode 100644
index 0000000..f2c945d
--- /dev/null
+++ b/oidc-common-profile-impl/src/test/java/net/shibboleth/oidc/profile/encoding/impl/SimpleNimbusResponseEncoderTest.java
@@ -0,0 +1,86 @@
+/*
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+
+package net.shibboleth.oidc.profile.encoding.impl;
+
+import static org.testng.Assert.assertNotNull;
+import static org.testng.Assert.assertTrue;
+
+import java.util.List;
+
+import org.opensaml.messaging.context.MessageContext;
+import org.springframework.mock.web.MockHttpServletRequest;
+import org.springframework.mock.web.MockHttpServletResponse;
+import org.testng.annotations.BeforeMethod;
+import org.testng.annotations.Test;
+
+import com.nimbusds.jose.jwk.JWKSet;
+import com.nimbusds.jose.jwk.KeyUse;
+import com.nimbusds.jose.jwk.gen.RSAKeyGenerator;
+import com.nimbusds.jose.jwk.RSAKey;
+import com.nimbusds.oauth2.sdk.Response;
+
+import net.minidev.json.JSONObject;
+import net.shibboleth.oidc.profile.messaging.JSONSuccessResponse;
+import net.shibboleth.shared.servlet.impl.HttpServletRequestResponseContext;
+import net.shibboleth.shared.servlet.impl.ThreadLocalHttpServletResponseSupplier;
+
+/**
+ * Tests for {@link SimpleNimbusResponseEncoder}.
+ */
+public class SimpleNimbusResponseEncoderTest {
+
+ /** Mock servlet response.*/
+ private MockHttpServletResponse mockResponse;
+
+ /** The encoder to test.*/
+ private SimpleNimbusResponseEncoder encoder;
+
+ /** The response.*/
+ private Response response;
+
+ /** The message context.*/
+ private MessageContext context;
+
+
+ @BeforeMethod public void setUp() throws Exception {
+ encoder = new SimpleNimbusResponseEncoder();
+ context = new MessageContext();
+ RSAKey jwk = new RSAKeyGenerator(2048)
+ .keyID("1")
+ .keyUse(KeyUse.ENCRYPTION)
+ .generate();
+ final JWKSet keySet = new JWKSet(List.of(jwk));
+ final JSONObject keySetJson = new JSONObject(keySet.toJSONObject());
+ response = new JSONSuccessResponse(keySetJson);
+ context.setMessage(response);
+ encoder.setMessageContext(context);
+ mockResponse = new MockHttpServletResponse();
+ encoder.setHttpServletResponseSupplier(new ThreadLocalHttpServletResponseSupplier());
+
+ HttpServletRequestResponseContext.loadCurrent(new MockHttpServletRequest(), mockResponse);
+ }
+
+ @Test
+ public void testSuccesfullEncoding() throws Exception {
+ encoder.initialize();
+ encoder.encode();
+ final String response = mockResponse.getContentAsString();
+ assertNotNull(response);
+ // These are all required
+ assertTrue(response.contains("keys"));
+ }
+
+}
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list