[java-idp-plugin-oidc-rp] branch main updated: JOIDCRP-44 - Null Handling Task
Phil Smart
philip.smart at jisc.ac.uk
Fri Aug 18 13:52:08 UTC 2023
This is an automated email from the git hooks/post-receive script.
philsmart pushed a commit to branch main
in repository java-idp-plugin-oidc-rp.
View the commit online:
http://git.shibboleth.net/view/?p=java-idp-plugin-oidc-rp.git;a=commit;h=4340d477f7b1e984d95194e0751f3de75886a3d0
The following commit(s) were added to refs/heads/main by this push:
new 4340d47 JOIDCRP-44 - Null Handling Task
4340d47 is described below
commit 4340d477f7b1e984d95194e0751f3de75886a3d0
Author: Phil Smart <philip.smart at jisc.ac.uk>
AuthorDate: Fri Aug 18 14:52:04 2023 +0100
JOIDCRP-44 - Null Handling Task
- Updated for null analysis
https://shibboleth.atlassian.net/browse/JOIDCRP-44
---
.../rp/config/navigate/MaxAgeLookupFunction.java | 15 +-
...viderMetadataStringListValueLookupFunction.java | 4 +-
.../navigate/AccessTokenLookupStrategy.java | 14 +-
.../AuthenticationRequestTimeLookupFunction.java | 9 +-
.../ClientIDFromOAuth2ClientContextFunction.java | 2 +-
.../DefaultEndUserClaimsLookupStrategy.java | 2 +-
.../navigate/DefaultIDTokenLookupStrategy.java | 7 +-
.../navigate/DefaultUserInfoJWTLookupStrategy.java | 10 +-
.../navigate/EncryptedIDTokenLookupStrategy.java | 10 +-
.../EncryptedUserInfoJWTLookupStrategy.java | 12 +-
.../IDTokenInAccessTokenUpdateStrategy.java | 7 +-
.../navigate/IDTokenJOSEHeaderLookupStrategy.java | 11 +-
...viderMetadataFromOuboundPeerLookupStrategy.java | 16 +-
.../OutboundMessageContextFromProxyPRC.java | 3 +-
.../navigate/RequestObjectTokenUpdateStrategy.java | 7 +-
.../navigate/SubFromIDTokenLookupFunction.java | 11 +-
...nfoInUserInfoResponseContextUpdateStrategy.java | 3 +-
.../context/logic/IsCodeFlowPredicate.java | 11 +-
.../context/logic/IsHybridFlowPredicate.java | 11 +-
.../context/logic/IsImplicitFlowPredicate.java | 11 +-
...earerTokenForClientAuthenticationPredicate.java | 4 +-
.../logic/RequestObjectRequiredAndSupported.java | 10 +-
.../RequiresSignatureVerificationPredicate.java | 8 +-
.../logic/UserInfoPlainResponseTypeCondition.java | 8 +-
...WTClaimsSetFromRequestObjectLookupFunction.java | 11 +-
.../PayloadFromRequestObjectLookupFunction.java | 12 +-
.../DefaulUserInfoJWTLookupStrategyTest.java | 1 +
.../DefaultEndUserClaimsLookupStrategyTest.java | 7 +-
.../navigate/DefaultIDTokenLookupStrategyTest.java | 2 +
.../EncryptedIDTokenLookupStrategyTest.java | 6 +-
.../EncryptedUserInfoJWTLookupStrategyTest.java | 1 +
.../IDTokenInAccessTokenUpdateStrategyTest.java | 34 +--
.../IDTokenJOSEHeaderLookupStrategyTest.java | 5 +-
.../navigate/SubFromIDTokenLookupFunctionTest.java | 1 +
...nUserInfoResponseContextUpdateStrategyTest.java | 1 +
.../plugin/authn/oidc/rp/test/TestTokenHelper.java | 46 ++--
.../idp/plugin/authn/oidc/rp/OIDCRPPlugin.java | 6 +-
.../ProxyAuthenticationFlowAuditExtractor.java | 4 +-
.../audit/impl/TransitionActionWriteAuditLog.java | 1 -
.../impl/DefaultAccessTokenResponseDecoder.java | 13 +-
.../impl/DefaultUserInfoResponseDecoder.java | 15 +-
.../impl/AbstractRequestEncoderFunction.java | 23 +-
.../impl/DefaultAuthCodeTokenRequestEncoder.java | 35 ++-
.../impl/DefaultUserInfoRequestEncoder.java | 29 +--
.../impl/AbstractHttpOIDCAuthenticationAction.java | 21 +-
.../AbstractOIDCAuthenticationResponseAction.java | 2 +-
...ssTokenToPrivateCredentialsMappingStrategy.java | 13 +-
.../oidc/rp/impl/AuthorizationController.java | 67 +++---
.../authn/oidc/rp/impl/BuildRequestObject.java | 25 ++-
.../oidc/rp/impl/DefaultClaimMergingStrategy.java | 3 +-
.../rp/impl/DefaultClaimSanitizationStrategy.java | 4 +-
.../impl/DefaultRedirectUriCreationFunction.java | 31 ++-
.../oidc/rp/impl/ExchangeCodeForAccessToken.java | 13 +-
.../rp/impl/InitializeAuthorizationRequest.java | 19 +-
...tializeBlankOutboundResponseMessageContext.java | 2 +-
...nitializeOAuth2ClientAuthenticationContext.java | 2 +-
...izeOAuth2ClientAuthenticationMethodHandler.java | 101 ++++++---
.../rp/impl/InitializeOAuth2ClientContext.java | 14 +-
...OutboundAuthorizationRequestMessageContext.java | 6 +-
.../rp/impl/InitializeRelyingPartyContext.java | 28 ++-
.../InitializeUnverifiedRelyingPartyContext.java | 2 +-
.../authn/oidc/rp/impl/OIDCProxySupport.java | 10 +-
.../rp/impl/PrepareOIDCInboundMessageContext.java | 10 +-
.../authn/oidc/rp/impl/ProcessEndUserClaims.java | 41 ++--
...impleOIDCSubjectIdentifierCanonicalization.java | 14 +-
.../rp/impl/UnsupportedResponseTypeAction.java | 2 +-
.../authn/oidc/rp/impl/UserInfoEndpointLookup.java | 2 +-
.../impl/ValidateAuthenticationResponseResult.java | 9 +-
.../ValidateExternalAuthenticationContext.java | 11 +-
.../rp/impl/ValidateOAuthAccessTokenResponse.java | 7 +-
.../oidc/rp/impl/ValidateOIDCAuthentication.java | 116 ++++++----
.../authn/oidc/rp/impl/ValidateResponseState.java | 34 ++-
.../authn/oidc/rp/impl/ValidateTokenClaims.java | 7 +-
.../rp/impl/ValidateUserInfoJSONObjectClaims.java | 26 ++-
...CAuthenticationRequestActionMessageHandler.java | 30 +--
...actOIDCAuthenticationRequestMessageHandler.java | 14 +-
...uthenticationContextClassReferencesHandler.java | 2 +-
.../rp/messaging/impl/AddEndpointURIHandler.java | 13 +-
.../impl/AddForceAuthenticationHandler.java | 3 +-
.../rp/messaging/impl/AddLoginHintHandler.java | 4 +-
.../oidc/rp/messaging/impl/AddMaxAgeHandler.java | 4 +-
.../oidc/rp/messaging/impl/AddNonceHandler.java | 2 +-
.../impl/AddPassiveAuthenticationHandler.java | 4 +-
.../rp/messaging/impl/AddRedirectURIHandler.java | 2 +-
.../messaging/impl/AddRequestedClaimsHandler.java | 2 +-
.../impl/AddResponseTypeAndModeHandler.java | 10 +-
.../oidc/rp/messaging/impl/AddScopesHandler.java | 4 +-
.../oidc/rp/messaging/impl/AddStateHandler.java | 24 +-
.../messaging/impl/BuildPlainRequestObjectJWT.java | 3 +-
.../impl/SetAuthenticationRequestTimeHandler.java | 4 +-
.../impl/OIDCProviderMetadataLookupHandler.java | 17 +-
...henticationRequestNonceClaimLookupStrategy.java | 12 +-
...tAuthenticationConfigurationLookupFunction.java | 35 +--
.../impl/NonceValidationActivationCondition.java | 5 +-
.../DefaultAccessTokenResponseDecoderTest.java | 2 +
.../NimbusAuthCodeTokenRequestEncoderTest.java | 4 +
.../authn/oidc/rp/impl/AbstractOIDCTest.java | 31 ++-
.../oidc/rp/impl/AuthorizationControllerTest.java | 85 ++++---
.../authn/oidc/rp/impl/BuildRequestObjectTest.java | 101 +++++----
.../DefaultRedirectUriCreationFunctionTest.java | 14 +-
.../rp/impl/ExchangeCodeForAccessTokenTest.java | 13 +-
...Auth2ClientAuthenticationMethodHandlerTest.java | 89 +++++---
...MockAsymmetricJOSEObjectCredentialResolver.java | 12 +-
.../oidc/rp/impl/MockSimpleStringTranscoder.java | 15 +-
.../OIDCRPFlowFromAuthenticationResponseTest.java | 94 +++++---
.../oidc/rp/impl/OIDCRPFlowPreRedirectTest.java | 119 ++++++----
.../plugin/authn/oidc/rp/impl/OIDCRPFlowTest.java | 245 ++++++++++++++-------
.../oidc/rp/impl/ProcessEndUserClaimsTest.java | 86 +++++---
...eOIDCSubjectIdentifierCanonicalizationTest.java | 15 +-
.../oidc/rp/impl/UserInfoEndpointLookupTest.java | 27 ++-
.../ValidateAuthenticationResponseResultTest.java | 7 +
.../impl/ValidateOAuthAccessTokenResponseTest.java | 2 +-
.../rp/impl/ValidateOIDCAuthenticationTest.java | 32 ++-
.../oidc/rp/impl/ValidateResponseStateTest.java | 20 +-
...nticationContextClassReferencesHandlerTest.java | 10 +-
.../messaging/impl/AddEndpointURIHandlerTest.java | 18 +-
.../AddForceAuthenticationPromptHandlerTest.java | 19 +-
.../impl/AddPassiveAuthenticationHandlerTest.java | 14 +-
.../messaging/impl/AddRedirectURIHandlerTest.java | 6 +-
.../impl/AddRequestedClaimsHandlerTest.java | 31 +--
.../impl/AddResponseTypeAndModeHandlerTest.java | 46 ++--
.../rp/messaging/impl/AddScopesHandlerTest.java | 9 +-
.../rp/messaging/impl/AddStateHandlerTest.java | 25 ++-
.../impl/BuildPlainRequestObjectJWTTest.java | 28 ++-
.../OIDCProviderMetadataLookupHandlerTest.java | 57 +++--
...henticationConfigurationLookupFunctionTest.java | 25 ++-
.../flow/AbstractAuthnXmlFlowExecutionTests.java | 19 +-
.../authn/test/flow/mock/MockFlowBuilder.java | 2 +-
128 files changed, 1655 insertions(+), 962 deletions(-)
diff --git a/idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/config/navigate/MaxAgeLookupFunction.java b/idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/config/navigate/MaxAgeLookupFunction.java
index 613b1ed..5f1903c 100644
--- a/idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/config/navigate/MaxAgeLookupFunction.java
+++ b/idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/config/navigate/MaxAgeLookupFunction.java
@@ -20,6 +20,7 @@ import java.util.function.Function;
import javax.annotation.Nonnull;
import javax.annotation.Nullable;
+import org.opensaml.messaging.context.MessageContext;
import org.opensaml.profile.context.ProfileRequestContext;
import net.shibboleth.oidc.profile.config.OIDCAuthenticationProfileConfiguration;
@@ -37,7 +38,7 @@ import net.shibboleth.shared.logic.Constraint;
public class MaxAgeLookupFunction extends AbstractRelyingPartyLookupFunction<Duration> {
/** Default max authentication age if none can be found on the profile context.*/
- private final Duration maxAgeDefault;
+ @Nonnull private final Duration maxAgeDefault;
/**
* Strategy used to locate the {@link OIDCAuthenticationRequest}.
@@ -55,8 +56,9 @@ public class MaxAgeLookupFunction extends AbstractRelyingPartyLookupFunction<Dur
maxAgeDefault = Constraint.isNotNull(defaultAge, "Max Age default can not be null");
authenticationRequestLookupStrategy = prc -> {
- if (prc.getOutboundMessageContext() != null && prc.getOutboundMessageContext().getMessage() != null &&
- prc.getOutboundMessageContext().getMessage() instanceof OIDCAuthenticationRequest request) {
+ final MessageContext msgCtx = prc.getOutboundMessageContext();
+ if (msgCtx != null && msgCtx.getMessage() != null &&
+ msgCtx.getMessage() instanceof final OIDCAuthenticationRequest request) {
return request;
}
return null;
@@ -82,8 +84,9 @@ public class MaxAgeLookupFunction extends AbstractRelyingPartyLookupFunction<Dur
// exists in the profile config it should have already been set on the authentication request.
final OIDCAuthenticationRequest authnRequest = authenticationRequestLookupStrategy.apply(input);
- if (authnRequest != null && authnRequest.getMaxAge() != null) {
- return authnRequest.getMaxAge();
+ final Duration authnRequestMaxAge = authnRequest != null ? authnRequest.getMaxAge() : null;
+ if (authnRequestMaxAge != null) {
+ return authnRequestMaxAge;
}
// Check one was not specified in the relying party context
@@ -91,7 +94,7 @@ public class MaxAgeLookupFunction extends AbstractRelyingPartyLookupFunction<Dur
final RelyingPartyContext rpc = getRelyingPartyContextLookupStrategy().apply(input);
if (rpc != null) {
final ProfileConfiguration pc = rpc.getProfileConfig();
- if (pc instanceof OIDCAuthenticationProfileConfiguration config){
+ if (pc instanceof final OIDCAuthenticationProfileConfiguration config){
final Duration maxAge = config.getMaxAuthenticationAge(input);
if (maxAge == null) {
return maxAgeDefault;
diff --git a/idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/config/navigate/ProviderMetadataStringListValueLookupFunction.java b/idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/config/navigate/ProviderMetadataStringListValueLookupFunction.java
index e679d3d..942c3cb 100644
--- a/idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/config/navigate/ProviderMetadataStringListValueLookupFunction.java
+++ b/idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/config/navigate/ProviderMetadataStringListValueLookupFunction.java
@@ -24,12 +24,12 @@ import javax.annotation.Nonnull;
import javax.annotation.Nullable;
import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
import com.nimbusds.openid.connect.sdk.op.OIDCProviderMetadata;
import net.shibboleth.shared.annotation.ParameterName;
import net.shibboleth.shared.logic.Constraint;
+import net.shibboleth.shared.primitive.LoggerFactory;
/**
* Fetches the value for the configured key as List of {@link String}s. May be {@code null} if the value is not found
@@ -66,7 +66,7 @@ public class ProviderMetadataStringListValueLookupFunction implements Function<O
log.trace("No value found for the key {}", keyName);
return null;
}
- if (value instanceof String strValue) {
+ if (value instanceof final String strValue) {
return List.of(strValue);
}
if (value instanceof List) {
diff --git a/idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/context/navigate/AccessTokenLookupStrategy.java b/idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/context/navigate/AccessTokenLookupStrategy.java
index 74ded0d..af7f51d 100644
--- a/idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/context/navigate/AccessTokenLookupStrategy.java
+++ b/idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/context/navigate/AccessTokenLookupStrategy.java
@@ -21,8 +21,6 @@ import javax.annotation.Nullable;
import javax.annotation.concurrent.ThreadSafe;
import org.opensaml.profile.context.ProfileRequestContext;
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
import com.nimbusds.oauth2.sdk.token.AccessToken;
@@ -33,10 +31,6 @@ import net.shibboleth.shared.annotation.ParameterName;
@ThreadSafe
public class AccessTokenLookupStrategy extends AbstractTokenResponseLookupStrategy
implements Function<ProfileRequestContext, AccessToken> {
-
- /** Logger. */
- @Nonnull
- private final Logger log = LoggerFactory.getLogger(AccessTokenLookupStrategy.class);
/** Constructor.*/
public AccessTokenLookupStrategy() {
@@ -55,13 +49,13 @@ public class AccessTokenLookupStrategy extends AbstractTokenResponseLookupStrate
}
@Override
- @Nullable public AccessToken apply(@Nonnull final ProfileRequestContext prc) {
+ @Nullable public AccessToken apply(@Nullable final ProfileRequestContext prc) {
final AccessTokenResponseContext tokenContext = getTokenResponseContextLookupStrategy().apply(prc);
- if (tokenContext == null || tokenContext.getTokenResponse() == null ||
- tokenContext.getTokenResponse().getTokens() == null) {
+ final var tokenResponse = tokenContext != null ? tokenContext.getTokenResponse() : null;
+ if (tokenResponse == null || tokenResponse.getTokens() == null) {
return null;
}
- return tokenContext.getTokenResponse().getTokens().getAccessToken();
+ return tokenResponse.getTokens().getAccessToken();
}
}
diff --git a/idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/context/navigate/AuthenticationRequestTimeLookupFunction.java b/idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/context/navigate/AuthenticationRequestTimeLookupFunction.java
index 2a32b8a..551ec76 100644
--- a/idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/context/navigate/AuthenticationRequestTimeLookupFunction.java
+++ b/idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/context/navigate/AuthenticationRequestTimeLookupFunction.java
@@ -21,8 +21,6 @@ import javax.annotation.Nonnull;
import javax.annotation.Nullable;
import org.opensaml.profile.context.ProfileRequestContext;
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
import net.shibboleth.oidc.profile.core.OIDCAuthenticationRequest;
import net.shibboleth.shared.logic.Constraint;
@@ -33,9 +31,6 @@ import net.shibboleth.shared.logic.Constraint;
*/
public class AuthenticationRequestTimeLookupFunction implements Function<ProfileRequestContext, Instant> {
- /** Class logger. */
- @Nonnull private final Logger log = LoggerFactory.getLogger(AuthenticationRequestTimeLookupFunction.class);
-
/**
* Strategy used to locate the {@link OIDCAuthenticationRequest}.
* Defaults to the outbound message context of the PRC.
@@ -45,8 +40,8 @@ public class AuthenticationRequestTimeLookupFunction implements Function<Profile
/** Constructor.*/
public AuthenticationRequestTimeLookupFunction() {
authenticationRequestLookupStrategy = prc -> {
- if (prc.getOutboundMessageContext() != null && prc.getOutboundMessageContext().getMessage() != null &&
- prc.getOutboundMessageContext().getMessage() instanceof OIDCAuthenticationRequest authnRequest) {
+ final Object outboundMessage = prc.ensureOutboundMessageContext().getMessage();
+ if (outboundMessage instanceof final OIDCAuthenticationRequest authnRequest) {
return authnRequest;
}
return null;
diff --git a/idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/context/navigate/ClientIDFromOAuth2ClientContextFunction.java b/idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/context/navigate/ClientIDFromOAuth2ClientContextFunction.java
index 0e8781a..b9b88e2 100644
--- a/idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/context/navigate/ClientIDFromOAuth2ClientContextFunction.java
+++ b/idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/context/navigate/ClientIDFromOAuth2ClientContextFunction.java
@@ -56,7 +56,7 @@ public class ClientIDFromOAuth2ClientContextFunction
/** {@inheritDoc} */
@Override @Nullable
- public String apply(@Nonnull final ProfileRequestContext prc, @Nullable final JWTClaimsSet claimsSet) {
+ public String apply(@Nullable final ProfileRequestContext prc, @Nullable final JWTClaimsSet claimsSet) {
final OAuth2ClientContext clientContext = oauth2ClientContextLookupStrategy.apply(prc);
if (clientContext == null) {
return null;
diff --git a/idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/context/navigate/DefaultEndUserClaimsLookupStrategy.java b/idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/context/navigate/DefaultEndUserClaimsLookupStrategy.java
index ae2d92e..9c2b7ca 100644
--- a/idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/context/navigate/DefaultEndUserClaimsLookupStrategy.java
+++ b/idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/context/navigate/DefaultEndUserClaimsLookupStrategy.java
@@ -58,7 +58,7 @@ public class DefaultEndUserClaimsLookupStrategy implements Function<ProfileReque
@Override
- @Nullable public ClaimsSet apply(@Nonnull final ProfileRequestContext prc) {
+ @Nullable public ClaimsSet apply(@Nullable final ProfileRequestContext prc) {
final EndUserClaimsContext endUserContext = endUserClaimsContextLookupStrategy.apply(prc);
diff --git a/idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/context/navigate/DefaultIDTokenLookupStrategy.java b/idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/context/navigate/DefaultIDTokenLookupStrategy.java
index 65fa062..8080add 100644
--- a/idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/context/navigate/DefaultIDTokenLookupStrategy.java
+++ b/idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/context/navigate/DefaultIDTokenLookupStrategy.java
@@ -49,12 +49,13 @@ public class DefaultIDTokenLookupStrategy extends AbstractTokenResponseLookupStr
}
@Override
- @Nullable public JWT apply(@Nonnull final ProfileRequestContext prc) {
+ @Nullable public JWT apply(@Nullable final ProfileRequestContext prc) {
final AccessTokenResponseContext tokenContext = getTokenResponseContextLookupStrategy().apply(prc);
- if (tokenContext == null || tokenContext.getTokenResponse() == null) {
+ final var tokenResponse = tokenContext != null ? tokenContext.getTokenResponse() : null;
+ if (tokenResponse == null || tokenResponse.getTokens() == null) {
return null;
}
- return tokenContext.getTokenResponse().getOIDCTokens().getIDToken();
+ return tokenResponse.getOIDCTokens().getIDToken();
}
}
diff --git a/idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/context/navigate/DefaultUserInfoJWTLookupStrategy.java b/idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/context/navigate/DefaultUserInfoJWTLookupStrategy.java
index fa154ab..8e0d941 100644
--- a/idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/context/navigate/DefaultUserInfoJWTLookupStrategy.java
+++ b/idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/context/navigate/DefaultUserInfoJWTLookupStrategy.java
@@ -26,6 +26,7 @@ import org.opensaml.profile.context.navigate.InboundMessageContextLookup;
import com.nimbusds.common.contenttype.ContentType;
import com.nimbusds.jwt.JWT;
+import com.nimbusds.openid.connect.sdk.UserInfoSuccessResponse;
import net.shibboleth.idp.plugin.authn.oidc.rp.context.UserInfoResponseContext;
import net.shibboleth.shared.logic.Constraint;
@@ -62,15 +63,14 @@ public class DefaultUserInfoJWTLookupStrategy implements Function<ProfileRequest
@Override
- @Nullable public JWT apply(@Nonnull final ProfileRequestContext prc) {
+ @Nullable public JWT apply(@Nullable final ProfileRequestContext prc) {
final UserInfoResponseContext userInfoContext = userInfoResponseContextLookupStrategy.apply(prc);
-
- if (userInfoContext == null || userInfoContext.getUserInfo() == null ||
- userInfoContext.getUserInfo().getEntityContentType() != ContentType.APPLICATION_JWT) {
+ final UserInfoSuccessResponse userInfo = userInfoContext != null ? userInfoContext.getUserInfo() : null;
+ if (userInfo == null || userInfo.getEntityContentType() != ContentType.APPLICATION_JWT) {
return null;
}
- return userInfoContext.getUserInfo().getUserInfoJWT();
+ return userInfo.getUserInfoJWT();
}
}
diff --git a/idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/context/navigate/EncryptedIDTokenLookupStrategy.java b/idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/context/navigate/EncryptedIDTokenLookupStrategy.java
index f9145ec..acebb6b 100644
--- a/idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/context/navigate/EncryptedIDTokenLookupStrategy.java
+++ b/idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/context/navigate/EncryptedIDTokenLookupStrategy.java
@@ -22,14 +22,15 @@ import javax.annotation.concurrent.ThreadSafe;
import org.opensaml.profile.context.ProfileRequestContext;
import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
import com.nimbusds.jwt.EncryptedJWT;
import com.nimbusds.jwt.JWT;
import com.nimbusds.jwt.SignedJWT;
+import com.nimbusds.openid.connect.sdk.OIDCTokenResponse;
import net.shibboleth.idp.plugin.authn.oidc.rp.context.AccessTokenResponseContext;
import net.shibboleth.shared.annotation.ParameterName;
+import net.shibboleth.shared.primitive.LoggerFactory;
/**
* Function that extracts the id_token from the {@link AccessTokenResponseContext} iff it is an {@link EncryptedJWT}
@@ -59,12 +60,13 @@ public class EncryptedIDTokenLookupStrategy extends AbstractTokenResponseLookupS
}
@Override
- @Nullable public JWT apply(@Nonnull final ProfileRequestContext prc) {
+ @Nullable public JWT apply(@Nullable final ProfileRequestContext prc) {
final AccessTokenResponseContext tokenContext = getTokenResponseContextLookupStrategy().apply(prc);
- if (tokenContext == null || tokenContext.getTokenResponse() == null) {
+ final OIDCTokenResponse tokenResponse = tokenContext != null ? tokenContext.getTokenResponse() : null;
+ if (tokenResponse == null) {
return null;
}
- final JWT token = tokenContext.getTokenResponse().getOIDCTokens().getIDToken();
+ final JWT token = tokenResponse.getOIDCTokens().getIDToken();
if (token instanceof EncryptedJWT) {
log.trace("EncryptedIDToken Lookup: ID Token is encrypted using algorithm '{}'",
token.getHeader().getAlgorithm());
diff --git a/idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/context/navigate/EncryptedUserInfoJWTLookupStrategy.java b/idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/context/navigate/EncryptedUserInfoJWTLookupStrategy.java
index a6b0e75..3a9b3b4 100644
--- a/idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/context/navigate/EncryptedUserInfoJWTLookupStrategy.java
+++ b/idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/context/navigate/EncryptedUserInfoJWTLookupStrategy.java
@@ -22,15 +22,16 @@ import javax.annotation.concurrent.ThreadSafe;
import org.opensaml.profile.context.ProfileRequestContext;
import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
import com.nimbusds.jwt.EncryptedJWT;
import com.nimbusds.jwt.JWT;
import com.nimbusds.jwt.SignedJWT;
+import com.nimbusds.openid.connect.sdk.UserInfoSuccessResponse;
import net.shibboleth.idp.plugin.authn.oidc.rp.context.AccessTokenResponseContext;
import net.shibboleth.idp.plugin.authn.oidc.rp.context.UserInfoResponseContext;
import net.shibboleth.shared.annotation.ParameterName;
+import net.shibboleth.shared.primitive.LoggerFactory;
/**
* Function that extracts the UserInfo JWT from the {@link UserInfoResponseContext} iff it is an {@link EncryptedJWT}
@@ -61,16 +62,17 @@ public class EncryptedUserInfoJWTLookupStrategy extends AbstractUserInfoTokenRes
}
@Override
- @Nullable public JWT apply(@Nonnull final ProfileRequestContext prc) {
+ @Nullable public JWT apply(@Nullable final ProfileRequestContext prc) {
final UserInfoResponseContext userInfoContext = getUserInfoResponseContextLookupStrategy().apply(prc);
- if (userInfoContext == null || userInfoContext.getUserInfo() == null) {
+ final UserInfoSuccessResponse userInfo = userInfoContext != null ? userInfoContext.getUserInfo() : null;
+ if (userInfo == null) {
return null;
}
- if (userInfoContext.getUserInfo().getUserInfoJWT() == null) {
+ if (userInfo.getUserInfoJWT() == null) {
log.trace("EncryptedUserInfoToken Lookup: UserInfo response JWT is null, nothing to return");
return null;
}
- final JWT token = userInfoContext.getUserInfo().getUserInfoJWT();
+ final JWT token = userInfo.getUserInfoJWT();
if (token instanceof EncryptedJWT) {
log.trace("EncryptedUserInfoToken Lookup: UserInfo response JWT is encrypted using algorithm '{}'",
token.getHeader().getAlgorithm());
diff --git a/idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/context/navigate/IDTokenInAccessTokenUpdateStrategy.java b/idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/context/navigate/IDTokenInAccessTokenUpdateStrategy.java
index 5319c54..fb58108 100644
--- a/idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/context/navigate/IDTokenInAccessTokenUpdateStrategy.java
+++ b/idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/context/navigate/IDTokenInAccessTokenUpdateStrategy.java
@@ -23,7 +23,6 @@ import org.opensaml.messaging.context.navigate.ChildContextLookup;
import org.opensaml.profile.context.ProfileRequestContext;
import org.opensaml.profile.context.navigate.InboundMessageContextLookup;
import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
import com.nimbusds.jwt.JWT;
import com.nimbusds.oauth2.sdk.ParseException;
@@ -33,6 +32,7 @@ import net.minidev.json.JSONObject;
import net.shibboleth.idp.plugin.authn.oidc.rp.context.AccessTokenResponseContext;
import net.shibboleth.shared.annotation.ParameterName;
import net.shibboleth.shared.logic.Constraint;
+import net.shibboleth.shared.primitive.LoggerFactory;
/** Consumer to update the id_token in the {@link AccessTokenResponseContext}.*/
public class IDTokenInAccessTokenUpdateStrategy implements BiConsumer<ProfileRequestContext, JWT> {
@@ -69,10 +69,11 @@ public class IDTokenInAccessTokenUpdateStrategy implements BiConsumer<ProfileReq
final AccessTokenResponseContext context =
tokenResponseContextLookupStrategy.apply(profileRequestContext);
- if (context != null) {
+ final OIDCTokenResponse tokenReponse = context != null ? context.getTokenResponse() : null;
+ if (context != null && tokenReponse != null) {
try {
// Create a new token response with the update id_token from the existing response
- final JSONObject jsonToken = context.getTokenResponse().toJSONObject();
+ final JSONObject jsonToken = tokenReponse.toJSONObject();
jsonToken.put("id_token", idToken.serialize());
context.setTokenResponse(OIDCTokenResponse.parse(jsonToken));
} catch (final ParseException e) {
diff --git a/idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/context/navigate/IDTokenJOSEHeaderLookupStrategy.java b/idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/context/navigate/IDTokenJOSEHeaderLookupStrategy.java
index 027d174..7b380d4 100644
--- a/idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/context/navigate/IDTokenJOSEHeaderLookupStrategy.java
+++ b/idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/context/navigate/IDTokenJOSEHeaderLookupStrategy.java
@@ -24,6 +24,7 @@ import org.opensaml.profile.context.ProfileRequestContext;
import com.nimbusds.jose.Header;
import com.nimbusds.jose.JWSHeader;
+import com.nimbusds.openid.connect.sdk.OIDCTokenResponse;
import net.shibboleth.idp.plugin.authn.oidc.rp.context.AccessTokenResponseContext;
import net.shibboleth.shared.annotation.ParameterName;
@@ -50,14 +51,14 @@ public class IDTokenJOSEHeaderLookupStrategy extends AbstractTokenResponseLookup
}
@Override
- @Nullable public JWSHeader apply(@Nonnull final ProfileRequestContext prc) {
+ @Nullable public JWSHeader apply(@Nullable final ProfileRequestContext prc) {
final AccessTokenResponseContext tokenContext = getTokenResponseContextLookupStrategy().apply(prc);
- if (tokenContext == null || tokenContext.getTokenResponse() == null ||
- tokenContext.getTokenResponse().getOIDCTokens().getIDToken() == null) {
+ final OIDCTokenResponse tokenResponse = tokenContext != null ? tokenContext.getTokenResponse() : null;
+ if (tokenResponse == null || tokenResponse.getOIDCTokens().getIDToken() == null) {
return null;
}
- final Header header = tokenContext.getTokenResponse().getOIDCTokens().getIDToken().getHeader();
- if (header instanceof JWSHeader jwsHeader) {
+ final Header header = tokenResponse.getOIDCTokens().getIDToken().getHeader();
+ if (header instanceof final JWSHeader jwsHeader) {
return jwsHeader;
}
return null;
diff --git a/idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/context/navigate/OIDCProviderMetadataFromOuboundPeerLookupStrategy.java b/idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/context/navigate/OIDCProviderMetadataFromOuboundPeerLookupStrategy.java
index b566e26..88c93a5 100644
--- a/idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/context/navigate/OIDCProviderMetadataFromOuboundPeerLookupStrategy.java
+++ b/idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/context/navigate/OIDCProviderMetadataFromOuboundPeerLookupStrategy.java
@@ -16,9 +16,9 @@ package net.shibboleth.idp.plugin.authn.oidc.rp.context.navigate;
import java.util.function.Function;
-import javax.annotation.Nonnull;
import javax.annotation.Nullable;
+import org.opensaml.messaging.context.MessageContext;
import org.opensaml.profile.context.ProfileRequestContext;
import net.shibboleth.oidc.metadata.context.OIDCProviderMetadataContext;
@@ -32,15 +32,19 @@ public class OIDCProviderMetadataFromOuboundPeerLookupStrategy
implements Function<ProfileRequestContext, OIDCProviderMetadataContext>{
@Override
- @Nullable public OIDCProviderMetadataContext apply(@Nonnull final ProfileRequestContext prc) {
- if (prc.getOutboundMessageContext() == null) {
+ @Nullable public OIDCProviderMetadataContext apply(@Nullable final ProfileRequestContext prc) {
+ if (prc == null) {
return null;
}
- if (prc.getOutboundMessageContext().getSubcontext(OIDCPeerEntityContext.class) == null) {
+ final MessageContext outboundMsgContext = prc.getOutboundMessageContext();
+ if (outboundMsgContext == null) {
return null;
}
- return prc.getOutboundMessageContext()
- .getSubcontext(OIDCPeerEntityContext.class).getSubcontext(OIDCProviderMetadataContext.class);
+ final OIDCPeerEntityContext peerContext = outboundMsgContext.getSubcontext(OIDCPeerEntityContext.class);
+ if (peerContext == null) {
+ return null;
+ }
+ return peerContext.getSubcontext(OIDCProviderMetadataContext.class);
}
}
diff --git a/idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/context/navigate/OutboundMessageContextFromProxyPRC.java b/idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/context/navigate/OutboundMessageContextFromProxyPRC.java
index f9a015b..73b14a9 100644
--- a/idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/context/navigate/OutboundMessageContextFromProxyPRC.java
+++ b/idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/context/navigate/OutboundMessageContextFromProxyPRC.java
@@ -31,8 +31,7 @@ public class OutboundMessageContextFromProxyPRC
@Override
@Nullable
- public MessageContext apply(@Nullable final ProfileRequestContext input) {
-
+ public MessageContext apply(@Nullable final ProfileRequestContext input) {
if (input == null) {
return null;
}
diff --git a/idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/context/navigate/RequestObjectTokenUpdateStrategy.java b/idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/context/navigate/RequestObjectTokenUpdateStrategy.java
index 913fbf6..19306cb 100644
--- a/idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/context/navigate/RequestObjectTokenUpdateStrategy.java
+++ b/idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/context/navigate/RequestObjectTokenUpdateStrategy.java
@@ -18,15 +18,16 @@ import java.util.function.BiConsumer;
import java.util.function.Function;
import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
import org.opensaml.messaging.context.MessageContext;
import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
import com.nimbusds.jwt.JWT;
import net.shibboleth.oidc.profile.core.OIDCAuthenticationRequest;
import net.shibboleth.shared.logic.Constraint;
+import net.shibboleth.shared.primitive.LoggerFactory;
/** Consumer that adds the {@link JWT} back to the Request Object in the {@link OIDCAuthenticationRequest}.*/
public class RequestObjectTokenUpdateStrategy implements BiConsumer<JWT, MessageContext> {
@@ -41,7 +42,7 @@ public class RequestObjectTokenUpdateStrategy implements BiConsumer<JWT, Message
/** Constructor.*/
public RequestObjectTokenUpdateStrategy() {
authenticationRequestLookupStrategy = mc -> {
- if (mc.getMessage() instanceof OIDCAuthenticationRequest request) {
+ if (mc.getMessage() instanceof final OIDCAuthenticationRequest request) {
return request;
}
return null;
@@ -60,7 +61,7 @@ public class RequestObjectTokenUpdateStrategy implements BiConsumer<JWT, Message
}
@Override
- public void accept(final JWT jwt, final MessageContext messageContext) {
+ public void accept(@Nullable final JWT jwt, @Nullable final MessageContext messageContext) {
if (messageContext == null) {
return;
}
diff --git a/idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/context/navigate/SubFromIDTokenLookupFunction.java b/idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/context/navigate/SubFromIDTokenLookupFunction.java
index f4794b8..f807ac1 100644
--- a/idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/context/navigate/SubFromIDTokenLookupFunction.java
+++ b/idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/context/navigate/SubFromIDTokenLookupFunction.java
@@ -24,12 +24,13 @@ import javax.annotation.concurrent.ThreadSafe;
import org.opensaml.profile.context.ProfileRequestContext;
import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
import com.nimbusds.jwt.JWTClaimsSet;
+import com.nimbusds.openid.connect.sdk.OIDCTokenResponse;
import net.shibboleth.idp.plugin.authn.oidc.rp.context.AccessTokenResponseContext;
import net.shibboleth.shared.annotation.ParameterName;
+import net.shibboleth.shared.primitive.LoggerFactory;
/**
* A function that pulls the subject 'sub' out of the id_token in the {@link AccessTokenResponseContext}.
@@ -67,14 +68,14 @@ public class SubFromIDTokenLookupFunction extends AbstractTokenResponseLookupStr
*/
@Override
@Nullable
- public String apply(@Nonnull final ProfileRequestContext prc, @Nullable final JWTClaimsSet claimsSet) {
+ public String apply(@Nullable final ProfileRequestContext prc, @Nullable final JWTClaimsSet claimsSet) {
final AccessTokenResponseContext tokenContext = getTokenResponseContextLookupStrategy().apply(prc);
- if (tokenContext == null || tokenContext.getTokenResponse() == null ||
- tokenContext.getTokenResponse().getOIDCTokens().getIDToken() == null) {
+ final OIDCTokenResponse tokenResponse = tokenContext != null ? tokenContext.getTokenResponse() : null;
+ if (tokenResponse == null || tokenResponse.getOIDCTokens().getIDToken() == null) {
return null;
}
try {
- final JWTClaimsSet claims = tokenContext.getTokenResponse().getOIDCTokens().getIDToken().getJWTClaimsSet();
+ final JWTClaimsSet claims = tokenResponse.getOIDCTokens().getIDToken().getJWTClaimsSet();
if (claims != null && claims.getSubject() != null) {
return claims.getSubject();
}
diff --git a/idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/context/navigate/UserInfoInUserInfoResponseContextUpdateStrategy.java b/idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/context/navigate/UserInfoInUserInfoResponseContextUpdateStrategy.java
index 79182aa..a71e5a8 100644
--- a/idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/context/navigate/UserInfoInUserInfoResponseContextUpdateStrategy.java
+++ b/idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/context/navigate/UserInfoInUserInfoResponseContextUpdateStrategy.java
@@ -21,7 +21,6 @@ import javax.annotation.Nonnull;
import org.opensaml.profile.context.ProfileRequestContext;
import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
import com.nimbusds.jwt.JWT;
import com.nimbusds.openid.connect.sdk.UserInfoResponse;
@@ -30,6 +29,7 @@ import com.nimbusds.openid.connect.sdk.UserInfoSuccessResponse;
import net.shibboleth.idp.plugin.authn.oidc.rp.context.AccessTokenResponseContext;
import net.shibboleth.idp.plugin.authn.oidc.rp.context.UserInfoResponseContext;
import net.shibboleth.shared.annotation.ParameterName;
+import net.shibboleth.shared.primitive.LoggerFactory;
/**
* Consumer strategy to update the UserInfo JWT in the {@link UserInfoResponseContext}.
@@ -41,7 +41,6 @@ public class UserInfoInUserInfoResponseContextUpdateStrategy extends AbstractUse
/** Class logger. */
@Nonnull private final Logger log = LoggerFactory.getLogger(UserInfoInUserInfoResponseContextUpdateStrategy.class);
-
/**
*
* Constructor.
diff --git a/idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/context/logic/IsCodeFlowPredicate.java b/idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/context/logic/IsCodeFlowPredicate.java
index cb9a2ee..1936800 100644
--- a/idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/context/logic/IsCodeFlowPredicate.java
+++ b/idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/context/logic/IsCodeFlowPredicate.java
@@ -21,9 +21,11 @@ import javax.annotation.Nullable;
import org.opensaml.messaging.context.MessageContext;
import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
+
+import com.nimbusds.oauth2.sdk.ResponseType;
import net.shibboleth.oidc.profile.core.OIDCAuthenticationRequest;
+import net.shibboleth.shared.primitive.LoggerFactory;
/**
* A predicate that determines if the flow is a 'code-flow' using the Authentication Request that is inside
@@ -40,14 +42,15 @@ public class IsCodeFlowPredicate implements Predicate<MessageContext> {
log.trace("Message context was null, can not determine flow type");
return false;
}
- if (!(input.getMessage() instanceof OIDCAuthenticationRequest)) {
+ if (!(input.getMessage() instanceof final OIDCAuthenticationRequest authnRequest)) {
log.trace("Message context did not contain an authentication request, can not determine flow type");
return false;
}
- if (((OIDCAuthenticationRequest)input.getMessage()).getResponseType() == null) {
+ final ResponseType responseType = authnRequest.getResponseType();
+ if (responseType == null) {
log.trace("Authentication request did not contain a response_type, can not determine flow type");
return false;
}
- return ((OIDCAuthenticationRequest)input.getMessage()).getResponseType().impliesCodeFlow();
+ return responseType.impliesCodeFlow();
}
}
diff --git a/idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/context/logic/IsHybridFlowPredicate.java b/idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/context/logic/IsHybridFlowPredicate.java
index 3e50d81..110eff1 100644
--- a/idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/context/logic/IsHybridFlowPredicate.java
+++ b/idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/context/logic/IsHybridFlowPredicate.java
@@ -21,9 +21,11 @@ import javax.annotation.Nullable;
import org.opensaml.messaging.context.MessageContext;
import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
+
+import com.nimbusds.oauth2.sdk.ResponseType;
import net.shibboleth.oidc.profile.core.OIDCAuthenticationRequest;
+import net.shibboleth.shared.primitive.LoggerFactory;
/**
* A predicate that determines if the flow is a 'hybrid-flow' using the Authentication Request that is inside
@@ -40,14 +42,15 @@ public class IsHybridFlowPredicate implements Predicate<MessageContext> {
log.trace("Message context was null, can not determine flow type");
return false;
}
- if (!(input.getMessage() instanceof OIDCAuthenticationRequest)) {
+ if (!(input.getMessage() instanceof final OIDCAuthenticationRequest authnRequest)) {
log.trace("Message context did not contain an authentication request, can not determine flow type");
return false;
}
- if (((OIDCAuthenticationRequest)input.getMessage()).getResponseType() == null) {
+ final ResponseType responseType = authnRequest.getResponseType();
+ if (responseType == null) {
log.trace("Authentication request did not contain a response_type, can not determine flow type");
return false;
}
- return ((OIDCAuthenticationRequest)input.getMessage()).getResponseType().impliesHybridFlow();
+ return responseType.impliesHybridFlow();
}
}
diff --git a/idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/context/logic/IsImplicitFlowPredicate.java b/idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/context/logic/IsImplicitFlowPredicate.java
index 03bf2d2..d243127 100644
--- a/idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/context/logic/IsImplicitFlowPredicate.java
+++ b/idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/context/logic/IsImplicitFlowPredicate.java
@@ -21,9 +21,11 @@ import javax.annotation.Nullable;
import org.opensaml.messaging.context.MessageContext;
import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
+
+import com.nimbusds.oauth2.sdk.ResponseType;
import net.shibboleth.oidc.profile.core.OIDCAuthenticationRequest;
+import net.shibboleth.shared.primitive.LoggerFactory;
/**
* A predicate that determines if the flow is a 'implicit-flow' using the Authentication Request that is inside
@@ -40,14 +42,15 @@ public class IsImplicitFlowPredicate implements Predicate<MessageContext> {
log.trace("Message context was null, can not determine flow type");
return false;
}
- if (!(input.getMessage() instanceof OIDCAuthenticationRequest)) {
+ if (!(input.getMessage() instanceof final OIDCAuthenticationRequest authnRequest)) {
log.trace("Message context did not contain an authentication request, can not determine flow type");
return false;
}
- if (((OIDCAuthenticationRequest)input.getMessage()).getResponseType() == null) {
+ final ResponseType responseType = authnRequest.getResponseType();
+ if (responseType == null) {
log.trace("Authentication request did not contain a response_type, can not determine flow type");
return false;
}
- return ((OIDCAuthenticationRequest)input.getMessage()).getResponseType().impliesImplicitFlow();
+ return responseType.impliesImplicitFlow();
}
}
diff --git a/idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/context/logic/JWTBearerTokenForClientAuthenticationPredicate.java b/idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/context/logic/JWTBearerTokenForClientAuthenticationPredicate.java
index 0119049..4a1d715 100644
--- a/idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/context/logic/JWTBearerTokenForClientAuthenticationPredicate.java
+++ b/idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/context/logic/JWTBearerTokenForClientAuthenticationPredicate.java
@@ -21,7 +21,6 @@ import org.opensaml.messaging.context.MessageContext;
import org.opensaml.profile.context.ProfileRequestContext;
import org.opensaml.profile.context.navigate.ParentProfileRequestContextLookup;
import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
import com.nimbusds.oauth2.sdk.auth.ClientAuthenticationMethod;
@@ -29,6 +28,7 @@ import net.shibboleth.oidc.profile.config.OIDCAuthenticationRelyingPartyProfileC
import net.shibboleth.profile.config.ProfileConfiguration;
import net.shibboleth.profile.context.RelyingPartyContext;
import net.shibboleth.profile.context.logic.messaging.AbstractRelyingPartyPredicate;
+import net.shibboleth.shared.primitive.LoggerFactory;
/**
* A predicate that determines if the client authentication method chosen is a JWT type.
@@ -50,7 +50,7 @@ public class JWTBearerTokenForClientAuthenticationPredicate extends AbstractRely
final RelyingPartyContext rpc = getRelyingPartyContextLookupStrategy().apply(input);
if (rpc != null) {
final ProfileConfiguration pc = rpc.getProfileConfig();
- if (pc instanceof OIDCAuthenticationRelyingPartyProfileConfiguration config) {
+ if (pc instanceof final OIDCAuthenticationRelyingPartyProfileConfiguration config) {
final String authMethod = config.getTokenEndpointAuthMethod(prc);
final ClientAuthenticationMethod method = new ClientAuthenticationMethod(authMethod);
if (method.equals(ClientAuthenticationMethod.CLIENT_SECRET_JWT) ||
diff --git a/idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/context/logic/RequestObjectRequiredAndSupported.java b/idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/context/logic/RequestObjectRequiredAndSupported.java
index 80090d7..3e33c56 100644
--- a/idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/context/logic/RequestObjectRequiredAndSupported.java
+++ b/idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/context/logic/RequestObjectRequiredAndSupported.java
@@ -22,7 +22,6 @@ import org.opensaml.messaging.context.navigate.ChildContextLookup;
import org.opensaml.profile.context.ProfileRequestContext;
import org.opensaml.profile.context.navigate.InboundMessageContextLookup;
import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
import com.nimbusds.openid.connect.sdk.op.OIDCProviderMetadata;
@@ -32,6 +31,7 @@ import net.shibboleth.oidc.profile.messaging.context.OIDCPeerEntityContext;
import net.shibboleth.profile.context.RelyingPartyContext;
import net.shibboleth.profile.context.logic.AbstractRelyingPartyPredicate;
import net.shibboleth.shared.logic.Constraint;
+import net.shibboleth.shared.primitive.LoggerFactory;
/**
* A predicate that tests whether a request object should be built based on what is configured in the profile
@@ -71,19 +71,21 @@ public class RequestObjectRequiredAndSupported extends AbstractRelyingPartyPredi
boolean requestObjectRequestedFromConfig = false;
final RelyingPartyContext rpc = getRelyingPartyContextLookupStrategy().apply(input);
- if (rpc != null && rpc.getProfileConfig() instanceof OIDCAuthenticationRelyingPartyProfileConfiguration rpConfig) {
+ if (rpc != null && rpc.getProfileConfig() instanceof final OIDCAuthenticationRelyingPartyProfileConfiguration rpConfig) {
requestObjectRequestedFromConfig = rpConfig.isUseRequestObject(input);
}
final OIDCProviderMetadataContext metadata = oidcProviderMetadataContextLookupStrategy.apply(input);
- if (metadata == null || metadata.getProviderInformation() == null) {
+ final OIDCProviderMetadata providerInformation =
+ metadata != null ? metadata.getProviderInformation() : null;
+ if (providerInformation == null) {
// Should not happen at the time this predicate is called.
log.warn("OIDC Provider Metadata is not available, can not determine if request object is supported, "
+ "will not build request object");
return false;
}
- final boolean isSupportedByOP = metadata.getProviderInformation().supportsRequestParam();
+ final boolean isSupportedByOP = providerInformation.supportsRequestParam();
final boolean requestedAndSupport =
requestObjectRequestedFromConfig && isSupportedByOP;
diff --git a/idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/context/logic/RequiresSignatureVerificationPredicate.java b/idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/context/logic/RequiresSignatureVerificationPredicate.java
index 3790a25..bd3d88e 100644
--- a/idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/context/logic/RequiresSignatureVerificationPredicate.java
+++ b/idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/context/logic/RequiresSignatureVerificationPredicate.java
@@ -17,12 +17,12 @@ package net.shibboleth.idp.plugin.authn.oidc.rp.messaging.context.logic;
import java.util.function.Function;
import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
import org.opensaml.messaging.context.MessageContext;
import org.opensaml.profile.context.ProfileRequestContext;
import org.opensaml.profile.context.navigate.ParentProfileRequestContextLookup;
import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
import net.shibboleth.idp.plugin.authn.oidc.rp.context.AbstractAuthenticatableOIDCContext;
import net.shibboleth.oidc.profile.config.OIDCAuthenticationRelyingPartyProfileConfiguration;
@@ -30,6 +30,7 @@ import net.shibboleth.profile.context.RelyingPartyContext;
import net.shibboleth.profile.context.logic.messaging.AbstractRelyingPartyPredicate;
import net.shibboleth.shared.annotation.ParameterName;
import net.shibboleth.shared.logic.Constraint;
+import net.shibboleth.shared.primitive.LoggerFactory;
/**
* Is successful TLS credential verification enough to validate the JWT in question or should JWT signature validation
@@ -59,7 +60,7 @@ public class RequiresSignatureVerificationPredicate extends AbstractRelyingParty
}
@Override
- public boolean test(@Nonnull final MessageContext msgContext) {
+ public boolean test(@Nullable final MessageContext msgContext) {
final ParentProfileRequestContextLookup<MessageContext> lookup = new ParentProfileRequestContextLookup<>();
final ProfileRequestContext prc = lookup.apply(msgContext);
if (prc == null) {
@@ -69,7 +70,8 @@ public class RequiresSignatureVerificationPredicate extends AbstractRelyingParty
boolean tlsServerValidationOnly = false;
final RelyingPartyContext rpc = getRelyingPartyContextLookupStrategy().apply(msgContext);
- if (rpc != null && rpc.getProfileConfig() instanceof OIDCAuthenticationRelyingPartyProfileConfiguration rpConfig) {
+ if (rpc != null &&
+ rpc.getProfileConfig() instanceof final OIDCAuthenticationRelyingPartyProfileConfiguration rpConfig) {
tlsServerValidationOnly = rpConfig.isTlsServerValidationSufficient(prc);
}
diff --git a/idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/context/logic/UserInfoPlainResponseTypeCondition.java b/idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/context/logic/UserInfoPlainResponseTypeCondition.java
index 21c654f..6e051fc 100644
--- a/idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/context/logic/UserInfoPlainResponseTypeCondition.java
+++ b/idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/context/logic/UserInfoPlainResponseTypeCondition.java
@@ -21,6 +21,7 @@ import javax.annotation.Nonnull;
import org.opensaml.profile.context.ProfileRequestContext;
import com.nimbusds.common.contenttype.ContentType;
+import com.nimbusds.openid.connect.sdk.UserInfoSuccessResponse;
import net.shibboleth.idp.plugin.authn.oidc.rp.context.UserInfoResponseContext;
@@ -48,10 +49,11 @@ public class UserInfoPlainResponseTypeCondition extends AbstractUserInfoResponse
@Override
protected boolean doTest(@Nonnull final ProfileRequestContext prc,
@Nonnull final UserInfoResponseContext context) {
- if (context.getUserInfo() == null) {
+ final UserInfoSuccessResponse userInfo = context.getUserInfo();
+ if (userInfo == null) {
return false;
}
- return context.getUserInfo().getEntityContentType() == ContentType.APPLICATION_JSON &&
- context.getUserInfo().getUserInfo() != null && context.getUserInfo().getUserInfoJWT() == null;
+ return userInfo.getEntityContentType() == ContentType.APPLICATION_JSON &&
+ userInfo.getUserInfo() != null && userInfo.getUserInfoJWT() == null;
}
}
diff --git a/idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/context/navigate/JWTClaimsSetFromRequestObjectLookupFunction.java b/idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/context/navigate/JWTClaimsSetFromRequestObjectLookupFunction.java
index da14149..c69d70b 100644
--- a/idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/context/navigate/JWTClaimsSetFromRequestObjectLookupFunction.java
+++ b/idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/context/navigate/JWTClaimsSetFromRequestObjectLookupFunction.java
@@ -22,13 +22,14 @@ import javax.annotation.Nullable;
import org.opensaml.messaging.context.MessageContext;
import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
import com.nimbusds.jose.Payload;
+import com.nimbusds.jwt.JWT;
import com.nimbusds.jwt.JWTClaimsSet;
import net.shibboleth.oidc.profile.core.OIDCAuthenticationRequest;
import net.shibboleth.shared.logic.Constraint;
+import net.shibboleth.shared.primitive.LoggerFactory;
/**
* Extract the {@link Payload} from the Request Object inside the {@link OIDCAuthenticationRequest}.
@@ -45,7 +46,7 @@ public class JWTClaimsSetFromRequestObjectLookupFunction implements Function<Mes
/** Constructor.*/
public JWTClaimsSetFromRequestObjectLookupFunction() {
authenticationRequestLookupStrategy = mc -> {
- if (mc.getMessage() instanceof OIDCAuthenticationRequest request) {
+ if (mc.getMessage() instanceof final OIDCAuthenticationRequest request) {
return request;
}
return null;
@@ -69,13 +70,13 @@ public class JWTClaimsSetFromRequestObjectLookupFunction implements Function<Mes
return null;
}
final OIDCAuthenticationRequest authnRequest = authenticationRequestLookupStrategy.apply(messageContext);
-
- if (authnRequest == null || authnRequest.getRequestObject() == null) {
+ final JWT requestObject = authnRequest != null ? authnRequest.getRequestObject() : null;
+ if (requestObject == null) {
return null;
}
try {
- return authnRequest.getRequestObject().getJWTClaimsSet();
+ return requestObject.getJWTClaimsSet();
} catch (final ParseException e) {
log.debug("Error parsing JWT Claims Set of the RequestObject", e);
return null;
diff --git a/idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/context/navigate/PayloadFromRequestObjectLookupFunction.java b/idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/context/navigate/PayloadFromRequestObjectLookupFunction.java
index 463a4db..ded589b 100644
--- a/idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/context/navigate/PayloadFromRequestObjectLookupFunction.java
+++ b/idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/context/navigate/PayloadFromRequestObjectLookupFunction.java
@@ -23,14 +23,15 @@ import javax.annotation.Nullable;
import org.opensaml.messaging.context.MessageContext;
import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
import com.nimbusds.jose.Payload;
+import com.nimbusds.jwt.JWT;
import com.nimbusds.jwt.PlainJWT;
import com.nimbusds.jwt.SignedJWT;
import net.shibboleth.oidc.profile.core.OIDCAuthenticationRequest;
import net.shibboleth.shared.logic.Constraint;
+import net.shibboleth.shared.primitive.LoggerFactory;
/**
* Extract the {@link Payload} from the Request Object inside the {@link OIDCAuthenticationRequest}.
@@ -47,7 +48,7 @@ public class PayloadFromRequestObjectLookupFunction implements Function<MessageC
/** Constructor.*/
public PayloadFromRequestObjectLookupFunction() {
authenticationRequestLookupStrategy = mc -> {
- if (mc.getMessage() instanceof OIDCAuthenticationRequest request) {
+ if (mc.getMessage() instanceof final OIDCAuthenticationRequest request) {
return request;
}
return null;
@@ -71,11 +72,12 @@ public class PayloadFromRequestObjectLookupFunction implements Function<MessageC
return null;
}
final OIDCAuthenticationRequest authnRequest = authenticationRequestLookupStrategy.apply(messageContext);
- if (authnRequest.getRequestObject() instanceof SignedJWT signedJwt) {
+ final JWT requestObject = authnRequest != null ? authnRequest.getRequestObject() : null;
+ if (requestObject instanceof final SignedJWT signedJwt) {
return new Payload(signedJwt);
- } else if (authnRequest.getRequestObject() instanceof PlainJWT) {
+ } else if (requestObject instanceof PlainJWT) {
try {
- return new Payload(authnRequest.getRequestObject().getJWTClaimsSet().getClaims());
+ return new Payload(requestObject.getJWTClaimsSet().getClaims());
} catch (final ParseException e) {
log.error("Unable to convert plaintext JWT to claims set", e);
}
diff --git a/idp-oidc-rp-api/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/context/navigate/DefaulUserInfoJWTLookupStrategyTest.java b/idp-oidc-rp-api/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/context/navigate/DefaulUserInfoJWTLookupStrategyTest.java
index 1e2c718..088a3d2 100644
--- a/idp-oidc-rp-api/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/context/navigate/DefaulUserInfoJWTLookupStrategyTest.java
+++ b/idp-oidc-rp-api/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/context/navigate/DefaulUserInfoJWTLookupStrategyTest.java
@@ -52,6 +52,7 @@ public class DefaulUserInfoJWTLookupStrategyTest {
testContext.setUserInfo(response);
}
+ @SuppressWarnings("null")
@Test
public void testGetUserInfoToken() throws ParseException {
assertEquals(function.apply(prc).getJWTClaimsSet().getSubject(), SUBJECT);
diff --git a/idp-oidc-rp-api/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/context/navigate/DefaultEndUserClaimsLookupStrategyTest.java b/idp-oidc-rp-api/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/context/navigate/DefaultEndUserClaimsLookupStrategyTest.java
index 813fee2..00cd042 100644
--- a/idp-oidc-rp-api/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/context/navigate/DefaultEndUserClaimsLookupStrategyTest.java
+++ b/idp-oidc-rp-api/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/context/navigate/DefaultEndUserClaimsLookupStrategyTest.java
@@ -23,15 +23,16 @@ import org.testng.annotations.Test;
import com.nimbusds.openid.connect.sdk.claims.ClaimsSet;
import net.shibboleth.idp.plugin.authn.oidc.rp.context.EndUserClaimsContext;
+import net.shibboleth.shared.annotation.constraint.NonnullBeforeExec;
/** Tests for {@link DefaultEndUserClaimsLookupStrategy}.*/
public class DefaultEndUserClaimsLookupStrategyTest {
private static final String SUBJECT = "test_client";
- private DefaultEndUserClaimsLookupStrategy function;
+ @NonnullBeforeExec private DefaultEndUserClaimsLookupStrategy function;
- private ProfileRequestContext prc;
+ @NonnullBeforeExec private ProfileRequestContext prc;
private EndUserClaimsContext testContext;
@@ -46,6 +47,8 @@ public class DefaultEndUserClaimsLookupStrategyTest {
testContext.setEndUserClaims(claims);
}
+
+ @SuppressWarnings("null")
@Test
public void testEndUserClaims() {
assertEquals(function.apply(prc).getStringClaim("sub"), SUBJECT);
diff --git a/idp-oidc-rp-api/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/context/navigate/DefaultIDTokenLookupStrategyTest.java b/idp-oidc-rp-api/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/context/navigate/DefaultIDTokenLookupStrategyTest.java
index 33c61df..137c9cc 100644
--- a/idp-oidc-rp-api/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/context/navigate/DefaultIDTokenLookupStrategyTest.java
+++ b/idp-oidc-rp-api/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/context/navigate/DefaultIDTokenLookupStrategyTest.java
@@ -54,6 +54,7 @@ public class DefaultIDTokenLookupStrategyTest {
testContext.setTokenResponse(response);
}
+ @SuppressWarnings("null")
@Test
public void testGetIDToken() throws ParseException {
assertEquals(function.apply(prc).getJWTClaimsSet().getSubject(), SUBJECT);
@@ -65,6 +66,7 @@ public class DefaultIDTokenLookupStrategyTest {
assertEquals(function.apply(prc), null);
}
+ @SuppressWarnings("null")
@Test
public void testGetIDTokens_emptyIDToken() throws ParseException {
final OIDCTokenResponse response = new OIDCTokenResponse(
diff --git a/idp-oidc-rp-api/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/context/navigate/EncryptedIDTokenLookupStrategyTest.java b/idp-oidc-rp-api/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/context/navigate/EncryptedIDTokenLookupStrategyTest.java
index 72fe8e2..cdc8eae 100644
--- a/idp-oidc-rp-api/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/context/navigate/EncryptedIDTokenLookupStrategyTest.java
+++ b/idp-oidc-rp-api/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/context/navigate/EncryptedIDTokenLookupStrategyTest.java
@@ -37,11 +37,10 @@ import net.minidev.json.JSONObject;
import net.shibboleth.idp.plugin.authn.oidc.rp.context.AccessTokenResponseContext;
import net.shibboleth.idp.plugin.authn.oidc.rp.test.TestTokenHelper;
import net.shibboleth.oidc.security.credential.DefaultClientSecretCredential;
+import net.shibboleth.shared.logic.Constraint;
/** Tests for {@link EncryptedIDTokenLookupStrategy}.*/
public class EncryptedIDTokenLookupStrategyTest {
-
-private static final String CLIENT_ID = "test_client";
/** The client_secret.*/
private static final String CLIENT_SECRET = "Xp2s5v8y/B?E(H+MbQeThWmYq3t6w9z$";
@@ -62,7 +61,8 @@ private static final String CLIENT_ID = "test_client";
JWEAlgorithm.DIR, EncryptionMethod.A128CBC_HS256,
new DefaultClientSecretCredential(CLIENT_SECRET).toSigningCredential(),
new DefaultClientSecretCredential(CLIENT_SECRET)
- .toEncryptionCredential(JWEAlgorithm.DIR, EncryptionMethod.A128CBC_HS256));
+ .toEncryptionCredential(Constraint.isNotNull(JWEAlgorithm.DIR, "alg can not be null"),
+ Constraint.isNotNull(EncryptionMethod.A128CBC_HS256, "alg can not be null")));
final Map<String, Object> tokenResponseAsMap = new ObjectMapper().readValue(
tokenResponse, new TypeReference<Map<String, Object>>() {});
diff --git a/idp-oidc-rp-api/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/context/navigate/EncryptedUserInfoJWTLookupStrategyTest.java b/idp-oidc-rp-api/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/context/navigate/EncryptedUserInfoJWTLookupStrategyTest.java
index d25797a..ed14500 100644
--- a/idp-oidc-rp-api/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/context/navigate/EncryptedUserInfoJWTLookupStrategyTest.java
+++ b/idp-oidc-rp-api/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/context/navigate/EncryptedUserInfoJWTLookupStrategyTest.java
@@ -50,6 +50,7 @@ private static final String CLIENT_ID = "test_client";
prc = new ProfileRequestContext();
}
+ @SuppressWarnings("null")
@Test
public void testGetEncryptedUserInfoToken() throws Exception {
final var userInfoResp = TestTokenHelper.createJWTUserInfoResponse(
diff --git a/idp-oidc-rp-api/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/context/navigate/IDTokenInAccessTokenUpdateStrategyTest.java b/idp-oidc-rp-api/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/context/navigate/IDTokenInAccessTokenUpdateStrategyTest.java
index 20163f7..792ff13 100644
--- a/idp-oidc-rp-api/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/context/navigate/IDTokenInAccessTokenUpdateStrategyTest.java
+++ b/idp-oidc-rp-api/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/context/navigate/IDTokenInAccessTokenUpdateStrategyTest.java
@@ -39,6 +39,7 @@ import net.minidev.json.JSONObject;
import net.shibboleth.idp.plugin.authn.oidc.rp.context.AccessTokenResponseContext;
import net.shibboleth.idp.plugin.authn.oidc.rp.test.TestTokenHelper;
import net.shibboleth.oidc.security.credential.DefaultClientSecretCredential;
+import net.shibboleth.shared.logic.Constraint;
/** Tests for {@link IDTokenInAccessTokenUpdateStrategy}.*/
public class IDTokenInAccessTokenUpdateStrategyTest {
@@ -63,7 +64,8 @@ public class IDTokenInAccessTokenUpdateStrategyTest {
JWEAlgorithm.DIR, EncryptionMethod.A128CBC_HS256,
new DefaultClientSecretCredential(CLIENT_SECRET).toSigningCredential(),
new DefaultClientSecretCredential(CLIENT_SECRET)
- .toEncryptionCredential(JWEAlgorithm.DIR, EncryptionMethod.A128CBC_HS256));
+ .toEncryptionCredential(Constraint.isNotNull(JWEAlgorithm.DIR,""),
+ Constraint.isNotNull(EncryptionMethod.A128CBC_HS256,"")));
final Map<String, Object> tokenResponseAsMap = new ObjectMapper().readValue(
tokenResponse, new TypeReference<Map<String, Object>>() {});
@@ -83,23 +85,27 @@ public class IDTokenInAccessTokenUpdateStrategyTest {
// assert pre-condition the id token is encrypted and the other tokens exist
assertNotNull(ctx.getTokenResponse());
- assertNotNull(ctx.getTokenResponse().getTokens());
- assertNotNull(ctx.getTokenResponse().getTokens().getAccessToken());
- assertNotNull(ctx.getTokenResponse().getTokens().getBearerAccessToken());
- assertNotNull(ctx.getTokenResponse().getOIDCTokens());
- assertNotNull(ctx.getTokenResponse().getOIDCTokens().getIDToken());
- assertTrue(ctx.getTokenResponse().getOIDCTokens().getIDToken() instanceof EncryptedJWT);
+ final var tokenResponseFromCtx = ctx.getTokenResponse();
+ assert tokenResponseFromCtx != null;
+ assertNotNull(tokenResponseFromCtx.getTokens());
+ assertNotNull(tokenResponseFromCtx.getTokens().getAccessToken());
+ assertNotNull(tokenResponseFromCtx.getTokens().getBearerAccessToken());
+ assertNotNull(tokenResponseFromCtx.getOIDCTokens());
+ assertNotNull(tokenResponseFromCtx.getOIDCTokens().getIDToken());
+ assertTrue(tokenResponseFromCtx.getOIDCTokens().getIDToken() instanceof EncryptedJWT);
strategy.accept(new ProfileRequestContext(), jwtToUpdate);
// assert post-condition the id token is now signed and the other tokens exist
- assertNotNull(ctx.getTokenResponse());
- assertNotNull(ctx.getTokenResponse().getTokens());
- assertNotNull(ctx.getTokenResponse().getTokens().getAccessToken());
- assertNotNull(ctx.getTokenResponse().getTokens().getBearerAccessToken());
- assertNotNull(ctx.getTokenResponse().getOIDCTokens());
- assertNotNull(ctx.getTokenResponse().getOIDCTokens().getIDToken());
- assertTrue(ctx.getTokenResponse().getOIDCTokens().getIDToken() instanceof SignedJWT);
+ final var tokenResponseFromCtxAfter = ctx.getTokenResponse();
+ assert tokenResponseFromCtxAfter != null;
+ assertNotNull(tokenResponseFromCtxAfter);
+ assertNotNull(tokenResponseFromCtxAfter.getTokens());
+ assertNotNull(tokenResponseFromCtxAfter.getTokens().getAccessToken());
+ assertNotNull(tokenResponseFromCtxAfter.getTokens().getBearerAccessToken());
+ assertNotNull(tokenResponseFromCtxAfter.getOIDCTokens());
+ assertNotNull(tokenResponseFromCtxAfter.getOIDCTokens().getIDToken());
+ assertTrue(tokenResponseFromCtxAfter.getOIDCTokens().getIDToken() instanceof SignedJWT);
}
}
diff --git a/idp-oidc-rp-api/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/context/navigate/IDTokenJOSEHeaderLookupStrategyTest.java b/idp-oidc-rp-api/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/context/navigate/IDTokenJOSEHeaderLookupStrategyTest.java
index fb784c4..989bd7b 100644
--- a/idp-oidc-rp-api/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/context/navigate/IDTokenJOSEHeaderLookupStrategyTest.java
+++ b/idp-oidc-rp-api/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/context/navigate/IDTokenJOSEHeaderLookupStrategyTest.java
@@ -36,6 +36,7 @@ import net.minidev.json.JSONObject;
import net.shibboleth.idp.plugin.authn.oidc.rp.context.AccessTokenResponseContext;
import net.shibboleth.idp.plugin.authn.oidc.rp.test.TestTokenHelper;
import net.shibboleth.oidc.security.credential.DefaultClientSecretCredential;
+import net.shibboleth.shared.logic.Constraint;
/** Tests for {@link IDTokenJOSEHeaderLookupStrategy}.*/
public class IDTokenJOSEHeaderLookupStrategyTest {
@@ -56,6 +57,7 @@ public class IDTokenJOSEHeaderLookupStrategyTest {
function = new IDTokenJOSEHeaderLookupStrategy(prc -> testContext);
}
+ @SuppressWarnings("null")
@Test
public void testGetJOSEHeader() throws Exception {
final String tokenResponse =
@@ -95,7 +97,8 @@ public class IDTokenJOSEHeaderLookupStrategyTest {
JWEAlgorithm.DIR, EncryptionMethod.A128CBC_HS256,
new DefaultClientSecretCredential(CLIENT_SECRET).toSigningCredential(),
new DefaultClientSecretCredential(CLIENT_SECRET)
- .toEncryptionCredential(JWEAlgorithm.DIR, EncryptionMethod.A128CBC_HS256));
+ .toEncryptionCredential(Constraint.isNotNull(JWEAlgorithm.DIR,""),
+ Constraint.isNotNull(EncryptionMethod.A128CBC_HS256,"")));
final Map<String, Object> tokenResponseAsMap = new ObjectMapper().readValue(
tokenResponse, new TypeReference<Map<String, Object>>() {});
diff --git a/idp-oidc-rp-api/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/context/navigate/SubFromIDTokenLookupFunctionTest.java b/idp-oidc-rp-api/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/context/navigate/SubFromIDTokenLookupFunctionTest.java
index 8099add..e5dd223 100644
--- a/idp-oidc-rp-api/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/context/navigate/SubFromIDTokenLookupFunctionTest.java
+++ b/idp-oidc-rp-api/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/context/navigate/SubFromIDTokenLookupFunctionTest.java
@@ -76,6 +76,7 @@ public class SubFromIDTokenLookupFunctionTest {
assertEquals(function.apply(prc, new JWTClaimsSet.Builder().build()), SUBJECT);
}
+ @SuppressWarnings("null")
@Test
public void getSubInIDToken_Encrypted_NullResponse() throws Exception {
final String tokenResponse =
diff --git a/idp-oidc-rp-api/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/context/navigate/UserInfoInUserInfoResponseContextUpdateStrategyTest.java b/idp-oidc-rp-api/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/context/navigate/UserInfoInUserInfoResponseContextUpdateStrategyTest.java
index edc3d89..f955da9 100644
--- a/idp-oidc-rp-api/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/context/navigate/UserInfoInUserInfoResponseContextUpdateStrategyTest.java
+++ b/idp-oidc-rp-api/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/context/navigate/UserInfoInUserInfoResponseContextUpdateStrategyTest.java
@@ -44,6 +44,7 @@ public class UserInfoInUserInfoResponseContextUpdateStrategyTest {
/** The strategy to test.*/
private UserInfoInUserInfoResponseContextUpdateStrategy strategy;
+ @SuppressWarnings("null")
@Test
public void testUpdateEncryptedToSigned() throws Exception {
diff --git a/idp-oidc-rp-api/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/test/TestTokenHelper.java b/idp-oidc-rp-api/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/test/TestTokenHelper.java
index d013689..0e041c0 100644
--- a/idp-oidc-rp-api/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/test/TestTokenHelper.java
+++ b/idp-oidc-rp-api/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/test/TestTokenHelper.java
@@ -53,6 +53,8 @@ import com.nimbusds.jwt.JWTClaimsSet;
import com.nimbusds.jwt.PlainJWT;
import com.nimbusds.jwt.SignedJWT;
+import net.shibboleth.shared.collection.CollectionSupport;
+
/** A helper class for generating tokens for testing.*/
public final class TestTokenHelper {
@@ -68,7 +70,8 @@ public final class TestTokenHelper {
*
* @return the JWT claims set.
*/
- public static JWTClaimsSet createBasicClaims(final Map<String, Object> overrideClaims) {
+ @SuppressWarnings("null")
+ @Nonnull public static JWTClaimsSet createBasicClaims(final Map<String, Object> overrideClaims) {
return new JWTClaimsSet.Builder()
.issuer(getClaimValue(overrideClaims, "iss", "test-issuer", String.class))
@@ -97,11 +100,12 @@ public final class TestTokenHelper {
*
* @return the JWT claims set.
*/
- public static JWTClaimsSet createBasicUserInfoClaims(final Map<String, Object> overrideClaims) {
+ @SuppressWarnings("null")
+ @Nonnull public static JWTClaimsSet createBasicUserInfoClaims(final Map<String, Object> overrideClaims) {
return new JWTClaimsSet.Builder()
.issuer(getClaimValue(overrideClaims, "iss", "test-issuer", String.class))
- .audience(getClaimValue(overrideClaims, "aud", List.of("test-client"), List.class))
+ .audience(getClaimValue(overrideClaims, "aud", CollectionSupport.listOf("test-client"), List.class))
.subject(getClaimValue(overrideClaims, "sub", "jdoe", String.class))
.claim("preferred_username", getClaimValue(overrideClaims, "preferred_username", "d.tu", String.class))
.claim("given_name", getClaimValue(overrideClaims, "given_name", "Demo", String.class))
@@ -158,12 +162,12 @@ public final class TestTokenHelper {
* @throws JOSEException on error.
* @throws ParseException on error.
*/
- public static JWT createJWT(@Nonnull final JWTClaimsSet payload, @Nullable final JWSAlgorithm sigAlg,
+ @Nonnull public static JWT createJWT(@Nonnull final JWTClaimsSet payload, @Nullable final JWSAlgorithm sigAlg,
@Nullable final JWEAlgorithm jweAlg, @Nullable final EncryptionMethod enc,
@Nullable final Credential sigKey, @Nullable final Credential encKey) throws JOSEException, ParseException {
// Sign first.
- if (sigAlg != null) {
+ if (sigAlg != null && sigKey != null) {
final var header = new JWSHeader.Builder(sigAlg)
.type(JOSEObjectType.JWT)
.build();
@@ -177,7 +181,7 @@ public final class TestTokenHelper {
signedJWT.sign(new ECDSASigner((ECPrivateKey)sigKey.getPrivateKey()));
}
- if (jweAlg != null) {
+ if (jweAlg != null && encKey != null) {
final JWEObject jweObject =
new JWEObject(new JWEHeader.Builder(jweAlg, enc)
.contentType("JWT")
@@ -186,20 +190,28 @@ public final class TestTokenHelper {
if (JWEAlgorithm.Family.RSA.contains(jweAlg)) {
jweObject.encrypt(new RSAEncrypter((RSAPublicKey)encKey.getPublicKey()));
- return EncryptedJWT.parse(jweObject.serialize());
+ final JWT encJwt = EncryptedJWT.parse(jweObject.serialize());
+ assert encJwt != null;
+ return encJwt;
} else if (JWEAlgorithm.Family.AES_KW.contains(jweAlg)
|| JWEAlgorithm.Family.AES_GCM_KW.contains(jweAlg)) {
jweObject.encrypt(new AESEncrypter(encKey.getSecretKey()));
- return EncryptedJWT.parse(jweObject.serialize());
+ final JWT encJwt = EncryptedJWT.parse(jweObject.serialize());
+ assert encJwt != null;
+ return encJwt;
} else if (JWEAlgorithm.Family.ECDH_ES.contains(jweAlg)) {
jweObject.encrypt(new ECDHEncrypter((ECPublicKey) encKey.getPublicKey()));
- return EncryptedJWT.parse(jweObject.serialize());
+ final JWT encJwt = EncryptedJWT.parse(jweObject.serialize());
+ assert encJwt != null;
+ return encJwt;
} else if (JWEAlgorithm.DIR == jweAlg) {
jweObject.encrypt(new DirectEncrypter(encKey.getSecretKey()));
- return EncryptedJWT.parse(jweObject.serialize());
+ final JWT encJwt = EncryptedJWT.parse(jweObject.serialize());
+ assert encJwt != null;
+ return encJwt;
}
} else {
return signedJWT;
@@ -221,7 +233,7 @@ public final class TestTokenHelper {
* @throws JOSEException on error
* @throws ParseException on error
*/
- public static JWT createJWTUserInfoResponse(final Map<String, Object> overrideClaims,
+ @Nonnull public static JWT createJWTUserInfoResponse(final Map<String, Object> overrideClaims,
@Nullable final JWSAlgorithm sigAlg, @Nullable final JWEAlgorithm jweAlg,
@Nullable final EncryptionMethod enc, @Nullable final Credential sigKey, @Nullable final Credential encKey)
throws JOSEException, ParseException {
@@ -246,7 +258,7 @@ public final class TestTokenHelper {
*
* @throws Exception on error.
*/
- public static String createAccessTokenResponseJSON(final Map<String, Object> overrideClaims,
+ @Nonnull public static String createAccessTokenResponseJSON(final Map<String, Object> overrideClaims,
@Nullable final JWSAlgorithm sigAlg,
@Nullable final JWEAlgorithm jweAlg, @Nullable final EncryptionMethod enc,
@Nullable final Credential sigKey, @Nullable final Credential encKey) throws Exception {
@@ -268,10 +280,12 @@ public final class TestTokenHelper {
*
* @throws JsonProcessingException on error
*/
- public static String createPlainUserInfoResponseString(final Map<String, Object> overrideClaims)
+ @Nonnull public static String createPlainUserInfoResponseString(final Map<String, Object> overrideClaims)
throws JsonProcessingException {
final JWTClaimsSet claims = createBasicUserInfoClaims(overrideClaims);
- return new ObjectMapper().writeValueAsString(claims.toJSONObject());
+ final String valueAsString = new ObjectMapper().writeValueAsString(claims.toJSONObject());
+ assert valueAsString != null;
+ return valueAsString;
}
@@ -284,7 +298,7 @@ public final class TestTokenHelper {
*
* @throws JOSEException on error
*/
- public static PlainJWT createPlainJWTUserInfoResponseJSON(final Map<String, Object> overrideClaims)
+ @Nonnull public static PlainJWT createPlainJWTUserInfoResponseJSON(final Map<String, Object> overrideClaims)
throws JOSEException {
final var payload = createBasicUserInfoClaims(overrideClaims);
@@ -299,7 +313,7 @@ public final class TestTokenHelper {
*
* @return An access token response
*/
- private static String buildTemplateAccessTokenJSONResponse(final String serializedJWT) {
+ @Nonnull private static String buildTemplateAccessTokenJSONResponse(final String serializedJWT) {
return "{\n"
+ " \"access_token\": \"W0y5aDNAzEPNpSzu1cuMG904BZuQFZJUUwG5F3ct0zydZWy1ji\",\n"
+ " \"token_type\": \"Bearer\",\n"
diff --git a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/OIDCRPPlugin.java b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/OIDCRPPlugin.java
index ffed2ad..1a0de94 100644
--- a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/OIDCRPPlugin.java
+++ b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/OIDCRPPlugin.java
@@ -37,8 +37,10 @@ public class OIDCRPPlugin extends FirstPartyIdPPlugin {
super(OIDCRPPlugin.class);
try {
final IdPModule module = new OIDCRPModule();
- setEnableOnInstall(Collections.singleton(module));
- setDisableOnRemoval(Collections.singleton(module));
+ final var moduleAsCollection = Collections.singleton(module);
+ assert moduleAsCollection != null;
+ setEnableOnInstall(moduleAsCollection);
+ setDisableOnRemoval(moduleAsCollection);
} catch (final IOException e) {
throw e;
} catch (final ModuleException e) {
diff --git a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/audit/impl/ProxyAuthenticationFlowAuditExtractor.java b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/audit/impl/ProxyAuthenticationFlowAuditExtractor.java
index 2c86307..bb95a6a 100644
--- a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/audit/impl/ProxyAuthenticationFlowAuditExtractor.java
+++ b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/audit/impl/ProxyAuthenticationFlowAuditExtractor.java
@@ -37,7 +37,9 @@ public class ProxyAuthenticationFlowAuditExtractor implements Function<ProfileRe
if (input != null) {
final BaseContext baseContext = input.getParent();
if (baseContext instanceof AuthenticationContext authnCtx && authnCtx.getAttemptedFlow()!= null) {
- return authnCtx.getAttemptedFlow().getId();
+ final var attemptedFlow = authnCtx.getAttemptedFlow();
+ assert attemptedFlow != null;
+ return attemptedFlow.getId();
}
}
return null;
diff --git a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/audit/impl/TransitionActionWriteAuditLog.java b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/audit/impl/TransitionActionWriteAuditLog.java
index abb4640..e162202 100644
--- a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/audit/impl/TransitionActionWriteAuditLog.java
+++ b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/audit/impl/TransitionActionWriteAuditLog.java
@@ -26,7 +26,6 @@ import net.shibboleth.idp.profile.audit.impl.WriteAuditLog;
* literal '{@literal success}', such that the write audit log action can be used inside a transition
* and does not prevent the transition from proceeding.
*/
-//TODO WriteAuditLog is profile-impl not API.
public class TransitionActionWriteAuditLog extends WriteAuditLog {
@Override
diff --git a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/decoding/impl/DefaultAccessTokenResponseDecoder.java b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/decoding/impl/DefaultAccessTokenResponseDecoder.java
index bc65e19..b0dec07 100644
--- a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/decoding/impl/DefaultAccessTokenResponseDecoder.java
+++ b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/decoding/impl/DefaultAccessTokenResponseDecoder.java
@@ -25,7 +25,6 @@ import org.apache.hc.core5.http.ClassicHttpResponse;
import org.apache.hc.core5.http.ContentType;
import org.apache.hc.core5.http.HttpStatus;
import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
import org.springframework.http.MediaType;
import org.springframework.util.MimeType;
@@ -35,6 +34,7 @@ import com.nimbusds.oauth2.sdk.TokenResponse;
import com.nimbusds.openid.connect.sdk.OIDCTokenResponse;
import net.minidev.json.JSONObject;
+import net.shibboleth.shared.primitive.LoggerFactory;
/**
* Default access token response decoder, which converts a successful HTTP response into an
@@ -46,12 +46,12 @@ public class DefaultAccessTokenResponseDecoder extends AbstractJSONResponseDecod
@Nonnull private final Logger log = LoggerFactory.getLogger(DefaultAccessTokenResponseDecoder.class);
@Override
- @Nullable public TokenResponse apply(@Nonnull final ClassicHttpResponse httpResponse) {
+ @Nullable public TokenResponse apply(@Nullable final ClassicHttpResponse httpResponse) {
try {
- if (httpResponse.getEntity() == null) {
- log.warn("HTTP Response did not contain an entity");
+ if (httpResponse == null || httpResponse.getEntity() == null) {
+ log.warn("No HTTP response, or response did not contain an entity");
return null;
}
@@ -60,8 +60,9 @@ public class DefaultAccessTokenResponseDecoder extends AbstractJSONResponseDecod
log.warn("HTTP response did not contain a content-type, must contain a content-type");
return null;
}
-
- if (MediaType.APPLICATION_JSON.compareTo(MimeType.valueOf(contentType.getMimeType())) != 0) {
+ final var mimeType = contentType.getMimeType();
+ assert mimeType != null;
+ if (MediaType.APPLICATION_JSON.compareTo(MimeType.valueOf(mimeType)) != 0) {
log.warn("Wrong content type header, expected 'application/json' found '{}'", contentType.getMimeType());
return null;
}
diff --git a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/decoding/impl/DefaultUserInfoResponseDecoder.java b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/decoding/impl/DefaultUserInfoResponseDecoder.java
index 812c041..a81f8be 100644
--- a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/decoding/impl/DefaultUserInfoResponseDecoder.java
+++ b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/decoding/impl/DefaultUserInfoResponseDecoder.java
@@ -18,12 +18,12 @@ import java.io.InputStream;
import java.util.Map;
import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
-import org.apache.hc.core5.http.Header;
import org.apache.hc.core5.http.ClassicHttpResponse;
+import org.apache.hc.core5.http.Header;
import org.apache.hc.core5.http.HttpStatus;
import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
import com.fasterxml.jackson.core.type.TypeReference;
import com.nimbusds.common.contenttype.ContentType;
@@ -36,6 +36,8 @@ import com.nimbusds.openid.connect.sdk.UserInfoSuccessResponse;
import com.nimbusds.openid.connect.sdk.claims.ClaimsSet;
import com.nimbusds.openid.connect.sdk.claims.UserInfo;
+import net.shibboleth.shared.primitive.LoggerFactory;
+
/**
* Response decoder for UserInfo responses. Supports both plain JSON Object and JWT responses.
@@ -55,8 +57,13 @@ public class DefaultUserInfoResponseDecoder extends AbstractJSONResponseDecoderF
// Checkstyle: CyclomaticComplexity|ReturnCount|MethodLength OFF
@Override
- public UserInfoResponse apply(@Nonnull final ClassicHttpResponse httpResponse) {
-
+ public UserInfoResponse apply(@Nullable final ClassicHttpResponse httpResponse) {
+
+ if (httpResponse == null) {
+ log.error("HttpResponse was null, can not process response");
+ return null;
+ }
+
try {
final int httpStatusCode = httpResponse.getCode();
diff --git a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/encoding/impl/AbstractRequestEncoderFunction.java b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/encoding/impl/AbstractRequestEncoderFunction.java
index 3ed96ff..c0588eb 100644
--- a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/encoding/impl/AbstractRequestEncoderFunction.java
+++ b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/encoding/impl/AbstractRequestEncoderFunction.java
@@ -25,9 +25,9 @@ import org.opensaml.messaging.context.navigate.ChildContextLookup;
import org.opensaml.profile.context.ProfileRequestContext;
import org.opensaml.profile.context.navigate.OutboundMessageContextLookup;
import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
import com.nimbusds.openid.connect.sdk.AuthenticationSuccessResponse;
+import com.nimbusds.openid.connect.sdk.op.OIDCProviderMetadata;
import net.shibboleth.oidc.authn.context.OAuth2ClientAuthenticationContext;
import net.shibboleth.oidc.metadata.context.OIDCProviderMetadataContext;
@@ -35,6 +35,7 @@ import net.shibboleth.oidc.profile.core.OIDCAuthenticationRequest;
import net.shibboleth.oidc.profile.messaging.context.OIDCPeerEntityContext;
import net.shibboleth.shared.component.AbstractInitializableComponent;
import net.shibboleth.shared.logic.Constraint;
+import net.shibboleth.shared.primitive.LoggerFactory;
/** Abstract request encoder function that pulls out various contexts and request/response messages.*/
public abstract class AbstractRequestEncoderFunction extends AbstractInitializableComponent
@@ -44,7 +45,7 @@ public abstract class AbstractRequestEncoderFunction extends AbstractInitializab
@Nonnull private final Logger log = LoggerFactory.getLogger(AbstractRequestEncoderFunction.class);
/** Lookup strategy to locate the OP metadata to use.*/
- @Nonnull private Function<ProfileRequestContext, OIDCProviderMetadataContext> providerMetadataLookupStrategy;
+ @Nonnull private Function<ProfileRequestContext, OIDCProviderMetadataContext> providerMetadataLookupStrategy;
/** The strategy used to lookup or create the {@link OAuth2ClientAuthenticationContext}.*/
@Nonnull
@@ -147,8 +148,12 @@ public abstract class AbstractRequestEncoderFunction extends AbstractInitializab
* failure.</p>
*/
@Override
- @Nullable public ClassicHttpRequest apply(@Nonnull final ProfileRequestContext profileRequestContext) {
+ @Nullable public ClassicHttpRequest apply(@Nullable final ProfileRequestContext profileRequestContext) {
+ if (profileRequestContext == null) {
+ log.error("Profile request context is null, unable to encode request");
+ return null;
+ }
final MessageContext inboundMessageCtx = profileRequestContext.getInboundMessageContext();
if (inboundMessageCtx == null) {
@@ -179,6 +184,12 @@ public abstract class AbstractRequestEncoderFunction extends AbstractInitializab
providerMetadataContext = providerMetadataLookupStrategy.apply(profileRequestContext);
if (providerMetadataContext == null) {
+ log.error("No provider metadata context found for peer");
+ return null;
+ }
+ assert providerMetadataContext != null;
+ final var providerMetadata = providerMetadataContext.getProviderInformation();
+ if (providerMetadata == null) {
log.error("No provider metadata found for peer");
return null;
}
@@ -189,7 +200,7 @@ public abstract class AbstractRequestEncoderFunction extends AbstractInitializab
return null;
}
- return doApply(profileRequestContext);
+ return doApply(profileRequestContext, providerMetadata);
}
@@ -197,10 +208,12 @@ public abstract class AbstractRequestEncoderFunction extends AbstractInitializab
* Encode a ClassicHttpRequest from the given context. Implementations should override this method.
*
* @param profileRequestContext the profile request context.
+ * @param providerMetadata the provider metadata.
*
* @return the request to execute.
*/
- @Nullable protected abstract ClassicHttpRequest doApply(@Nonnull ProfileRequestContext profileRequestContext);
+ @Nullable protected abstract ClassicHttpRequest doApply(@Nonnull final ProfileRequestContext profileRequestContext,
+ @Nonnull final OIDCProviderMetadata providerMetadata);
}
diff --git a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/encoding/impl/DefaultAuthCodeTokenRequestEncoder.java b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/encoding/impl/DefaultAuthCodeTokenRequestEncoder.java
index 238764d..4c53b01 100644
--- a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/encoding/impl/DefaultAuthCodeTokenRequestEncoder.java
+++ b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/encoding/impl/DefaultAuthCodeTokenRequestEncoder.java
@@ -22,13 +22,17 @@ import org.apache.hc.core5.http.ClassicHttpRequest;
import org.apache.hc.core5.http.io.support.ClassicRequestBuilder;
import org.opensaml.profile.context.ProfileRequestContext;
import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
import com.nimbusds.jose.util.StandardCharset;
import com.nimbusds.oauth2.sdk.AuthorizationCodeGrant;
import com.nimbusds.oauth2.sdk.AuthorizationGrant;
import com.nimbusds.oauth2.sdk.TokenRequest;
import com.nimbusds.oauth2.sdk.http.HTTPRequest;
+import com.nimbusds.openid.connect.sdk.AuthenticationSuccessResponse;
+import com.nimbusds.openid.connect.sdk.op.OIDCProviderMetadata;
+
+import net.shibboleth.oidc.authn.context.OAuth2ClientAuthenticationContext;
+import net.shibboleth.shared.primitive.LoggerFactory;
/**
* A token request encoder that builds an OAuth2.0 Access Token Request for an authorization_code grant and returns an
@@ -41,22 +45,35 @@ public class DefaultAuthCodeTokenRequestEncoder extends AbstractRequestEncoderFu
private final Logger log = LoggerFactory.getLogger(DefaultAuthCodeTokenRequestEncoder.class);
@Override
- @Nullable public ClassicHttpRequest doApply(@Nonnull final ProfileRequestContext profileRequestContext) {
+ @Nullable public ClassicHttpRequest doApply(@Nonnull final ProfileRequestContext profileRequestContext,
+ @Nonnull final OIDCProviderMetadata providerMetadata) {
try {
- if (getClientAuthenticationContext() == null) {
+ final OAuth2ClientAuthenticationContext authnContext = getClientAuthenticationContext();
+ if (authnContext == null) {
log.warn("No client authentication context to base token request off");
return null;
}
+ final AuthenticationSuccessResponse authnResponse = getAuthenticationResponse();
+ if (authnResponse == null) {
+ log.warn("No authentication response from upstream OpenID Provider to base token request off");
+ return null;
+ }
+ final var authnRequest = getAuthenticationRequest();
+ if (authnRequest == null) {
+ log.warn("No authentication request to base token request off");
+ return null;
+ }
+
final AuthorizationGrant codeGrant =
- new AuthorizationCodeGrant(getAuthenticationResponse().getAuthorizationCode(),
- getAuthenticationRequest().getRedirectURI());
+ new AuthorizationCodeGrant(authnResponse.getAuthorizationCode(), authnRequest.getRedirectURI());
- final TokenRequest tokenRequest =
- new TokenRequest(getProviderMetadataContext().getProviderInformation().getTokenEndpointURI(),
- getClientAuthenticationContext().getClientAuthentication(), codeGrant);
+ final TokenRequest tokenRequest = new TokenRequest(providerMetadata.getTokenEndpointURI(),
+ authnContext.getClientAuthentication(), codeGrant);
- return convertHttpRequest(tokenRequest.toHTTPRequest());
+ final var httpRequest = tokenRequest.toHTTPRequest();
+ assert httpRequest != null;
+ return convertHttpRequest(httpRequest);
} catch (final Exception e) {
log.warn("Unable to encode token request", e);
diff --git a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/encoding/impl/DefaultUserInfoRequestEncoder.java b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/encoding/impl/DefaultUserInfoRequestEncoder.java
index 90c3db0..9980be9 100644
--- a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/encoding/impl/DefaultUserInfoRequestEncoder.java
+++ b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/encoding/impl/DefaultUserInfoRequestEncoder.java
@@ -28,11 +28,12 @@ import org.opensaml.messaging.context.navigate.ChildContextLookup;
import org.opensaml.profile.context.ProfileRequestContext;
import org.opensaml.profile.context.navigate.InboundMessageContextLookup;
import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
import org.springframework.http.HttpMethod;
import com.nimbusds.jose.util.StandardCharset;
import com.nimbusds.oauth2.sdk.token.BearerAccessToken;
+import com.nimbusds.openid.connect.sdk.OIDCTokenResponse;
+import com.nimbusds.openid.connect.sdk.op.OIDCProviderMetadata;
import net.shibboleth.idp.plugin.authn.oidc.rp.config.navigate.UserInfoHttpRequestMethodLookupStrategy;
import net.shibboleth.idp.plugin.authn.oidc.rp.context.AccessTokenResponseContext;
@@ -40,6 +41,7 @@ import net.shibboleth.idp.plugin.authn.oidc.rp.exception.OIDCRPException;
import net.shibboleth.oidc.profile.oauth2.config.OAuth2AuthorizationProfileConfiguration.HttpRequestMethod;
import net.shibboleth.shared.annotation.constraint.NotEmpty;
import net.shibboleth.shared.logic.Constraint;
+import net.shibboleth.shared.primitive.LoggerFactory;
/**
* Default encoder for UserInfo requests. Supports either GET or POST requests.
@@ -96,7 +98,8 @@ public class DefaultUserInfoRequestEncoder extends AbstractRequestEncoderFunctio
@Override
- @Nullable public ClassicHttpRequest doApply(@Nonnull final ProfileRequestContext profileRequestContext) {
+ @Nullable public ClassicHttpRequest doApply(@Nonnull final ProfileRequestContext profileRequestContext,
+ @Nonnull final OIDCProviderMetadata providerMetadata) {
try {
final HttpRequestMethod requestMethod = httpMethodLookupStrategy.apply(profileRequestContext);
@@ -109,13 +112,9 @@ public class DefaultUserInfoRequestEncoder extends AbstractRequestEncoderFunctio
}
final URI uri = new URIBuilder().setScheme(HTTPS)
- .setPort(getProviderMetadataContext().getProviderInformation().getUserInfoEndpointURI().getPort())
- .setHost(getProviderMetadataContext()
- .getProviderInformation()
- .getUserInfoEndpointURI().getHost())
- .setPath(getProviderMetadataContext()
- .getProviderInformation()
- .getUserInfoEndpointURI().getPath())
+ .setPort(providerMetadata.getUserInfoEndpointURI().getPort())
+ .setHost(providerMetadata.getUserInfoEndpointURI().getHost())
+ .setPath(providerMetadata.getUserInfoEndpointURI().getPath())
.build();
// Add headers and create request.
@@ -125,6 +124,7 @@ public class DefaultUserInfoRequestEncoder extends AbstractRequestEncoderFunctio
.setHeader("Content-Type", ContentType.APPLICATION_FORM_URLENCODED.getMimeType())
.setCharset(StandardCharset.UTF_8);
+ assert rb != null;
addBearerTokenToGet(rb, responseCtx);
} else if (requestMethod == HttpRequestMethod.POST) {
@@ -132,6 +132,7 @@ public class DefaultUserInfoRequestEncoder extends AbstractRequestEncoderFunctio
.setHeader("Content-Type", ContentType.APPLICATION_FORM_URLENCODED.getMimeType())
.setCharset(StandardCharset.UTF_8);
+ assert rb != null;
addBearerTokenToPost(rb, responseCtx);
} else {
log.error("Unable to construct UserInfo request, unknown request method: {}", requestMethod);
@@ -159,10 +160,11 @@ public class DefaultUserInfoRequestEncoder extends AbstractRequestEncoderFunctio
private void addBearerTokenToPost(@Nonnull final ClassicRequestBuilder rb,
@Nonnull final AccessTokenResponseContext responseCtx) throws OIDCRPException {
- if (responseCtx.getTokenResponse() == null) {
+ final OIDCTokenResponse tokenResponse = responseCtx.getTokenResponse();
+ if (tokenResponse == null) {
throw new OIDCRPException("No access token response found");
}
- final BearerAccessToken bearer = responseCtx.getTokenResponse().getTokens().getBearerAccessToken();
+ final BearerAccessToken bearer = tokenResponse.getTokens().getBearerAccessToken();
if (bearer == null) {
throw new OIDCRPException("Access token was not Bearer type");
}
@@ -180,10 +182,11 @@ public class DefaultUserInfoRequestEncoder extends AbstractRequestEncoderFunctio
private void addBearerTokenToGet(@Nonnull final ClassicRequestBuilder rb,
@Nonnull final AccessTokenResponseContext responseCtx) throws OIDCRPException {
- if (responseCtx.getTokenResponse() == null) {
+ final OIDCTokenResponse tokenResponse = responseCtx.getTokenResponse();
+ if (tokenResponse == null) {
throw new OIDCRPException("No access token response found");
}
- final BearerAccessToken bearer = responseCtx.getTokenResponse().getTokens().getBearerAccessToken();
+ final BearerAccessToken bearer = tokenResponse.getTokens().getBearerAccessToken();
if (bearer == null) {
throw new OIDCRPException("Access token was not Bearer type");
}
diff --git a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/AbstractHttpOIDCAuthenticationAction.java b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/AbstractHttpOIDCAuthenticationAction.java
index 2977a9a..e670021 100644
--- a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/AbstractHttpOIDCAuthenticationAction.java
+++ b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/AbstractHttpOIDCAuthenticationAction.java
@@ -29,7 +29,6 @@ import org.opensaml.profile.context.ProfileRequestContext;
import org.opensaml.security.httpclient.HttpClientSecurityParameters;
import org.opensaml.security.httpclient.HttpClientSecuritySupport;
import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
import com.nimbusds.oauth2.sdk.ErrorObject;
import com.nimbusds.oauth2.sdk.ErrorResponse;
@@ -41,6 +40,7 @@ import net.shibboleth.shared.annotation.constraint.NonnullAfterInit;
import net.shibboleth.shared.annotation.constraint.ThreadSafeAfterInit;
import net.shibboleth.shared.component.ComponentInitializationException;
import net.shibboleth.shared.logic.Constraint;
+import net.shibboleth.shared.primitive.LoggerFactory;
/**
* An abstract class for OIDC actions that make synchronous HTTP requests and return {@link Response responses}.
@@ -188,13 +188,18 @@ public abstract class AbstractHttpOIDCAuthenticationAction<T extends Response>
*
* @return a human readable error string
*/
- private String formatErrorResponse(@Nonnull final ErrorObject error) {
+ private String formatErrorResponse(@Nullable final ErrorObject error) {
final StringBuilder errorMsg = new StringBuilder();
- errorMsg.append("Error response, HTTP status code '")
- .append(error.getHTTPStatusCode())
- .append("', error code '").append(error.getCode())
- .append("', description: ").append(error.getDescription());
- return errorMsg.toString();
+ if (error == null) {
+ errorMsg.append("Unknown error");
+ return errorMsg.toString();
+ } else {
+ errorMsg.append("Error response, HTTP status code '")
+ .append(error.getHTTPStatusCode())
+ .append("', error code '").append(error.getCode())
+ .append("', description: ").append(error.getDescription());
+ return errorMsg.toString();
+ }
}
@@ -215,9 +220,11 @@ public abstract class AbstractHttpOIDCAuthenticationAction<T extends Response>
Constraint.isNotNull(request, "Request can not be null");
final HttpClientContext clientContext = HttpClientContext.create();
+ assert clientContext != null;
HttpClientSecuritySupport.marshalSecurityParameters(clientContext, httpClientSecurityParameters, true);
HttpClientSecuritySupport.addDefaultTLSTrustEngineCriteria(clientContext, request);
final ClassicHttpResponse httpResponse = httpClient.executeOpen(null, request, clientContext);
+ assert httpResponse != null;
final String scheme = request.getScheme();
assert scheme != null;
HttpClientSecuritySupport.checkTLSCredentialEvaluated(clientContext, scheme);
diff --git a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/AbstractOIDCAuthenticationResponseAction.java b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/AbstractOIDCAuthenticationResponseAction.java
index a8c68b1..88ce008 100644
--- a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/AbstractOIDCAuthenticationResponseAction.java
+++ b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/AbstractOIDCAuthenticationResponseAction.java
@@ -26,7 +26,6 @@ import org.opensaml.profile.action.EventIds;
import org.opensaml.profile.context.ProfileRequestContext;
import org.opensaml.profile.context.navigate.OutboundMessageContextLookup;
import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
import com.nimbusds.openid.connect.sdk.AuthenticationResponse;
import com.nimbusds.openid.connect.sdk.AuthenticationSuccessResponse;
@@ -37,6 +36,7 @@ import net.shibboleth.oidc.metadata.context.OIDCProviderMetadataContext;
import net.shibboleth.oidc.profile.core.OIDCAuthenticationRequest;
import net.shibboleth.oidc.profile.messaging.context.OIDCPeerEntityContext;
import net.shibboleth.shared.logic.Constraint;
+import net.shibboleth.shared.primitive.LoggerFactory;
/**
* Abstract class for actions based on the {@link AuthenticationResponse} located under
diff --git a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/AccessTokenToPrivateCredentialsMappingStrategy.java b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/AccessTokenToPrivateCredentialsMappingStrategy.java
index 5393577..0070b19 100644
--- a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/AccessTokenToPrivateCredentialsMappingStrategy.java
+++ b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/AccessTokenToPrivateCredentialsMappingStrategy.java
@@ -18,7 +18,6 @@ import java.security.Principal;
import java.time.Duration;
import java.util.ArrayList;
import java.util.Collection;
-import java.util.Collections;
import java.util.List;
import java.util.function.Function;
@@ -30,10 +29,12 @@ import org.opensaml.profile.context.navigate.InboundMessageContextLookup;
import com.nimbusds.oauth2.sdk.token.AccessToken;
import com.nimbusds.oauth2.sdk.token.RefreshToken;
+import com.nimbusds.openid.connect.sdk.OIDCTokenResponse;
import net.shibboleth.idp.plugin.authn.oidc.rp.context.AccessTokenResponseContext;
import net.shibboleth.idp.plugin.authn.oidc.rp.principal.OAuth2AccessTokenPrincipal;
import net.shibboleth.idp.plugin.authn.oidc.rp.principal.OAuth2RefreshTokenPrincipal;
+import net.shibboleth.shared.collection.CollectionSupport;
import net.shibboleth.shared.logic.Constraint;
/**
@@ -71,10 +72,12 @@ public class AccessTokenToPrivateCredentialsMappingStrategy
@Override
public Collection<Principal> apply(final ProfileRequestContext input) {
final AccessTokenResponseContext context = tokenResponseContextLookupStrategy.apply(input);
- if (context != null && context.getTokenResponse() != null) {
+ final OIDCTokenResponse tokenResponse = context != null ? context.getTokenResponse() : null;
+ if (tokenResponse != null) {
final List<Principal> principals = new ArrayList<>();
- final AccessToken accessToken = context.getTokenResponse().getTokens().getAccessToken();
- final RefreshToken refreshToken = context.getTokenResponse().getTokens().getRefreshToken();
+ final AccessToken accessToken = tokenResponse.getTokens().getAccessToken();
+ assert accessToken != null;
+ final RefreshToken refreshToken = tokenResponse.getTokens().getRefreshToken();
final OAuth2AccessTokenPrincipal accessTokenPrincipal = new OAuth2AccessTokenPrincipal(
accessToken.getValue(), accessToken.getType().getValue(),
@@ -89,7 +92,7 @@ public class AccessTokenToPrivateCredentialsMappingStrategy
return principals;
}
- return Collections.emptyList();
+ return CollectionSupport.emptyList();
}
}
diff --git a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/AuthorizationController.java b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/AuthorizationController.java
index c4de786..694a2eb 100644
--- a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/AuthorizationController.java
+++ b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/AuthorizationController.java
@@ -24,33 +24,33 @@ import org.opensaml.messaging.context.MessageContext;
import org.opensaml.messaging.context.navigate.ChildContextLookup;
import org.opensaml.messaging.decoder.MessageDecoder;
import org.opensaml.messaging.decoder.MessageDecodingException;
+import org.opensaml.messaging.handler.MessageHandler;
import org.opensaml.messaging.handler.MessageHandlerException;
import org.opensaml.profile.action.EventIds;
import org.opensaml.profile.context.EventContext;
import org.opensaml.profile.context.ProfileRequestContext;
-import org.opensaml.profile.context.navigate.OutboundMessageContextLookup;
import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
import org.springframework.stereotype.Controller;
import org.springframework.web.bind.annotation.GetMapping;
import org.springframework.web.bind.annotation.RequestMapping;
+import com.nimbusds.oauth2.sdk.ResponseMode;
+
import jakarta.servlet.ServletException;
import jakarta.servlet.http.HttpServletRequest;
import jakarta.servlet.http.HttpServletResponse;
import net.shibboleth.idp.authn.ExternalAuthentication;
import net.shibboleth.idp.authn.ExternalAuthenticationException;
import net.shibboleth.idp.authn.context.AuthenticationContext;
-import net.shibboleth.idp.plugin.authn.oidc.rp.context.OAuth2ClientContext;
import net.shibboleth.idp.plugin.authn.oidc.rp.context.OIDCAuthnContext;
import net.shibboleth.idp.plugin.authn.oidc.rp.context.OutboundMessageHandlerContext;
import net.shibboleth.idp.plugin.authn.oidc.rp.exception.OIDCProxyException;
import net.shibboleth.oidc.profile.core.OIDCAuthenticationRequest;
-import net.shibboleth.oidc.profile.messaging.context.OIDCPeerEntityContext;
import net.shibboleth.shared.annotation.constraint.NotEmpty;
import net.shibboleth.shared.component.AbstractInitializableComponent;
import net.shibboleth.shared.component.ComponentInitializationException;
import net.shibboleth.shared.logic.Constraint;
+import net.shibboleth.shared.primitive.LoggerFactory;
/**
* Servlet compatible with the {@link ExternalAuthentication} interface that begins, by HTTP redirect, an
@@ -86,8 +86,6 @@ public class AuthorizationController extends AbstractInitializableComponent {
/** Lookup strategy to locate the SAML context. */
@Nonnull private Function<ProfileRequestContext,OIDCAuthnContext> oidcContextLookupStrategy;
- /** The strategy used to lookup or create the {@link OAuth2ClientContext} for storing the client_id.*/
- @Nonnull private Function<ProfileRequestContext, OAuth2ClientContext> oauth2ClientContextLookupStrategy;
/** Constructor.*/
public AuthorizationController() {
@@ -98,26 +96,6 @@ public class AuthorizationController extends AbstractInitializableComponent {
// PRC -> AC -> OIDCAuthnContext
oidcContextLookupStrategy = new ChildContextLookup<>(OIDCAuthnContext.class).compose(
new ChildContextLookup<>(AuthenticationContext.class));
-
-
- // Default under OIDCPeerEntityContext in the outbound context (create true).
- oauth2ClientContextLookupStrategy = new ChildContextLookup<>(OAuth2ClientContext.class, true).compose(
- new ChildContextLookup<>(OIDCPeerEntityContext.class).compose(
- new OutboundMessageContextLookup()));
- }
-
- /**
- * Set the strategy to lookup the {@link OAuth2ClientContext}
- * from the {@link ProfileRequestContext}.
- *
- * @param strgy the strategy.
- */
- public void setOAuth2ClientContextLookupStrategy(
- @Nonnull final Function<ProfileRequestContext, OAuth2ClientContext> strgy) {
- checkSetterPreconditions();
-
- oauth2ClientContextLookupStrategy = Constraint.isNotNull(strgy,
- "OAuth2 client context lookup strategy cannot be null");
}
/**
@@ -180,14 +158,12 @@ public class AuthorizationController extends AbstractInitializableComponent {
return;
}
- if (nestedPRC.getOutboundMessageContext() != null &&
- nestedPRC.getOutboundMessageContext().getMessage() instanceof OIDCAuthenticationRequest) {
+ final MessageContext outMsgContext = nestedPRC.getOutboundMessageContext();
+ if (outMsgContext != null && outMsgContext.getMessage() instanceof OIDCAuthenticationRequest) {
// Build a handler context to allow certain parameters to be set e.g. state,
- // by the pre-message-encoders.
- final OutboundMessageHandlerContext handlerContext = new OutboundMessageHandlerContext(key);
-
- nestedPRC.getOutboundMessageContext().addSubcontext(handlerContext);
+ // by the pre-message-encoders.
+ outMsgContext.addSubcontext(new OutboundMessageHandlerContext(key));
} else {
log.error("Outbound Authorization message not found");
@@ -196,20 +172,22 @@ public class AuthorizationController extends AbstractInitializableComponent {
return;
}
- try {
- if (oidcContext.getOutboundMessageHandler() != null) {
- oidcContext.getOutboundMessageHandler().invoke(nestedPRC.getOutboundMessageContext());
+ try {
+ final MessageHandler handler = oidcContext.getOutboundMessageHandler();
+ if (handler != null) {
+ handler.invoke(outMsgContext);
}
log.debug("OIDC Relying Party Proxy executing message encoders to make upstream request "
+ "to OpenID Provider");
oidcContext.getEncodeMessageAction().execute(nestedPRC);
// Handle error added by the EncodeMessage action.
final EventContext eventCtx = nestedPRC.getSubcontext(EventContext.class);
- if (eventCtx != null && eventCtx.getEvent() != null
+ final Object event = eventCtx != null ? eventCtx.getEvent() : null;
+ if (eventCtx != null && event != null
&& !EventIds.PROCEED_EVENT_ID.equals(eventCtx.getEvent())) {
- log.error("Message encoding action signaled non-proceed event {}", eventCtx.getEvent());
+ log.error("Message encoding action signaled non-proceed event {}", event);
httpRequest.setAttribute(ExternalAuthentication.AUTHENTICATION_ERROR_KEY,
- eventCtx.getEvent().toString());
+ event.toString());
ExternalAuthentication.finishExternalAuthentication(key, httpRequest, httpResponse);
return;
}
@@ -271,8 +249,9 @@ public class AuthorizationController extends AbstractInitializableComponent {
}
// Find which response mode to expect from that set in the authentication request
OIDCAuthenticationRequest authnRequest = null;
- if (nestedPRC.getOutboundMessageContext() != null &&
- nestedPRC.getOutboundMessageContext().getMessage() instanceof OIDCAuthenticationRequest authenticationRequest) {
+ final MessageContext outMsgContext = nestedPRC.getOutboundMessageContext();
+ if (outMsgContext != null &&
+ outMsgContext.getMessage() instanceof final OIDCAuthenticationRequest authenticationRequest) {
authnRequest = authenticationRequest;
}
@@ -286,11 +265,15 @@ public class AuthorizationController extends AbstractInitializableComponent {
authnRequest.getResponseType(), authnRequest.getResponseMode());
try {
+ final ResponseMode responseMode = authnRequest.getResponseMode();
+ if (responseMode == null) {
+ throw new MessageDecodingException("Unable to obtain response_mode to decode incomming request");
+ }
final MessageDecoder decoder =
- oidcContext.getMessageDecoderFactory().apply(authnRequest.getResponseMode().getValue());
+ oidcContext.getMessageDecoderFactory().apply(responseMode.getValue());
if (decoder == null) {
throw new MessageDecodingException("Unable to obtain MessageDecoder for response_mode: "
- + authnRequest.getResponseMode().getValue());
+ + responseMode.getValue());
}
try {
decoder.initialize();
diff --git a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/BuildRequestObject.java b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/BuildRequestObject.java
index 87bbe7f..732ce24 100644
--- a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/BuildRequestObject.java
+++ b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/BuildRequestObject.java
@@ -28,10 +28,9 @@ import org.opensaml.profile.action.EventIds;
import org.opensaml.profile.context.ProfileRequestContext;
import org.opensaml.profile.context.navigate.OutboundMessageContextLookup;
import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
-import com.google.common.base.Predicates;
import com.nimbusds.jwt.JWT;
+import com.nimbusds.oauth2.sdk.ResponseMode;
import com.nimbusds.oauth2.sdk.id.Audience;
import com.nimbusds.oauth2.sdk.id.Issuer;
import com.nimbusds.openid.connect.sdk.claims.ACR;
@@ -46,7 +45,10 @@ import net.shibboleth.oidc.profile.core.OIDCAuthenticationRequest;
import net.shibboleth.oidc.profile.encoding.AuthenticationContextClassReferenceSupport;
import net.shibboleth.oidc.profile.messaging.context.OIDCPeerEntityContext;
import net.shibboleth.profile.context.RelyingPartyContext;
+import net.shibboleth.shared.annotation.constraint.NonnullBeforeExec;
import net.shibboleth.shared.logic.Constraint;
+import net.shibboleth.shared.logic.PredicateSupport;
+import net.shibboleth.shared.primitive.LoggerFactory;
/**
@@ -87,15 +89,15 @@ public class BuildRequestObject extends AbstractAuthenticationAction {
@Nonnull private Predicate<ProfileRequestContext> requestObjectToBeSignedPredicate;
/** OIDC authentication request built by the IdP. */
- @Nullable private OIDCAuthenticationRequest authnRequest;
+ @NonnullBeforeExec private OIDCAuthenticationRequest authnRequest;
/** OpenID Provider metadata .*/
- @Nullable private OIDCProviderMetadata providerMetadata;
+ @NonnullBeforeExec private OIDCProviderMetadata providerMetadata;
/** Constructor.*/
public BuildRequestObject() {
- claimsSetIsValidPredicate = Predicates.alwaysTrue();
- requestObjectToBeSignedPredicate = Predicates.alwaysTrue();
+ claimsSetIsValidPredicate = PredicateSupport.alwaysTrue();
+ requestObjectToBeSignedPredicate = PredicateSupport.alwaysTrue();
providerMetadataLookupStrategy = new ChildContextLookup<>(OIDCProviderMetadataContext.class).compose(
new ChildContextLookup<>(OIDCPeerEntityContext.class).compose(
@@ -177,6 +179,11 @@ public class BuildRequestObject extends AbstractAuthenticationAction {
return false;
}
authnRequest = (OIDCAuthenticationRequest) outboundMsgContext.getMessage();
+ if (authnRequest == null) {
+ log.error("{} No authentication request found", getLogPrefix());
+ ActionSupport.buildEvent(profileRequestContext, EventIds.INVALID_PROFILE_CTX);
+ return false;
+ }
final OIDCProviderMetadataContext providerMetadataContext =
providerMetadataLookupStrategy.apply(profileRequestContext);
@@ -226,8 +233,8 @@ public class BuildRequestObject extends AbstractAuthenticationAction {
setClaimIfPresent(requestObjectClaims, "response_type", authnRequest.getResponseType());
// Only set the response_mode if not equal to the default for that response_type
- if (authnRequest.getDefaultResponseMode() != null &&
- !authnRequest.getDefaultResponseMode().equals(authnRequest.getResponseMode())){
+ final ResponseMode responseMode = authnRequest.getDefaultResponseMode();
+ if (responseMode != null && !responseMode.equals(authnRequest.getResponseMode())){
requestObjectClaims.setClaim("response_mode", authnRequest.getResponseMode());
}
@@ -278,7 +285,7 @@ public class BuildRequestObject extends AbstractAuthenticationAction {
*/
private void setClaimIfPresent(
@Nonnull final ClaimsSet claims, @Nonnull final String claimName, @Nullable final Object claim) {
- if (claim instanceof Duration duration) {
+ if (claim instanceof final Duration duration) {
// Convert to seconds
claims.setClaim(claimName, duration.toSeconds());
} else if (claim != null) {
diff --git a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/DefaultClaimMergingStrategy.java b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/DefaultClaimMergingStrategy.java
index a00e4d8..ad170b1 100644
--- a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/DefaultClaimMergingStrategy.java
+++ b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/DefaultClaimMergingStrategy.java
@@ -22,10 +22,11 @@ import javax.annotation.Nonnull;
import javax.annotation.Nullable;
import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
import com.nimbusds.openid.connect.sdk.claims.ClaimsSet;
+import net.shibboleth.shared.primitive.LoggerFactory;
+
/**
* A default merging strategy for combing claims in the UserInfo response with those from the id_token.
* <ol>
diff --git a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/DefaultClaimSanitizationStrategy.java b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/DefaultClaimSanitizationStrategy.java
index a7b2947..c0421ce 100644
--- a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/DefaultClaimSanitizationStrategy.java
+++ b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/DefaultClaimSanitizationStrategy.java
@@ -38,7 +38,7 @@ public class DefaultClaimSanitizationStrategy implements UnaryOperator<ClaimsSet
/** Constructor.*/
public DefaultClaimSanitizationStrategy() {
- validationClaims = Set.of(IDTokenClaims.AUTHORIZED_PARTY.getClaimName(),
+ final Set<String> validationClaimsBuilt = Set.of(IDTokenClaims.AUTHORIZED_PARTY.getClaimName(),
IDTokenClaims.NONCE.getClaimName(),
IDTokenClaims.AUTHENTICATION_TIME.getClaimName(),
IDTokenClaims.AUTHENTICATION_CONTEXT_CLASS_REFERENCE.getClaimName(),
@@ -48,6 +48,8 @@ public class DefaultClaimSanitizationStrategy implements UnaryOperator<ClaimsSet
JWTClaims.AUDIENCE_CLAIM.getClaimName(),
JWTClaims.EXPIRATION_TIME_CLAIM.getClaimName(),
"at_hash");
+ assert validationClaimsBuilt != null;
+ validationClaims = validationClaimsBuilt;
}
@Override
diff --git a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/DefaultRedirectUriCreationFunction.java b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/DefaultRedirectUriCreationFunction.java
index 2f1e641..44483f3 100644
--- a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/DefaultRedirectUriCreationFunction.java
+++ b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/DefaultRedirectUriCreationFunction.java
@@ -29,7 +29,6 @@ import org.opensaml.messaging.context.navigate.ChildContextLookup;
import org.opensaml.profile.context.ProfileRequestContext;
import org.opensaml.profile.context.navigate.OutboundMessageContextLookup;
import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
import jakarta.servlet.http.HttpServletRequest;
import net.shibboleth.idp.plugin.authn.oidc.rp.context.OAuth2ClientContext;
@@ -40,6 +39,7 @@ import net.shibboleth.shared.annotation.constraint.ThreadSafeAfterInit;
import net.shibboleth.shared.component.AbstractIdentifiableInitializableComponent;
import net.shibboleth.shared.component.ComponentInitializationException;
import net.shibboleth.shared.logic.Constraint;
+import net.shibboleth.shared.primitive.LoggerFactory;
import net.shibboleth.shared.primitive.StringSupport;
/**
@@ -137,13 +137,17 @@ public class DefaultRedirectUriCreationFunction extends AbstractIdentifiableInit
}
@Override
- @Nullable public URI apply(@Nonnull final HttpServletRequest request, @Nonnull final ProfileRequestContext prc) {
+ @Nullable public URI apply(@Nullable final HttpServletRequest request, @Nullable final ProfileRequestContext prc) {
final OAuth2ClientContext context = oauth2ClientContextLookupStrategy.apply(prc);
if (context == null) {
log.warn("Could not locate the OAuth2 Client Context, can not compute redirect_uri");
return null;
}
+ if (request == null) {
+ log.warn("HttpServletRequest was unavailable, can not compute redirect_uri");
+ return null;
+ }
if (context.getRedirectUriOverride() != null) {
return context.getRedirectUriOverride();
}
@@ -156,8 +160,13 @@ public class DefaultRedirectUriCreationFunction extends AbstractIdentifiableInit
try {
- final URI redirectUri = buildURIIgnoreDefaultPorts(request.getScheme(),
- request.getServerName(),
+ final String scheme = request.getScheme();
+ assert scheme != null;
+ final String serverName = request.getServerName();
+ assert serverName != null;
+
+ final URI redirectUri = buildURIIgnoreDefaultPorts(scheme,
+ serverName,
request.getServerPort(),
request.getContextPath()+request.getServletPath()+callbackServletPath);
@@ -182,12 +191,16 @@ public class DefaultRedirectUriCreationFunction extends AbstractIdentifiableInit
* @throws URISyntaxException if there is an error getting information from the URI.
*/
@Nonnull private String buildOrigin(@Nonnull final URI uri) throws URISyntaxException {
-
if (uri.getPort() == -1) {
//is the default port (or is not defined), do not include
- return new URI(String.format("%s://%s", uri.getScheme(),uri.getHost())).toString();
+ final String uriAsString = new URI(String.format("%s://%s", uri.getScheme(),uri.getHost())).toString();
+ assert uriAsString != null;
+ return uriAsString;
} else {
- return new URI(String.format("%s://%s:%s", uri.getScheme(),uri.getHost(),uri.getPort())).toString();
+ final String uriAsString =
+ new URI(String.format("%s://%s:%s", uri.getScheme(),uri.getHost(),uri.getPort())).toString();
+ assert uriAsString != null;
+ return uriAsString;
}
}
@@ -221,12 +234,14 @@ public class DefaultRedirectUriCreationFunction extends AbstractIdentifiableInit
usedPort = -1;
}
}
- return new URIBuilder()
+ final URI builtUri = new URIBuilder()
.setScheme(scheme)
.setHost(host)
.setPort(usedPort)
.setPath(path)
.build();
+ assert builtUri != null;
+ return builtUri;
}
}
diff --git a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/ExchangeCodeForAccessToken.java b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/ExchangeCodeForAccessToken.java
index 7b4f6e5..162077f 100644
--- a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/ExchangeCodeForAccessToken.java
+++ b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/ExchangeCodeForAccessToken.java
@@ -24,9 +24,9 @@ import org.opensaml.profile.action.EventIds;
import org.opensaml.profile.context.ProfileRequestContext;
import org.opensaml.profile.context.navigate.InboundMessageContextLookup;
import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
import com.nimbusds.oauth2.sdk.TokenResponse;
+import com.nimbusds.openid.connect.sdk.AuthenticationSuccessResponse;
import com.nimbusds.openid.connect.sdk.OIDCTokenResponse;
import net.shibboleth.idp.authn.AuthnEventIds;
@@ -34,6 +34,7 @@ import net.shibboleth.idp.authn.context.AuthenticationContext;
import net.shibboleth.idp.plugin.authn.oidc.rp.context.AccessTokenResponseContext;
import net.shibboleth.idp.plugin.authn.oidc.rp.exception.OIDCRPException;
import net.shibboleth.shared.logic.Constraint;
+import net.shibboleth.shared.primitive.LoggerFactory;
/**
@@ -81,8 +82,14 @@ public class ExchangeCodeForAccessToken extends AbstractHttpOIDCAuthenticationAc
@Override protected void doExecute(@Nonnull final ProfileRequestContext profileRequestContext,
@Nonnull final AuthenticationContext authenticationContext) {
+ final AuthenticationSuccessResponse response = getAuthenticationResponse();
+ if (response == null) {
+ log.debug("{} No AuthenticationSuccessResponse found", getLogPrefix());
+ ActionSupport.buildEvent(profileRequestContext, EventIds.INVALID_PROFILE_CTX);
+ return;
+ }
log.debug("{} Exchanging auth_code '{}' for id_token from provider '{}'", getLogPrefix(),
- getAuthenticationResponse().getAuthorizationCode(),
+ response.getAuthorizationCode(),
authenticationContext.getAuthenticatingAuthority());
final AccessTokenResponseContext responseCtx =
@@ -94,7 +101,7 @@ public class ExchangeCodeForAccessToken extends AbstractHttpOIDCAuthenticationAc
}
try {
final TokenResponse responseObject = handleRequest(profileRequestContext, responseCtx);
- if (responseObject instanceof OIDCTokenResponse tokenResponse) {
+ if (responseObject instanceof final OIDCTokenResponse tokenResponse) {
responseCtx.setTokenResponse(tokenResponse);
log.trace("{} Token request response was successful '{}'",getLogPrefix(),
tokenResponse.indicatesSuccess());
diff --git a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/InitializeAuthorizationRequest.java b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/InitializeAuthorizationRequest.java
index cab977c..5a9b287 100644
--- a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/InitializeAuthorizationRequest.java
+++ b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/InitializeAuthorizationRequest.java
@@ -17,14 +17,13 @@ package net.shibboleth.idp.plugin.authn.oidc.rp.impl;
import java.util.function.Function;
import javax.annotation.Nonnull;
-import javax.annotation.Nullable;
+import org.opensaml.messaging.context.MessageContext;
import org.opensaml.messaging.context.navigate.ChildContextLookup;
import org.opensaml.profile.action.ActionSupport;
import org.opensaml.profile.context.ProfileRequestContext;
import org.opensaml.profile.context.navigate.OutboundMessageContextLookup;
import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
import com.nimbusds.oauth2.sdk.id.ClientID;
@@ -33,7 +32,9 @@ import net.shibboleth.idp.profile.AbstractProfileAction;
import net.shibboleth.idp.profile.IdPEventIds;
import net.shibboleth.oidc.profile.core.OIDCAuthenticationRequest;
import net.shibboleth.oidc.profile.messaging.context.OIDCPeerEntityContext;
+import net.shibboleth.shared.annotation.constraint.NonnullBeforeExec;
import net.shibboleth.shared.logic.Constraint;
+import net.shibboleth.shared.primitive.LoggerFactory;
/**
* An action that creates an {@link OIDCAuthenticationRequest} shell to populate in future steps,
@@ -53,7 +54,10 @@ public class InitializeAuthorizationRequest extends AbstractProfileAction {
private Function<ProfileRequestContext, OAuth2ClientContext> oauth2ClientContextLookupStrategy;
/** The stashed OAuth2 client context.*/
- @Nullable private OAuth2ClientContext oauth2ClientContext;
+ @NonnullBeforeExec private OAuth2ClientContext oauth2ClientContext;
+
+ /** The stashed outbound message context. */
+ @NonnullBeforeExec private MessageContext outMessageContext;
/** Constructor.*/
public InitializeAuthorizationRequest() {
@@ -91,6 +95,13 @@ public class InitializeAuthorizationRequest extends AbstractProfileAction {
return false;
}
+ outMessageContext = profileRequestContext.getOutboundMessageContext();
+ if (outMessageContext == null) {
+ log.error("{} Outbound message context not found", getLogPrefix());
+ ActionSupport.buildEvent(profileRequestContext, IdPEventIds.INVALID_PROFILE_CONFIG);
+ return false;
+ }
+
return true;
}
@@ -101,7 +112,7 @@ public class InitializeAuthorizationRequest extends AbstractProfileAction {
final OIDCAuthenticationRequest authRequest =
new OIDCAuthenticationRequest(new ClientID(oauth2ClientContext.getClientId()));
- profileRequestContext.getOutboundMessageContext().setMessage(authRequest);
+ outMessageContext.setMessage(authRequest);
log.debug("{} Adding shell OIDC authentication request to outbound context for client '{}'", getLogPrefix(),
oauth2ClientContext.getClientId());
diff --git a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/InitializeBlankOutboundResponseMessageContext.java b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/InitializeBlankOutboundResponseMessageContext.java
index 1c7177a..d395578 100644
--- a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/InitializeBlankOutboundResponseMessageContext.java
+++ b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/InitializeBlankOutboundResponseMessageContext.java
@@ -19,9 +19,9 @@ import javax.annotation.Nonnull;
import org.opensaml.messaging.context.MessageContext;
import org.opensaml.profile.context.ProfileRequestContext;
import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
import net.shibboleth.idp.profile.AbstractProfileAction;
+import net.shibboleth.shared.primitive.LoggerFactory;
/**
* Action that adds an outbound {@link MessageContext} to the outbound message context inside
diff --git a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/InitializeOAuth2ClientAuthenticationContext.java b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/InitializeOAuth2ClientAuthenticationContext.java
index c186ba0..ad1b1a7 100644
--- a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/InitializeOAuth2ClientAuthenticationContext.java
+++ b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/InitializeOAuth2ClientAuthenticationContext.java
@@ -25,11 +25,11 @@ import org.opensaml.messaging.handler.MessageHandlerException;
import org.opensaml.profile.action.EventIds;
import org.opensaml.profile.context.ProfileRequestContext;
import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
import net.shibboleth.oidc.authn.context.OAuth2ClientAuthenticationContext;
import net.shibboleth.oidc.profile.messaging.context.OIDCPeerEntityContext;
import net.shibboleth.shared.logic.Constraint;
+import net.shibboleth.shared.primitive.LoggerFactory;
/**
* An {@link AbstractMessageHandler action} that initializes an {@link OAuth2ClientAuthenticationContext} for later use.
diff --git a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/InitializeOAuth2ClientAuthenticationMethodHandler.java b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/InitializeOAuth2ClientAuthenticationMethodHandler.java
index d591656..8352120 100644
--- a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/InitializeOAuth2ClientAuthenticationMethodHandler.java
+++ b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/InitializeOAuth2ClientAuthenticationMethodHandler.java
@@ -34,7 +34,6 @@ import org.opensaml.profile.context.ProfileRequestContext;
import org.opensaml.profile.context.navigate.ParentProfileRequestContextLookup;
import org.opensaml.security.credential.Credential;
import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
import com.nimbusds.jose.Algorithm;
import com.nimbusds.jose.JOSEException;
@@ -69,15 +68,17 @@ import net.shibboleth.oidc.security.credential.JWKCredential;
import net.shibboleth.oidc.security.jose.SignatureSigningParameters;
import net.shibboleth.oidc.security.jose.context.SecurityParametersContext;
import net.shibboleth.profile.context.RelyingPartyContext;
+import net.shibboleth.shared.annotation.constraint.NonnullBeforeExec;
import net.shibboleth.shared.logic.Constraint;
+import net.shibboleth.shared.primitive.LoggerFactory;
/**
* An {@link AbstractMessageHandler action} that resolves the Client Authentication method for the chosen
* upstream OpenID Provider (issuer) from the profile configuration, and adds it to the
* {@link OAuth2ClientAuthenticationContext}.
*
- * <p>If a JWT client authentication type, the security parameters context is used create a signed JWT client assertion.
- * </p>
+ * <p>If a JWT client authentication type, the security parameters context is used to create a signed JWT
+ * client assertion.</p>
*
* @event {@link org.opensaml.profile.action.EventIds#PROCEED_EVENT_ID}
* @event {@link IdPEventIds#INVALID_PROFILE_CONFIG}
@@ -103,7 +104,7 @@ public class InitializeOAuth2ClientAuthenticationMethodHandler extends AbstractM
oauth2ClientAuthenticationContextLookupStrategy;
/** The stashed OAuth2 client authentication context.*/
- @Nullable private OAuth2ClientAuthenticationContext oauth2ClientAuthenticationContext;
+ @NonnullBeforeExec private OAuth2ClientAuthenticationContext oauth2ClientAuthenticationContext;
/** Lookup strategy to locate the OP metadata to use.*/
@Nonnull private Function<MessageContext, OIDCProviderMetadataContext> providerMetadataLookupStrategy;
@@ -112,7 +113,7 @@ public class InitializeOAuth2ClientAuthenticationMethodHandler extends AbstractM
@Nonnull private Function<ProfileRequestContext,RelyingPartyContext> relyingPartyContextLookupStrategy;
/** Applicable stashed profile configuration. */
- @Nullable private OIDCAuthenticationRelyingPartyProfileConfiguration profileConfiguration;
+ @NonnullBeforeExec private OIDCAuthenticationRelyingPartyProfileConfiguration profileConfiguration;
/** Strategy used to look up the {@link SecurityParametersContext} to set the parameters for. */
@Nonnull private Function<MessageContext, SecurityParametersContext> securityParametersContextLookupStrategy;
@@ -127,7 +128,7 @@ public class InitializeOAuth2ClientAuthenticationMethodHandler extends AbstractM
@Nullable private SecurityParametersContext jwtBearerClientAuthSecurityParameters;
/** The stashed provider metadata.*/
- @Nullable private OIDCProviderMetadata providerMetadata;
+ @NonnullBeforeExec private OIDCProviderMetadata providerMetadata;
/** The stashed client_secret to use if required.*/
@Nullable private ClientSecretCredential clientCredential;
@@ -234,7 +235,7 @@ public class InitializeOAuth2ClientAuthenticationMethodHandler extends AbstractM
final RelyingPartyContext rpCtx = relyingPartyContextLookupStrategy.compose(PRC_LOOKUP).apply(messageContext);
if (rpCtx != null && rpCtx.getConfiguration() != null &&
- rpCtx.getProfileConfig() instanceof OIDCAuthenticationRelyingPartyProfileConfiguration rpConfig) {
+ rpCtx.getProfileConfig() instanceof final OIDCAuthenticationRelyingPartyProfileConfiguration rpConfig) {
profileConfiguration = rpConfig;
}
if (profileConfiguration == null) {
@@ -250,7 +251,11 @@ public class InitializeOAuth2ClientAuthenticationMethodHandler extends AbstractM
log.error("{} Provider metadata not found", getLogPrefix());
throw new MessageHandlerException("Provider metadata not found");
}
+
providerMetadata = providerCtx.getProviderInformation();
+ if (providerMetadata == null) {
+ throw new MessageHandlerException("No provider metadata found from profile configuration");
+ }
clientAuthMethod = profileConfiguration.getTokenEndpointAuthMethod(PRC_LOOKUP.apply(messageContext));
if (clientAuthMethod.isEmpty()) {
@@ -281,6 +286,7 @@ public class InitializeOAuth2ClientAuthenticationMethodHandler extends AbstractM
throw new MessageHandlerException("No client secret credential found from profile configuration, "
+ "can not construct client authenticaton");
}
+ assert clientCredential != null;
final Secret secret = new Secret(clientCredential.getSecret());
// TODO redundent check for now, as the secret can not expire. Add back?
if (secret.expired()) {
@@ -322,15 +328,20 @@ public class InitializeOAuth2ClientAuthenticationMethodHandler extends AbstractM
* @throws MessageHandlerException if the wrong algorithm family is specified in the security context
*/
private void verifySuitableClientSecretJWTSecurityContext() throws MessageHandlerException {
- if (jwtBearerClientAuthSecurityParameters == null ||
- jwtBearerClientAuthSecurityParameters.getSignatureSigningParameters() == null) {
+
+ final SecurityParametersContext bearerSecurityParams = jwtBearerClientAuthSecurityParameters;
+ if (bearerSecurityParams == null || bearerSecurityParams.getSignatureSigningParameters() == null) {
throw new MessageHandlerException("Missing security parameters needed to build client_secret_jwt");
}
- if (jwtBearerClientAuthSecurityParameters.getSignatureSigningParameters().getSigningCredential() == null) {
+
+ final SignatureSigningParameters signatureSigningParameters = bearerSecurityParams.getSignatureSigningParameters();
+ assert signatureSigningParameters != null;
+
+ if (signatureSigningParameters.getSignatureAlgorithm() == null ||
+ signatureSigningParameters.getSigningCredential() == null) {
throw new MessageHandlerException("Missing credential needed to build client_secret_jwt");
}
- final Algorithm jwsAlgorithm =
- resolveAlgorithm(jwtBearerClientAuthSecurityParameters.getSignatureSigningParameters());
+ final Algorithm jwsAlgorithm = resolveAlgorithm(signatureSigningParameters);
if (!JWSAlgorithm.Family.HMAC_SHA.contains(jwsAlgorithm)) {
throw new MessageHandlerException("Trying to construct client_secret_jwt using the wrong algorithm: "
+ jwsAlgorithm);
@@ -345,15 +356,19 @@ public class InitializeOAuth2ClientAuthenticationMethodHandler extends AbstractM
* @throws MessageHandlerException if the wrong algorithm family is specified in the security context
*/
private void verifySuitablePrivateKetJWTSecurityContext() throws MessageHandlerException {
- if (jwtBearerClientAuthSecurityParameters == null ||
- jwtBearerClientAuthSecurityParameters.getSignatureSigningParameters() == null) {
+
+ final SecurityParametersContext bearerSecurityParams = jwtBearerClientAuthSecurityParameters;
+ if (bearerSecurityParams == null || bearerSecurityParams.getSignatureSigningParameters() == null) {
throw new MessageHandlerException("Missing security parameters needed to private_key_jwt");
}
- if (jwtBearerClientAuthSecurityParameters.getSignatureSigningParameters().getSigningCredential() == null) {
+
+ final SignatureSigningParameters signatureSigningParameters = bearerSecurityParams.getSignatureSigningParameters();
+ assert signatureSigningParameters != null;
+
+ if (signatureSigningParameters.getSigningCredential() == null) {
throw new MessageHandlerException("Missing credential needed to build private_key_jwt");
}
- final Algorithm jwsAlgorithm =
- resolveAlgorithm(jwtBearerClientAuthSecurityParameters.getSignatureSigningParameters());
+ final Algorithm jwsAlgorithm = resolveAlgorithm(signatureSigningParameters);
if (!JWSAlgorithm.Family.SIGNATURE.contains(jwsAlgorithm)) {
throw new MessageHandlerException("Trying to construct private_key_jwt using the wrong algorithm: "
+ jwsAlgorithm);
@@ -365,8 +380,8 @@ public class InitializeOAuth2ClientAuthenticationMethodHandler extends AbstractM
*
* @return the constructed JWT claims set
*/
- private JWTClaimsSet buildClientAuthenticationJwtClaims() {
- return new JWTClaimsSet.Builder()
+ @Nonnull private JWTClaimsSet buildClientAuthenticationJwtClaims() {
+ final JWTClaimsSet claimsSet = new JWTClaimsSet.Builder()
.subject(clientId)
.issuer(clientId)
.audience(providerMetadata.getTokenEndpointURI().toString())
@@ -374,24 +389,33 @@ public class InitializeOAuth2ClientAuthenticationMethodHandler extends AbstractM
.issueTime(Date.from(Instant.now()))
.expirationTime(Date.from(Instant.now().plus(jwtBearerExpiryOffset)))
.build();
+ assert claimsSet != null;
+ return claimsSet;
}
/**
* Build a signed JWT bearer token for client authentication using the populated security parameters. Relies on
- * the correct alg and credential existing in the security context ahead of time for the correct SignedJWT to be
+ * the correct 'alg' and credential existing in the security context ahead of time for the correct SignedJWT to be
* returned e.g. for either client_secret_jwt or private_key_jwt.
*
* @return a signed JWT bearer token, or {@code null} if there was an error during construction
*/
@Nullable private SignedJWT buildClientAuthenticationJwt() {
- if (jwtBearerClientAuthSecurityParameters == null ||
- jwtBearerClientAuthSecurityParameters.getSignatureSigningParameters() == null) {
- log.error("{} Requested client_secret_jwt client authentication, but signing parameters could not "
- + "be found",getLogPrefix());
+
+ final SecurityParametersContext bearerSecurityParams = jwtBearerClientAuthSecurityParameters;
+ if (bearerSecurityParams == null) {
+ log.error("{} Requested client_secret_jwt client authentication, but signing parameters context "
+ + "could not be found",getLogPrefix());
+ return null;
+ }
+ final SignatureSigningParameters signingParams = bearerSecurityParams.getSignatureSigningParameters();
+ if (signingParams == null) {
+ log.error("{} Requested client_secret_jwt client authentication, but signing parameters "
+ + "could not be found",getLogPrefix());
return null;
}
final JWTClaimsSet claims = buildClientAuthenticationJwtClaims();
- final SignedJWT signed = signClaims(claims, jwtBearerClientAuthSecurityParameters);
+ final SignedJWT signed = signClaims(claims, signingParams);
if (signed == null) {
log.trace("Could not construct client_secret_jwt client authentication");
return null;
@@ -403,16 +427,24 @@ public class InitializeOAuth2ClientAuthenticationMethodHandler extends AbstractM
* Sign the given JWT claims set using the signing parameters from the context.
*
* @param jwtClaimSetToSign the claims to sign
- * @param secContext the security context to determine the signing algorithm and keys
+ * @param signingParams the signing parameters required to sign the JWT
*
* @return a signed JWT or {@code null} if an error occurs.
*/
@Nullable private SignedJWT signClaims(@Nonnull final JWTClaimsSet jwtClaimSetToSign,
- @Nonnull final SecurityParametersContext secContext) {
+ @Nonnull final SignatureSigningParameters signingParams) {
try {
SignedJWT jwt = null;
- final Credential credential = secContext.getSignatureSigningParameters().getSigningCredential();
- final Algorithm jwsAlgorithm = resolveAlgorithm(secContext.getSignatureSigningParameters());
+ final Credential credential = signingParams.getSigningCredential();
+ if (credential == null) {
+ log.error("{} JWT Bearer Token could not be signed, no signing credential found", getLogPrefix());
+ return null;
+ }
+ final Algorithm jwsAlgorithm = resolveAlgorithm(signingParams);
+ if (jwsAlgorithm == null) {
+ log.error("{} JWT Bearer Token could not be signed, no signing algorithm found", getLogPrefix());
+ return null;
+ }
final JWSSigner signer = getSigner(jwsAlgorithm, credential);
final JWSHeader.Builder headerBuilder = new JWSHeader.Builder(new JWSAlgorithm(jwsAlgorithm.getName()))
.keyID(CredentialConversionUtil.resolveKid(credential));
@@ -448,7 +480,8 @@ public class InitializeOAuth2ClientAuthenticationMethodHandler extends AbstractM
* @return signer for algorithm and private key
* @throws JOSEException if algorithm cannot be supported
*/
- private JWSSigner getSigner(final Algorithm jwsAlgorithm, final Credential credential) throws JOSEException {
+ private JWSSigner getSigner(@Nonnull final Algorithm jwsAlgorithm,
+ @Nonnull final Credential credential) throws JOSEException {
if (JWSAlgorithm.Family.EC.contains(jwsAlgorithm)) {
return new ECDSASigner((ECPrivateKey) credential.getPrivateKey());
}
@@ -467,11 +500,15 @@ public class InitializeOAuth2ClientAuthenticationMethodHandler extends AbstractM
* @param params the signature signing parameters
* @return JWS algorithm
*/
- protected JWSAlgorithm resolveAlgorithm(@Nonnull final SignatureSigningParameters params) {
+ @Nullable protected JWSAlgorithm resolveAlgorithm(@Nonnull final SignatureSigningParameters params) {
+ if (params.getSignatureAlgorithm() == null) {
+ log.trace("{} Signature algorithm is null", getLogPrefix());
+ return null;
+ }
final JWSAlgorithm algorithm = new JWSAlgorithm(params.getSignatureAlgorithm());
final Credential credential = params.getSigningCredential();
- if (credential instanceof JWKCredential jwkCred && !algorithm.equals(jwkCred.getAlgorithm())) {
+ if (credential instanceof final JWKCredential jwkCred && !algorithm.equals(jwkCred.getAlgorithm())) {
log.debug("{} Signature signing algorithm {} differs from JWK algorithm '{}'", getLogPrefix(),
algorithm.getName(), jwkCred.getAlgorithm() != null ?
jwkCred.getAlgorithm() : "not specified");
diff --git a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/InitializeOAuth2ClientContext.java b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/InitializeOAuth2ClientContext.java
index 7ca498b..35772f0 100644
--- a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/InitializeOAuth2ClientContext.java
+++ b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/InitializeOAuth2ClientContext.java
@@ -18,7 +18,6 @@ import java.net.URI;
import java.util.function.Function;
import javax.annotation.Nonnull;
-import javax.annotation.Nullable;
import org.opensaml.messaging.context.navigate.ChildContextLookup;
import org.opensaml.profile.action.ActionSupport;
@@ -26,7 +25,6 @@ import org.opensaml.profile.action.EventIds;
import org.opensaml.profile.context.ProfileRequestContext;
import org.opensaml.profile.context.navigate.OutboundMessageContextLookup;
import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
import net.shibboleth.idp.plugin.authn.oidc.rp.config.navigate.RedirectUriLookupFunction;
import net.shibboleth.idp.plugin.authn.oidc.rp.context.OAuth2ClientContext;
@@ -35,8 +33,9 @@ import net.shibboleth.idp.profile.IdPEventIds;
import net.shibboleth.oidc.profile.config.OIDCAuthenticationRelyingPartyProfileConfiguration;
import net.shibboleth.oidc.profile.messaging.context.OIDCPeerEntityContext;
import net.shibboleth.profile.context.RelyingPartyContext;
-import net.shibboleth.shared.annotation.constraint.NonnullAfterInit;
+import net.shibboleth.shared.annotation.constraint.NonnullBeforeExec;
import net.shibboleth.shared.logic.Constraint;
+import net.shibboleth.shared.primitive.LoggerFactory;
import net.shibboleth.shared.primitive.StringSupport;
/**
@@ -56,10 +55,10 @@ public class InitializeOAuth2ClientContext extends AbstractProfileAction {
private final Logger log = LoggerFactory.getLogger(InitializeOAuth2ClientContext.class);
/** The strategy used to lookup or create the {@link OAuth2ClientContext} for storing the client_id.*/
- @NonnullAfterInit private Function<ProfileRequestContext, OAuth2ClientContext> oauth2ClientContextLookupStrategy;
+ @Nonnull private Function<ProfileRequestContext, OAuth2ClientContext> oauth2ClientContextLookupStrategy;
/** The stashed OAuth2 client context.*/
- @Nullable private OAuth2ClientContext oauth2ClientContext;
+ @NonnullBeforeExec private OAuth2ClientContext oauth2ClientContext;
/** A redirect_uri lookup strategy which can pull out an override redirect_uri from the profile request context.*/
@Nonnull private Function<ProfileRequestContext, URI> redirectUriOverrideLookupStrategy;
@@ -68,7 +67,7 @@ public class InitializeOAuth2ClientContext extends AbstractProfileAction {
@Nonnull private Function<ProfileRequestContext,RelyingPartyContext> relyingPartyContextLookupStrategy;
/** Applicable stashed profile configuration. */
- @Nullable private OIDCAuthenticationRelyingPartyProfileConfiguration profileConfiguration;
+ @NonnullBeforeExec private OIDCAuthenticationRelyingPartyProfileConfiguration profileConfiguration;
/** Constructor.*/
public InitializeOAuth2ClientContext() {
@@ -136,7 +135,7 @@ public class InitializeOAuth2ClientContext extends AbstractProfileAction {
final RelyingPartyContext rpCtx = relyingPartyContextLookupStrategy.apply(profileRequestContext);
if (rpCtx != null && rpCtx.getConfiguration() != null &&
- rpCtx.getProfileConfig() instanceof OIDCAuthenticationRelyingPartyProfileConfiguration rpConfig) {
+ rpCtx.getProfileConfig() instanceof final OIDCAuthenticationRelyingPartyProfileConfiguration rpConfig) {
profileConfiguration = rpConfig;
}
if (profileConfiguration == null) {
@@ -158,6 +157,7 @@ public class InitializeOAuth2ClientContext extends AbstractProfileAction {
ActionSupport.buildEvent(profileRequestContext, IdPEventIds.INVALID_RELYING_PARTY_CONFIG);
return;
}
+ assert clientId != null;
oauth2ClientContext.setClientId(clientId);
final URI redirectUri = redirectUriOverrideLookupStrategy.apply(profileRequestContext);
diff --git a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/InitializeOutboundAuthorizationRequestMessageContext.java b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/InitializeOutboundAuthorizationRequestMessageContext.java
index 180ff04..b1a7aa2 100644
--- a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/InitializeOutboundAuthorizationRequestMessageContext.java
+++ b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/InitializeOutboundAuthorizationRequestMessageContext.java
@@ -17,7 +17,6 @@ package net.shibboleth.idp.plugin.authn.oidc.rp.impl;
import java.util.function.Function;
import javax.annotation.Nonnull;
-import javax.annotation.Nullable;
import org.opensaml.messaging.context.BaseContext;
import org.opensaml.messaging.context.MessageContext;
@@ -27,7 +26,6 @@ import org.opensaml.profile.action.EventIds;
import org.opensaml.profile.context.ProfileRequestContext;
import org.opensaml.profile.context.navigate.InboundMessageContextLookup;
import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
import net.shibboleth.idp.profile.AbstractProfileAction;
import net.shibboleth.idp.profile.IdPEventIds;
@@ -35,7 +33,9 @@ import net.shibboleth.oidc.metadata.context.OIDCMetadataContext;
import net.shibboleth.oidc.metadata.context.OIDCProviderMetadataContext;
import net.shibboleth.oidc.profile.messaging.context.OIDCPeerEntityContext;
import net.shibboleth.profile.context.RelyingPartyContext;
+import net.shibboleth.shared.annotation.constraint.NonnullBeforeExec;
import net.shibboleth.shared.logic.Constraint;
+import net.shibboleth.shared.primitive.LoggerFactory;
/**
* Initialize an outbound message context with an OIDC peer entity context ready for an authorization/authentication
@@ -52,7 +52,7 @@ public class InitializeOutboundAuthorizationRequestMessageContext extends Abstra
private final Logger log = LoggerFactory.getLogger(InitializeOutboundAuthorizationRequestMessageContext.class);
/** The {@link OIDCPeerEntityContext} to base the outbound context on. */
- @Nullable private OIDCPeerEntityContext peerEntityCtx;
+ @NonnullBeforeExec private OIDCPeerEntityContext peerEntityCtx;
/** Strategy function to lookup the {@link OIDCMetadataContext} that represents this client during
* communication with the given OIDC peer. */
diff --git a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/InitializeRelyingPartyContext.java b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/InitializeRelyingPartyContext.java
index 835882a..0409bd2 100644
--- a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/InitializeRelyingPartyContext.java
+++ b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/InitializeRelyingPartyContext.java
@@ -17,7 +17,6 @@ package net.shibboleth.idp.plugin.authn.oidc.rp.impl;
import java.util.function.Function;
import javax.annotation.Nonnull;
-import javax.annotation.Nullable;
import org.opensaml.messaging.context.navigate.ChildContextLookup;
import org.opensaml.profile.action.ActionSupport;
@@ -26,7 +25,6 @@ import org.opensaml.profile.context.ProfileRequestContext;
import org.opensaml.profile.context.navigate.InboundMessageContextLookup;
import org.opensaml.saml.common.messaging.context.SAMLPeerEntityContext;
import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
import net.shibboleth.idp.profile.AbstractProfileAction;
import net.shibboleth.idp.profile.IdPEventIds;
@@ -34,7 +32,9 @@ import net.shibboleth.oidc.metadata.context.OIDCMetadataContext;
import net.shibboleth.oidc.metadata.context.OIDCProviderMetadataContext;
import net.shibboleth.oidc.profile.messaging.context.OIDCPeerEntityContext;
import net.shibboleth.profile.context.RelyingPartyContext;
+import net.shibboleth.shared.annotation.constraint.NonnullBeforeExec;
import net.shibboleth.shared.logic.Constraint;
+import net.shibboleth.shared.primitive.LoggerFactory;
/**
* Action that adds a {@link RelyingPartyContext} to the current {@link ProfileRequestContext} tree via a creation
@@ -58,11 +58,14 @@ public class InitializeRelyingPartyContext extends AbstractProfileAction {
private Function<ProfileRequestContext, OIDCProviderMetadataContext> oidcProviderMetadataContextLookupStrategy;
/** OIDC peer entity context to populate from. */
- @Nullable private OIDCPeerEntityContext peerEntityCtx;
+ @NonnullBeforeExec private OIDCPeerEntityContext peerEntityCtx;
/** Strategy used to look up the {@link SAMLPeerEntityContext} to draw from. */
@Nonnull private Function<ProfileRequestContext,OIDCPeerEntityContext> peerEntityContextLookupStrategy;
+ /** The stashed identifier of the OIDC entity.*/
+ @NonnullBeforeExec private String peerIdentifier;
+
/** Constructor. */
public InitializeRelyingPartyContext() {
relyingPartyContextCreationStrategy = new ChildContextLookup<>(RelyingPartyContext.class, true);
@@ -129,6 +132,12 @@ public class InitializeRelyingPartyContext extends AbstractProfileAction {
ActionSupport.buildEvent(profileRequestContext, EventIds.INVALID_MSG_CTX);
return false;
}
+ peerIdentifier = peerEntityCtx.getIdentifier();
+ if (peerIdentifier == null) {
+ log.warn("{} Unable to locate peer identifier", getLogPrefix());
+ ActionSupport.buildEvent(profileRequestContext, EventIds.INVALID_MSG_CTX);
+ return false;
+ }
return true;
}
@@ -142,13 +151,22 @@ public class InitializeRelyingPartyContext extends AbstractProfileAction {
ActionSupport.buildEvent(profileRequestContext, IdPEventIds.INVALID_RELYING_PARTY_CTX);
return;
}
+
log.debug("Attaching RelyingPartyContext for OP '{}'", peerEntityCtx.getIdentifier());
rpContext.setRelyingPartyId(peerEntityCtx.getIdentifier());
rpContext.setRelyingPartyIdContextTree(peerEntityCtx);
final OIDCProviderMetadataContext oidcContext =
oidcProviderMetadataContextLookupStrategy.apply(profileRequestContext);
- if (oidcContext != null && oidcContext.getProviderInformation() != null
- && peerEntityCtx.getIdentifier().equals(oidcContext.getProviderInformation().getIssuer().getValue())) {
+
+ if (oidcContext == null) {
+ log.trace("{} Unable to find OpenID Provider Metadata", getLogPrefix());
+ ActionSupport.buildEvent(profileRequestContext, IdPEventIds.INVALID_RELYING_PARTY_CTX);
+ return;
+ }
+
+ final var providerMetadata = oidcContext.getProviderInformation();
+ if (providerMetadata != null &&
+ peerIdentifier.equals(providerMetadata.getIssuer().getValue())) {
log.debug("{} Setting the OP context to 'verified'", getLogPrefix());
rpContext.setVerified(true);
}
diff --git a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/InitializeUnverifiedRelyingPartyContext.java b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/InitializeUnverifiedRelyingPartyContext.java
index be94894..d481218 100644
--- a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/InitializeUnverifiedRelyingPartyContext.java
+++ b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/InitializeUnverifiedRelyingPartyContext.java
@@ -22,12 +22,12 @@ import org.opensaml.messaging.context.navigate.ChildContextLookup;
import org.opensaml.profile.action.ActionSupport;
import org.opensaml.profile.context.ProfileRequestContext;
import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
import net.shibboleth.idp.profile.AbstractProfileAction;
import net.shibboleth.idp.profile.IdPEventIds;
import net.shibboleth.profile.context.RelyingPartyContext;
import net.shibboleth.shared.logic.Constraint;
+import net.shibboleth.shared.primitive.LoggerFactory;
/**
* Action that adds an unverified {@link RelyingPartyContext} to the current {@link ProfileRequestContext} tree via a
diff --git a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/OIDCProxySupport.java b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/OIDCProxySupport.java
index 7f20cb8..669b412 100644
--- a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/OIDCProxySupport.java
+++ b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/OIDCProxySupport.java
@@ -45,7 +45,9 @@ public final class OIDCProxySupport {
while(sb.length() < length){
sb.append(Integer.toHexString(secureRandom.nextInt()));
}
- return sb.toString().substring(0, length);
+ final String nonce = sb.toString().substring(0, length);
+ assert nonce != null;
+ return nonce;
}
@@ -115,7 +117,11 @@ public final class OIDCProxySupport {
if (stateSplit.length!=2) {
throw new OIDCProxyException("State does not contain the nonce component");
}
- return stateSplit[0];
+ final String foundState = stateSplit[0];
+ if (foundState == null) {
+ throw new OIDCProxyException("State does not contain the nonce component");
+ }
+ return foundState;
}
}
diff --git a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/PrepareOIDCInboundMessageContext.java b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/PrepareOIDCInboundMessageContext.java
index d220d83..b6f1946 100644
--- a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/PrepareOIDCInboundMessageContext.java
+++ b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/PrepareOIDCInboundMessageContext.java
@@ -25,9 +25,6 @@ import org.opensaml.profile.action.ActionSupport;
import org.opensaml.profile.action.EventIds;
import org.opensaml.profile.context.ProfileRequestContext;
import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
-
-import com.google.common.base.Predicates;
import net.shibboleth.idp.authn.context.AuthenticationContext;
import net.shibboleth.idp.profile.AbstractProfileAction;
@@ -35,6 +32,8 @@ import net.shibboleth.oidc.profile.messaging.context.OIDCPeerEntityContext;
import net.shibboleth.shared.annotation.constraint.NonnullAfterInit;
import net.shibboleth.shared.component.ComponentInitializationException;
import net.shibboleth.shared.logic.Constraint;
+import net.shibboleth.shared.logic.PredicateSupport;
+import net.shibboleth.shared.primitive.LoggerFactory;
/**
* Action that adds an inbound {@link MessageContext} and a {@link OIDCPeerEntityContext} to the
@@ -68,7 +67,7 @@ public class PrepareOIDCInboundMessageContext extends AbstractProfileAction {
/** Constructor.*/
public PrepareOIDCInboundMessageContext() {
- addToExistingInboundMessageContextPredicate = Predicates.alwaysFalse();
+ addToExistingInboundMessageContextPredicate = PredicateSupport.alwaysFalse();
}
@Override
@@ -88,7 +87,8 @@ public class PrepareOIDCInboundMessageContext extends AbstractProfileAction {
public void setAddToExistingInboundMessageContext(final boolean flag) {
checkSetterPreconditions();
- addToExistingInboundMessageContextPredicate = flag ? Predicates.alwaysTrue() : Predicates.alwaysFalse();
+ addToExistingInboundMessageContextPredicate =
+ flag ? PredicateSupport.alwaysTrue() : PredicateSupport.alwaysFalse();
}
/**
diff --git a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/ProcessEndUserClaims.java b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/ProcessEndUserClaims.java
index a9e4e65..4cef84f 100644
--- a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/ProcessEndUserClaims.java
+++ b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/ProcessEndUserClaims.java
@@ -20,7 +20,6 @@ import java.util.function.Function;
import java.util.function.UnaryOperator;
import javax.annotation.Nonnull;
-import javax.annotation.Nullable;
import org.opensaml.messaging.context.navigate.ChildContextLookup;
import org.opensaml.profile.action.ActionSupport;
@@ -28,10 +27,11 @@ import org.opensaml.profile.action.EventIds;
import org.opensaml.profile.context.ProfileRequestContext;
import org.opensaml.profile.context.navigate.InboundMessageContextLookup;
import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
import com.nimbusds.common.contenttype.ContentType;
import com.nimbusds.jwt.JWTClaimsSet;
+import com.nimbusds.openid.connect.sdk.OIDCTokenResponse;
+import com.nimbusds.openid.connect.sdk.UserInfoSuccessResponse;
import com.nimbusds.openid.connect.sdk.claims.ClaimsSet;
import net.shibboleth.idp.authn.AbstractAuthenticationAction;
@@ -39,7 +39,9 @@ import net.shibboleth.idp.authn.context.AuthenticationContext;
import net.shibboleth.idp.plugin.authn.oidc.rp.context.AccessTokenResponseContext;
import net.shibboleth.idp.plugin.authn.oidc.rp.context.EndUserClaimsContext;
import net.shibboleth.idp.plugin.authn.oidc.rp.context.UserInfoResponseContext;
+import net.shibboleth.shared.annotation.constraint.NonnullBeforeExec;
import net.shibboleth.shared.logic.Constraint;
+import net.shibboleth.shared.primitive.LoggerFactory;
/**
* Process the end-user claims from the id_token and possible UserInfo claims sets.
@@ -82,13 +84,13 @@ public class ProcessEndUserClaims extends AbstractAuthenticationAction {
@Nonnull private UnaryOperator<ClaimsSet> claimSanitizationStrategy;
/** The stashed UserInfo claims. This is allowably {@literal empty} if the UserInfo endpoint was not used.*/
- @Nullable private ClaimsSet userInfoClaims;
+ @NonnullBeforeExec private ClaimsSet userInfoClaims;
/**
* The stashed id_token claims. This should never be {@literal null} or {@literal empty} once
* {@link #doPreExecute(ProfileRequestContext)} has run.
*/
- @Nullable private JWTClaimsSet idTokenClaims;
+ @NonnullBeforeExec private JWTClaimsSet idTokenClaims;
/** Constructor.*/
@@ -200,16 +202,18 @@ public class ProcessEndUserClaims extends AbstractAuthenticationAction {
final UserInfoResponseContext userInfoCtx =
userInfoResponseContextLookupStrategy.apply(profileRequestContext);
- if (userInfoCtx == null || userInfoCtx.getUserInfo() == null) {
+ final UserInfoSuccessResponse userInfo = userInfoCtx != null ? userInfoCtx.getUserInfo() : null;
+
+ if (userInfoCtx == null || userInfo == null) {
log.trace("{} No UserInfo response context returned by lookup strategy, creating empty "
+ "UserInfo claims", getLogPrefix());
userInfoClaims = new ClaimsSet();
- } else if (userInfoCtx.getUserInfo().getEntityContentType() == ContentType.APPLICATION_JSON) {
- userInfoClaims = userInfoCtx.getUserInfo().getUserInfo();
- } else if (userInfoCtx.getUserInfo().getEntityContentType() == ContentType.APPLICATION_JWT) {
+ } else if (userInfo.getEntityContentType() == ContentType.APPLICATION_JSON) {
+ userInfoClaims = userInfo.getUserInfo();
+ } else if (userInfo.getEntityContentType() == ContentType.APPLICATION_JWT) {
try {
final ClaimsSet claims = new ClaimsSet();
- claims.putAll(userInfoCtx.getUserInfo().getUserInfoJWT().getJWTClaimsSet().getClaims());
+ claims.putAll(userInfo.getUserInfoJWT().getJWTClaimsSet().getClaims());
userInfoClaims = claims;
} catch (final ParseException e) {
log.warn("Unable to extract UserInfo claims from JWT claimsset", e);
@@ -222,19 +226,21 @@ public class ProcessEndUserClaims extends AbstractAuthenticationAction {
final AccessTokenResponseContext tokenResponseCtx =
accessTokenResponseContextLookupStrategy.apply(profileRequestContext);
- if (tokenResponseCtx == null || tokenResponseCtx.getTokenResponse() == null) {
+ final OIDCTokenResponse tokenResponse = tokenResponseCtx != null ? tokenResponseCtx.getTokenResponse() : null;
+
+ if (tokenResponseCtx == null || tokenResponse == null) {
log.debug("{} No AccessTokenResponseContext or Access Token returned by lookup strategy", getLogPrefix());
ActionSupport.buildEvent(profileRequestContext, EventIds.INVALID_PROFILE_CTX);
return false;
}
- if (tokenResponseCtx.getTokenResponse().getOIDCTokens() == null ||
- tokenResponseCtx.getTokenResponse().getOIDCTokens().getIDToken() == null) {
+ if (tokenResponse.getOIDCTokens() == null ||
+ tokenResponse.getOIDCTokens().getIDToken() == null) {
log.debug("{} AccessTokenResponseContext did not contain an id_token", getLogPrefix());
ActionSupport.buildEvent(profileRequestContext, EventIds.INVALID_PROFILE_CTX);
return false;
}
try {
- idTokenClaims = tokenResponseCtx.getTokenResponse().getOIDCTokens().getIDToken().getJWTClaimsSet();
+ idTokenClaims = tokenResponse.getOIDCTokens().getIDToken().getJWTClaimsSet();
if (idTokenClaims == null) {
log.debug("{} AccessTokenResponseContext did not contain an id_token with accessible claims, "
+ "possibly still encrypted",
@@ -245,6 +251,7 @@ public class ProcessEndUserClaims extends AbstractAuthenticationAction {
} catch (final ParseException e) {
log.debug("{} Unable to parse claims from id_token", getLogPrefix());
ActionSupport.buildEvent(profileRequestContext, EventIds.INVALID_PROFILE_CTX);
+ return false;
}
return true;
@@ -270,11 +277,13 @@ public class ProcessEndUserClaims extends AbstractAuthenticationAction {
// Add to end user claims context both the merged claims, and the parsed id_token claims.
// The id_token claims are stashed here to avoid re-parsing downstream.
+ final var idTokenClaimsCopy = idTokenClaims;
+ assert idTokenClaimsCopy != null;
endUserClaimsContextLookupStrategy.apply(profileRequestContext)
- .setEndUserClaims(mergedClaims)
- .setUnprocessedIdTokenClaims(idTokenClaims);
+ .setEndUserClaims(mergedClaims != null ? mergedClaims : new ClaimsSet())
+ .setUnprocessedIdTokenClaims(idTokenClaimsCopy);
- if (log.isTraceEnabled()) {
+ if (log.isTraceEnabled() && mergedClaims != null) {
log.trace("{} Merged and sanitized claims to produce the claims set '{}'",
getLogPrefix(), mergedClaims.toJSONString());
}
diff --git a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/SimpleOIDCSubjectIdentifierCanonicalization.java b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/SimpleOIDCSubjectIdentifierCanonicalization.java
index 3d03db6..1e4e64c 100644
--- a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/SimpleOIDCSubjectIdentifierCanonicalization.java
+++ b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/SimpleOIDCSubjectIdentifierCanonicalization.java
@@ -19,11 +19,11 @@ import java.util.function.Predicate;
import javax.annotation.Nonnull;
import javax.annotation.Nullable;
+import javax.security.auth.Subject;
import org.opensaml.profile.action.ActionSupport;
import org.opensaml.profile.context.ProfileRequestContext;
import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
import net.shibboleth.idp.authn.AbstractSubjectCanonicalizationAction;
import net.shibboleth.idp.authn.AuthnEventIds;
@@ -31,6 +31,7 @@ import net.shibboleth.idp.authn.SubjectCanonicalizationException;
import net.shibboleth.idp.authn.context.SubjectCanonicalizationContext;
import net.shibboleth.idp.plugin.authn.oidc.rp.principal.OIDCSubjectIdentifierPrincipal;
import net.shibboleth.shared.annotation.ParameterName;
+import net.shibboleth.shared.primitive.LoggerFactory;
/**
* An action that operates on a {@link SubjectCanonicalizationContext} child of the current
@@ -65,8 +66,10 @@ public class SimpleOIDCSubjectIdentifierCanonicalization extends AbstractSubject
@Nonnull final SubjectCanonicalizationContext c14nContext) {
if (embeddedPredicate.apply(profileRequestContext, c14nContext, true)) {
+ final Subject c14CtxSubject = c14nContext.getSubject();
+ assert c14CtxSubject != null;
subjectIdentifierPrincipal =
- c14nContext.getSubject().getPrincipals(OIDCSubjectIdentifierPrincipal.class).iterator().next();
+ c14CtxSubject.getPrincipals(OIDCSubjectIdentifierPrincipal.class).iterator().next();
return super.doPreExecute(profileRequestContext, c14nContext);
}
@@ -77,7 +80,7 @@ public class SimpleOIDCSubjectIdentifierCanonicalization extends AbstractSubject
@Override
protected void doExecute(@Nonnull final ProfileRequestContext profileRequestContext,
@Nonnull final SubjectCanonicalizationContext c14nContext) {
-
+ assert subjectIdentifierPrincipal != null;
c14nContext.setPrincipalName(applyTransforms(subjectIdentifierPrincipal.getName()));
}
@@ -128,8 +131,9 @@ public class SimpleOIDCSubjectIdentifierCanonicalization extends AbstractSubject
@Nonnull final SubjectCanonicalizationContext c14nContext, final boolean duringAction) {
final Set<OIDCSubjectIdentifierPrincipal> subjects;
- if (c14nContext.getSubject() != null) {
- subjects = c14nContext.getSubject().getPrincipals(OIDCSubjectIdentifierPrincipal.class);
+ final Subject c14CtxSubject = c14nContext.getSubject();
+ if (c14CtxSubject != null) {
+ subjects = c14CtxSubject.getPrincipals(OIDCSubjectIdentifierPrincipal.class);
} else {
subjects = null;
}
diff --git a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/UnsupportedResponseTypeAction.java b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/UnsupportedResponseTypeAction.java
index dd0dfd7..458b780 100644
--- a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/UnsupportedResponseTypeAction.java
+++ b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/UnsupportedResponseTypeAction.java
@@ -19,10 +19,10 @@ import javax.annotation.Nonnull;
import org.opensaml.profile.action.ActionSupport;
import org.opensaml.profile.context.ProfileRequestContext;
import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
import net.shibboleth.idp.profile.AbstractProfileAction;
import net.shibboleth.oidc.profile.core.OidcEventIds;
+import net.shibboleth.shared.primitive.LoggerFactory;
/**
* Simple action to log the response from an unsupported grant type.
diff --git a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/UserInfoEndpointLookup.java b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/UserInfoEndpointLookup.java
index 7dfcce5..45bf242 100644
--- a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/UserInfoEndpointLookup.java
+++ b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/UserInfoEndpointLookup.java
@@ -24,7 +24,6 @@ import org.opensaml.profile.action.EventIds;
import org.opensaml.profile.context.ProfileRequestContext;
import org.opensaml.profile.context.navigate.InboundMessageContextLookup;
import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
import com.nimbusds.openid.connect.sdk.UserInfoResponse;
@@ -35,6 +34,7 @@ import net.shibboleth.idp.plugin.authn.oidc.rp.context.UserInfoResponseContext;
import net.shibboleth.idp.plugin.authn.oidc.rp.exception.OIDCRPException;
import net.shibboleth.oidc.profile.core.OidcEventIds;
import net.shibboleth.shared.logic.Constraint;
+import net.shibboleth.shared.primitive.LoggerFactory;
/**
* Request information from the UserInfo OAuth2.0 endpoint using the access_token already present
diff --git a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/ValidateAuthenticationResponseResult.java b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/ValidateAuthenticationResponseResult.java
index 35bc499..5e388b7 100644
--- a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/ValidateAuthenticationResponseResult.java
+++ b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/ValidateAuthenticationResponseResult.java
@@ -15,14 +15,12 @@
package net.shibboleth.idp.plugin.authn.oidc.rp.impl;
import javax.annotation.Nonnull;
-import javax.annotation.Nullable;
import org.opensaml.messaging.context.MessageContext;
import org.opensaml.profile.action.ActionSupport;
import org.opensaml.profile.action.EventIds;
import org.opensaml.profile.context.ProfileRequestContext;
import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
import com.nimbusds.oauth2.sdk.ErrorResponse;
import com.nimbusds.openid.connect.sdk.AuthenticationErrorResponse;
@@ -30,6 +28,8 @@ import com.nimbusds.openid.connect.sdk.AuthenticationResponse;
import net.shibboleth.idp.authn.AbstractAuthenticationAction;
import net.shibboleth.idp.authn.context.AuthenticationContext;
+import net.shibboleth.shared.annotation.constraint.NonnullBeforeExec;
+import net.shibboleth.shared.primitive.LoggerFactory;
/**
* An action that checks the inbound authentication response indicated success as opposed to an error.
@@ -44,7 +44,7 @@ public class ValidateAuthenticationResponseResult extends AbstractAuthentication
@Nonnull private final Logger log = LoggerFactory.getLogger(ValidateAuthenticationResponseResult.class);
/** Context containing the result to examine. */
- @Nullable private AuthenticationResponse authenticationResponse;
+ @NonnullBeforeExec private AuthenticationResponse authenticationResponse;
@Override
protected boolean doPreExecute(@Nonnull final ProfileRequestContext profileRequestContext,
@@ -57,7 +57,7 @@ public class ValidateAuthenticationResponseResult extends AbstractAuthentication
return false;
}
- if (inMsgContext.getMessage() instanceof AuthenticationResponse response) {
+ if (inMsgContext.getMessage() instanceof final AuthenticationResponse response) {
authenticationResponse = response;
} else {
log.debug("{} Inbound message was not an authentication response", getLogPrefix());
@@ -73,6 +73,7 @@ public class ValidateAuthenticationResponseResult extends AbstractAuthentication
if (!authenticationResponse.indicatesSuccess()) {
final AuthenticationErrorResponse error = authenticationResponse.toErrorResponse();
+ assert error != null;
if (log.isErrorEnabled()) {
log.error("{} OIDC Authentication Response contained an error from upstream OP '{}' : {}",
getLogPrefix(), authenticationContext.getAuthenticatingAuthority(),
diff --git a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/ValidateExternalAuthenticationContext.java b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/ValidateExternalAuthenticationContext.java
index 9740953..46b6ca8 100644
--- a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/ValidateExternalAuthenticationContext.java
+++ b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/ValidateExternalAuthenticationContext.java
@@ -15,18 +15,18 @@
package net.shibboleth.idp.plugin.authn.oidc.rp.impl;
import javax.annotation.Nonnull;
-import javax.annotation.Nullable;
import org.opensaml.profile.action.ActionSupport;
import org.opensaml.profile.action.EventIds;
import org.opensaml.profile.context.ProfileRequestContext;
import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
import net.shibboleth.idp.authn.AbstractAuthenticationAction;
import net.shibboleth.idp.authn.AuthnEventIds;
import net.shibboleth.idp.authn.context.AuthenticationContext;
import net.shibboleth.idp.authn.context.ExternalAuthenticationContext;
+import net.shibboleth.shared.annotation.constraint.NonnullBeforeExec;
+import net.shibboleth.shared.primitive.LoggerFactory;
/**
* An action that checks for a {@link ExternalAuthenticationContext} for a signalled event via the
@@ -41,7 +41,7 @@ public class ValidateExternalAuthenticationContext extends AbstractAuthenticatio
@Nonnull private final Logger log = LoggerFactory.getLogger(ValidateExternalAuthenticationContext.class);
/** Context containing the result to examine. */
- @Nullable private ExternalAuthenticationContext extContext;
+ @NonnullBeforeExec private ExternalAuthenticationContext extContext;
/** {@inheritDoc} */
@Override
@@ -67,10 +67,11 @@ public class ValidateExternalAuthenticationContext extends AbstractAuthenticatio
protected void doExecute(@Nonnull final ProfileRequestContext profileRequestContext,
@Nonnull final AuthenticationContext authenticationContext) {
- if (extContext.getAuthnError() != null) {
+ final String authnError = extContext.getAuthnError();
+ if (authnError != null) {
log.warn("{} OIDC Proxy authentication attempt signaled an error: {}", getLogPrefix(),
extContext.getAuthnError());
- ActionSupport.buildEvent(profileRequestContext, extContext.getAuthnError());
+ ActionSupport.buildEvent(profileRequestContext, authnError);
} else {
log.trace("{} Continuing with OIDC Proxy authentication attempt", getLogPrefix());
}
diff --git a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/ValidateOAuthAccessTokenResponse.java b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/ValidateOAuthAccessTokenResponse.java
index b6c8a25..25bb332 100644
--- a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/ValidateOAuthAccessTokenResponse.java
+++ b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/ValidateOAuthAccessTokenResponse.java
@@ -26,7 +26,6 @@ import org.opensaml.profile.action.EventIds;
import org.opensaml.profile.context.ProfileRequestContext;
import org.opensaml.profile.context.navigate.InboundMessageContextLookup;
import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
import com.nimbusds.openid.connect.sdk.OIDCTokenResponse;
@@ -36,6 +35,7 @@ import net.shibboleth.idp.plugin.authn.oidc.rp.context.AccessTokenResponseContex
import net.shibboleth.oidc.profile.core.OidcEventIds;
import net.shibboleth.shared.annotation.constraint.NotEmpty;
import net.shibboleth.shared.logic.Constraint;
+import net.shibboleth.shared.primitive.LoggerFactory;
/**
* Validation action that validates the OAuth Access Token Response against RFC 6749 section 5.1
@@ -118,10 +118,11 @@ public class ValidateOAuthAccessTokenResponse extends AbstractAuthenticationActi
ActionSupport.buildEvent(profileRequestContext, OidcEventIds.INVALID_ACCESS_TOKEN);
return;
}
+ final Instant tokenResponseCreatedAt = responseCtx.getTokenResponseCreatedAt();
if (tokenResponse.getTokens().getAccessToken().getLifetime() != 0 &&
- responseCtx.getTokenResponseCreatedAt() != null) {
+ tokenResponseCreatedAt != null) {
final Instant now = Instant.now();
- final Instant expiresAt = responseCtx.getTokenResponseCreatedAt().plus(Duration.ofSeconds(
+ final Instant expiresAt = tokenResponseCreatedAt.plus(Duration.ofSeconds(
tokenResponse.getTokens().getAccessToken().getLifetime()));
if (expiresAt.isBefore(now)) {
log.warn("{} Access token response is invalid, token has expired", getLogPrefix());
diff --git a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/ValidateOIDCAuthentication.java b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/ValidateOIDCAuthentication.java
index e788ab2..6fd6225 100644
--- a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/ValidateOIDCAuthentication.java
+++ b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/ValidateOIDCAuthentication.java
@@ -16,13 +16,13 @@ package net.shibboleth.idp.plugin.authn.oidc.rp.impl;
import java.security.Principal;
import java.text.ParseException;
+import java.time.Instant;
import java.util.ArrayList;
import java.util.Collection;
import java.util.Date;
import java.util.List;
import java.util.Map;
import java.util.function.Function;
-import java.util.stream.Collectors;
import javax.annotation.Nonnull;
import javax.annotation.Nullable;
@@ -37,11 +37,12 @@ import org.opensaml.profile.context.ProfileRequestContext;
import org.opensaml.profile.context.navigate.InboundMessageContextLookup;
import org.opensaml.saml.metadata.resolver.MetadataResolver;
import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
import com.google.common.collect.HashMultimap;
import com.google.common.collect.Multimap;
+import com.nimbusds.jwt.JWTClaimsSet;
import com.nimbusds.openid.connect.sdk.AuthenticationSuccessResponse;
+import com.nimbusds.openid.connect.sdk.claims.ClaimsSet;
import net.minidev.json.JSONObject;
import net.shibboleth.idp.attribute.AttributeDecodingException;
@@ -69,9 +70,11 @@ import net.shibboleth.profile.context.RelyingPartyContext;
import net.shibboleth.saml.profile.context.navigate.SAMLMetadataContextLookupFunction;
import net.shibboleth.shared.annotation.constraint.Live;
import net.shibboleth.shared.annotation.constraint.NonnullAfterInit;
+import net.shibboleth.shared.annotation.constraint.NonnullBeforeExec;
import net.shibboleth.shared.annotation.constraint.NonnullElements;
import net.shibboleth.shared.annotation.constraint.NotEmpty;
import net.shibboleth.shared.logic.Constraint;
+import net.shibboleth.shared.primitive.LoggerFactory;
import net.shibboleth.shared.service.ReloadableService;
import net.shibboleth.shared.service.ServiceException;
import net.shibboleth.shared.service.ServiceableComponent;
@@ -120,10 +123,13 @@ public class ValidateOIDCAuthentication extends AbstractValidationAction {
private Function<ProfileRequestContext, Collection<Principal>> contextToPrivateCredentialsMappingStrategy;
/** Store off profile config. */
- @Nullable private OIDCAuthenticationRelyingPartyProfileConfiguration profileConfiguration;
+ @NonnullBeforeExec private OIDCAuthenticationRelyingPartyProfileConfiguration profileConfiguration;
/** The context with claims pertaining to the end-user of this authentication.*/
- @Nullable private EndUserClaimsContext endUserContext;
+ @NonnullBeforeExec private EndUserClaimsContext endUserContext;
+
+ /** The set of id_token claims before they are processed.*/
+ @NonnullBeforeExec private JWTClaimsSet unprocessedIdTokenClaims;
/** Strategy used to look up the {@link EndUserClaimsContext} to set the parameters for. */
@Nonnull private final Function<ProfileRequestContext, EndUserClaimsContext>
@@ -293,12 +299,13 @@ public class ValidateOIDCAuthentication extends AbstractValidationAction {
ActionSupport.buildEvent(profileRequestContext, EventIds.INVALID_PROFILE_CTX);
return false;
}
- if (endUserContext.getUnprocessedIdTokenClaims() == null) {
+ unprocessedIdTokenClaims = endUserContext.getUnprocessedIdTokenClaims();
+ if (unprocessedIdTokenClaims == null) {
log.error("{} id_token not found in response", getLogPrefix());
ActionSupport.buildEvent(profileRequestContext, EventIds.INVALID_PROFILE_CTX);
return false;
}
- if (endUserContext.getUnprocessedIdTokenClaims().getSubject() == null) {
+ if (unprocessedIdTokenClaims.getSubject() == null) {
log.error("{} id_token did not contain a subject (sub)", getLogPrefix());
ActionSupport.buildEvent(profileRequestContext, EventIds.INVALID_PROFILE_CTX);
return false;
@@ -320,27 +327,30 @@ public class ValidateOIDCAuthentication extends AbstractValidationAction {
processAttributes(profileRequestContext);
}
- if (attributeExtractionStrategy != null) {
+ final var localAttributeExtractionStrategy = attributeExtractionStrategy;
+ if (localAttributeExtractionStrategy != null) {
log.debug("{} Applying custom extraction strategy function", getLogPrefix());
if (attributeContext == null) {
- attributeContext = profileRequestContext
- .getSubcontext(RelyingPartyContext.class)
- .ensureSubcontext(AttributeContext.class);
+ final RelyingPartyContext rpc = profileRequestContext.getSubcontext(RelyingPartyContext.class);
+ assert rpc != null;
+ attributeContext = rpc.ensureSubcontext(AttributeContext.class);
}
- final Collection<IdPAttribute> attributes = new ArrayList<>(attributeContext.getIdPAttributes().values());
- final Collection<IdPAttribute> newAttributes = attributeExtractionStrategy.apply(profileRequestContext);
+ final var localAttributeContext = attributeContext;
+ assert localAttributeContext != null;
+ final Collection<IdPAttribute> attributes = new ArrayList<>(localAttributeContext.getIdPAttributes().values());
+ final Collection<IdPAttribute> newAttributes = localAttributeExtractionStrategy.apply(profileRequestContext);
if (newAttributes != null) {
if (log.isDebugEnabled()) {
log.debug("{} Extracted attributes with custom strategy: {}", getLogPrefix(),
newAttributes.stream().map(IdPAttribute::getId).toList());
}
attributes.addAll(newAttributes);
- attributeContext.setIdPAttributes(attributes);
+ localAttributeContext.setIdPAttributes(attributes);
}
}
-
+
log.info("{} OIDC authentication succeeded for '{}'", getLogPrefix(),
- endUserContext.getUnprocessedIdTokenClaims().getSubject());
+ unprocessedIdTokenClaims.getSubject());
acrTranslator =
profileConfiguration.getAuthenticationContextClassReferenceTranslationStrategy(profileRequestContext);
@@ -349,15 +359,16 @@ public class ValidateOIDCAuthentication extends AbstractValidationAction {
buildAuthenticationResult(profileRequestContext, authenticationContext);
- if (authenticationContext.getAuthenticationResult() != null
- && profileConfiguration.isProxiedAuthnInstant(profileRequestContext)) {
-
+ final AuthenticationResult authnResult = authenticationContext.getAuthenticationResult();
+ if (authnResult != null && profileConfiguration.isProxiedAuthnInstant(profileRequestContext)) {
try {
- if (endUserContext.getUnprocessedIdTokenClaims().getDateClaim("auth_time") != null) {
- final Date authnTimeDate = endUserContext.getUnprocessedIdTokenClaims().getDateClaim("auth_time");
+ final Date authnTimeDate = unprocessedIdTokenClaims.getDateClaim("auth_time");
+ if (authnTimeDate != null) {
log.debug("{} Resetting authentication time to proxied value: {}", getLogPrefix(),
authnTimeDate);
- authenticationContext.getAuthenticationResult().setAuthenticationInstant(authnTimeDate.toInstant());
+ final Instant authnTimeInstant = authnTimeDate.toInstant();
+ assert authnTimeInstant != null;
+ authnResult.setAuthenticationInstant(authnTimeInstant);
} else {
log.debug("{} Unable to reset authentication time, auth_time not present in id_token",
getLogPrefix());
@@ -374,9 +385,10 @@ public class ValidateOIDCAuthentication extends AbstractValidationAction {
@Override
protected Subject populateSubject(@Nonnull final Subject subject) {
- if (acrTranslator != null && endUserContext.getUnprocessedIdTokenClaims().getClaim("acr") != null
- && endUserContext.getUnprocessedIdTokenClaims().getClaim("acr") instanceof String acr) {
- final Collection<Principal> translated = acrTranslator.apply(List.of(acr));
+ final var localAcrTranslator = acrTranslator;
+ if (localAcrTranslator != null && unprocessedIdTokenClaims.getClaim("acr") != null
+ && unprocessedIdTokenClaims.getClaim("acr") instanceof final String acr) {
+ final Collection<Principal> translated = localAcrTranslator.apply(List.of(acr));
if (translated != null && !translated.isEmpty()) {
subject.getPrincipals().addAll(translated);
if (log.isDebugEnabled()) {
@@ -386,11 +398,12 @@ public class ValidateOIDCAuthentication extends AbstractValidationAction {
}
}
- if (amrTranslator != null && endUserContext.getUnprocessedIdTokenClaims().getClaim("amr") != null
- && endUserContext.getUnprocessedIdTokenClaims().getClaim("amr") instanceof Collection) {
+ final var localAmrTranslator = amrTranslator;
+ if (localAmrTranslator != null && unprocessedIdTokenClaims.getClaim("amr") != null
+ && unprocessedIdTokenClaims.getClaim("amr") instanceof Collection) {
try {
- final List<String> amrs = endUserContext.getUnprocessedIdTokenClaims().getStringListClaim("amr");
- final Collection<Principal> translated = amrTranslator.apply(amrs);
+ final List<String> amrs = unprocessedIdTokenClaims.getStringListClaim("amr");
+ final Collection<Principal> translated = localAmrTranslator.apply(amrs);
if (translated != null && !translated.isEmpty()) {
subject.getPrincipals().addAll(translated);
if (log.isDebugEnabled()) {
@@ -403,16 +416,20 @@ public class ValidateOIDCAuthentication extends AbstractValidationAction {
}
}
- // TODO What type of subject? switch on subject_types_supported and subject_type.
- subject.getPrincipals().add(
- new OIDCSubjectIdentifierPrincipal(endUserContext.getUnprocessedIdTokenClaims().getSubject()));
+ // TODO What type of subject? switch on subject_types_supported and subject_type.
+ final String localSubject = unprocessedIdTokenClaims.getSubject();
+ assert localSubject != null;
+ subject.getPrincipals().add(new OIDCSubjectIdentifierPrincipal(localSubject));
subject.getPrincipals().add(buildProxyPrincipal());
- if (attributeContext != null && !attributeContext.getIdPAttributes().isEmpty()) {
+ final Map<String, IdPAttribute> idpAttributes =
+ attributeContext != null ? attributeContext.getIdPAttributes() : null;
+ if (attributeContext != null && idpAttributes != null && !idpAttributes.isEmpty()) {
+ assert attributeContext != null;
log.debug("{} Adding filtered inbound attributes to Subject", getLogPrefix());
subject.getPrincipals().addAll(
- attributeContext.getIdPAttributes().values()
+ idpAttributes.values()
.stream()
.map(IdPAttributePrincipal::new)
.toList());
@@ -442,7 +459,7 @@ public class ValidateOIDCAuthentication extends AbstractValidationAction {
// TODO: Is this useful in the OIDC context. There is no proxy audience I know of in the OIDC or OAuth spec
// like there is in saml?
final ProxyAuthenticationPrincipal proxied = new ProxyAuthenticationPrincipal();
- proxied.getAuthorities().add(endUserContext.getUnprocessedIdTokenClaims().getIssuer());
+ proxied.getAuthorities().add(unprocessedIdTokenClaims.getIssuer());
return proxied;
}
@@ -456,14 +473,16 @@ public class ValidateOIDCAuthentication extends AbstractValidationAction {
log.debug("{} Decoding incoming OIDC claims", getLogPrefix());
final Multimap<String,IdPAttribute> mapped = HashMultimap.create();
+ assert mapped != null;
assert transcoderRegistry!= null;
try (final ServiceableComponent<AttributeTranscoderRegistry> component =
transcoderRegistry.getServiceableComponent()) {
- assert endUserContext.getEndUserClaims() != null;
+ final ClaimsSet endUserClaims = endUserContext.getEndUserClaims();
+ assert endUserClaims != null;
for (final Map.Entry<String, Object> claim :
- endUserContext.getEndUserClaims().toJSONObject().entrySet()) {
+ endUserClaims.toJSONObject().entrySet()) {
try {
final JSONObject jsonClaim = new JSONObject();
jsonClaim.put(claim.getKey(), claim.getValue());
@@ -480,11 +499,12 @@ public class ValidateOIDCAuthentication extends AbstractValidationAction {
log.debug("{} Incoming OIDC Attributes mapped to attribute IDs: {}", getLogPrefix(), mapped.keySet());
if (!mapped.isEmpty()) {
- attributeContext = profileRequestContext
- .getSubcontext(RelyingPartyContext.class)
- .ensureSubcontext(AttributeContext.class);
- attributeContext.setUnfilteredIdPAttributes(mapped.values());
- attributeContext.setIdPAttributes(null);
+ final RelyingPartyContext rpc = profileRequestContext.getSubcontext(RelyingPartyContext.class);
+ assert rpc != null;
+ final var ac = attributeContext = rpc.ensureSubcontext(AttributeContext.class);
+ assert ac != null;
+ ac.setUnfilteredIdPAttributes(mapped.values());
+ ac.setIdPAttributes(null);
filterAttributes(profileRequestContext);
}
}
@@ -509,7 +529,7 @@ public class ValidateOIDCAuthentication extends AbstractValidationAction {
final AttributeFilter filter = component.getComponent();
filter.filterAttributes(filterContext);
filterContext.removeFromParent();
- assert attributeContext!=null;
+ assert attributeContext != null;
attributeContext.setIdPAttributes(filterContext.getFilteredIdPAttributes().values());
} catch (final AttributeFilterException e) {
log.error("{} Error while filtering inbound attributes", getLogPrefix(), e);
@@ -527,8 +547,11 @@ public class ValidateOIDCAuthentication extends AbstractValidationAction {
private void populateFilterContext(@Nonnull final ProfileRequestContext profileRequestContext,
@Nonnull final AttributeFilterContext filterContext) {
+ final AttributeContext ac = attributeContext;
+ assert ac != null;
+
filterContext.setDirection(Direction.INBOUND)
- .setPrefilteredIdPAttributes(attributeContext.getUnfilteredIdPAttributes().values())
+ .setPrefilteredIdPAttributes(ac.getUnfilteredIdPAttributes().values())
.setMetadataResolver(metadataResolver)
.setRequesterMetadataContextLookupStrategy(null)
// TODO OIDC? depends if this is now for upstream?
@@ -536,8 +559,10 @@ public class ValidateOIDCAuthentication extends AbstractValidationAction {
new SAMLMetadataContextLookupFunction().compose(
new RecursiveTypedParentContextLookup<>(ProfileRequestContext.class)))
.setProxiedRequesterContextLookupStrategy(null)
- .setAttributeIssuerID(getResponderLookupStrategy().apply(profileRequestContext))
- .setAttributeRecipientID(getRequesterLookupStrategy().apply(profileRequestContext));
+ .setAttributeIssuerID(Constraint.isNotNull(getResponderLookupStrategy(),
+ "No responder Strategy").apply(profileRequestContext))
+ .setAttributeRecipientID(Constraint.isNotNull(getRequesterLookupStrategy(),
+ "No requester strategy").apply(profileRequestContext));
}
@@ -563,6 +588,7 @@ public class ValidateOIDCAuthentication extends AbstractValidationAction {
}
for (final TranscodingRule rules : transcodingRules) {
+ assert rules != null;
final AttributeTranscoder<JSONObject> transcoder = TranscoderSupport.getTranscoder(rules);
final IdPAttribute decodedAttribute = transcoder.decode(profileRequestContext, input, rules);
if (decodedAttribute != null) {
diff --git a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/ValidateResponseState.java b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/ValidateResponseState.java
index a39c08c..0e3e6ce 100644
--- a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/ValidateResponseState.java
+++ b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/ValidateResponseState.java
@@ -19,11 +19,15 @@ import javax.annotation.Nonnull;
import org.opensaml.profile.action.ActionSupport;
import org.opensaml.profile.context.ProfileRequestContext;
import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
+
+import com.nimbusds.oauth2.sdk.id.State;
+import com.nimbusds.openid.connect.sdk.AuthenticationSuccessResponse;
import net.shibboleth.idp.authn.AuthnEventIds;
import net.shibboleth.idp.authn.context.AuthenticationContext;
+import net.shibboleth.oidc.profile.core.OIDCAuthenticationRequest;
import net.shibboleth.shared.annotation.constraint.NotEmpty;
+import net.shibboleth.shared.primitive.LoggerFactory;
/**
* Authentication action that validates the authentication response state parameter
@@ -46,18 +50,36 @@ public class ValidateResponseState extends AbstractOIDCAuthenticationResponseAct
@Override protected void doExecute(@Nonnull final ProfileRequestContext profileRequestContext,
@Nonnull final AuthenticationContext authenticationContext) {
+ final OIDCAuthenticationRequest authnRequest = getAuthenticationRequest();
+ if (authnRequest == null) {
+ log.error("{} The authentication request does not exist, state can not be checked",
+ getLogPrefix());
+ ActionSupport.buildEvent(profileRequestContext, AuthnEventIds.NO_CREDENTIALS);
+ return;
+ }
+ final AuthenticationSuccessResponse authnResponse = getAuthenticationResponse();
+ if (authnResponse == null) {
+ log.error("{} The authentication response does not exist, state can not be checked",
+ getLogPrefix());
+ ActionSupport.buildEvent(profileRequestContext, AuthnEventIds.NO_CREDENTIALS);
+ return;
+ }
+
log.trace("{} Proxy authentication request state '{}' was returned in the response as '{}'",
- getLogPrefix(),getAuthenticationRequest().getState(),getAuthenticationResponse().getState());
+ getLogPrefix(),authnRequest.getState(),authnResponse.getState());
- if (getAuthenticationRequest().getState() == null || getAuthenticationResponse().getState() == null) {
+ if (authnRequest.getState() == null || authnResponse.getState() == null) {
log.error("{} The state parameter was not present in either the request or response, "
+ "state is mandatory for proxy OIDC requests",getLogPrefix());
ActionSupport.buildEvent(profileRequestContext, AuthnEventIds.NO_CREDENTIALS);
return;
}
- if (!getAuthenticationRequest().getState().equals(getAuthenticationResponse().getState())) {
- log.error("{} Request state did not match response state, has it been tampered with!",
- getLogPrefix());
+ final State authnRequestState = authnRequest.getState();
+ final State authnResponseState = authnResponse.getState();
+ if (authnRequestState == null || authnResponseState == null ||
+ !authnRequestState.equals(authnResponseState)) {
+ log.error("{} Request state '{}' did not match response state '{}', has it been tampered with!",
+ getLogPrefix(), authnRequestState, authnResponseState);
ActionSupport.buildEvent(profileRequestContext, AuthnEventIds.NO_CREDENTIALS);
return;
}
diff --git a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/ValidateTokenClaims.java b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/ValidateTokenClaims.java
index 23dbbe2..15055dd 100644
--- a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/ValidateTokenClaims.java
+++ b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/ValidateTokenClaims.java
@@ -25,7 +25,6 @@ import org.opensaml.profile.action.ActionSupport;
import org.opensaml.profile.action.EventIds;
import org.opensaml.profile.context.ProfileRequestContext;
import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
import com.nimbusds.jwt.JWT;
import com.nimbusds.jwt.JWTClaimsSet;
@@ -38,8 +37,10 @@ import net.shibboleth.oidc.jwt.claims.ClaimsValidator;
import net.shibboleth.oidc.jwt.claims.JWTValidationException;
import net.shibboleth.oidc.profile.core.OidcEventIds;
import net.shibboleth.shared.annotation.constraint.NonnullAfterInit;
+import net.shibboleth.shared.annotation.constraint.NonnullBeforeExec;
import net.shibboleth.shared.component.ComponentInitializationException;
import net.shibboleth.shared.logic.Constraint;
+import net.shibboleth.shared.primitive.LoggerFactory;
/**
* Action that validates the claims of a JWT using the supplied
@@ -63,7 +64,7 @@ public class ValidateTokenClaims extends AbstractAuthenticationAction {
@Nullable private Consumer<ProfileRequestContext> cleanupHook;
/** The parsed claimset. */
- @Nullable private JWTClaimsSet claimsSet;
+ @NonnullBeforeExec private JWTClaimsSet claimsSet;
/** The JWT claims validator used to verify the claimsset.*/
@NonnullAfterInit private ClaimsValidator claimsValidator;
@@ -150,7 +151,7 @@ public class ValidateTokenClaims extends AbstractAuthenticationAction {
log.debug("{} Validating JWT claims for subject '{}'",getLogPrefix(), subject);
try {
- claimsValidator.validate(claimsSet,profileRequestContext);
+ claimsValidator.validate(claimsSet, profileRequestContext);
if (cleanupHook != null) {
cleanupHook.accept(profileRequestContext);
}
diff --git a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/ValidateUserInfoJSONObjectClaims.java b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/ValidateUserInfoJSONObjectClaims.java
index 32c5c94..962e2e7 100644
--- a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/ValidateUserInfoJSONObjectClaims.java
+++ b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/ValidateUserInfoJSONObjectClaims.java
@@ -26,10 +26,10 @@ import org.opensaml.profile.action.EventIds;
import org.opensaml.profile.context.ProfileRequestContext;
import org.opensaml.profile.context.navigate.InboundMessageContextLookup;
import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
import com.nimbusds.common.contenttype.ContentType;
import com.nimbusds.jwt.JWTClaimsSet;
+import com.nimbusds.openid.connect.sdk.OIDCTokenResponse;
import com.nimbusds.openid.connect.sdk.UserInfoResponse;
import com.nimbusds.openid.connect.sdk.UserInfoSuccessResponse;
import com.nimbusds.openid.connect.sdk.claims.ClaimsSet;
@@ -39,7 +39,9 @@ import net.shibboleth.idp.authn.context.AuthenticationContext;
import net.shibboleth.idp.plugin.authn.oidc.rp.context.AccessTokenResponseContext;
import net.shibboleth.idp.plugin.authn.oidc.rp.context.UserInfoResponseContext;
import net.shibboleth.oidc.profile.core.OidcEventIds;
+import net.shibboleth.shared.annotation.constraint.NonnullBeforeExec;
import net.shibboleth.shared.logic.Constraint;
+import net.shibboleth.shared.primitive.LoggerFactory;
/**
* Validate a successful UserInfo JSON Object Response according to section 5.3.2 of OpenID Connect Core 1.0.
@@ -61,10 +63,13 @@ public class ValidateUserInfoJSONObjectClaims extends AbstractAuthenticationActi
@Nonnull private Function<ProfileRequestContext, AccessTokenResponseContext> tokenResponseContextLookupStrategy;
/** The stashed user info response context.*/
- @Nullable private UserInfoResponseContext userInfoCtx;
+ @NonnullBeforeExec private UserInfoResponseContext userInfoCtx;
+
+ /** The stashed user info response.*/
+ @NonnullBeforeExec private UserInfoSuccessResponse userInfo;
/** The stashed id_token claims.*/
- @Nullable private JWTClaimsSet idTokenClaims;
+ @NonnullBeforeExec private JWTClaimsSet idTokenClaims;
/** Constructor.*/
public ValidateUserInfoJSONObjectClaims() {
@@ -107,8 +112,9 @@ public class ValidateUserInfoJSONObjectClaims extends AbstractAuthenticationActi
userInfoCtx =
userInfoResponseContextLookupStrategy.apply(profileRequestContext);
- if (userInfoCtx == null || userInfoCtx.getUserInfo() == null) {
- log.debug("{} No UserInfo response context returned by lookup strategy", getLogPrefix());
+ userInfo = userInfoCtx != null ? userInfoCtx.getUserInfo() : null;
+ if (userInfo == null) {
+ log.debug("{} No UserInfo response returned by lookup strategy", getLogPrefix());
ActionSupport.buildEvent(profileRequestContext, EventIds.INVALID_PROFILE_CTX);
return false;
}
@@ -120,14 +126,14 @@ public class ValidateUserInfoJSONObjectClaims extends AbstractAuthenticationActi
ActionSupport.buildEvent(profileRequestContext, EventIds.INVALID_PROFILE_CTX);
return false;
}
- if (tokenResponseCtx.getTokenResponse() == null ||
- tokenResponseCtx.getTokenResponse().getOIDCTokens().getIDToken() == null) {
+ final OIDCTokenResponse tokenResponse = tokenResponseCtx.getTokenResponse();
+ if (tokenResponse == null || tokenResponse.getOIDCTokens().getIDToken() == null) {
log.debug("{} AccessTokenResponseContext did not contain an id_token", getLogPrefix());
ActionSupport.buildEvent(profileRequestContext, EventIds.INVALID_PROFILE_CTX);
return false;
}
try {
- idTokenClaims = tokenResponseCtx.getTokenResponse().getOIDCTokens().getIDToken().getJWTClaimsSet();
+ idTokenClaims = tokenResponse.getOIDCTokens().getIDToken().getJWTClaimsSet();
if (idTokenClaims == null) {
log.debug("{} AccessTokenResponseContext did not contain an id_token with accessible claims, "
+ "possibly still encrypted",
@@ -138,6 +144,7 @@ public class ValidateUserInfoJSONObjectClaims extends AbstractAuthenticationActi
} catch (final ParseException e) {
log.debug("{} Unable to parse claims from id_token", getLogPrefix());
ActionSupport.buildEvent(profileRequestContext, EventIds.INVALID_PROFILE_CTX);
+ return false;
}
return true;
@@ -148,7 +155,8 @@ public class ValidateUserInfoJSONObjectClaims extends AbstractAuthenticationActi
log.trace("{} Validating UserInfo JSON Object claims", getLogPrefix());
- final ClaimsSet claims = resolveClaimsSet(userInfoCtx.getUserInfo());
+ assert userInfo != null;
+ final ClaimsSet claims = resolveClaimsSet(userInfo);
if (claims == null) {
log.debug("{} UserInfo claims can not be resolved", getLogPrefix());
ActionSupport.buildEvent(profileRequestContext, OidcEventIds.INVALID_USERINFO_CLAIMS);
diff --git a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/impl/AbstractOIDCAuthenticationRequestActionMessageHandler.java b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/impl/AbstractOIDCAuthenticationRequestActionMessageHandler.java
index 8ed6641..2b3b3e3 100644
--- a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/impl/AbstractOIDCAuthenticationRequestActionMessageHandler.java
+++ b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/impl/AbstractOIDCAuthenticationRequestActionMessageHandler.java
@@ -27,7 +27,6 @@ import org.opensaml.messaging.handler.MessageHandlerException;
import org.opensaml.profile.context.ProfileRequestContext;
import org.opensaml.profile.context.navigate.ParentProfileRequestContextLookup;
import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
import com.google.common.base.Predicates;
import com.nimbusds.openid.connect.sdk.op.OIDCProviderMetadata;
@@ -39,7 +38,9 @@ import net.shibboleth.oidc.profile.config.OIDCAuthenticationRelyingPartyProfileC
import net.shibboleth.oidc.profile.core.OIDCAuthenticationRequest;
import net.shibboleth.oidc.profile.messaging.context.OIDCPeerEntityContext;
import net.shibboleth.profile.context.RelyingPartyContext;
+import net.shibboleth.shared.annotation.constraint.NonnullBeforeExec;
import net.shibboleth.shared.logic.Constraint;
+import net.shibboleth.shared.primitive.LoggerFactory;
import net.shibboleth.shared.primitive.NonnullSupplier;
/**
@@ -66,13 +67,13 @@ public abstract class AbstractOIDCAuthenticationRequestActionMessageHandler exte
@Nonnull private Function<ProfileRequestContext,RelyingPartyContext> relyingPartyContextLookupStrategy;
/** OIDC authentication request built by the IdP. */
- @Nullable private OIDCAuthenticationRequest authnRequest;
+ @NonnullBeforeExec private OIDCAuthenticationRequest authnRequest;
/** OpenID Provider metadata .*/
- @Nullable private OIDCProviderMetadata providerMetadata;
+ @NonnullBeforeExec private OIDCProviderMetadata providerMetadata;
/** Applicable profile configuration. */
- @Nullable private OIDCAuthenticationRelyingPartyProfileConfiguration profileConfiguration;
+ @NonnullBeforeExec private OIDCAuthenticationRelyingPartyProfileConfiguration profileConfiguration;
/** Current HTTP request, if available. */
@Nullable private NonnullSupplier<HttpServletRequest> httpServletRequestSupplier;
@@ -102,10 +103,10 @@ public abstract class AbstractOIDCAuthenticationRequestActionMessageHandler exte
* @return the HTTP servlet request supplier
*/
@Nullable public HttpServletRequest getHttpServletRequest() {
- if (httpServletRequestSupplier == null) {
- return null;
- }
- return httpServletRequestSupplier.get();
+ if (httpServletRequestSupplier != null) {
+ return httpServletRequestSupplier.get();
+ }
+ return null;
}
/**
@@ -123,7 +124,7 @@ public abstract class AbstractOIDCAuthenticationRequestActionMessageHandler exte
*
* @return the authentication request.
*/
- @Nullable protected OIDCAuthenticationRequest getAuthenticationRequest() {
+ @NonnullBeforeExec protected OIDCAuthenticationRequest getAuthenticationRequest() {
return authnRequest;
}
@@ -133,7 +134,8 @@ public abstract class AbstractOIDCAuthenticationRequestActionMessageHandler exte
*
* @return the profile configuration
*/
- @Nullable protected OIDCAuthenticationRelyingPartyProfileConfiguration getProfileConfiguration() {
+ @NonnullBeforeExec
+ protected OIDCAuthenticationRelyingPartyProfileConfiguration getProfileConfiguration() {
return profileConfiguration;
}
@@ -144,7 +146,7 @@ public abstract class AbstractOIDCAuthenticationRequestActionMessageHandler exte
*
* @return The provider metadata context.
*/
- @Nullable protected OIDCProviderMetadata getProviderMetadata() {
+ @NonnullBeforeExec protected OIDCProviderMetadata getProviderMetadata() {
return providerMetadata;
}
@@ -235,9 +237,11 @@ public abstract class AbstractOIDCAuthenticationRequestActionMessageHandler exte
if (providerMetadata == null) {
throw new MessageHandlerException("No provider metadata context found for peer");
}
- final RelyingPartyContext rpCtx = adapt(relyingPartyContextLookupStrategy).apply(messageContext);
+ final var adaptedFunction = adapt(relyingPartyContextLookupStrategy);
+ assert adaptedFunction != null;
+ final RelyingPartyContext rpCtx = adaptedFunction.apply(messageContext);
if (rpCtx != null && rpCtx.getConfiguration() != null &&
- rpCtx.getProfileConfig() instanceof OIDCAuthenticationRelyingPartyProfileConfiguration rpConfig) {
+ rpCtx.getProfileConfig() instanceof final OIDCAuthenticationRelyingPartyProfileConfiguration rpConfig) {
profileConfiguration = rpConfig;
}
if (profileConfiguration == null) {
diff --git a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/impl/AbstractOIDCAuthenticationRequestMessageHandler.java b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/impl/AbstractOIDCAuthenticationRequestMessageHandler.java
index 54a5988..54db396 100644
--- a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/impl/AbstractOIDCAuthenticationRequestMessageHandler.java
+++ b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/impl/AbstractOIDCAuthenticationRequestMessageHandler.java
@@ -17,19 +17,19 @@ package net.shibboleth.idp.plugin.authn.oidc.rp.messaging.impl;
import java.util.function.Function;
import javax.annotation.Nonnull;
-import javax.annotation.Nullable;
import org.opensaml.messaging.context.MessageContext;
import org.opensaml.messaging.context.navigate.ChildContextLookup;
import org.opensaml.messaging.handler.AbstractMessageHandler;
import org.opensaml.messaging.handler.MessageHandlerException;
import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
import net.shibboleth.idp.plugin.authn.oidc.rp.context.OutboundMessageHandlerContext;
import net.shibboleth.idp.profile.impl.WebFlowMessageHandlerAdaptor;
import net.shibboleth.oidc.profile.core.OIDCAuthenticationRequest;
+import net.shibboleth.shared.annotation.constraint.NonnullBeforeExec;
import net.shibboleth.shared.logic.Constraint;
+import net.shibboleth.shared.primitive.LoggerFactory;
/**
* An abstract message handler that does *not* run inside an {@link WebFlowMessageHandlerAdaptor}. Makes available the
@@ -48,17 +48,17 @@ public abstract class AbstractOIDCAuthenticationRequestMessageHandler extends Ab
@Nonnull private Function<MessageContext, OIDCAuthenticationRequest> authenticationRequestLookupStrategy;
/** The stashed {@link OutboundMessageHandlerContext}.*/
- @Nullable private OutboundMessageHandlerContext outboundMessageContext;
+ @NonnullBeforeExec private OutboundMessageHandlerContext outboundMessageContext;
/** The stashed {@link OIDCAuthenticationRequest}.*/
- @Nullable private OIDCAuthenticationRequest authnRequest;
+ @NonnullBeforeExec private OIDCAuthenticationRequest authnRequest;
/** Constructor.*/
protected AbstractOIDCAuthenticationRequestMessageHandler() {
outboundMessageHandlerContextLookupStrategy = new ChildContextLookup<>(OutboundMessageHandlerContext.class);
authenticationRequestLookupStrategy = mc -> {
- if (mc.getMessage() instanceof OIDCAuthenticationRequest request) {
+ if (mc.getMessage() instanceof final OIDCAuthenticationRequest request) {
return request;
}
return null;
@@ -71,7 +71,7 @@ public abstract class AbstractOIDCAuthenticationRequestMessageHandler extends Ab
*
* @return the outbound message context.
*/
- @Nullable protected OutboundMessageHandlerContext getOutboundMessageContext() {
+ @NonnullBeforeExec protected OutboundMessageHandlerContext getOutboundMessageContext() {
return outboundMessageContext;
}
@@ -80,7 +80,7 @@ public abstract class AbstractOIDCAuthenticationRequestMessageHandler extends Ab
*
* @return the authentication request
*/
- @Nullable protected OIDCAuthenticationRequest getAuthenticationRequest() {
+ @NonnullBeforeExec protected OIDCAuthenticationRequest getAuthenticationRequest() {
return authnRequest;
}
diff --git a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/impl/AddAuthenticationContextClassReferencesHandler.java b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/impl/AddAuthenticationContextClassReferencesHandler.java
index f0a99dc..d8c1645 100644
--- a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/impl/AddAuthenticationContextClassReferencesHandler.java
+++ b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/impl/AddAuthenticationContextClassReferencesHandler.java
@@ -24,12 +24,12 @@ import org.opensaml.messaging.context.MessageContext;
import org.opensaml.messaging.handler.MessageHandlerException;
import org.opensaml.profile.context.ProfileRequestContext;
import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
import com.nimbusds.openid.connect.sdk.claims.ACR;
import net.shibboleth.oidc.authn.principal.AuthenticationContextClassReferencePrincipal;
import net.shibboleth.oidc.profile.config.navigate.ProxyAwareDefaultOIDCAuthenticationContextClassRequestLookupFunction;
+import net.shibboleth.shared.primitive.LoggerFactory;
/**
* A message handler that adds any authentication context class references from the those derived from the
diff --git a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/impl/AddEndpointURIHandler.java b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/impl/AddEndpointURIHandler.java
index 630fd1f..44301f2 100644
--- a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/impl/AddEndpointURIHandler.java
+++ b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/impl/AddEndpointURIHandler.java
@@ -14,17 +14,21 @@
package net.shibboleth.idp.plugin.authn.oidc.rp.messaging.impl;
+import java.net.URI;
+
import javax.annotation.Nonnull;
import org.opensaml.messaging.context.MessageContext;
import org.opensaml.messaging.handler.MessageHandlerException;
import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
+
+import net.shibboleth.shared.primitive.LoggerFactory;
+
/**
* A message handler that adds the authorization endpoint URI from the providers metadata
* to the under constructions authentication request. If an authorization endpoint does
- * not exist, an error event is returned.
+ * not exist, an exception is thrown.
*/
public class AddEndpointURIHandler extends AbstractOIDCAuthenticationRequestActionMessageHandler {
@@ -34,11 +38,12 @@ public class AddEndpointURIHandler extends AbstractOIDCAuthenticationRequestActi
@Override protected void doInvoke(@Nonnull final MessageContext messageContext)
throws MessageHandlerException {
- if (getProviderMetadata().getAuthorizationEndpointURI() == null) {
+ final URI authzEndpoint = getProviderMetadata().getAuthorizationEndpointURI();
+ if (authzEndpoint == null) {
throw new MessageHandlerException("OAuth 2.0 Authorization Endpoint URI not found in provider metadata");
}
- getAuthenticationRequest().setEndpointURI(getProviderMetadata().getAuthorizationEndpointURI());
+ getAuthenticationRequest().setEndpointURI(authzEndpoint);
log.trace("{} Added authorization endpoint '{}' to authentication request",getLogPrefix(),
getAuthenticationRequest().getEndpointURI());
}
diff --git a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/impl/AddForceAuthenticationHandler.java b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/impl/AddForceAuthenticationHandler.java
index eda2861..1f7243d 100644
--- a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/impl/AddForceAuthenticationHandler.java
+++ b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/impl/AddForceAuthenticationHandler.java
@@ -21,11 +21,12 @@ import javax.annotation.Nonnull;
import org.opensaml.messaging.context.MessageContext;
import org.opensaml.messaging.handler.MessageHandlerException;
import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
import com.nimbusds.oauth2.sdk.ParseException;
import com.nimbusds.openid.connect.sdk.Prompt;
+import net.shibboleth.shared.primitive.LoggerFactory;
+
/**
* An action that sets the 'prompt' parameter to 'login' and max_age to 0 seconds, iff force authn was requested by the
* upstream SP (or is overridden in the profile config).
diff --git a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/impl/AddLoginHintHandler.java b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/impl/AddLoginHintHandler.java
index 77e22a5..a6f0b04 100644
--- a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/impl/AddLoginHintHandler.java
+++ b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/impl/AddLoginHintHandler.java
@@ -19,7 +19,9 @@ import javax.annotation.Nonnull;
import org.opensaml.messaging.context.MessageContext;
import org.opensaml.messaging.handler.MessageHandlerException;
import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
+
+import net.shibboleth.shared.primitive.LoggerFactory;
+
/** Message handler that adds the login_hint parameter based on any defined in the profile configuration.*/
public class AddLoginHintHandler extends AbstractOIDCAuthenticationRequestActionMessageHandler {
diff --git a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/impl/AddMaxAgeHandler.java b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/impl/AddMaxAgeHandler.java
index 1e48b0f..ea57cf5 100644
--- a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/impl/AddMaxAgeHandler.java
+++ b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/impl/AddMaxAgeHandler.java
@@ -21,7 +21,9 @@ import javax.annotation.Nonnull;
import org.opensaml.messaging.context.MessageContext;
import org.opensaml.messaging.handler.MessageHandlerException;
import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
+
+import net.shibboleth.shared.primitive.LoggerFactory;
+
/** Message handler that adds the max_age parameter based on any defined in the profile configuration.*/
public class AddMaxAgeHandler extends AbstractOIDCAuthenticationRequestActionMessageHandler {
diff --git a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/impl/AddNonceHandler.java b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/impl/AddNonceHandler.java
index 849c488..1f4c4d2 100644
--- a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/impl/AddNonceHandler.java
+++ b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/impl/AddNonceHandler.java
@@ -22,12 +22,12 @@ import org.opensaml.messaging.context.MessageContext;
import org.opensaml.messaging.handler.MessageHandlerException;
import org.opensaml.profile.context.ProfileRequestContext;
import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
import com.nimbusds.openid.connect.sdk.Nonce;
import net.shibboleth.idp.plugin.authn.oidc.rp.impl.OIDCProxySupport;
import net.shibboleth.shared.logic.Constraint;
+import net.shibboleth.shared.primitive.LoggerFactory;
/**
* A message handler that adds a nonce from a lookup strategy to the authentication request.
diff --git a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/impl/AddPassiveAuthenticationHandler.java b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/impl/AddPassiveAuthenticationHandler.java
index dc93323..0e5f4f2 100644
--- a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/impl/AddPassiveAuthenticationHandler.java
+++ b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/impl/AddPassiveAuthenticationHandler.java
@@ -20,12 +20,12 @@ import org.opensaml.messaging.context.MessageContext;
import org.opensaml.messaging.handler.MessageHandlerException;
import org.opensaml.profile.context.ProfileRequestContext;
import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
import com.nimbusds.oauth2.sdk.ParseException;
import com.nimbusds.openid.connect.sdk.Prompt;
import net.shibboleth.idp.authn.context.AuthenticationContext;
+import net.shibboleth.shared.primitive.LoggerFactory;
/**
* A message handler that sets the 'prompt' parameter to 'none' if passive authentication has been requested by the
@@ -41,7 +41,7 @@ public class AddPassiveAuthenticationHandler extends AbstractOIDCAuthenticationR
final ProfileRequestContext prc = lookupProfileRequestContext(messageContext);
boolean isPassive = false;
- if (prc != null && prc.getParent() instanceof AuthenticationContext authnContext) {
+ if (prc != null && prc.getParent() instanceof final AuthenticationContext authnContext) {
isPassive = authnContext.isPassive();
}
if (isPassive) {
diff --git a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/impl/AddRedirectURIHandler.java b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/impl/AddRedirectURIHandler.java
index 121b38f..abe2d7f 100644
--- a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/impl/AddRedirectURIHandler.java
+++ b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/impl/AddRedirectURIHandler.java
@@ -24,12 +24,12 @@ import org.opensaml.messaging.context.MessageContext;
import org.opensaml.messaging.handler.MessageHandlerException;
import org.opensaml.profile.context.ProfileRequestContext;
import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
import jakarta.servlet.http.HttpServletRequest;
import net.shibboleth.shared.annotation.constraint.NonnullAfterInit;
import net.shibboleth.shared.component.ComponentInitializationException;
import net.shibboleth.shared.logic.Constraint;
+import net.shibboleth.shared.primitive.LoggerFactory;
/**
* A message handler that adds a redirect_uri to the authentication request.
diff --git a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/impl/AddRequestedClaimsHandler.java b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/impl/AddRequestedClaimsHandler.java
index 02b9feb..09dade3 100644
--- a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/impl/AddRequestedClaimsHandler.java
+++ b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/impl/AddRequestedClaimsHandler.java
@@ -23,11 +23,11 @@ import org.opensaml.messaging.context.MessageContext;
import org.opensaml.messaging.handler.MessageHandlerException;
import org.opensaml.profile.context.ProfileRequestContext;
import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
import com.nimbusds.openid.connect.sdk.OIDCClaimsRequest;
import net.shibboleth.shared.logic.FunctionSupport;
+import net.shibboleth.shared.primitive.LoggerFactory;
diff --git a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/impl/AddResponseTypeAndModeHandler.java b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/impl/AddResponseTypeAndModeHandler.java
index df7914f..02e1694 100644
--- a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/impl/AddResponseTypeAndModeHandler.java
+++ b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/impl/AddResponseTypeAndModeHandler.java
@@ -23,11 +23,12 @@ import javax.annotation.Nullable;
import org.opensaml.messaging.context.MessageContext;
import org.opensaml.messaging.handler.MessageHandlerException;
import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
import com.nimbusds.oauth2.sdk.ResponseMode;
import com.nimbusds.oauth2.sdk.ResponseType;
+import net.shibboleth.shared.primitive.LoggerFactory;
+
/**
* Action that populates the authentication request response_mode and response_type from various strategies,
* by default from the profile configuration.
@@ -36,9 +37,6 @@ import com.nimbusds.oauth2.sdk.ResponseType;
*/
public class AddResponseTypeAndModeHandler extends AbstractOIDCAuthenticationRequestActionMessageHandler {
- /** The Default response type if none is selected.*/
- @Nonnull private static final ResponseType DEFAULT_RESPONSE_TYPE = ResponseType.CODE;
-
/** Class logger. */
@Nonnull private final Logger log = LoggerFactory.getLogger(AddResponseTypeAndModeHandler.class);
@@ -60,6 +58,10 @@ public class AddResponseTypeAndModeHandler extends AbstractOIDCAuthenticationReq
final ResponseMode responseModeOverride = parseResponseMode(responseModeFromProfile);
final ResponseMode compatibleMode = ResponseMode.resolve(null, responseType);
+ if (compatibleMode == null) {
+ throw new MessageHandlerException("A compatible response_mode for response_type "
+ + "'"+responseType+"' could not be found");
+ }
checkProviderSupportsResponseMode(compatibleMode);
diff --git a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/impl/AddScopesHandler.java b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/impl/AddScopesHandler.java
index 505a463..cdc3fd9 100644
--- a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/impl/AddScopesHandler.java
+++ b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/impl/AddScopesHandler.java
@@ -21,7 +21,9 @@ import javax.annotation.Nonnull;
import org.opensaml.messaging.context.MessageContext;
import org.opensaml.messaging.handler.MessageHandlerException;
import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
+
+import net.shibboleth.shared.primitive.LoggerFactory;
+
/**
* A message handler that adds the scopes from the profile request object to the authentication request.
diff --git a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/impl/AddStateHandler.java b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/impl/AddStateHandler.java
index 6e96eb5..cffc38d 100644
--- a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/impl/AddStateHandler.java
+++ b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/impl/AddStateHandler.java
@@ -22,13 +22,12 @@ import javax.annotation.Nullable;
import org.opensaml.messaging.context.MessageContext;
import org.opensaml.messaging.handler.MessageHandlerException;
import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
import com.nimbusds.oauth2.sdk.id.State;
import com.nimbusds.openid.connect.sdk.claims.ClaimsSet;
import net.shibboleth.idp.plugin.authn.oidc.rp.impl.OIDCProxySupport;
-import net.shibboleth.shared.component.ComponentInitializationException;
+import net.shibboleth.shared.primitive.LoggerFactory;
/**
* Add state to the authentication request URL and the request object claims (if present).
@@ -51,8 +50,12 @@ public class AddStateHandler extends AbstractOIDCAuthenticationRequestMessageHan
// By default, generate state from the SWF key and a 32 character nonce.
stateGenerationStrategy = msg -> {
if (getOutboundMessageContext() != null) {
- return OIDCProxySupport.generateState(OIDCProxySupport.generateNonce(32),
- getOutboundMessageContext().getWebflowKey());
+ final String swfKey = getOutboundMessageContext().getWebflowKey();
+ if (swfKey != null) {
+ return OIDCProxySupport.generateState(OIDCProxySupport.generateNonce(32), swfKey);
+ } else {
+ return null;
+ }
}
return null;
};
@@ -72,15 +75,6 @@ public class AddStateHandler extends AbstractOIDCAuthenticationRequestMessageHan
}
}
-
- @Override
- protected void doInitialize() throws ComponentInitializationException {
- super.doInitialize();
-
- if (stateGenerationStrategy == null) {
- throw new ComponentInitializationException("redirectUriCreationStrategy cannot be null");
- }
- }
/** {@inheritDoc} */
@Override
@@ -97,8 +91,8 @@ public class AddStateHandler extends AbstractOIDCAuthenticationRequestMessageHan
getAuthenticationRequest().setState(state);
// Add to Request Object if exists
- if (getAuthenticationRequest().getRequestObjectClaimsSet() != null) {
- final ClaimsSet claims = getAuthenticationRequest().getRequestObjectClaimsSet();
+ final ClaimsSet claims = getAuthenticationRequest().getRequestObjectClaimsSet();
+ if (claims != null) {
log.trace("{} Adding state to JWT RequestObject", getLogPrefix());
claims.setClaim(STATE_CLAIM, state);
}
diff --git a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/impl/BuildPlainRequestObjectJWT.java b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/impl/BuildPlainRequestObjectJWT.java
index 9732709..3563ed6 100644
--- a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/impl/BuildPlainRequestObjectJWT.java
+++ b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/impl/BuildPlainRequestObjectJWT.java
@@ -19,12 +19,13 @@ import javax.annotation.Nonnull;
import org.opensaml.messaging.context.MessageContext;
import org.opensaml.messaging.handler.MessageHandlerException;
import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
import com.nimbusds.jwt.PlainJWT;
import com.nimbusds.oauth2.sdk.ParseException;
import com.nimbusds.openid.connect.sdk.claims.ClaimsSet;
+import net.shibboleth.shared.primitive.LoggerFactory;
+
/**
* If the Request Object claims are present in the authentication request, convert them
* into a JWTClaimsSet inside a PlainJWT.
diff --git a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/impl/SetAuthenticationRequestTimeHandler.java b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/impl/SetAuthenticationRequestTimeHandler.java
index a5ed03f..13626bf 100644
--- a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/impl/SetAuthenticationRequestTimeHandler.java
+++ b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/impl/SetAuthenticationRequestTimeHandler.java
@@ -21,7 +21,9 @@ import javax.annotation.Nonnull;
import org.opensaml.messaging.context.MessageContext;
import org.opensaml.messaging.handler.MessageHandlerException;
import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
+
+import net.shibboleth.shared.primitive.LoggerFactory;
+
/** Handler that adds the authentication request time to the authentication request.*/
public class SetAuthenticationRequestTimeHandler extends AbstractOIDCAuthenticationRequestMessageHandler {
diff --git a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/metadata/impl/OIDCProviderMetadataLookupHandler.java b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/metadata/impl/OIDCProviderMetadataLookupHandler.java
index 9d5f308..fd0ebd2 100644
--- a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/metadata/impl/OIDCProviderMetadataLookupHandler.java
+++ b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/metadata/impl/OIDCProviderMetadataLookupHandler.java
@@ -12,7 +12,6 @@
* limitations under the License.
*/
-
package net.shibboleth.idp.plugin.authn.oidc.rp.metadata.impl;
import java.util.Objects;
@@ -27,7 +26,6 @@ import org.opensaml.messaging.handler.AbstractMessageHandler;
import org.opensaml.messaging.handler.MessageHandlerException;
import org.opensaml.saml.common.messaging.context.SAMLMetadataContext;
import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
import com.nimbusds.oauth2.sdk.id.Issuer;
import com.nimbusds.openid.connect.sdk.op.OIDCProviderMetadata;
@@ -41,6 +39,7 @@ import net.shibboleth.oidc.profile.messaging.context.OIDCPeerEntityContext;
import net.shibboleth.shared.annotation.constraint.NonnullAfterInit;
import net.shibboleth.shared.component.ComponentInitializationException;
import net.shibboleth.shared.logic.Constraint;
+import net.shibboleth.shared.primitive.LoggerFactory;
import net.shibboleth.shared.resolver.CriteriaSet;
import net.shibboleth.shared.resolver.ResolverException;
@@ -125,15 +124,14 @@ public class OIDCProviderMetadataLookupHandler extends AbstractMessageHandler {
ifNotInitializedThrowUninitializedComponentException();
final AbstractOIDCEntityContext entityCtx = contextClassLookupStrategy.apply(messageContext);
-
- if (entityCtx == null || entityCtx.getIdentifier() == null) {
+ final String id = entityCtx != null ? entityCtx.getIdentifier() : null;
+ if (entityCtx == null || id == null) {
log.debug("{} OIDC entity context class '{}' missing or did not contain an issuer identifier",
getLogPrefix(), AbstractOIDCEntityContext.class);
return;
}
- final OIDCProviderMetadataContext existingMetadataCtx = resolveExisting(messageContext,
- entityCtx.getIdentifier());
+ final OIDCProviderMetadataContext existingMetadataCtx = resolveExisting(messageContext,id);
if (existingMetadataCtx != null) {
log.debug("{} Resolved existing provider metadata context, removing existing "
+ "and re-using it", getLogPrefix());
@@ -180,12 +178,13 @@ public class OIDCProviderMetadataLookupHandler extends AbstractMessageHandler {
if (copyContextStrategy == null) {
return null;
}
-
+ assert copyContextStrategy != null;
final OIDCProviderMetadataContext existing = copyContextStrategy.apply(messageContext);
if (existing != null) {
- if (existing.getProviderInformation() != null) {
+ final OIDCProviderMetadata providerInformation = existing.getProviderInformation();
+ if (providerInformation != null) {
// Validate that existing data has the same issuer
- if (Objects.equals(existing.getProviderInformation().getIssuer().getValue(), issuer)) {
+ if (Objects.equals(providerInformation.getIssuer().getValue(), issuer)) {
log.debug("{} Found an existing and suitable OIDCProviderMetadataContext from which to copy ",
getLogPrefix());
final OIDCProviderMetadataContext copy = new OIDCProviderMetadataContext();
diff --git a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/security/impl/AuthenticationRequestNonceClaimLookupStrategy.java b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/security/impl/AuthenticationRequestNonceClaimLookupStrategy.java
index 1d02fe7..0eef8ca 100644
--- a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/security/impl/AuthenticationRequestNonceClaimLookupStrategy.java
+++ b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/security/impl/AuthenticationRequestNonceClaimLookupStrategy.java
@@ -25,6 +25,7 @@ import org.opensaml.messaging.context.MessageContext;
import org.opensaml.profile.context.ProfileRequestContext;
import com.nimbusds.jwt.JWTClaimsSet;
+import com.nimbusds.openid.connect.sdk.Nonce;
import net.shibboleth.oidc.profile.core.OIDCAuthenticationRequest;
import net.shibboleth.shared.logic.Constraint;
@@ -57,21 +58,22 @@ public final class AuthenticationRequestNonceClaimLookupStrategy
authenticationRequestLookupStrategy = prc -> {
final MessageContext messageContext = prc.getOutboundMessageContext();
if (messageContext != null &&
- messageContext.getMessage() instanceof OIDCAuthenticationRequest authnRequest) {
+ messageContext.getMessage() instanceof final OIDCAuthenticationRequest authnRequest) {
return authnRequest;
}
return null;
};
}
- @Override @Nullable public String apply(@Nonnull final ProfileRequestContext context,
- @Nonnull final JWTClaimsSet cliams) {
+ @Override @Nullable public String apply(@Nullable final ProfileRequestContext context,
+ @Nullable final JWTClaimsSet claims) {
final OIDCAuthenticationRequest request = authenticationRequestLookupStrategy.apply(context);
- if (request == null) {
+ final Nonce nonce = request != null ? request.getNonce() : null;
+ if (nonce == null) {
return null;
}
- return request.getNonce().getValue();
+ return nonce.getValue();
}
}
diff --git a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/security/impl/ClientAuthenticationConfigurationLookupFunction.java b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/security/impl/ClientAuthenticationConfigurationLookupFunction.java
index e47e3ed..da6e5ce 100644
--- a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/security/impl/ClientAuthenticationConfigurationLookupFunction.java
+++ b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/security/impl/ClientAuthenticationConfigurationLookupFunction.java
@@ -32,7 +32,6 @@ import org.opensaml.profile.context.ProfileRequestContext;
import org.opensaml.profile.context.navigate.ParentProfileRequestContextLookup;
import org.opensaml.security.config.SecurityConfiguration;
import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
import com.nimbusds.jose.Algorithm;
import com.nimbusds.jose.JWSAlgorithm;
@@ -44,11 +43,13 @@ import net.shibboleth.oidc.security.jose.SignatureSigningConfiguration;
import net.shibboleth.oidc.security.jose.impl.BasicSignatureSigningConfiguration;
import net.shibboleth.profile.config.ProfileConfiguration;
import net.shibboleth.profile.context.RelyingPartyContext;
-import net.shibboleth.profile.relyingparty.RelyingPartyConfigurationResolver;
+import net.shibboleth.profile.relyingparty.RelyingPartyConfiguration;
import net.shibboleth.shared.annotation.constraint.NonnullElements;
import net.shibboleth.shared.annotation.constraint.NotLive;
import net.shibboleth.shared.annotation.constraint.Unmodifiable;
+import net.shibboleth.shared.collection.CollectionSupport;
import net.shibboleth.shared.logic.Constraint;
+import net.shibboleth.shared.primitive.LoggerFactory;
/**
* A function that returns a {@link SignatureSigningConfiguration} list for signing client authentication JWTs.
@@ -73,24 +74,12 @@ public class ClientAuthenticationConfigurationLookupFunction
*/
@Nonnull private Function<ProfileRequestContext, RelyingPartyContext> relyingPartyContextLookupStrategy;
- /** A resolver for default security configurations. */
- @Nullable private RelyingPartyConfigurationResolver rpResolver;
/** Constructor. */
public ClientAuthenticationConfigurationLookupFunction() {
relyingPartyContextLookupStrategy = new ChildContextLookup<>(RelyingPartyContext.class);
}
- /**
- * Set the resolver for default security configurations.
- *
- * @param resolver
- * the resolver to use
- */
- public void setRelyingPartyConfigurationResolver(@Nullable final RelyingPartyConfigurationResolver resolver) {
- rpResolver = resolver;
- }
-
/**
* Set the strategy used to locate the {@link RelyingPartyContext} associated
* with a given {@link ProfileRequestContext}.
@@ -114,18 +103,18 @@ public class ClientAuthenticationConfigurationLookupFunction
if (rpc != null) {
final ProfileConfiguration pc = rpc.getProfileConfig();
- if (pc != null && pc.getSecurityConfiguration(PRC_LOOKUP.apply(input)) instanceof JSONSecurityConfiguration jsonSecConfig
+ if (pc != null && pc.getSecurityConfiguration(PRC_LOOKUP.apply(input)) instanceof final JSONSecurityConfiguration jsonSecConfig
&& jsonSecConfig.getJwtSignatureSigningConfiguration() != null) {
- configs.add(((JSONSecurityConfiguration) pc.getSecurityConfiguration(PRC_LOOKUP.apply(input)))
- .getJwtSignatureSigningConfiguration());
+ configs.add(jsonSecConfig.getJwtSignatureSigningConfiguration());
}
- if (pc instanceof OIDCAuthenticationRelyingPartyProfileConfiguration oidcRpConfig) {
+ if (pc instanceof final OIDCAuthenticationRelyingPartyProfileConfiguration oidcRpConfig) {
tokenEndpointAuthMethod = oidcRpConfig.getTokenEndpointAuthMethod(PRC_LOOKUP.apply(input));
}
// Check for a per-profile default (relying party independent) config.
- if (rpc.getConfiguration() != null) {
- final SecurityConfiguration defaultConfig = rpc.getConfiguration().getSecurityConfiguration(PRC_LOOKUP.apply(input));
- if (defaultConfig instanceof JSONSecurityConfiguration jsonSecConfig
+ final RelyingPartyConfiguration rpConfig = rpc.getConfiguration();
+ if (rpConfig != null) {
+ final SecurityConfiguration defaultConfig = rpConfig.getSecurityConfiguration(PRC_LOOKUP.apply(input));
+ if (defaultConfig instanceof final JSONSecurityConfiguration jsonSecConfig
&& jsonSecConfig.getJwtSignatureSigningConfiguration() != null) {
configs.add(jsonSecConfig.getJwtSignatureSigningConfiguration());
}
@@ -134,7 +123,7 @@ public class ClientAuthenticationConfigurationLookupFunction
if (tokenEndpointAuthMethod == null) {
log.trace("Token endpoint client authentication method can not be found");
- return Collections.emptyList();
+ return CollectionSupport.emptyList();
}
final ClientAuthenticationMethod method = new ClientAuthenticationMethod(tokenEndpointAuthMethod);
@@ -170,7 +159,7 @@ public class ClientAuthenticationConfigurationLookupFunction
@Nonnull final JWSAlgorithm.Family algFamily, @Nullable final List<String> algorithms) {
if (algorithms == null) {
- return Collections.emptyList();
+ return CollectionSupport.emptyList();
}
final List<String> filtered = algorithms.stream()
diff --git a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/security/impl/NonceValidationActivationCondition.java b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/security/impl/NonceValidationActivationCondition.java
index fa59539..b5ec436 100644
--- a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/security/impl/NonceValidationActivationCondition.java
+++ b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/security/impl/NonceValidationActivationCondition.java
@@ -18,6 +18,7 @@ import java.util.function.BiPredicate;
import java.util.function.Function;
import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
import javax.annotation.concurrent.ThreadSafe;
import org.opensaml.messaging.context.MessageContext;
@@ -57,7 +58,7 @@ public class NonceValidationActivationCondition implements BiPredicate<ProfileRe
authenticationRequestLookupStrategy = prc -> {
final MessageContext messageContext = prc.getOutboundMessageContext();
if (messageContext != null &&
- messageContext.getMessage() instanceof OIDCAuthenticationRequest request) {
+ messageContext.getMessage() instanceof final OIDCAuthenticationRequest request) {
return request;
}
return null;
@@ -65,7 +66,7 @@ public class NonceValidationActivationCondition implements BiPredicate<ProfileRe
}
@Override
- public boolean test(@Nonnull final ProfileRequestContext context, @Nonnull final JWTClaimsSet claims) {
+ public boolean test(@Nullable final ProfileRequestContext context, @Nullable final JWTClaimsSet claims) {
final OIDCAuthenticationRequest request = authenticationRequestLookupStrategy.apply(context);
if (request == null) {
diff --git a/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/decoding/impl/DefaultAccessTokenResponseDecoderTest.java b/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/decoding/impl/DefaultAccessTokenResponseDecoderTest.java
index e8a5972..26f16fd 100644
--- a/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/decoding/impl/DefaultAccessTokenResponseDecoderTest.java
+++ b/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/decoding/impl/DefaultAccessTokenResponseDecoderTest.java
@@ -54,6 +54,7 @@ public class DefaultAccessTokenResponseDecoderTest extends AbstractOIDCTest {
}
+ @SuppressWarnings("null")
@Test
public void testEncoder_Success() throws ComponentInitializationException, UnsupportedOperationException, IOException {
decoder.initialize();
@@ -82,6 +83,7 @@ public class DefaultAccessTokenResponseDecoderTest extends AbstractOIDCTest {
assertNull(decodedResponse);
}
+ @SuppressWarnings("null")
@Test
public void testEncoder_InternalServerErrorResponse() throws ComponentInitializationException {
decoder.initialize();
diff --git a/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/encoding/impl/NimbusAuthCodeTokenRequestEncoderTest.java b/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/encoding/impl/NimbusAuthCodeTokenRequestEncoderTest.java
index 7e57235..086f44c 100644
--- a/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/encoding/impl/NimbusAuthCodeTokenRequestEncoderTest.java
+++ b/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/encoding/impl/NimbusAuthCodeTokenRequestEncoderTest.java
@@ -65,6 +65,7 @@ public class NimbusAuthCodeTokenRequestEncoderTest extends AbstractOIDCTest {
encoder.initialize();
final ClassicHttpRequest request = encoder.apply(prc);
assertNotNull(request);
+ assert request != null;
assertNotNull(request.getFirstHeader("Authorization"));
assertNotNull(request.getEntity().getContent());
final String content = new String(
@@ -86,6 +87,7 @@ public class NimbusAuthCodeTokenRequestEncoderTest extends AbstractOIDCTest {
encoder.initialize();
final ClassicHttpRequest request = encoder.apply(prc);
assertNotNull(request);
+ assert request != null;
assertNull(request.getFirstHeader("Authorization"));
assertNotNull(request.getEntity().getContent());
final String content = new String(request.getEntity().getContent().readAllBytes(), StandardCharsets.UTF_8);
@@ -110,6 +112,7 @@ public class NimbusAuthCodeTokenRequestEncoderTest extends AbstractOIDCTest {
encoder.initialize();
final ClassicHttpRequest request = encoder.apply(prc);
assertNotNull(request);
+ assert request != null;
assertNull(request.getFirstHeader("Authorization"));
assertNotNull(request.getEntity().getContent());
final String content = new String(
@@ -145,6 +148,7 @@ public class NimbusAuthCodeTokenRequestEncoderTest extends AbstractOIDCTest {
encoder.initialize();
final ClassicHttpRequest request = encoder.apply(prc);
assertNotNull(request);
+ assert request != null;
assertNull(request.getFirstHeader("Authorization"));
assertNotNull(request.getEntity().getContent());
final String content = new String(
diff --git a/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/AbstractOIDCTest.java b/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/AbstractOIDCTest.java
index db2745b..f7f8328 100644
--- a/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/AbstractOIDCTest.java
+++ b/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/AbstractOIDCTest.java
@@ -14,11 +14,14 @@
package net.shibboleth.idp.plugin.authn.oidc.rp.impl;
+import static org.testng.Assert.assertNotNull;
+
import java.net.URI;
import java.time.Duration;
import java.util.Map;
import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
import org.apache.hc.core5.http.ClassicHttpResponse;
import org.opensaml.messaging.context.MessageContext;
@@ -46,6 +49,7 @@ import net.shibboleth.oidc.profile.messaging.context.OIDCPeerEntityContext;
import net.shibboleth.oidc.security.impl.support.TestCredentialHelper;
import net.shibboleth.profile.context.RelyingPartyContext;
import net.shibboleth.profile.relyingparty.BasicRelyingPartyConfiguration;
+import net.shibboleth.shared.annotation.constraint.NonnullBeforeExec;
import net.shibboleth.shared.annotation.constraint.NotEmpty;
/** Abstract class for tests that require context setup appropriate for an OIDC request/response.*/
@@ -242,7 +246,7 @@ public abstract class AbstractOIDCTest {
protected DefaultOIDCAuthorizationConfiguration partyConfig;
/** The OIDC provider metadata context.*/
- protected OIDCProviderMetadataContext providerCtx;
+ @NonnullBeforeExec protected OIDCProviderMetadataContext providerCtx;
/**
* Setup the various contexts.
@@ -294,6 +298,7 @@ public abstract class AbstractOIDCTest {
providerCtx = new OIDCProviderMetadataContext();
providerCtx.setProviderInformation(
OIDCProviderMetadata.parse((JSONObject)parser.parse(GOOD_PROVIDER_CONFIGURATION_INFO)));
+ assert providerCtx != null;
peerEntityCtx.addSubcontext(providerCtx);
outMsgCtx.addSubcontext(peerEntityCtx);
@@ -321,9 +326,27 @@ public abstract class AbstractOIDCTest {
* @param prc the prc
* @return the relying party configuration
*/
- protected DefaultOIDCAuthorizationConfiguration getRelyingPartyProfileConfig(final ProfileRequestContext prc) {
- return (DefaultOIDCAuthorizationConfiguration) prc.getSubcontext(RelyingPartyContext.class)
- .getProfileConfig();
+ protected DefaultOIDCAuthorizationConfiguration getRelyingPartyProfileConfig(@Nonnull final ProfileRequestContext prc) {
+ final var rpc = prc.getSubcontext(RelyingPartyContext.class);
+ assert rpc != null;
+ return (DefaultOIDCAuthorizationConfiguration) rpc.getProfileConfig();
+ }
+
+ /**
+ * Get the outbound message context from the given PRC. If the PRC is null or the outbound message context
+ * is null, the assertions will fail.
+ *
+ * @param prc the profile request context
+ *
+ * @return the message context. Never null at that point.
+ */
+ @Nonnull protected MessageContext getOutboundMessageContextFailIfNull(@Nullable final ProfileRequestContext prc){
+ assertNotNull(prc);
+ assert prc != null;
+ final var outboundMsgCtx = prc.getOutboundMessageContext();
+ assertNotNull(outboundMsgCtx);
+ assert outboundMsgCtx != null;
+ return outboundMsgCtx;
}
diff --git a/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/AuthorizationControllerTest.java b/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/AuthorizationControllerTest.java
index 836ffd7..cc0bee6 100644
--- a/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/AuthorizationControllerTest.java
+++ b/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/AuthorizationControllerTest.java
@@ -104,7 +104,9 @@ import net.shibboleth.oidc.security.impl.SignJWTHandler;
import net.shibboleth.oidc.security.impl.support.TestCredentialHelper;
import net.shibboleth.oidc.security.jose.SignatureSigningParameters;
import net.shibboleth.oidc.security.jose.context.SecurityParametersContext;
+import net.shibboleth.shared.annotation.constraint.NonnullBeforeExec;
import net.shibboleth.shared.component.ComponentInitializationException;
+import net.shibboleth.shared.logic.Constraint;
import net.shibboleth.shared.net.URLBuilder;
import net.shibboleth.shared.primitive.NonnullSupplier;
import net.shibboleth.shared.servlet.HttpServletSupport;
@@ -113,6 +115,7 @@ import net.shibboleth.shared.servlet.HttpServletSupport;
@ContextConfiguration(classes = {AuthorizationController.class, IdPPropertyConfigurer.class})
@WebAppConfiguration
@TestPropertySource(properties = {"shibboleth.authn.OIDC.externalAuthnPath=/Authn/OIDC/RP",})
+ at SuppressWarnings("null")
public class AuthorizationControllerTest extends AbstractTestNGSpringContextTests {
/** The web application context loaded by the test framework. */
@@ -131,7 +134,7 @@ public class AuthorizationControllerTest extends AbstractTestNGSpringContextTest
@Nonnull private final String REDIRECT_URI = "http://localhost/Authn/OIDC/RP/callback";
/** The mock MVC entry point for testing. */
- @Nonnull private MockMvc mockMvc;
+ @NonnullBeforeExec private MockMvc mockMvc;
/** The mock servlet context.*/
@Nonnull @Autowired private ServletContext servletContext;
@@ -183,14 +186,16 @@ public class AuthorizationControllerTest extends AbstractTestNGSpringContextTest
// assert no error in the context
assertNull(extContext.getAuthnError());
//basic check of the redirection URL.
- assertTrue(result.getResponse().getRedirectedUrl().contains(ENDPOINT_URI));
- assertTrue(result.getResponse().getRedirectedUrl().contains(URLEncoder.encode(REDIRECT_URI, "UTF-8")));
- assertTrue(result.getResponse().getRedirectedUrl().contains("client_id"));
- assertTrue(result.getResponse().getRedirectedUrl().contains("response_type"));
- assertTrue(result.getResponse().getRedirectedUrl().contains("scope"));
- assertTrue(result.getResponse().getRedirectedUrl().contains("state"));
+ final var redirectUrl = result.getResponse().getRedirectedUrl();
+ assert redirectUrl != null;
+ assertTrue(redirectUrl.contains(ENDPOINT_URI));
+ assertTrue(redirectUrl.contains(URLEncoder.encode(REDIRECT_URI, "UTF-8")));
+ assertTrue(redirectUrl.contains("client_id"));
+ assertTrue(redirectUrl.contains("response_type"));
+ assertTrue(redirectUrl.contains("scope"));
+ assertTrue(redirectUrl.contains("state"));
// Should not contain the request object
- assertFalse(result.getResponse().getRedirectedUrl().contains("request"));
+ assertFalse(redirectUrl.contains("request"));
}
/**
@@ -201,14 +206,18 @@ public class AuthorizationControllerTest extends AbstractTestNGSpringContextTest
@Test
public void testSuccessfulAuthorizeRequest_WithRequestObject() throws Exception {
- assertTrue(context.getSubcontext(AuthenticationContext.class)
- .getSubcontext(ProfileRequestContext.class)
- .getOutboundMessageContext().getMessage() instanceof OIDCAuthenticationRequest);
+ assert context != null;
+ final var ac = context.getSubcontext(AuthenticationContext.class);
+ assert ac != null;
+ final var prc = ac.getSubcontext(ProfileRequestContext.class);
+ assert prc != null;
+ final var outbound = prc.getOutboundMessageContext();
+ assert outbound != null;
+ assertTrue(outbound.getMessage() instanceof OIDCAuthenticationRequest);
// Add a request object into the request
final OIDCAuthenticationRequest request =
- (OIDCAuthenticationRequest) context.getSubcontext(AuthenticationContext.class)
- .getSubcontext(ProfileRequestContext.class)
- .getOutboundMessageContext().getMessage();
+ (OIDCAuthenticationRequest) outbound.getMessage();
+ assert request != null;
addRequestObject(request);
final MvcResult result = mockMvc.perform(get("/Authn/OIDC/RP/authz")
@@ -218,8 +227,10 @@ public class AuthorizationControllerTest extends AbstractTestNGSpringContextTest
assertNotNull(result.getResponse().getHeader("Location"));
final ExternalAuthenticationContext extContext = extractExternalAuthContext();
// assert no error in the context
- assertNull(extContext.getAuthnError());
- assertTrue(result.getResponse().getRedirectedUrl().contains(ENDPOINT_URI));
+ assertNull(extContext.getAuthnError());
+ final var redirectUrl = result.getResponse().getRedirectedUrl();
+ assert redirectUrl != null;
+ assertTrue(redirectUrl.contains(ENDPOINT_URI));
final String redirect = result.getResponse().getRedirectedUrl();
final List<NameValuePair> params = URLEncodedUtils.parse(new URI(redirect), Charset.forName("UTF-8"));
//basic check of the redirection URL.
@@ -291,13 +302,17 @@ public class AuthorizationControllerTest extends AbstractTestNGSpringContextTest
// overwrites previous if set from previous method executions.
servletContext.setAttribute(ExternalAuthentication.SWF_KEY, mockFlowExecutor);
- // add a security params context to nested prc
- addSecurityParametersContext(
- prc.getSubcontext(AuthenticationContext.class).getSubcontext(ProfileRequestContext.class));
+ // add a security params context to nested prc
+ final var ac = prc.getSubcontext(AuthenticationContext.class);
+ assert ac != null;
+ final var nestedPrc = ac.getSubcontext(ProfileRequestContext.class);
+ assert nestedPrc != null;
+ addSecurityParametersContext(nestedPrc);
// add standard set of preencode message handlers to authn context under ac
- addPreEncodeMessageHandler(
- prc.getSubcontext(AuthenticationContext.class).getSubcontext(OIDCAuthnContext.class));
+ final var oidcAuthnContext = ac.getSubcontext(OIDCAuthnContext.class);
+ assert oidcAuthnContext != null;
+ addPreEncodeMessageHandler(oidcAuthnContext);
return prc;
}
@@ -345,7 +360,9 @@ public class AuthorizationControllerTest extends AbstractTestNGSpringContextTest
*/
private void addSecurityParametersContext(@Nonnull final ProfileRequestContext prc) throws Exception {
// Create a sec context under the nested prc outbound msg context
- final var secContext = prc.getOutboundMessageContext().ensureSubcontext(SecurityParametersContext.class);
+ final var outboundMsgContext = prc.getOutboundMessageContext();
+ assert outboundMsgContext != null;
+ final var secContext = outboundMsgContext.ensureSubcontext(SecurityParametersContext.class);
final var sigParams = new SignatureSigningParameters();
sigParams.setSignatureAlgorithm("HS256");
@@ -364,6 +381,7 @@ public class AuthorizationControllerTest extends AbstractTestNGSpringContextTest
* @return a profile request context.
* @throws Exception on error creating the duo client
*/
+ @SuppressWarnings("null")
@Nonnull private ProfileRequestContext buildProfileRequestContext() throws Exception {
// Add an outer root PRC.
@@ -408,7 +426,7 @@ public class AuthorizationControllerTest extends AbstractTestNGSpringContextTest
// Create an add a build OIDCAuthenticationRequest, add to nested PRC outboundmessage
final OIDCAuthenticationRequest request =
new OIDCAuthenticationRequest(new ClientID("test-client"));
- request.setResponseType(ResponseType.CODE);
+ request.setResponseType(Constraint.isNotNull(ResponseType.CODE, "Response code can not be null"));
request.setEndpointURI(new URI(ENDPOINT_URI));
request.setRedirectURI(new URI(REDIRECT_URI));
@@ -418,8 +436,10 @@ public class AuthorizationControllerTest extends AbstractTestNGSpringContextTest
final OIDCPeerEntityContext peerEntity = new OIDCPeerEntityContext();
peerEntity.setIdentifier(ISSUER);
- final OAuth2ClientContext clientContext = peerEntity.ensureSubcontext(OAuth2ClientContext.class);
- prc.getOutboundMessageContext().addSubcontext(peerEntity);
+ final OAuth2ClientContext clientContext = peerEntity.ensureSubcontext(OAuth2ClientContext.class);
+ final var outboundMsgContext = prc.getOutboundMessageContext();
+ assert outboundMsgContext != null;
+ outboundMsgContext.addSubcontext(peerEntity);
return rootPrc;
}
@@ -438,8 +458,9 @@ public class AuthorizationControllerTest extends AbstractTestNGSpringContextTest
getConversationScope().get(ProfileRequestContext.BINDING_KEY);
assertTrue(prcObject instanceof ProfileRequestContext);
- final ExternalAuthenticationContext extContext = ((ProfileRequestContext)prcObject).
- getSubcontext(AuthenticationContext.class).getSubcontext(ExternalAuthenticationContext.class);
+ final var ac = ((ProfileRequestContext)prcObject).getSubcontext(AuthenticationContext.class);
+ assert ac != null;
+ final ExternalAuthenticationContext extContext = ac.getSubcontext(ExternalAuthenticationContext.class);
assertNotNull(extContext);
return extContext;
@@ -458,7 +479,7 @@ public class AuthorizationControllerTest extends AbstractTestNGSpringContextTest
*
* @param encoder the encoder to use.
*/
- public MockEncodeMessage(final MessageEncoder encoder) {
+ public MockEncodeMessage(@Nonnull final MessageEncoder encoder) {
messageEncoder = encoder;
}
@@ -510,12 +531,16 @@ public class AuthorizationControllerTest extends AbstractTestNGSpringContextTest
final OIDCAuthenticationRequest outboundMessage =
(OIDCAuthenticationRequest)messageContext.getMessage();
-
- final URLBuilder urlBuilder = new URLBuilder(outboundMessage.getEndpointURI().toString());
+ assert outboundMessage != null;
+ final var endpointUri = outboundMessage.getEndpointURI();
+ assert endpointUri != null;
+ final URLBuilder urlBuilder = new URLBuilder(Constraint.isNotNull(endpointUri.toString(),
+ "endpoint can not be null"));
serializeAuthorizationParamsToUrl(outboundMessage, urlBuilder);
final String redirectURL = urlBuilder.buildURL();
final HttpServletResponse response = getHttpServletResponse();
+ assert response != null;
HttpServletSupport.addNoCacheHeaders(response);
HttpServletSupport.setUTF8Encoding(response);
HttpServletSupport.setContentType(response, "application/x-www-form-urlencoded");
diff --git a/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/BuildRequestObjectTest.java b/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/BuildRequestObjectTest.java
index baf8531..91fa866 100644
--- a/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/BuildRequestObjectTest.java
+++ b/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/BuildRequestObjectTest.java
@@ -49,6 +49,7 @@ import net.shibboleth.profile.context.RelyingPartyContext;
import net.shibboleth.profile.relyingparty.BasicRelyingPartyConfiguration;
import net.shibboleth.profile.relyingparty.RelyingPartyConfiguration;
import net.shibboleth.shared.component.ComponentInitializationException;
+import net.shibboleth.shared.logic.Constraint;
/** Tests for the {@link BuildRequestObject} action.*/
public class BuildRequestObjectTest extends AbstractOIDCTest {
@@ -82,7 +83,7 @@ public class BuildRequestObjectTest extends AbstractOIDCTest {
// Setup a basic authentication request
authnRequest.setNonce(new Nonce());
- authnRequest.setResponseType(ResponseType.CODE);
+ authnRequest.setResponseType(Constraint.isNotNull(ResponseType.CODE, "response code is null"));
authnRequest.setResponseMode(ResponseMode.QUERY);
authnRequest.setDefaultResponseMode(ResponseMode.QUERY);
authnRequest.setMaxAge(Duration.ofSeconds(60));
@@ -100,11 +101,14 @@ public class BuildRequestObjectTest extends AbstractOIDCTest {
action.initialize();
final Event event = action.execute(src);
assertNull(event);
- assertNotNull(prc.getOutboundMessageContext().getMessage());
- assertNotNull(((OIDCAuthenticationRequest)prc.getOutboundMessageContext()
- .getMessage()).getRequestObjectClaimsSet());
- final ClaimsSet claims = (((OIDCAuthenticationRequest)prc.getOutboundMessageContext()
- .getMessage()).getRequestObjectClaimsSet());
+ final var outboundMsgCtx = getOutboundMessageContextFailIfNull(prc);
+ final var outboundMsg = outboundMsgCtx.getMessage();
+ assert outboundMsg != null;
+ assertNotNull(outboundMsg);
+ assertNotNull(
+ ((OIDCAuthenticationRequest)outboundMsg).getRequestObjectClaimsSet());
+ final ClaimsSet claims = (((OIDCAuthenticationRequest)outboundMsg).getRequestObjectClaimsSet());
+ assert claims != null;
assertEquals(claims.getStringClaim("scope"),"openid");
assertEquals(claims.getStringClaim("iss"),"https://rp.example.com");
assertEquals(claims.getStringClaim("client_id"),"https://rp.example.com");
@@ -130,11 +134,13 @@ public class BuildRequestObjectTest extends AbstractOIDCTest {
action.initialize();
final Event event = action.execute(src);
assertNull(event);
- assertNotNull(prc.getOutboundMessageContext().getMessage());
- assertNotNull(((OIDCAuthenticationRequest)prc.getOutboundMessageContext()
- .getMessage()).getRequestObjectClaimsSet());
- final ClaimsSet claims = (((OIDCAuthenticationRequest)prc.getOutboundMessageContext()
- .getMessage()).getRequestObjectClaimsSet());
+ final var outboundMsgCtx = getOutboundMessageContextFailIfNull(prc);
+ final var outboundMsg = outboundMsgCtx.getMessage();
+ assert outboundMsg != null;
+ assertNotNull(outboundMsg);
+ assertNotNull(((OIDCAuthenticationRequest)outboundMsg).getRequestObjectClaimsSet());
+ final ClaimsSet claims = (((OIDCAuthenticationRequest)outboundMsg).getRequestObjectClaimsSet());
+ assert claims != null;
assertEquals(claims.getStringClaim("scope"),"openid");
assertEquals(claims.getStringClaim("iss"),"https://rp.example.com");
assertEquals(claims.getStringClaim("client_id"),"https://rp.example.com");
@@ -167,11 +173,13 @@ public class BuildRequestObjectTest extends AbstractOIDCTest {
action.initialize();
final Event event = action.execute(src);
assertNull(event);
- assertNotNull(prc.getOutboundMessageContext().getMessage());
- assertNotNull(((OIDCAuthenticationRequest)prc.getOutboundMessageContext()
- .getMessage()).getRequestObjectClaimsSet());
- final ClaimsSet claims = (((OIDCAuthenticationRequest)prc.getOutboundMessageContext()
- .getMessage()).getRequestObjectClaimsSet());
+ final var outboundMsgCtx = getOutboundMessageContextFailIfNull(prc);
+ final var outboundMsg = outboundMsgCtx.getMessage();
+ assert outboundMsg != null;
+ assertNotNull(outboundMsg);
+ assertNotNull(((OIDCAuthenticationRequest)outboundMsg).getRequestObjectClaimsSet());
+ final ClaimsSet claims = (((OIDCAuthenticationRequest)outboundMsg).getRequestObjectClaimsSet());
+ assert claims != null;
assertEquals(claims.getStringClaim("scope"),"openid");
assertEquals(claims.getStringClaim("iss"),"https://rp.example.com");
assertEquals(claims.getStringClaim("client_id"),"https://rp.example.com");
@@ -206,11 +214,13 @@ public class BuildRequestObjectTest extends AbstractOIDCTest {
action.initialize();
final Event event = action.execute(src);
assertNull(event);
- assertNotNull(prc.getOutboundMessageContext().getMessage());
- assertNotNull(((OIDCAuthenticationRequest)prc.getOutboundMessageContext()
- .getMessage()).getRequestObjectClaimsSet());
- final ClaimsSet claims = (((OIDCAuthenticationRequest)prc.getOutboundMessageContext()
- .getMessage()).getRequestObjectClaimsSet());
+ final var outboundMsgCtx = getOutboundMessageContextFailIfNull(prc);
+ final var outboundMsg = outboundMsgCtx.getMessage();
+ assert outboundMsg != null;
+ assertNotNull(outboundMsg);
+ assertNotNull(((OIDCAuthenticationRequest)outboundMsg).getRequestObjectClaimsSet());
+ final ClaimsSet claims = (((OIDCAuthenticationRequest)outboundMsg).getRequestObjectClaimsSet());
+ assert claims != null;
assertEquals(claims.getStringClaim("scope"),"openid");
assertEquals(claims.getStringClaim("iss"),"https://rp.example.com");
assertEquals(claims.getStringClaim("client_id"),"https://rp.example.com");
@@ -258,11 +268,13 @@ public class BuildRequestObjectTest extends AbstractOIDCTest {
action.initialize();
final Event event = action.execute(src);
assertNull(event);
- assertNotNull(prc.getOutboundMessageContext().getMessage());
- assertNotNull(((OIDCAuthenticationRequest)prc.getOutboundMessageContext()
- .getMessage()).getRequestObjectClaimsSet());
- final ClaimsSet claims = (((OIDCAuthenticationRequest)prc.getOutboundMessageContext()
- .getMessage()).getRequestObjectClaimsSet());
+ final var outboundMsgCtx = getOutboundMessageContextFailIfNull(prc);
+ final var outboundMsg = outboundMsgCtx.getMessage();
+ assert outboundMsg != null;
+ assertNotNull(outboundMsg);
+ assertNotNull(((OIDCAuthenticationRequest)outboundMsg).getRequestObjectClaimsSet());
+ final ClaimsSet claims = (((OIDCAuthenticationRequest)outboundMsg).getRequestObjectClaimsSet());
+ assert claims != null;
assertEquals(claims.getStringClaim("scope"),"openid");
assertEquals(claims.getStringClaim("iss"),"https://rp.example.com");
assertEquals(claims.getStringClaim("client_id"),"https://rp.example.com");
@@ -316,11 +328,13 @@ public class BuildRequestObjectTest extends AbstractOIDCTest {
action.initialize();
final Event event = action.execute(src);
assertNull(event);
- assertNotNull(prc.getOutboundMessageContext().getMessage());
- assertNotNull(((OIDCAuthenticationRequest)prc.getOutboundMessageContext()
- .getMessage()).getRequestObjectClaimsSet());
- final ClaimsSet claims = (((OIDCAuthenticationRequest)prc.getOutboundMessageContext()
- .getMessage()).getRequestObjectClaimsSet());
+ final var outboundMsgCtx = getOutboundMessageContextFailIfNull(prc);
+ final var outboundMsg = outboundMsgCtx.getMessage();
+ assert outboundMsg != null;
+ assertNotNull(outboundMsg);
+ assertNotNull(((OIDCAuthenticationRequest)outboundMsg).getRequestObjectClaimsSet());
+ final ClaimsSet claims = (((OIDCAuthenticationRequest)outboundMsg).getRequestObjectClaimsSet());
+ assert claims != null;
assertEquals(claims.getStringClaim("scope"),"openid");
assertEquals(claims.getStringClaim("iss"),"https://rp.example.com");
assertEquals(claims.getStringClaim("client_id"),"https://rp.example.com");
@@ -374,11 +388,14 @@ public class BuildRequestObjectTest extends AbstractOIDCTest {
action.initialize();
final Event event = action.execute(src);
assertNull(event);
- assertNotNull(prc.getOutboundMessageContext().getMessage());
- assertNotNull(((OIDCAuthenticationRequest)prc.getOutboundMessageContext()
- .getMessage()).getRequestObjectClaimsSet());
- final ClaimsSet claims = (((OIDCAuthenticationRequest)prc.getOutboundMessageContext()
- .getMessage()).getRequestObjectClaimsSet());
+ assertNull(event);
+ final var outboundMsgCtx = getOutboundMessageContextFailIfNull(prc);
+ final var outboundMsg = outboundMsgCtx.getMessage();
+ assert outboundMsg != null;
+ assertNotNull(outboundMsg);
+ assertNotNull(((OIDCAuthenticationRequest)outboundMsg).getRequestObjectClaimsSet());
+ final ClaimsSet claims = (((OIDCAuthenticationRequest)outboundMsg).getRequestObjectClaimsSet());
+ assert claims != null;
assertEquals(claims.getStringClaim("scope"),"openid");
assertEquals(claims.getStringClaim("iss"),"https://rp.example.com");
assertEquals(claims.getStringClaim("client_id"),"https://rp.example.com");
@@ -423,11 +440,13 @@ public class BuildRequestObjectTest extends AbstractOIDCTest {
action.initialize();
final Event event = action.execute(src);
assertNull(event);
- assertNotNull(prc.getOutboundMessageContext().getMessage());
- assertNotNull(((OIDCAuthenticationRequest)prc.getOutboundMessageContext()
- .getMessage()).getRequestObjectClaimsSet());
- final ClaimsSet claims = (((OIDCAuthenticationRequest)prc.getOutboundMessageContext()
- .getMessage()).getRequestObjectClaimsSet());
+ final var outboundMsgCtx = getOutboundMessageContextFailIfNull(prc);
+ final var outboundMsg = outboundMsgCtx.getMessage();
+ assert outboundMsg != null;
+ assertNotNull(outboundMsg);
+ assertNotNull(((OIDCAuthenticationRequest)outboundMsg).getRequestObjectClaimsSet());
+ final ClaimsSet claims = (((OIDCAuthenticationRequest)outboundMsg).getRequestObjectClaimsSet());
+ assert claims != null;
assertEquals(claims.getStringClaim("scope"),"openid");
assertEquals(claims.getStringClaim("iss"),"https://rp.example.com");
assertEquals(claims.getStringClaim("client_id"),"https://rp.example.com");
diff --git a/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/DefaultRedirectUriCreationFunctionTest.java b/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/DefaultRedirectUriCreationFunctionTest.java
index 52c9cad..5a19d67 100644
--- a/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/DefaultRedirectUriCreationFunctionTest.java
+++ b/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/DefaultRedirectUriCreationFunctionTest.java
@@ -48,15 +48,15 @@ public class DefaultRedirectUriCreationFunctionTest {
/** Created client context.*/
private OAuth2ClientContext clientContext;
-
@BeforeMethod
public void setUp() throws Exception {
request = new MockHttpServletRequest();
MockitoAnnotations.openMocks(this);
prc = new ProfileRequestContext();
- prc.setOutboundMessageContext(new MessageContext());
+ final var msgContext = new MessageContext();
+ prc.setOutboundMessageContext(msgContext);
final OIDCPeerEntityContext peerCtx =
- prc.getOutboundMessageContext().ensureSubcontext(OIDCPeerEntityContext.class);
+ msgContext.ensureSubcontext(OIDCPeerEntityContext.class);
clientContext = peerCtx.ensureSubcontext(OAuth2ClientContext.class);
}
@@ -78,8 +78,10 @@ public class DefaultRedirectUriCreationFunctionTest {
request.addHeader("Host", "allowed.com");
request.setServerPort(443);
request.setScheme("https");
-
+
+ assert request != null;
final URI redirect = strategy.apply(request, prc);
+ assert redirect != null;
assertEquals(redirect.toASCIIString(), "https://allowed.com"+CALLBACK_PATH);
}
@@ -146,6 +148,7 @@ public class DefaultRedirectUriCreationFunctionTest {
request.setServerPort(8443);
request.setScheme("https");
final URI redirect = strategy.apply(request, prc);
+ assert redirect != null;
assertEquals(redirect.toASCIIString(), "https://allowed.com:8443"+CALLBACK_PATH);
}
@@ -168,6 +171,7 @@ public class DefaultRedirectUriCreationFunctionTest {
request.setServerPort(8080);
request.setScheme("http");
final URI redirect = strategy.apply(request, prc);
+ assert redirect != null;
assertEquals(redirect.toASCIIString(), "http://allowed.com:8080"+CALLBACK_PATH);
}
@@ -190,6 +194,7 @@ public class DefaultRedirectUriCreationFunctionTest {
request.setServerPort(-1);
request.setScheme("http");
final URI redirect = strategy.apply(request, prc);
+ assert redirect != null;
assertEquals(redirect.toASCIIString(), "http://allowed.com"+CALLBACK_PATH);
}
@@ -236,6 +241,7 @@ public class DefaultRedirectUriCreationFunctionTest {
request.setScheme("https");
clientContext.setRedirectUriOverride(new URI("https://registered.com"+CALLBACK_PATH));
final URI redirect = strategy.apply(request, prc);
+ assert redirect != null;
assertEquals(redirect.toASCIIString(), "https://registered.com"+CALLBACK_PATH);
}
diff --git a/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/ExchangeCodeForAccessTokenTest.java b/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/ExchangeCodeForAccessTokenTest.java
index 46c3cd3..3d4e4ef 100644
--- a/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/ExchangeCodeForAccessTokenTest.java
+++ b/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/ExchangeCodeForAccessTokenTest.java
@@ -23,8 +23,6 @@ import static org.testng.Assert.fail;
import java.net.URI;
import java.net.URISyntaxException;
-import javax.annotation.Nonnull;
-
import org.apache.hc.client5.http.classic.HttpClient;
import org.apache.hc.client5.http.classic.methods.HttpUriRequest;
import org.apache.hc.core5.http.ClassicHttpResponse;
@@ -58,7 +56,7 @@ import net.shibboleth.idp.profile.context.navigate.WebflowRequestContextProfileR
public class ExchangeCodeForAccessTokenTest extends AbstractOIDCTest {
/** The action to test.*/
- @Nonnull private ExchangeCodeForAccessToken exchangeAction;
+ private ExchangeCodeForAccessToken exchangeAction;
@Override
@@ -173,6 +171,7 @@ public class ExchangeCodeForAccessTokenTest extends AbstractOIDCTest {
final Event event = exchangeAction.execute(src);
assertNotNull(event);
+ assert event != null;
assertEquals("AuthenticationException",event.getId());
}
@@ -220,6 +219,7 @@ public class ExchangeCodeForAccessTokenTest extends AbstractOIDCTest {
exchangeAction.initialize();
final Event event = exchangeAction.execute(src);
+ assert event != null;
assertNotNull(event);
assertEquals("AuthenticationException",event.getId());
@@ -230,8 +230,10 @@ public class ExchangeCodeForAccessTokenTest extends AbstractOIDCTest {
final HttpClient httpClient = Mockito.mock(HttpClient.class);
final ClassicHttpResponse httpResponse = Mockito.mock(ClassicHttpResponse.class);
- Mockito.when(httpResponse.getCode()).thenReturn(200);
-
+ Mockito.when(httpResponse.getCode()).thenReturn(200);
+ Mockito.when(httpClient.executeOpen((HttpHost) Mockito.any(), (HttpUriRequest) Mockito.any(), (
+ HttpContext) Mockito.any())).thenReturn(httpResponse);
+ assert httpClient != null;
// create new client with mock response
exchangeAction.setHttpClient(httpClient);
@@ -257,6 +259,7 @@ public class ExchangeCodeForAccessTokenTest extends AbstractOIDCTest {
exchangeAction.initialize();
final Event event = exchangeAction.execute(src);
+ assert event != null;
assertNotNull(event);
assertEquals("AuthenticationException",event.getId());
diff --git a/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/InitializeOAuth2ClientAuthenticationMethodHandlerTest.java b/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/InitializeOAuth2ClientAuthenticationMethodHandlerTest.java
index 3ff85d0..934d344 100644
--- a/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/InitializeOAuth2ClientAuthenticationMethodHandlerTest.java
+++ b/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/InitializeOAuth2ClientAuthenticationMethodHandlerTest.java
@@ -14,7 +14,6 @@
package net.shibboleth.idp.plugin.authn.oidc.rp.impl;
-
import static org.testng.Assert.assertEquals;
import static org.testng.Assert.assertNotNull;
import static org.testng.Assert.assertTrue;
@@ -55,14 +54,19 @@ public class InitializeOAuth2ClientAuthenticationMethodHandlerTest extends Abstr
public void testInitialiseClientSecretBasic_Success() throws Exception {
partyConfig.setTokenEndpointAuthMethod("client_secret_basic");
handler.initialize();
- handler.invoke(prc.getOutboundMessageContext());
+ final var outboundMsgCtx = prc.getOutboundMessageContext();
+ assert outboundMsgCtx != null;
+ handler.invoke(outboundMsgCtx);
- final var context = prc.getOutboundMessageContext().getSubcontext(OIDCPeerEntityContext.class)
- .getSubcontext(OAuth2ClientAuthenticationContext.class);
+ final var peerEntityCtx = outboundMsgCtx.getSubcontext(OIDCPeerEntityContext.class);
+ assert peerEntityCtx != null;
+ final var context = peerEntityCtx.getSubcontext(OAuth2ClientAuthenticationContext.class);
+ assert context != null;
assertNotNull(context);
assertNotNull(context.getClientAuthentication());
assertTrue(context.getClientAuthentication() instanceof ClientSecretBasic);
final var basicClientAuth = (ClientSecretBasic) context.getClientAuthentication();
+ assert basicClientAuth != null;
assertEquals(basicClientAuth.getClientSecret().getValue(),CLIENT_SECRET);
}
@@ -72,7 +76,8 @@ public class InitializeOAuth2ClientAuthenticationMethodHandlerTest extends Abstr
partyConfig.setClientCredential(null);
handler.initialize();
- handler.invoke(prc.getOutboundMessageContext());
+ final var outboundMsgCtx = getOutboundMessageContextFailIfNull(prc);
+ handler.invoke(outboundMsgCtx);
}
@@ -82,7 +87,8 @@ public class InitializeOAuth2ClientAuthenticationMethodHandlerTest extends Abstr
partyConfig.setClientCredential(null);
handler.initialize();
- handler.invoke(prc.getOutboundMessageContext());
+ final var outboundMsgCtx = getOutboundMessageContextFailIfNull(prc);
+ handler.invoke(outboundMsgCtx);
}
@@ -90,14 +96,18 @@ public class InitializeOAuth2ClientAuthenticationMethodHandlerTest extends Abstr
public void testInitialiseClientSecretPost_Success() throws Exception {
partyConfig.setTokenEndpointAuthMethod("client_secret_post");
handler.initialize();
- handler.invoke(prc.getOutboundMessageContext());
+ final var outboundMsgCtx = getOutboundMessageContextFailIfNull(prc);
+ handler.invoke(outboundMsgCtx);
- final var context = prc.getOutboundMessageContext().getSubcontext(OIDCPeerEntityContext.class)
- .getSubcontext(OAuth2ClientAuthenticationContext.class);
+ final var peerEntityCtx = outboundMsgCtx.getSubcontext(OIDCPeerEntityContext.class);
+ assert peerEntityCtx != null;
+ final var context = peerEntityCtx.getSubcontext(OAuth2ClientAuthenticationContext.class);
+ assert context != null;
assertNotNull(context);
assertNotNull(context.getClientAuthentication());
assertTrue(context.getClientAuthentication() instanceof ClientSecretPost);
final var basicClientAuth = (ClientSecretPost) context.getClientAuthentication();
+ assert basicClientAuth != null;
assertEquals(basicClientAuth.getClientSecret().getValue(),CLIENT_SECRET);
}
@@ -111,17 +121,23 @@ public class InitializeOAuth2ClientAuthenticationMethodHandlerTest extends Abstr
secContext.setSignatureSigningParameters(secParams);
secParams.setSigningCredential(new DefaultClientSecretCredential(CLIENT_SECRET).toSigningCredential());
- prc.getOutboundMessageContext().addSubcontext(secContext);
+ final var outboundMsgCtx = getOutboundMessageContextFailIfNull(prc);
+
+ outboundMsgCtx.addSubcontext(secContext);
handler.initialize();
- handler.invoke(prc.getOutboundMessageContext());
+ handler.invoke(outboundMsgCtx);
+
+ final var peerEntityCtx = outboundMsgCtx.getSubcontext(OIDCPeerEntityContext.class);
+ assert peerEntityCtx != null;
- final var context = prc.getOutboundMessageContext().getSubcontext(OIDCPeerEntityContext.class)
- .getSubcontext(OAuth2ClientAuthenticationContext.class);
+ final var context = peerEntityCtx.getSubcontext(OAuth2ClientAuthenticationContext.class);
+ assert context != null;
assertNotNull(context);
assertNotNull(context.getClientAuthentication());
assertTrue(context.getClientAuthentication() instanceof ClientSecretJWT);
final var clientSecretJwt = (ClientSecretJWT) context.getClientAuthentication();
+ assert clientSecretJwt != null;
assertNotNull(clientSecretJwt);
assertNotNull(clientSecretJwt.getJWTAuthenticationClaimsSet());
assertNotNull(clientSecretJwt.getClientAssertion());
@@ -140,10 +156,8 @@ public class InitializeOAuth2ClientAuthenticationMethodHandlerTest extends Abstr
public void testInitialiseClientSecretJWT_NoSecurityParams() throws Exception {
partyConfig.setTokenEndpointAuthMethod("client_secret_jwt");
handler.initialize();
- handler.invoke(prc.getOutboundMessageContext());
-
- final var context = prc.getOutboundMessageContext().getSubcontext(OIDCPeerEntityContext.class)
- .getSubcontext(OAuth2ClientAuthenticationContext.class);
+ final var outboundMsgCtx = getOutboundMessageContextFailIfNull(prc);
+ handler.invoke(outboundMsgCtx);
}
@Test
@@ -158,19 +172,26 @@ public class InitializeOAuth2ClientAuthenticationMethodHandlerTest extends Abstr
.keyID("1")
.keyUse(KeyUse.ENCRYPTION)
.generate();
- secParams.setSigningCredential(new BasicCredential(key.toPublicKey(), key.toPrivateKey()));
+ final var publicKey = key.toPublicKey();
+ assert publicKey != null;
+ secParams.setSigningCredential(new BasicCredential(publicKey, key.toPrivateKey()));
- prc.getOutboundMessageContext().addSubcontext(secContext);
+ final var outboundMsgCtx = getOutboundMessageContextFailIfNull(prc);
+ outboundMsgCtx.addSubcontext(secContext);
handler.initialize();
- handler.invoke(prc.getOutboundMessageContext());
+ handler.invoke(outboundMsgCtx);
+
+ final var peerEntityCtx = outboundMsgCtx.getSubcontext(OIDCPeerEntityContext.class);
+ assert peerEntityCtx != null;
- final var context = prc.getOutboundMessageContext().getSubcontext(OIDCPeerEntityContext.class)
- .getSubcontext(OAuth2ClientAuthenticationContext.class);
+ final var context = peerEntityCtx.getSubcontext(OAuth2ClientAuthenticationContext.class);
+ assert context != null;
assertNotNull(context);
assertNotNull(context.getClientAuthentication());
assertTrue(context.getClientAuthentication() instanceof PrivateKeyJWT);
final var privateKeyJwt = (PrivateKeyJWT) context.getClientAuthentication();
+ assert privateKeyJwt != null;
assertNotNull(privateKeyJwt);
assertNotNull(privateKeyJwt.getJWTAuthenticationClaimsSet());
assertNotNull(privateKeyJwt.getClientAssertion());
@@ -196,12 +217,15 @@ public class InitializeOAuth2ClientAuthenticationMethodHandlerTest extends Abstr
.keyID("1")
.keyUse(KeyUse.ENCRYPTION)
.generate();
- secParams.setSigningCredential(new BasicCredential(key.toPublicKey(), key.toPrivateKey()));
+ final var publicKey = key.toPublicKey();
+ assert publicKey != null;
+ secParams.setSigningCredential(new BasicCredential(publicKey, key.toPrivateKey()));
- prc.getOutboundMessageContext().addSubcontext(secContext);
+ final var outboundMsgCtx = getOutboundMessageContextFailIfNull(prc);
+ outboundMsgCtx.addSubcontext(secContext);
handler.initialize();
- handler.invoke(prc.getOutboundMessageContext());
+ handler.invoke(outboundMsgCtx);
}
@Test(expectedExceptions = MessageHandlerException.class)
@@ -214,10 +238,11 @@ public class InitializeOAuth2ClientAuthenticationMethodHandlerTest extends Abstr
secContext.setSignatureSigningParameters(secParams);
secParams.setSigningCredential(new DefaultClientSecretCredential(CLIENT_SECRET).toSigningCredential());
- prc.getOutboundMessageContext().addSubcontext(secContext);
+ final var outboundMsgCtx = getOutboundMessageContextFailIfNull(prc);
+ outboundMsgCtx.addSubcontext(secContext);
handler.initialize();
- handler.invoke(prc.getOutboundMessageContext());
+ handler.invoke(outboundMsgCtx);
}
@@ -230,10 +255,11 @@ public class InitializeOAuth2ClientAuthenticationMethodHandlerTest extends Abstr
secParams.setSignatureAlgorithm("RS256");
secContext.setSignatureSigningParameters(secParams);
- prc.getOutboundMessageContext().addSubcontext(secContext);
+ final var outboundMsgCtx = getOutboundMessageContextFailIfNull(prc);
+ outboundMsgCtx.addSubcontext(secContext);
handler.initialize();
- handler.invoke(prc.getOutboundMessageContext());
+ handler.invoke(outboundMsgCtx);
}
@Test(expectedExceptions = MessageHandlerException.class)
@@ -245,10 +271,11 @@ public class InitializeOAuth2ClientAuthenticationMethodHandlerTest extends Abstr
secParams.setSignatureAlgorithm("HS256");
secContext.setSignatureSigningParameters(secParams);
- prc.getOutboundMessageContext().addSubcontext(secContext);
+ final var outboundMsgCtx = getOutboundMessageContextFailIfNull(prc);
+ outboundMsgCtx.addSubcontext(secContext);
handler.initialize();
- handler.invoke(prc.getOutboundMessageContext());
+ handler.invoke(outboundMsgCtx);
}
}
diff --git a/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/MockAsymmetricJOSEObjectCredentialResolver.java b/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/MockAsymmetricJOSEObjectCredentialResolver.java
index 16370e4..cc8d838 100644
--- a/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/MockAsymmetricJOSEObjectCredentialResolver.java
+++ b/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/MockAsymmetricJOSEObjectCredentialResolver.java
@@ -59,8 +59,12 @@ public class MockAsymmetricJOSEObjectCredentialResolver implements JOSEObjectCre
jwkCredential.setAlgorithm(alg);
jwkCredential.setKid(kid);
try {
- jwkCredential.setPrivateKey(key.toPrivateKey());
- jwkCredential.setPublicKey(key.toPublicKey());
+ final var publicKey = key.toPublicKey();
+ assert publicKey != null;
+ final var privateKey = key.toPrivateKey();
+ assert privateKey != null;
+ jwkCredential.setPrivateKey(privateKey);
+ jwkCredential.setPublicKey(publicKey);
} catch (final JOSEException e) {
fail();
}
@@ -69,7 +73,9 @@ public class MockAsymmetricJOSEObjectCredentialResolver implements JOSEObjectCre
@Override
public Iterable<Credential> resolve(final CriteriaSet criteria) throws ResolverException {
- return List.of(resolveSingle(criteria));
+ final List<Credential> creds = List.of(resolveSingle(criteria));
+ assert creds != null;
+ return creds;
}
}
diff --git a/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/MockSimpleStringTranscoder.java b/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/MockSimpleStringTranscoder.java
index ebac491..a0e6376 100644
--- a/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/MockSimpleStringTranscoder.java
+++ b/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/MockSimpleStringTranscoder.java
@@ -14,7 +14,6 @@
package net.shibboleth.idp.plugin.authn.oidc.rp.impl;
-import java.util.Collections;
import java.util.List;
import javax.annotation.Nonnull;
@@ -31,6 +30,7 @@ import net.shibboleth.idp.attribute.StringAttributeValue;
import net.shibboleth.idp.attribute.transcoding.TranscodingRule;
import net.shibboleth.oidc.attribute.transcoding.AbstractOIDCAttributeTranscoder;
import net.shibboleth.shared.annotation.constraint.NotEmpty;
+import net.shibboleth.shared.collection.CollectionSupport;
/**
* Sample transcoder for tests which only supports simple strings.
@@ -49,21 +49,26 @@ public class MockSimpleStringTranscoder extends AbstractOIDCAttributeTranscoder
for (final Object value : attribute.getValues()) {
attributeString.append(value.toString());
}
- return toJSONObject(attributeString.toString());
+ assert attributeString != null;
+ final String attributeStringAsString = attributeString.toString();
+ assert attributeStringAsString != null;
+ return toJSONObject(attributeStringAsString);
}
@Override
protected List<IdPAttributeValue> decodeValues(final ProfileRequestContext profileRequestContext, final Object input,
final TranscodingRule rule) throws AttributeDecodingException {
if (input instanceof String) {
- return List.of(StringAttributeValue.valueOf((String)input));
+ return CollectionSupport.listOf(StringAttributeValue.valueOf((String)input));
}
- return Collections.emptyList();
+ return CollectionSupport.emptyList();
}
@Nonnull private Object toJSONObject(@Nonnull @NotEmpty final String value) throws AttributeEncodingException {
try {
- return new JSONParser(JSONParser.MODE_PERMISSIVE).parse(value);
+ final var parsed = new JSONParser(JSONParser.MODE_PERMISSIVE).parse(value);
+ assert parsed != null;
+ return parsed;
} catch (final ParseException e) {
throw new AttributeEncodingException("Unable to parse string into JSONObject", e);
}
diff --git a/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/OIDCRPFlowFromAuthenticationResponseTest.java b/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/OIDCRPFlowFromAuthenticationResponseTest.java
index 45359bf..dce7f97 100644
--- a/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/OIDCRPFlowFromAuthenticationResponseTest.java
+++ b/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/OIDCRPFlowFromAuthenticationResponseTest.java
@@ -57,6 +57,8 @@ import net.shibboleth.oidc.security.impl.support.TestCredentialHelper;
import net.shibboleth.oidc.security.jose.impl.BasicDecryptionConfiguration;
import net.shibboleth.oidc.security.jose.impl.BasicSignatureSigningConfiguration;
import net.shibboleth.oidc.security.jose.impl.BasicSignatureValidationConfiguration;
+import net.shibboleth.shared.collection.CollectionSupport;
+import net.shibboleth.shared.logic.Constraint;
import okhttp3.mockwebserver.MockResponse;
import okhttp3.mockwebserver.MockWebServer;
@@ -70,13 +72,14 @@ public class OIDCRPFlowFromAuthenticationResponseTest extends OIDCRPFlowTest {
private void basicSetup() {
setFlowPath(FLOW);
+ assert flowResources != null;
setFlowModelResources(flowResources);
setSubflows(subflows);
final Map<String,String> mockProperties = Map.of(
"idp.entityID", "http://idp.example.com/",
"idp.authn.oidc.rp.provider.proxyIssuer",OP_ISSUER_ID);
-
+ assert mockProperties != null;
setMockProperties(mockProperties);
}
@@ -186,6 +189,7 @@ public class OIDCRPFlowFromAuthenticationResponseTest extends OIDCRPFlowTest {
final JSONSecurityConfiguration secConfig = (JSONSecurityConfiguration)
partyConfig.getSecurityConfiguration(prc);
+ assert secConfig != null;
final BasicSignatureSigningConfiguration signingConfig = new BasicSignatureSigningConfiguration();
// Add more than one type of algorithm and credential, and make sure the resolver and signer picks the correctly
// NOTE, the client_secret credential will be added by the resolver, so you do not need to add it here.
@@ -194,7 +198,9 @@ public class OIDCRPFlowFromAuthenticationResponseTest extends OIDCRPFlowTest {
.keyID("1")
.keyUse(KeyUse.ENCRYPTION)
.generate();
- signingConfig.setSigningCredentials(List.of(new BasicCredential(encKey.toPublicKey(), encKey.toPrivateKey())));
+ final var publicKey = encKey.toPublicKey();
+ assert publicKey != null;
+ signingConfig.setSigningCredentials(List.of(new BasicCredential(publicKey, encKey.toPrivateKey())));
signingConfig.setSignatureAlgorithms(List.of("RS256","HS256"));
secConfig.setJwtSignatureSigningConfiguration(signingConfig);
@@ -256,9 +262,12 @@ public class OIDCRPFlowFromAuthenticationResponseTest extends OIDCRPFlowTest {
final JSONSecurityConfiguration secConfig = (JSONSecurityConfiguration)
partyConfig.getSecurityConfiguration(prc);
final BasicSignatureSigningConfiguration signingConfig = new BasicSignatureSigningConfiguration();
- signingConfig.setSigningCredentials(List.of(new BasicCredential(encKey.toPublicKey(), encKey.toPrivateKey())));
+ final var publicKey = encKey.toPublicKey();
+ assert publicKey != null;
+ signingConfig.setSigningCredentials(List.of(new BasicCredential(publicKey, encKey.toPrivateKey())));
// Ensure it chooses the RS algorithm here.
signingConfig.setSignatureAlgorithms(List.of("RS256","HS256"));
+ assert secConfig != null;
secConfig.setJwtSignatureSigningConfiguration(signingConfig);
updateFlowExecution(flowExecution);
@@ -337,6 +346,7 @@ public class OIDCRPFlowFromAuthenticationResponseTest extends OIDCRPFlowTest {
mockOPServer.start(9918);
final var prc = resumeBasicFlow();
+ assert prc != null;
mockOPServer.shutdown();
@@ -358,19 +368,25 @@ public class OIDCRPFlowFromAuthenticationResponseTest extends OIDCRPFlowTest {
JWSAlgorithm.HS256, JWEAlgorithm.DIR, EncryptionMethod.A128CBC_HS256,
new DefaultClientSecretCredential(CLIENT_SECRET).toSigningCredential(),
new DefaultClientSecretCredential(CLIENT_SECRET).toEncryptionCredential(
- JWEAlgorithm.DIR, EncryptionMethod.A128CBC_HS256));
+ Constraint.isNotNull(JWEAlgorithm.DIR,""),
+ Constraint.isNotNull(EncryptionMethod.A128CBC_HS256,"")));
final var sigKey = new ECKeyGenerator(Curve.P_256).keyID("123").generate();
+ final var pubSigKey = sigKey.toPublicKey();
+ final var privateSigKey = sigKey.toPrivateKey();
+ assert pubSigKey != null && privateSigKey != null;
final RSAKey encKey = new RSAKeyGenerator(2048)
.keyID("1")
.keyUse(KeyUse.ENCRYPTION)
.generate();
+ final var pubEncKey = encKey.toPublicKey();
+ assert pubEncKey != null;
final var userInfoResp = TestTokenHelper.createJWTUserInfoResponse(
Map.of("iss", OP_ISSUER_ID, "aud", List.of(CLIENT_ID)), JWSAlgorithm.ES256,
JWEAlgorithm.RSA_OAEP_256,
EncryptionMethod.A256GCM,
- new BasicCredential(sigKey.toPublicKey(), sigKey.toPrivateKey()),
- new BasicCredential(encKey.toPublicKey(), encKey.toPrivateKey()));
+ new BasicCredential(pubSigKey, privateSigKey),
+ new BasicCredential(pubEncKey, encKey.toPrivateKey()));
// First is token exchange
queueMockServerResponse(mockOPServer, 200, accessTokenResp, "application/json");
@@ -409,7 +425,7 @@ public class OIDCRPFlowFromAuthenticationResponseTest extends OIDCRPFlowTest {
new BasicSignatureValidationConfiguration();
sigValidation.setSignatureTrustEngine(
new ExplicitKeySignedJWTTrustEngine(
- new ChainingJOSEObjectCredentialResolver(List.of(
+ new ChainingJOSEObjectCredentialResolver(CollectionSupport.listOf(
new ClientSecretCriterionCredentialResolver(),
new MockAsymmetricJOSEObjectCredentialResolver(
sigKey,sigKey.getKeyID(), JWEAlgorithm.RSA_OAEP_256)))
@@ -453,12 +469,14 @@ public class OIDCRPFlowFromAuthenticationResponseTest extends OIDCRPFlowTest {
final RSAKey encKey = new RSAKeyGenerator(2048)
.keyID("1")
.keyUse(KeyUse.ENCRYPTION)
- .generate();
+ .generate();
+ final var encKeyPublic = encKey.toPublicKey();
+ assert encKeyPublic != null;
final var accessTokenResp = TestTokenHelper.createAccessTokenResponseJSON(
Map.of("iss", OP_ISSUER_ID, "azp", CLIENT_ID, "aud", List.of(CLIENT_ID)),
JWSAlgorithm.HS256, JWEAlgorithm.RSA_OAEP_256, EncryptionMethod.A256GCM,
new DefaultClientSecretCredential(CLIENT_SECRET).toSigningCredential(),
- new BasicCredential(encKey.toPublicKey(), encKey.toPrivateKey()));
+ new BasicCredential(encKeyPublic, encKey.toPrivateKey()));
final var userInfoResp =
TestTokenHelper.createPlainUserInfoResponseString(Map.of("iss", OP_ISSUER_ID, "aud", List.of(CLIENT_ID)));
@@ -538,6 +556,8 @@ public class OIDCRPFlowFromAuthenticationResponseTest extends OIDCRPFlowTest {
mockOPServer.start(9918);
final var prc = resumeBasicFlow();
+ assertNotNull(prc);
+ assert prc != null;
mockOPServer.shutdown();
@@ -572,8 +592,13 @@ public class OIDCRPFlowFromAuthenticationResponseTest extends OIDCRPFlowTest {
.createFlowExecution(getFlowDefinition());
final ProfileRequestContext prc = populateBasicContextTreeFromAuthnResponse(flowExecution);
// Add mapping functions
- addACRAndAMRFunctions(prc.getSubcontext(AuthenticationContext.class)
- .getSubcontext(ProfileRequestContext.class));
+ final var ac = prc.getSubcontext(AuthenticationContext.class);
+ assert ac != null;
+ assert prc != null;
+ final var nestedPrc = ac.getSubcontext(ProfileRequestContext.class);
+ assertNotNull(nestedPrc);
+ assert nestedPrc != null;
+ addACRAndAMRFunctions(nestedPrc);
updateFlowExecution(flowExecution);
@@ -588,10 +613,12 @@ public class OIDCRPFlowFromAuthenticationResponseTest extends OIDCRPFlowTest {
assertStandardEndFlowSuccessConditions(prc);
// Add checks for added ACRs and AMRs
- assertNotNull(prc.getSubcontext(SubjectCanonicalizationContext.class).getSubject()
- .getPrincipals(AuthenticationContextClassReferencePrincipal.class));
- assertNotNull(prc.getSubcontext(SubjectCanonicalizationContext.class).getSubject()
- .getPrincipals(AuthenticationMethodPrincipal.class));
+ final var subjectC14nCtx = prc.getSubcontext(SubjectCanonicalizationContext.class);
+ assert subjectC14nCtx != null;
+ final var subject = subjectC14nCtx.getSubject();
+ assert subject != null;
+ assertNotNull(subject.getPrincipals(AuthenticationContextClassReferencePrincipal.class));
+ assertNotNull(subject.getPrincipals(AuthenticationMethodPrincipal.class));
}
@@ -611,12 +638,18 @@ public class OIDCRPFlowFromAuthenticationResponseTest extends OIDCRPFlowTest {
.createFlowExecution(getFlowDefinition());
final ProfileRequestContext prc = populateBasicContextTreeFromAuthnResponse(flowExecution);
+ assert prc != null;
+ final var ac = prc.getSubcontext(AuthenticationContext.class);
+ assert ac != null;
+ final var nestedPrc = ac.getSubcontext(ProfileRequestContext.class);
+ assert nestedPrc != null;
+ final var outBoundMsgCtx = nestedPrc.getOutboundMessageContext();
+ assert outBoundMsgCtx != null;
// Add a response type that suggests this flow was triggered by the IMPLICIT grant.
- final OIDCAuthenticationRequest request =
- (OIDCAuthenticationRequest)prc.getSubcontext(AuthenticationContext.class)
- .getSubcontext(ProfileRequestContext.class).getOutboundMessageContext().getMessage();
+ final OIDCAuthenticationRequest request = (OIDCAuthenticationRequest)outBoundMsgCtx.getMessage();
+ assert request != null;
request.setResponseType(ResponseType.IDTOKEN);
assertNotNull(request);
@@ -645,14 +678,16 @@ public class OIDCRPFlowFromAuthenticationResponseTest extends OIDCRPFlowTest {
final FlowExecutionImpl flowExecution = (FlowExecutionImpl)getFlowExecutionFactory()
.createFlowExecution(getFlowDefinition());
final ProfileRequestContext prc = buildProfileRequestContext("authn/OIDCRelyingParty", false,false);
+ assert prc != null;
+ final var ac = prc.getSubcontext(AuthenticationContext.class);
+ assert ac != null;
- prc.getSubcontext(AuthenticationContext.class)
- .addSubcontext(new ExternalAuthenticationContext(new ExternalAuthenticationImpl(false)));
+ ac.addSubcontext(new ExternalAuthenticationContext(new ExternalAuthenticationImpl(false)));
flowExecution.getConversationScope().put("opensamlProfileRequestContext",prc);
// create a nested PRC under the authentication context
final ProfileRequestContext nestPrc = (ProfileRequestContext)
- prc.getSubcontext(AuthenticationContext.class).addSubcontext(new ProfileRequestContext(), true);
+ ac.addSubcontext(new ProfileRequestContext(), true);
final MessageContext outMsgCtx = new MessageContext();
final OIDCAuthenticationRequest request = new OIDCAuthenticationRequest(new ClientID(OP_ISSUER_ID));
@@ -705,6 +740,7 @@ public class OIDCRPFlowFromAuthenticationResponseTest extends OIDCRPFlowTest {
mockOPServer.start(9918);
final var prc = resumeBasicFlow();
+ assert prc != null;
mockOPServer.shutdown();
// Assert test conditions
@@ -735,7 +771,8 @@ public class OIDCRPFlowFromAuthenticationResponseTest extends OIDCRPFlowTest {
queueMockServerResponse(mockOPServer, 200, userInfoResp, "application/json");
mockOPServer.start(9918);
- final var prc = resumeBasicFlow();
+ final var prc = resumeBasicFlow();
+ assert prc != null;
mockOPServer.shutdown();
// Assert test conditions
@@ -765,7 +802,8 @@ public class OIDCRPFlowFromAuthenticationResponseTest extends OIDCRPFlowTest {
queueMockServerResponse(mockOPServer, 200, userInfoResp, "application/json");
mockOPServer.start(9918);
- final var prc = resumeBasicFlow();
+ final var prc = resumeBasicFlow();
+ assert prc != null;
mockOPServer.shutdown();
// Assert test conditions
@@ -799,7 +837,8 @@ public class OIDCRPFlowFromAuthenticationResponseTest extends OIDCRPFlowTest {
queueMockServerResponse(mockOPServer, 200, userInfoResp, "application/json");
mockOPServer.start(9918);
- final var prc = resumeBasicFlow();
+ final var prc = resumeBasicFlow();
+ assert prc != null;
mockOPServer.shutdown();
// Assert test conditions
@@ -829,7 +868,8 @@ public class OIDCRPFlowFromAuthenticationResponseTest extends OIDCRPFlowTest {
queueMockServerResponse(mockOPServer, 200, userInfoResp, "application/json");
mockOPServer.start(9918);
- final var prc = resumeBasicFlow();
+ final var prc = resumeBasicFlow();
+ assert prc != null;
mockOPServer.shutdown();
// Assert test conditions
@@ -863,7 +903,7 @@ public class OIDCRPFlowFromAuthenticationResponseTest extends OIDCRPFlowTest {
mockOPServer.start(9918);
final var prc = resumeBasicFlow();
-
+ assert prc != null;
mockOPServer.shutdown();
// Assert test conditions
@@ -898,7 +938,7 @@ public class OIDCRPFlowFromAuthenticationResponseTest extends OIDCRPFlowTest {
mockOPServer.start(9918);
final var prc = resumeBasicFlow();
-
+ assert prc != null;
mockOPServer.shutdown();
// Assert test conditions
diff --git a/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/OIDCRPFlowPreRedirectTest.java b/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/OIDCRPFlowPreRedirectTest.java
index 515ec79..7720223 100644
--- a/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/OIDCRPFlowPreRedirectTest.java
+++ b/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/OIDCRPFlowPreRedirectTest.java
@@ -18,12 +18,8 @@ import java.security.Principal;
import java.util.List;
import java.util.Map;
-import javax.annotation.Nonnull;
-
import org.junit.Test;
import org.opensaml.profile.context.ProfileRequestContext;
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
import org.springframework.webflow.core.collection.LocalAttributeMap;
import org.springframework.webflow.execution.FlowExecution;
@@ -44,11 +40,7 @@ import okhttp3.mockwebserver.MockWebServer;
* pre-authn redirect.
*
*/
-public class OIDCRPFlowPreRedirectTest extends OIDCRPFlowTest {
-
- /** Class logger. */
- @Nonnull private final Logger log = LoggerFactory.getLogger(OIDCRPFlowPreRedirectTest.class);
-
+public class OIDCRPFlowPreRedirectTest extends OIDCRPFlowTest {
/**
* Test the flow running to the authorization redirect using default, basic, settings.
@@ -59,6 +51,7 @@ public class OIDCRPFlowPreRedirectTest extends OIDCRPFlowTest {
public void testFlowToAuthorizationRedirect() throws Exception {
setFlowPath(FLOW);
+ assert flowResources != null;
setFlowModelResources(flowResources);
setSubflows(subflows);
@@ -66,7 +59,7 @@ public class OIDCRPFlowPreRedirectTest extends OIDCRPFlowTest {
"idp.service.clientinfo.failFast","false",
"idp.entityID", "http://idp.example.com/",
"idp.authn.oidc.rp.provider.proxyIssuer",OP_ISSUER_ID);
-
+ assert mockProperties != null;
setMockProperties(mockProperties);
final MockWebServer mockOPServer = createSimpleServer();
@@ -89,13 +82,18 @@ public class OIDCRPFlowPreRedirectTest extends OIDCRPFlowTest {
mockOPServer.shutdown();
final var nestedPrc = assertStandardAuthenticationRedirectFlowSuccessConditions(prc);
+ final var outboundMsgCtx = nestedPrc.getOutboundMessageContext();
+ assert outboundMsgCtx != null;
final OIDCAuthenticationRequest request =
- (OIDCAuthenticationRequest) nestedPrc.getOutboundMessageContext().getMessage();
+ (OIDCAuthenticationRequest) outboundMsgCtx.getMessage();
+ assert request != null;
assertNull(request.getRequestObject());
assertNull(request.getRequestObjectClaimsSet());
assertNull(request.getRequestedClaims());
assertTrue(request.getAcrs().isEmpty());
- assertEquals(request.getRedirectURI().toASCIIString(), "https://localhost/callback");
+ final var redirectUri = request.getRedirectURI();
+ assert redirectUri != null;
+ assertEquals(redirectUri.toASCIIString(), "https://localhost/callback");
assertEquals(request.getResponseMode(), ResponseMode.QUERY);
}
@@ -110,6 +108,7 @@ public class OIDCRPFlowPreRedirectTest extends OIDCRPFlowTest {
public void testUsingRequestObject() throws Exception {
setFlowPath(FLOW);
+ assert flowResources != null;
setFlowModelResources(flowResources);
setSubflows(subflows);
@@ -117,7 +116,7 @@ public class OIDCRPFlowPreRedirectTest extends OIDCRPFlowTest {
"idp.service.clientinfo.failFast","false",
"idp.entityID", "http://idp.example.com/",
"idp.authn.oidc.rp.provider.proxyIssuer",OP_ISSUER_ID_REQUESTOBJECT_TRUE);
-
+ assert mockProperties != null;
setMockProperties(mockProperties);
final MockWebServer mockOPServer = createSimpleServer();
@@ -141,8 +140,12 @@ public class OIDCRPFlowPreRedirectTest extends OIDCRPFlowTest {
mockOPServer.shutdown();
final var nestedPrc = assertStandardAuthenticationRedirectFlowSuccessConditions(prc);
+ assert nestedPrc != null;
+ final var outboundMsgCtx = nestedPrc.getOutboundMessageContext();
+ assert outboundMsgCtx != null;
final OIDCAuthenticationRequest request =
- (OIDCAuthenticationRequest) nestedPrc.getOutboundMessageContext().getMessage();
+ (OIDCAuthenticationRequest) outboundMsgCtx.getMessage();
+ assert request != null;
assertNull(request.getRequestObject());
assertNotNull(request.getRequestObjectClaimsSet());
assertNull(request.getRequestedClaims());
@@ -163,6 +166,7 @@ public class OIDCRPFlowPreRedirectTest extends OIDCRPFlowTest {
public void testUsingRequestObject_WithEncryption() throws Exception {
setFlowPath(FLOW);
+ assert flowResources != null;
setFlowModelResources(flowResources);
setSubflows(subflows);
@@ -170,7 +174,7 @@ public class OIDCRPFlowPreRedirectTest extends OIDCRPFlowTest {
"idp.service.clientinfo.failFast","false",
"idp.entityID", "http://idp.example.com/",
"idp.authn.oidc.rp.provider.proxyIssuer",OP_ISSUER_ID_REQUESTOBJECT_TRUE_ENCRYPT);
-
+ assert mockProperties != null;
setMockProperties(mockProperties);
final MockWebServer mockOPServer = createSimpleServer();
@@ -199,8 +203,11 @@ public class OIDCRPFlowPreRedirectTest extends OIDCRPFlowTest {
mockOPServer.shutdown();
final var nestedPrc = assertStandardAuthenticationRedirectFlowSuccessConditions(prc);
+ final var outboundMsgCtx = nestedPrc.getOutboundMessageContext();
+ assert outboundMsgCtx != null;
final OIDCAuthenticationRequest request =
- (OIDCAuthenticationRequest) nestedPrc.getOutboundMessageContext().getMessage();
+ (OIDCAuthenticationRequest) outboundMsgCtx.getMessage();
+ assert request != null;
assertNull(request.getRequestObject());
assertNotNull(request.getRequestObjectClaimsSet());
assertNull(request.getRequestedClaims());
@@ -210,22 +217,26 @@ public class OIDCRPFlowPreRedirectTest extends OIDCRPFlowTest {
assertStandardRequestObjectSuccessConditions(request.getRequestObjectClaimsSet(), "https://localhost:9921");
// Check security context
- assertNotNull(nestedPrc.getOutboundMessageContext().getSubcontext(SecurityParametersContext.class));
+ assertNotNull(outboundMsgCtx.getSubcontext(SecurityParametersContext.class));
final SecurityParametersContext secContext =
- nestedPrc.getOutboundMessageContext().getSubcontext(SecurityParametersContext.class);
+ outboundMsgCtx.getSubcontext(SecurityParametersContext.class);
+ assert secContext != null;
+ final var sigSigningParams = secContext.getSignatureSigningParameters();
+ final var encParams = secContext.getEncryptionParameters();
+ assert sigSigningParams != null && encParams != null;
// Check signing params are set correctly
- assertNotNull(secContext.getSignatureSigningParameters());
- assertEquals("HS256",secContext.getSignatureSigningParameters().getSignatureAlgorithm());
- assertNotNull(secContext.getSignatureSigningParameters().getSigningCredential());
+ assertNotNull(sigSigningParams);
+ assertEquals("HS256",sigSigningParams.getSignatureAlgorithm());
+ assertNotNull(sigSigningParams.getSigningCredential());
// Check encryption params are set correctly
assertNotNull(secContext.getEncryptionParameters());
- assertEquals("A128CBC-HS256",secContext.getEncryptionParameters().getDataEncryptionAlgorithm());
- assertEquals("RSA-OAEP",secContext.getEncryptionParameters().getKeyTransportEncryptionAlgorithm());
+ assertEquals("A128CBC-HS256",encParams.getDataEncryptionAlgorithm());
+ assertEquals("RSA-OAEP",encParams.getKeyTransportEncryptionAlgorithm());
// No data enc credential, as that is derived once key encrypted.
- assertNull(secContext.getEncryptionParameters().getDataEncryptionCredential());
- assertNotNull(secContext.getEncryptionParameters().getKeyTransportEncryptionCredential());
+ assertNull(encParams.getDataEncryptionCredential());
+ assertNotNull(encParams.getKeyTransportEncryptionCredential());
}
/**
@@ -238,6 +249,7 @@ public class OIDCRPFlowPreRedirectTest extends OIDCRPFlowTest {
public void testUsingRequestObject_RSA256Signature() throws Exception {
setFlowPath(FLOW);
+ assert flowResources != null;
setFlowModelResources(flowResources);
setSubflows(subflows);
@@ -245,7 +257,7 @@ public class OIDCRPFlowPreRedirectTest extends OIDCRPFlowTest {
"idp.service.clientinfo.failFast","false",
"idp.entityID", "http://idp.example.com/",
"idp.authn.oidc.rp.provider.proxyIssuer",OP_ISSUER_ID_REQUESTOBJECT_TRUE_RSA256_SIG);
-
+ assert mockProperties != null;
setMockProperties(mockProperties);
final MockWebServer mockOPServer = createSimpleServer();
@@ -269,8 +281,11 @@ public class OIDCRPFlowPreRedirectTest extends OIDCRPFlowTest {
mockOPServer.shutdown();
final var nestedPrc = assertStandardAuthenticationRedirectFlowSuccessConditions(prc);
+ final var outboundMsgCtx = nestedPrc.getOutboundMessageContext();
+ assert outboundMsgCtx != null;
final OIDCAuthenticationRequest request =
- (OIDCAuthenticationRequest) nestedPrc.getOutboundMessageContext().getMessage();
+ (OIDCAuthenticationRequest) outboundMsgCtx.getMessage();
+ assert request != null;
assertNull(request.getRequestObject());
assertNotNull(request.getRequestObjectClaimsSet());
assertNull(request.getRequestedClaims());
@@ -280,14 +295,18 @@ public class OIDCRPFlowPreRedirectTest extends OIDCRPFlowTest {
assertStandardRequestObjectSuccessConditions(request.getRequestObjectClaimsSet(), "https://localhost:9920");
// Check security context
- assertNotNull(nestedPrc.getOutboundMessageContext().getSubcontext(SecurityParametersContext.class));
+ assert outboundMsgCtx != null;
+ assertNotNull(outboundMsgCtx.getSubcontext(SecurityParametersContext.class));
final SecurityParametersContext secContext =
- nestedPrc.getOutboundMessageContext().getSubcontext(SecurityParametersContext.class);
+ outboundMsgCtx.getSubcontext(SecurityParametersContext.class);
// Check signing params are set correctly
+ assert secContext != null;
+ final var sigSigningParams = secContext.getSignatureSigningParameters();
+ assert sigSigningParams != null;
assertNotNull(secContext.getSignatureSigningParameters());
- assertEquals("RS256",secContext.getSignatureSigningParameters().getSignatureAlgorithm());
- assertNotNull(secContext.getSignatureSigningParameters().getSigningCredential());
+ assertEquals("RS256",sigSigningParams.getSignatureAlgorithm());
+ assertNotNull(sigSigningParams.getSigningCredential());
}
@@ -302,6 +321,7 @@ public class OIDCRPFlowPreRedirectTest extends OIDCRPFlowTest {
throws Exception {
setFlowPath(FLOW);
+ assert flowResources != null;
setFlowModelResources(flowResources);
setSubflows(subflows);
@@ -309,7 +329,7 @@ public class OIDCRPFlowPreRedirectTest extends OIDCRPFlowTest {
"idp.service.clientinfo.failFast","false",
"idp.entityID", "http://idp.example.com/",
"idp.authn.oidc.rp.provider.proxyIssuer",OP_ISSUER_ID_REQUESTOBJECT_TRUE_HS512_SIG);
-
+ assert mockProperties != null;
setMockProperties(mockProperties);
final MockWebServer mockOPServer = createSimpleServer();
@@ -335,22 +355,28 @@ public class OIDCRPFlowPreRedirectTest extends OIDCRPFlowTest {
assertFlowExecutionEnded();
- assertNotNull(prc.getSubcontext(AuthenticationContext.class));
- assertNotNull(prc.getSubcontext(AuthenticationContext.class).getSubcontext(ProfileRequestContext.class));
- final var nestedPrc = prc.getSubcontext(AuthenticationContext.class).getSubcontext(ProfileRequestContext.class);
+ final var ac = prc.getSubcontext(AuthenticationContext.class);
+ assert ac != null;
+ assertNotNull(ac);
+ assertNotNull(ac.getSubcontext(ProfileRequestContext.class));
+ final var nestedPrc = ac.getSubcontext(ProfileRequestContext.class);
+ assert nestedPrc != null;
+ final var outboundMsgCtx = nestedPrc.getOutboundMessageContext();
+ assert outboundMsgCtx != null;
final OIDCAuthenticationRequest request =
- (OIDCAuthenticationRequest) nestedPrc.getOutboundMessageContext().getMessage();
+ (OIDCAuthenticationRequest) outboundMsgCtx.getMessage();
+ assert request != null;
assertNotNull(request);
assertNull(request.getRequestObject());
assertNull(request.getRequestObjectClaimsSet());
assertNull(request.getRequestedClaims());
assertTrue(request.getAcrs().isEmpty());
-
+
// Check security context does not contain credentials and algorithms
- assertNotNull(nestedPrc.getOutboundMessageContext().getSubcontext(SecurityParametersContext.class));
+ assertNotNull(outboundMsgCtx.getSubcontext(SecurityParametersContext.class));
final SecurityParametersContext secContext =
- nestedPrc.getOutboundMessageContext().getSubcontext(SecurityParametersContext.class);
-
+ outboundMsgCtx.getSubcontext(SecurityParametersContext.class);
+ assert secContext != null;
// Check signing params have not been built as signature algorithms did not match
assertNull(secContext.getSignatureSigningParameters());
@@ -365,6 +391,7 @@ public class OIDCRPFlowPreRedirectTest extends OIDCRPFlowTest {
public void testWithACRs() throws Exception {
setFlowPath(FLOW);
+ assert flowResources != null;
setFlowModelResources(flowResources);
setSubflows(subflows);
@@ -372,7 +399,7 @@ public class OIDCRPFlowPreRedirectTest extends OIDCRPFlowTest {
"idp.service.clientinfo.failFast","false",
"idp.entityID", "http://idp.example.com/",
"idp.authn.oidc.rp.provider.proxyIssuer",OP_ISSUER_ID);
-
+ assert mockProperties != null;
setMockProperties(mockProperties);
final MockWebServer mockOPServer = createSimpleServer();
@@ -392,9 +419,12 @@ public class OIDCRPFlowPreRedirectTest extends OIDCRPFlowTest {
final RequestedPrincipalContext rpc = new RequestedPrincipalContext();
final List<Principal> requestedPrincipals =
List.of(new AuthnContextClassRefPrincipal("http://example.org/ac/classes/mfa"));
+ assert requestedPrincipals != null;
rpc.setRequestedPrincipals(requestedPrincipals);
rpc.setOperator("exact");
- prc.getSubcontext(AuthenticationContext.class).addSubcontext(rpc);
+ final var ac = prc.getSubcontext(AuthenticationContext.class);
+ assert ac != null;
+ ac.addSubcontext(rpc);
flowExecution.getConversationScope().put("opensamlProfileRequestContext", prc);
updateFlowExecution(flowExecution);
@@ -403,8 +433,11 @@ public class OIDCRPFlowPreRedirectTest extends OIDCRPFlowTest {
mockOPServer.shutdown();
final var nestedPrc = assertStandardAuthenticationRedirectFlowSuccessConditions(prc);
+ final var outboundMsgCtx = nestedPrc.getOutboundMessageContext();
+ assert outboundMsgCtx != null;
final OIDCAuthenticationRequest request =
- (OIDCAuthenticationRequest) nestedPrc.getOutboundMessageContext().getMessage();
+ (OIDCAuthenticationRequest) outboundMsgCtx.getMessage();
+ assert request != null;
assertNull(request.getRequestObject());
assertNull(request.getRequestObjectClaimsSet());
assertNull(request.getRequestedClaims());
diff --git a/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/OIDCRPFlowTest.java b/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/OIDCRPFlowTest.java
index 89334ab..3a49d8d 100644
--- a/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/OIDCRPFlowTest.java
+++ b/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/OIDCRPFlowTest.java
@@ -14,7 +14,6 @@
package net.shibboleth.idp.plugin.authn.oidc.rp.impl;
-import java.net.InetAddress;
import java.net.URI;
import java.net.UnknownHostException;
import java.security.Principal;
@@ -22,7 +21,6 @@ import java.util.ArrayList;
import java.util.HashMap;
import java.util.List;
import java.util.Map;
-import java.util.Set;
import javax.annotation.Nonnull;
import javax.annotation.Nullable;
@@ -42,7 +40,6 @@ import org.opensaml.profile.context.PreviousEventContext;
import org.opensaml.profile.context.ProfileRequestContext;
import org.opensaml.xmlsec.config.GlobalAlgorithmRegistryInitializer;
import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
import org.springframework.beans.factory.support.BeanDefinitionBuilder;
import org.springframework.core.io.ClassPathResource;
import org.springframework.webflow.engine.Flow;
@@ -92,6 +89,9 @@ import net.shibboleth.profile.context.RelyingPartyContext;
import net.shibboleth.profile.relyingparty.BasicRelyingPartyConfiguration;
import net.shibboleth.shared.annotation.constraint.NonnullElements;
import net.shibboleth.shared.annotation.constraint.Unmodifiable;
+import net.shibboleth.shared.collection.CollectionSupport;
+import net.shibboleth.shared.logic.Constraint;
+import net.shibboleth.shared.primitive.LoggerFactory;
import net.shibboleth.shared.spring.config.IdentifiableBeanPostProcessor;
import okhttp3.mockwebserver.MockWebServer;
import okhttp3.tls.HandshakeCertificates;
@@ -102,45 +102,46 @@ import okhttp3.tls.HeldCertificate;
*
* <p>Note, the profile configuration which normal exists in oidc-commons i.e.
* inside the relying-party/postconfig.xml, is in the test resources tree in the /conf directory.</p>
- * */
+ */
+
public class OIDCRPFlowTest extends AbstractAuthnXmlFlowExecutionTests {
/** The Default OP Issuer to use.*/
- protected static final String OP_ISSUER_ID = "https://localhost:9918";
+ @Nonnull protected static final String OP_ISSUER_ID = "https://localhost:9918";
/** The OP Issuer to use with an override in the config to use the request object authn param.*/
- protected static final String OP_ISSUER_ID_REQUESTOBJECT_TRUE = "https://localhost:9919";
+ @Nonnull protected static final String OP_ISSUER_ID_REQUESTOBJECT_TRUE = "https://localhost:9919";
/** The OP Issuer to use with an override in the config to use the request object authn param
* signed using RS256.*/
- protected static final String OP_ISSUER_ID_REQUESTOBJECT_TRUE_RSA256_SIG = "https://localhost:9920";
+ @Nonnull protected static final String OP_ISSUER_ID_REQUESTOBJECT_TRUE_RSA256_SIG = "https://localhost:9920";
/** The OP Issuer to use with an override in the config to use the request object authn param
* signed using HS512.*/
- protected static final String OP_ISSUER_ID_REQUESTOBJECT_TRUE_HS512_SIG = "https://localhost:9923";
+ @Nonnull protected static final String OP_ISSUER_ID_REQUESTOBJECT_TRUE_HS512_SIG = "https://localhost:9923";
/** The OP Issuer to use with an override in the config to use the request object authn param
* which is to be encrypted.*/
- protected static final String OP_ISSUER_ID_REQUESTOBJECT_TRUE_ENCRYPT= "https://localhost:9921";
+ @Nonnull protected static final String OP_ISSUER_ID_REQUESTOBJECT_TRUE_ENCRYPT= "https://localhost:9921";
/** A redirect_uri override.*/
- protected static final String REDIRECT_URI_OVERRIDE = "https://localhost/callback";
+ @Nonnull protected static final String REDIRECT_URI_OVERRIDE = "https://localhost/callback";
/** The client_id.*/
- protected static final String CLIENT_ID = "demo_rp";
+ @Nonnull protected static final String CLIENT_ID = "demo_rp";
/** The client_secret.*/
- protected static final String CLIENT_SECRET = "Xp2s5v8y/B?E(H+MbQeThWmYq3t6w9z$";
+ @Nonnull protected static final String CLIENT_SECRET = "Xp2s5v8y/B?E(H+MbQeThWmYq3t6w9z$";
/** A JWKSet resource.*/
- protected static final ClassPathResource REMOTE_JWKSET_RESPONSE =
+ @Nonnull protected static final ClassPathResource REMOTE_JWKSET_RESPONSE =
new ClassPathResource("/conf/credentials/remote-jwkset-response.jwk");
/**
* Example of good provider metadata. Endpoints are localhost to support the
* mock server that is started.
*/
- protected static final ClassPathResource GOOD_PROVIDER_CONFIGURATION_INFO =
+ @Nonnull protected static final ClassPathResource GOOD_PROVIDER_CONFIGURATION_INFO =
new ClassPathResource("/metadata/test-provider-standard.json");
@@ -148,26 +149,26 @@ public class OIDCRPFlowTest extends AbstractAuthnXmlFlowExecutionTests {
* Example of good provider metadata. Endpoints are localhost to support the
* mock server that is started. This OP supports the use of the request object.
*/
- protected static final ClassPathResource GOOD_PROVIDER_CONFIGURATION_INFO_USE_REQUEST_OBJECT =
+ @Nonnull protected static final ClassPathResource GOOD_PROVIDER_CONFIGURATION_INFO_USE_REQUEST_OBJECT =
new ClassPathResource("/metadata/test-provider-requestobject.json");
/**
* Example of good provider metadata. Endpoints are localhost to support the
* mock server that is started. This OP supports the use of the request object.
*/
- protected static final ClassPathResource GOOD_PROVIDER_CONFIGURATION_INFO_USE_REQUEST_OBJECT_ENCRYPT =
+ @Nonnull protected static final ClassPathResource GOOD_PROVIDER_CONFIGURATION_INFO_USE_REQUEST_OBJECT_ENCRYPT =
new ClassPathResource("/metadata/test-provider-requestobject-encrypt.json");
/**
* Example of good provider metadata. Only supports RS256 signature alg for request object.
*/
- protected static final ClassPathResource GOOD_PROVIDER_CONFIGURATION_INFO_USE_REQUEST_OBJECT_RSA256_SIG =
+ @Nonnull protected static final ClassPathResource GOOD_PROVIDER_CONFIGURATION_INFO_USE_REQUEST_OBJECT_RSA256_SIG =
new ClassPathResource("/metadata/test-provider-requestobject-rs256-sig.json");
/**
* Example of good provider metadata. Only supports HS512 signature alg for request object.
*/
- protected static final ClassPathResource GOOD_PROVIDER_CONFIGURATION_INFO_USE_REQUEST_OBJECT_HS512_SIG =
+ @Nonnull protected static final ClassPathResource GOOD_PROVIDER_CONFIGURATION_INFO_USE_REQUEST_OBJECT_HS512_SIG =
new ClassPathResource("/metadata/test-provider-requestobject-HS512-only-sig.json");
@@ -182,7 +183,7 @@ public class OIDCRPFlowTest extends AbstractAuthnXmlFlowExecutionTests {
/** List of mocked subflows.*/
@Nonnull @NonnullElements @Unmodifiable protected final List<Flow> subflows =
- List.of(MockFlowBuilder.MockNoOpFlow("c14n"));
+ CollectionSupport.listOf(MockFlowBuilder.MockNoOpFlow("c14n"));
/**
* Map of flow resources that support building the flow to test.
@@ -190,7 +191,7 @@ public class OIDCRPFlowTest extends AbstractAuthnXmlFlowExecutionTests {
*
* <p>Note, these are all local to the RP, as copied from the IdP. These might need updating in the futre.</p>
*/
- @Nonnull @NonnullElements @Unmodifiable protected final Map<String,String> flowResources =
+ @Nullable @NonnullElements @Unmodifiable protected final Map<String,String> flowResources =
Map.of(
"classpath:flow-test/flows/authn/authn-abstract-flow.xml","authn.abstract",
"classpath:flow-test/flows/authn/conditions/conditions-flow.xml","authn/conditions",
@@ -255,10 +256,11 @@ public class OIDCRPFlowTest extends AbstractAuthnXmlFlowExecutionTests {
final HttpClientConnectionManager cm = PoolingHttpClientConnectionManagerBuilder.create()
.setSSLSocketFactory(sslSocketFactory)
.build();
- addBeanSingleton(builderContext, "shibboleth.InternalHttpClient",HttpClients.custom()
+ addBeanSingleton(builderContext, "shibboleth.InternalHttpClient",
+ Constraint.isNotNull(HttpClients.custom()
.setConnectionManager(cm)
.evictExpiredConnections()
- .build());
+ .build(),"HttpClient can not be null"));
} catch (final Exception e) {
log.error("Could not mock HTTP response",e);
@@ -345,7 +347,7 @@ public class OIDCRPFlowTest extends AbstractAuthnXmlFlowExecutionTests {
*
* @throws ParseException on error.
*/
- protected OIDCPeerEntityContext createPeerContext() throws ParseException {
+ @Nonnull protected OIDCPeerEntityContext createPeerContext() throws ParseException {
final OIDCPeerEntityContext peerCtx = new OIDCPeerEntityContext();
final OIDCProviderMetadata providerMetadata =
OIDCProviderMetadata.parse(TestJsonHelper.readJsonFromFile(GOOD_PROVIDER_CONFIGURATION_INFO));
@@ -360,7 +362,7 @@ public class OIDCRPFlowTest extends AbstractAuthnXmlFlowExecutionTests {
*
* @return the authentication request.
*/
- protected OIDCAuthenticationRequest createAuthenticationRequest() {
+ @Nonnull protected OIDCAuthenticationRequest createAuthenticationRequest() {
final OIDCAuthenticationRequest request = new OIDCAuthenticationRequest(new ClientID(OP_ISSUER_ID));
request.setState(new State("8df98fd63a53fa5b5433d6f8754bca5d.65317332"));
request.setNonce(new Nonce("abadnonce"));
@@ -369,7 +371,7 @@ public class OIDCRPFlowTest extends AbstractAuthnXmlFlowExecutionTests {
return request;
}
- protected OAuth2ClientContext createOAuth2ClientContext(@Nonnull final String clientId,
+ @Nonnull protected OAuth2ClientContext createOAuth2ClientContext(@Nonnull final String clientId,
@Nullable final URI redirectOverride) {
final OAuth2ClientContext context = new OAuth2ClientContext();
context.setClientId(clientId);
@@ -383,7 +385,7 @@ public class OIDCRPFlowTest extends AbstractAuthnXmlFlowExecutionTests {
* @return the basic security configuration.
*/
- protected JSONSecurityConfiguration createBasicSecurityConfigAndValidationParams() {
+ @Nonnull protected JSONSecurityConfiguration createBasicSecurityConfigAndValidationParams() {
final var securityConfig = new JSONSecurityConfiguration();
@@ -409,10 +411,12 @@ public class OIDCRPFlowTest extends AbstractAuthnXmlFlowExecutionTests {
*
* @throws Exception on error.
*/
- protected AuthenticationResponse createAuthenticationResponse() throws Exception {
- return AuthenticationResponseParser.parse(
+ @Nonnull protected AuthenticationResponse createAuthenticationResponse() throws Exception {
+ final AuthenticationResponse authnResponse = AuthenticationResponseParser.parse(
new URI("/idp/profile/Authn/OIDC/RP/callback"
+ "?state=8df98fd63a53fa5b5433d6f8754bca5d.65317332&code=z8C2DCp6sn0D9aGbEqlrFesdPVRXPtDX"));
+ assert authnResponse != null;
+ return authnResponse;
}
@@ -423,8 +427,8 @@ public class OIDCRPFlowTest extends AbstractAuthnXmlFlowExecutionTests {
return super.buildProfileRequestContext(flowId, forceAuthn, addC14Context);
}
-
- protected ProfileRequestContext populateBasicContextTreeFromAuthnResponse(
+ @SuppressWarnings("null")
+ @Nonnull protected ProfileRequestContext populateBasicContextTreeFromAuthnResponse(
final FlowExecutionImpl flowExecution) throws Exception {
final ProfileRequestContext prc = buildProfileRequestContext("authn/OIDCRelyingParty", false,false);
@@ -439,7 +443,7 @@ public class OIDCRPFlowTest extends AbstractAuthnXmlFlowExecutionTests {
final DefaultOIDCAuthorizationConfiguration partyConfig = new DefaultOIDCAuthorizationConfiguration();
partyContext.setProfileConfig(partyConfig);
partyConfig.setClientCredential(TestCredentialHelper.createClientSecretCredential(CLIENT_SECRET));
- partyConfig.setTokenEndpointAuthMethods(Set.of("client_secret_basic"));
+ partyConfig.setTokenEndpointAuthMethods(CollectionSupport.setOf("client_secret_basic"));
partyConfig.setClientId(CLIENT_ID);
partyConfig.setRedirectUriOverride(REDIRECT_URI_OVERRIDE);
final BasicRelyingPartyConfiguration rPartyConfig = new BasicRelyingPartyConfiguration();
@@ -470,6 +474,7 @@ public class OIDCRPFlowTest extends AbstractAuthnXmlFlowExecutionTests {
}
/* Add functions to convert ACR and AMR in id_token responses to principals.*/
+ @SuppressWarnings("null")
protected void addACRAndAMRFunctions(@Nonnull final ProfileRequestContext prc) {
final DefaultOIDCAuthorizationConfiguration partyConfig =
(DefaultOIDCAuthorizationConfiguration) prc.getSubcontext(RelyingPartyContext.class).getProfileConfig();
@@ -504,6 +509,7 @@ public class OIDCRPFlowTest extends AbstractAuthnXmlFlowExecutionTests {
* @param prc the prc
* @return the relying party configuration
*/
+ @SuppressWarnings("null")
protected DefaultOIDCAuthorizationConfiguration getRelyingPartyProfileConfig(final ProfileRequestContext prc) {
return (DefaultOIDCAuthorizationConfiguration) prc.getSubcontext(AuthenticationContext.class)
.getSubcontext(ProfileRequestContext.class)
@@ -521,24 +527,34 @@ public class OIDCRPFlowTest extends AbstractAuthnXmlFlowExecutionTests {
protected ProfileRequestContext assertStandardEndFlowSuccessConditions(final ProfileRequestContext rootPrc) {
//assert success conditions.
assertFlowExecutionEnded();
- assertNotNull(rootPrc.getSubcontext(AuthenticationContext.class));
+ final var ac = rootPrc.getSubcontext(AuthenticationContext.class);
+ assertNotNull(ac);
+ assert ac != null;
// Is there an authn result?
- assertNotNull(rootPrc.getSubcontext(AuthenticationContext.class).getAuthenticationResult());
- assertNotNull(rootPrc.getSubcontext(SubjectCanonicalizationContext.class));
- assertNotNull(rootPrc.getSubcontext(SubjectCanonicalizationContext.class).getSubject().getPrincipals());
+ assertNotNull(ac.getAuthenticationResult());
+ final var subjectC14nCtx = rootPrc.getSubcontext(SubjectCanonicalizationContext.class);
+ assertNotNull(subjectC14nCtx);
+ assert subjectC14nCtx != null;
+ final var subject = subjectC14nCtx.getSubject();
+ assertNotNull(subject);
+ assert subject != null;
+ assertNotNull(subject.getPrincipals());
//As SimpleSubjectCanonicalization has not been run, we pull out the subject
final OIDCSubjectIdentifierPrincipal subjectIndentifierPrincipal =
- rootPrc.getSubcontext(SubjectCanonicalizationContext.class).getSubject()
- .getPrincipals(OIDCSubjectIdentifierPrincipal.class).iterator().next();
+ subject.getPrincipals(OIDCSubjectIdentifierPrincipal.class).iterator().next();
assertNotNull(subjectIndentifierPrincipal);
assertEquals(subjectIndentifierPrincipal.getName(),"jdoe");
- final var nestedPrc = rootPrc.getSubcontext(AuthenticationContext.class)
- .getSubcontext(ProfileRequestContext.class);
- assertTrue(nestedPrc.getInboundMessageContext().getMessage() instanceof AuthenticationResponse);
- assertNotNull(nestedPrc.getInboundMessageContext().getSubcontext(AccessTokenResponseContext.class));
- assertNotNull(nestedPrc.getInboundMessageContext().getSubcontext(UserInfoResponseContext.class));
- assertNotNull(nestedPrc.getInboundMessageContext().getSubcontext(EndUserClaimsContext.class));
+ final var nestedPrc = ac.getSubcontext(ProfileRequestContext.class);
+ assertNotNull(nestedPrc);
+ assert nestedPrc != null;
+ final var inboundMsgCtx = nestedPrc.getInboundMessageContext();
+ assertNotNull(inboundMsgCtx);
+ assert inboundMsgCtx != null;
+ assertTrue(inboundMsgCtx.getMessage() instanceof AuthenticationResponse);
+ assertNotNull(inboundMsgCtx.getSubcontext(AccessTokenResponseContext.class));
+ assertNotNull(inboundMsgCtx.getSubcontext(UserInfoResponseContext.class));
+ assertNotNull(inboundMsgCtx.getSubcontext(EndUserClaimsContext.class));
return nestedPrc;
}
@@ -553,22 +569,30 @@ public class OIDCRPFlowTest extends AbstractAuthnXmlFlowExecutionTests {
protected ProfileRequestContext assertStandardAuthenticationRedirectFlowSuccessConditions(
final ProfileRequestContext rootPrc) {
//assert success conditions.
- assertCurrentStateEquals("AuthnRequest");
- assertNotNull(rootPrc.getSubcontext(AuthenticationContext.class));
-
- assertNotNull(rootPrc.getSubcontext(AuthenticationContext.class).getSubcontext(ProfileRequestContext.class));
- assertNotNull(rootPrc.getSubcontext(AuthenticationContext.class).getSubcontext(ProfileRequestContext.class)
- .getOutboundMessageContext());
- assertTrue(rootPrc.getSubcontext(AuthenticationContext.class).getSubcontext(ProfileRequestContext.class)
- .getOutboundMessageContext().getMessage() instanceof OIDCAuthenticationRequest);
+ assertCurrentStateEquals("AuthnRequest");
+ final var ac = rootPrc.getSubcontext(AuthenticationContext.class);
+ assertNotNull(ac);
+ assert ac != null;
+
+ final var nestedPrc = ac.getSubcontext(ProfileRequestContext.class);
+ assertNotNull(nestedPrc);
+ assert nestedPrc != null;
+ final var ouboundMsgCtx = nestedPrc.getOutboundMessageContext();
+ assertNotNull(ouboundMsgCtx);
+ assert ouboundMsgCtx != null;
+
+
+ assertTrue(ouboundMsgCtx.getMessage() instanceof OIDCAuthenticationRequest);
final OIDCAuthenticationRequest request =
- (OIDCAuthenticationRequest) rootPrc.getSubcontext(AuthenticationContext.class)
- .getSubcontext(ProfileRequestContext.class).getOutboundMessageContext().getMessage();
+ (OIDCAuthenticationRequest) ouboundMsgCtx.getMessage();
+ assert request != null;
assertEquals(request.getResponseType(), ResponseType.CODE);
- assertEquals(request.getRedirectURI().toASCIIString(), "https://localhost/callback");
+ final var redirectUri = request.getRedirectURI();
+ assert redirectUri != null;
+ assertEquals(redirectUri.toASCIIString(), "https://localhost/callback");
assertEquals(request.getResponseMode(), ResponseMode.QUERY);
- return rootPrc.getSubcontext(AuthenticationContext.class).getSubcontext(ProfileRequestContext.class);
+ return ac.getSubcontext(ProfileRequestContext.class);
}
/**
@@ -585,10 +609,19 @@ public class OIDCRPFlowTest extends AbstractAuthnXmlFlowExecutionTests {
// No subject result
assertNull(rootPrc.getSubcontext(SubjectCanonicalizationContext.class));
// No an authn result
- assertNull(rootPrc.getSubcontext(AuthenticationContext.class).getAuthenticationResult());
+ final var ac = rootPrc.getSubcontext(AuthenticationContext.class);
+ assertNotNull(ac);
+ assert ac != null;
+ final var acResult = ac.getAuthenticationResult();
+ assertNull(acResult);
// Ensure flow did not produce an end-user message context
- assertNull(rootPrc.getSubcontext(AuthenticationContext.class).getSubcontext(ProfileRequestContext.class)
- .getInboundMessageContext().getSubcontext(EndUserClaimsContext.class));
+ final var nestedPrc = ac.getSubcontext(ProfileRequestContext.class);
+ assertNotNull(nestedPrc);
+ assert nestedPrc != null;
+ final var inboundMsgCtx = nestedPrc.getInboundMessageContext();
+ assertNotNull(inboundMsgCtx);
+ assert inboundMsgCtx != null;
+ assertNull(inboundMsgCtx.getSubcontext(EndUserClaimsContext.class));
assertPreviousEventContextError(rootPrc, error);
}
@@ -603,11 +636,23 @@ public class OIDCRPFlowTest extends AbstractAuthnXmlFlowExecutionTests {
assertFlowExecutionEnded();
// No subject result
assertNull(rootPrc.getSubcontext(SubjectCanonicalizationContext.class));
+
// No an authn result
- assertNull(rootPrc.getSubcontext(AuthenticationContext.class).getAuthenticationResult());
+ final var ac = rootPrc.getSubcontext(AuthenticationContext.class);
+ assertNotNull(ac);
+ assert ac != null;
+ final var acResult = ac.getAuthenticationResult();
+ assertNull(acResult);
+ assert acResult == null;
+
// Ensure flow did not produce an end-user message context
- assertNull(rootPrc.getSubcontext(AuthenticationContext.class).getSubcontext(ProfileRequestContext.class)
- .getInboundMessageContext().getSubcontext(EndUserClaimsContext.class));
+ final var nestedPrc = ac.getSubcontext(ProfileRequestContext.class);
+ assertNotNull(nestedPrc);
+ assert nestedPrc != null;
+ final var inboundMsgCtx = nestedPrc.getInboundMessageContext();
+ assertNotNull(inboundMsgCtx);
+ assert inboundMsgCtx != null;
+ assertNull(inboundMsgCtx.getSubcontext(EndUserClaimsContext.class));
}
/**
@@ -634,14 +679,16 @@ public class OIDCRPFlowTest extends AbstractAuthnXmlFlowExecutionTests {
protected void assertPreviousEventContextError(@Nonnull final ProfileRequestContext rootPrc,
@Nonnull final String error) {
- assertNotNull(rootPrc.getSubcontext(AuthenticationContext.class));
- assertNotNull(rootPrc.getSubcontext(AuthenticationContext.class).getSubcontext(ProfileRequestContext.class));
- assertNotNull(rootPrc.getSubcontext(AuthenticationContext.class).getSubcontext(ProfileRequestContext.class)
- .getSubcontext(PreviousEventContext.class));
- final var previousEvent = rootPrc.getSubcontext(AuthenticationContext.class)
- .getSubcontext(ProfileRequestContext.class)
- .getSubcontext(PreviousEventContext.class);
-
+ final var ac = rootPrc.getSubcontext(AuthenticationContext.class);
+ assertNotNull(ac);
+ assert ac != null;
+ final var nestedPrc = ac.getSubcontext(ProfileRequestContext.class);
+ assertNotNull(nestedPrc);
+ assert nestedPrc != null;
+ assertNotNull(nestedPrc.getSubcontext(PreviousEventContext.class));
+ final var previousEvent = nestedPrc.getSubcontext(PreviousEventContext.class);
+ assertNotNull(previousEvent);
+ assert previousEvent != null;
assertTrue(previousEvent.getEvent() instanceof String);
assertEquals(error, (String)previousEvent.getEvent());
}
@@ -684,12 +731,20 @@ public class OIDCRPFlowTest extends AbstractAuthnXmlFlowExecutionTests {
*/
protected void assertIdTokenSignatureAndClaimsVerified(final ProfileRequestContext nestedPrc)
throws java.text.ParseException {
- final var accessTokenResponse =
- nestedPrc.getInboundMessageContext().getSubcontext(AccessTokenResponseContext.class);
- assertNotNull(accessTokenResponse.getTokenResponse().getOIDCTokens().getIDToken());
+
+ final var inboundMsgCtx = nestedPrc.getInboundMessageContext();
+ assertNotNull(inboundMsgCtx);
+ assert inboundMsgCtx != null;
+ final var accessTokenResponse = inboundMsgCtx.getSubcontext(AccessTokenResponseContext.class);
+ assertNotNull(accessTokenResponse);
+ assert accessTokenResponse != null;
+ final var tokenResponse = accessTokenResponse.getTokenResponse();
+ assertNotNull(tokenResponse);
+ assert tokenResponse != null;
+ assertNotNull(tokenResponse.getOIDCTokens().getIDToken());
//TODO this might change if the token we mutate is not in the original token response
- assertTrue(accessTokenResponse.getTokenResponse().getOIDCTokens().getIDToken() instanceof SignedJWT);
- final var signedJwt = (SignedJWT) accessTokenResponse.getTokenResponse().getOIDCTokens().getIDToken();
+ assertTrue(tokenResponse.getOIDCTokens().getIDToken() instanceof SignedJWT);
+ final var signedJwt = (SignedJWT) tokenResponse.getOIDCTokens().getIDToken();
assertEquals(signedJwt.getState(), com.nimbusds.jose.JWSObject.State.VERIFIED);
assertStandardIdTokenClaimsSuccessCondition(signedJwt.getJWTClaimsSet());
}
@@ -703,11 +758,19 @@ public class OIDCRPFlowTest extends AbstractAuthnXmlFlowExecutionTests {
*/
protected void assertUserInfoTokenSignatureVerified(final ProfileRequestContext nestedPrc)
throws java.text.ParseException {
- final var userInfoResponse =
- nestedPrc.getInboundMessageContext().getSubcontext(UserInfoResponseContext.class);
- assertNotNull(userInfoResponse.getUserInfo());
- assertEquals(userInfoResponse.getUserInfo().getEntityContentType(), ContentType.APPLICATION_JWT);
- final var jwtResponse = userInfoResponse.getUserInfo().getUserInfoJWT();
+
+ final var inboundMsgCtx = nestedPrc.getInboundMessageContext();
+ assertNotNull(inboundMsgCtx);
+ assert inboundMsgCtx != null;
+
+ final var userInfoResponse = inboundMsgCtx.getSubcontext(UserInfoResponseContext.class);
+ assertNotNull(userInfoResponse);
+ assert userInfoResponse != null;
+ final var userInfo = userInfoResponse.getUserInfo();
+ assertNotNull(userInfo);
+ assert userInfo != null;
+ assertEquals(userInfo.getEntityContentType(), ContentType.APPLICATION_JWT);
+ final var jwtResponse = userInfo.getUserInfoJWT();
assertTrue(jwtResponse instanceof SignedJWT);
final var signedJwt = (SignedJWT) jwtResponse;
assertEquals(signedJwt.getState(), com.nimbusds.jose.JWSObject.State.VERIFIED);
@@ -723,10 +786,19 @@ public class OIDCRPFlowTest extends AbstractAuthnXmlFlowExecutionTests {
*/
protected void assertPlainJSONObjectUserInfoToken(final ProfileRequestContext nestedPrc)
throws java.text.ParseException {
- final var userInfoResponse =
- nestedPrc.getInboundMessageContext().getSubcontext(UserInfoResponseContext.class);
+
+ final var inboundMsgCtx = nestedPrc.getInboundMessageContext();
+ assertNotNull(inboundMsgCtx);
+ assert inboundMsgCtx != null;
+
+ final var userInfoResponse = inboundMsgCtx.getSubcontext(UserInfoResponseContext.class);
+ assertNotNull(userInfoResponse);
+ assert userInfoResponse != null;
assertNotNull(userInfoResponse.getUserInfo());
- assertTrue(userInfoResponse.getUserInfo().getEntityContentType() == ContentType.APPLICATION_JSON);
+ final var userInfo = userInfoResponse.getUserInfo();
+ assertNotNull(userInfo);
+ assert userInfo != null;
+ assertTrue(userInfo.getEntityContentType() == ContentType.APPLICATION_JSON);
}
@@ -739,8 +811,15 @@ public class OIDCRPFlowTest extends AbstractAuthnXmlFlowExecutionTests {
*/
protected void assertEndUserClaimsVerified(final ProfileRequestContext nestedPrc)
throws java.text.ParseException {
+
+ final var inboundMsgCtx = nestedPrc.getInboundMessageContext();
+ assertNotNull(inboundMsgCtx);
+ assert inboundMsgCtx != null;
+
final var endUserClaims =
- nestedPrc.getInboundMessageContext().getSubcontext(EndUserClaimsContext.class);
+ inboundMsgCtx.getSubcontext(EndUserClaimsContext.class);
+ assertNotNull(endUserClaims);
+ assert endUserClaims != null;
assertStandardEndUserClaimsSuccessCondition(endUserClaims.getEndUserClaims());
}
diff --git a/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/ProcessEndUserClaimsTest.java b/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/ProcessEndUserClaimsTest.java
index f2316a5..9657b15 100644
--- a/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/ProcessEndUserClaimsTest.java
+++ b/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/ProcessEndUserClaimsTest.java
@@ -149,15 +149,20 @@ public class ProcessEndUserClaimsTest extends AbstractOIDCTest {
action.initialize();
action.execute(src);
- assertNotNull(prc.getInboundMessageContext().getSubcontext(EndUserClaimsContext.class));
+ final var inboundMsg = prc.getInboundMessageContext();
+ assert inboundMsg != null;
+ assertNotNull(inboundMsg.getSubcontext(EndUserClaimsContext.class));
final EndUserClaimsContext claimsContext =
- prc.getInboundMessageContext().getSubcontext(EndUserClaimsContext.class);
- assertNull(claimsContext.getEndUserClaims().getClaim("iss"));
- assertNull(claimsContext.getEndUserClaims().getClaim("aud"));
- assertEquals(claimsContext.getEndUserClaims().getClaim("sub"), "jdoe");
- assertEquals(claimsContext.getEndUserClaims().getClaim("family_name"), "blogs");
- assertEquals(claimsContext.getEndUserClaims().getClaim("given_name"), "joe");
- assertEquals(claimsContext.getEndUserClaims().getClaim("email"), "joe at example.com");
+ inboundMsg.getSubcontext(EndUserClaimsContext.class);
+ assert claimsContext != null;
+ final var claims = claimsContext.getEndUserClaims();
+ assert claims != null;
+ assertNull(claims.getClaim("iss"));
+ assertNull(claims.getClaim("aud"));
+ assertEquals(claims.getClaim("sub"), "jdoe");
+ assertEquals(claims.getClaim("family_name"), "blogs");
+ assertEquals(claims.getClaim("given_name"), "joe");
+ assertEquals(claims.getClaim("email"), "joe at example.com");
}
@Test
@@ -166,9 +171,14 @@ public class ProcessEndUserClaimsTest extends AbstractOIDCTest {
action.initialize();
final Event event = action.execute(src);
assertNull(event);
- assertNotNull(prc.getInboundMessageContext().getSubcontext(EndUserClaimsContext.class).getEndUserClaims());
- final ClaimsSet claims =
- prc.getInboundMessageContext().getSubcontext(EndUserClaimsContext.class).getEndUserClaims();
+ final var inboundMsg = prc.getInboundMessageContext();
+ assert inboundMsg != null;
+ assertNotNull(inboundMsg.getSubcontext(EndUserClaimsContext.class));
+ final EndUserClaimsContext claimsContext =
+ inboundMsg.getSubcontext(EndUserClaimsContext.class);
+ assert claimsContext != null;
+ final var claims = claimsContext.getEndUserClaims();
+ assert claims != null;
assertEquals(claims.getClaim("name"),"jdoe");
assertEquals(claims.getClaim("sub"),"jdoe");
assertEquals(claims.getClaim("given_name"),"joe");
@@ -185,9 +195,14 @@ public class ProcessEndUserClaimsTest extends AbstractOIDCTest {
action.initialize();
final Event event = action.execute(src);
assertNull(event);
- assertNotNull(prc.getInboundMessageContext().getSubcontext(EndUserClaimsContext.class).getEndUserClaims());
- final ClaimsSet claims =
- prc.getInboundMessageContext().getSubcontext(EndUserClaimsContext.class).getEndUserClaims();
+ final var inboundMsg = prc.getInboundMessageContext();
+ assert inboundMsg != null;
+ assertNotNull(inboundMsg.getSubcontext(EndUserClaimsContext.class));
+ final EndUserClaimsContext claimsContext =
+ inboundMsg.getSubcontext(EndUserClaimsContext.class);
+ assert claimsContext != null;
+ final var claims = claimsContext.getEndUserClaims();
+ assert claims != null;
assertEquals(claims.getClaim("name"),"jdoe");
assertEquals(claims.getClaim("sub"),"jdoe");
assertEquals(claims.getClaim("given_name"),"joe");
@@ -205,15 +220,20 @@ public class ProcessEndUserClaimsTest extends AbstractOIDCTest {
action.initialize();
action.execute(src);
- assertNotNull(prc.getInboundMessageContext().getSubcontext(EndUserClaimsContext.class));
+ final var inboundMsg = prc.getInboundMessageContext();
+ assert inboundMsg != null;
+ assertNotNull(inboundMsg.getSubcontext(EndUserClaimsContext.class));
final EndUserClaimsContext claimsContext =
- prc.getInboundMessageContext().getSubcontext(EndUserClaimsContext.class);
- assertNull(claimsContext.getEndUserClaims().getClaim("iss"));
- assertNull(claimsContext.getEndUserClaims().getClaim("aud"));
- assertEquals(claimsContext.getEndUserClaims().getClaim("sub"), "jdoe");
- assertEquals(claimsContext.getEndUserClaims().getClaim("family_name"), "blogs");
- assertNull(claimsContext.getEndUserClaims().getClaim("given_name"), "joe");
- assertNull(claimsContext.getEndUserClaims().getClaim("email"), "joe at example.com");
+ inboundMsg.getSubcontext(EndUserClaimsContext.class);
+ assert claimsContext != null;
+ final var claims = claimsContext.getEndUserClaims();
+ assert claims != null;
+ assertNull(claims.getClaim("iss"));
+ assertNull(claims.getClaim("aud"));
+ assertEquals(claims.getClaim("sub"), "jdoe");
+ assertEquals(claims.getClaim("family_name"), "blogs");
+ assertNull(claims.getClaim("given_name"), "joe");
+ assertNull(claims.getClaim("email"), "joe at example.com");
}
@Test
@@ -228,8 +248,9 @@ public class ProcessEndUserClaimsTest extends AbstractOIDCTest {
});
action.initialize();
- final Event event = action.execute(src);
-
+ final Event event = action.execute(src);
+ assertNotNull(event);
+ assert event != null;
assertEquals(event.getId(), EventIds.INVALID_PROFILE_CTX);
}
@@ -255,13 +276,18 @@ public class ProcessEndUserClaimsTest extends AbstractOIDCTest {
action.initialize();
action.execute(src);
- assertNotNull(prc.getInboundMessageContext().getSubcontext(EndUserClaimsContext.class));
+ final var inboundMsg = prc.getInboundMessageContext();
+ assert inboundMsg != null;
+ assertNotNull(inboundMsg.getSubcontext(EndUserClaimsContext.class));
final EndUserClaimsContext claimsContext =
- prc.getInboundMessageContext().getSubcontext(EndUserClaimsContext.class);
- assertNull(claimsContext.getEndUserClaims().getClaim("iss"));
- assertNull(claimsContext.getEndUserClaims().getClaim("aud"));
- assertEquals(claimsContext.getEndUserClaims().getClaim("given_name"), "joe");
- assertEquals(claimsContext.getEndUserClaims().getClaim("email"), "joe at example.com");
+ inboundMsg.getSubcontext(EndUserClaimsContext.class);
+ assert claimsContext != null;
+ final var claims = claimsContext.getEndUserClaims();
+ assert claims != null;
+ assertNull(claims.getClaim("iss"));
+ assertNull(claims.getClaim("aud"));
+ assertEquals(claims.getClaim("given_name"), "joe");
+ assertEquals(claims.getClaim("email"), "joe at example.com");
}
diff --git a/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/SimpleOIDCSubjectIdentifierCanonicalizationTest.java b/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/SimpleOIDCSubjectIdentifierCanonicalizationTest.java
index e731b0b..1da4910 100644
--- a/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/SimpleOIDCSubjectIdentifierCanonicalizationTest.java
+++ b/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/SimpleOIDCSubjectIdentifierCanonicalizationTest.java
@@ -25,8 +25,6 @@ import org.testng.Assert;
import org.testng.annotations.BeforeMethod;
import org.testng.annotations.Test;
-import com.google.common.base.Predicates;
-
import net.shibboleth.idp.authn.AuthnEventIds;
import net.shibboleth.idp.authn.context.AuthenticationContext;
import net.shibboleth.idp.authn.context.SubjectCanonicalizationContext;
@@ -34,6 +32,7 @@ import net.shibboleth.idp.plugin.authn.oidc.rp.principal.OIDCSubjectIdentifierPr
import net.shibboleth.idp.profile.context.navigate.WebflowRequestContextProfileRequestContextLookup;
import net.shibboleth.idp.profile.testing.ActionTestingSupport;
import net.shibboleth.shared.collection.Pair;
+import net.shibboleth.shared.logic.PredicateSupport;
/** Tests for {@link SimpleOIDCSubjectIdentifierCanonicalization}.*/
@@ -50,7 +49,7 @@ public class SimpleOIDCSubjectIdentifierCanonicalizationTest extends AbstractOID
action.setProfileContextLookupStrategy(new ChildContextLookup<>(ProfileRequestContext.class).compose(
new ChildContextLookup<>(AuthenticationContext.class)
.compose(new WebflowRequestContextProfileRequestContextLookup())));
- action.setActivationCondition(Predicates.alwaysTrue());
+ action.setActivationCondition(PredicateSupport.alwaysTrue());
action.initialize();
}
@@ -67,7 +66,9 @@ public class SimpleOIDCSubjectIdentifierCanonicalizationTest extends AbstractOID
final Event event = action.execute(src);
ActionTestingSupport.assertEvent(event, AuthnEventIds.INVALID_SUBJECT);
- Assert.assertNotNull(prc.getSubcontext(SubjectCanonicalizationContext.class).getException());
+ final var subjectC14nCtx = prc.getSubcontext(SubjectCanonicalizationContext.class);
+ assert subjectC14nCtx != null;
+ Assert.assertNotNull(subjectC14nCtx.getException());
}
@Test public void testMultiPrincipals() {
@@ -79,7 +80,9 @@ public class SimpleOIDCSubjectIdentifierCanonicalizationTest extends AbstractOID
final Event event = action.execute(src);
ActionTestingSupport.assertEvent(event, AuthnEventIds.INVALID_SUBJECT);
- Assert.assertNotNull(prc.getSubcontext(SubjectCanonicalizationContext.class).getException());
+ final var subjectC14nCtx = prc.getSubcontext(SubjectCanonicalizationContext.class);
+ assert subjectC14nCtx != null;
+ Assert.assertNotNull(subjectC14nCtx.getException());
}
@Test public void testSuccess() {
@@ -91,6 +94,7 @@ public class SimpleOIDCSubjectIdentifierCanonicalizationTest extends AbstractOID
ActionTestingSupport.assertProceedEvent(event);
final SubjectCanonicalizationContext sc = prc.getSubcontext(SubjectCanonicalizationContext.class);
+ assert sc != null;
Assert.assertEquals(sc.getPrincipalName(), "foo");
}
@@ -103,6 +107,7 @@ public class SimpleOIDCSubjectIdentifierCanonicalizationTest extends AbstractOID
ActionTestingSupport.assertProceedEvent(event);
final SubjectCanonicalizationContext sc = prc.getSubcontext(SubjectCanonicalizationContext.class);
+ assert sc != null;
Assert.assertEquals(sc.getPrincipalName(), "foo");
}
diff --git a/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/UserInfoEndpointLookupTest.java b/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/UserInfoEndpointLookupTest.java
index 685f471..3ba4172 100644
--- a/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/UserInfoEndpointLookupTest.java
+++ b/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/UserInfoEndpointLookupTest.java
@@ -23,16 +23,12 @@ import static org.testng.Assert.fail;
import java.net.URI;
import java.net.URISyntaxException;
-import javax.annotation.Nonnull;
-
import org.apache.hc.client5.http.classic.HttpClient;
import org.apache.hc.client5.http.classic.methods.HttpUriRequest;
import org.apache.hc.core5.http.ClassicHttpResponse;
import org.apache.hc.core5.http.HttpHost;
-import org.apache.hc.core5.http.HttpResponse;
import org.apache.hc.core5.http.io.entity.StringEntity;
import org.apache.hc.core5.http.io.support.ClassicRequestBuilder;
-import org.apache.hc.core5.http.message.StatusLine;
import org.apache.hc.core5.http.protocol.HttpContext;
import org.apache.hc.core5.net.URIBuilder;
import org.mockito.Mockito;
@@ -60,7 +56,7 @@ import net.shibboleth.oidc.profile.core.OidcEventIds;
public class UserInfoEndpointLookupTest extends AbstractOIDCTest {
/** The action to test.*/
- @Nonnull private UserInfoEndpointLookup action;
+ private UserInfoEndpointLookup action;
@Override
@@ -127,13 +123,16 @@ public class UserInfoEndpointLookupTest extends AbstractOIDCTest {
final Event event = action.execute(src);
//Null is success
assertNull(event);
- assertNotNull(prc.getInboundMessageContext().getSubcontext(UserInfoResponseContext.class));
- assertNotNull(prc.getInboundMessageContext().getSubcontext(UserInfoResponseContext.class)
- .getUserInfo());
- assertEquals(prc.getInboundMessageContext().getSubcontext(UserInfoResponseContext.class)
- .getUserInfo().getEntityContentType(), ContentType.APPLICATION_JSON);
- assertNotNull(prc.getInboundMessageContext().getSubcontext(UserInfoResponseContext.class)
- .getUserInfo().getUserInfo().getClaim("sub"),"248289761001");
+ final var inboundMsgCtx = prc.getInboundMessageContext();
+ assert inboundMsgCtx != null;
+ final var userInfoCtx = inboundMsgCtx.getSubcontext(UserInfoResponseContext.class);
+ assertNotNull(userInfoCtx);
+ assert userInfoCtx != null;
+ assertNotNull(userInfoCtx.getUserInfo());
+ final var userInfo = userInfoCtx.getUserInfo();
+ assert userInfo != null;
+ assertEquals(userInfo.getEntityContentType(), ContentType.APPLICATION_JSON);
+ assertNotNull(userInfo.getUserInfo().getClaim("sub"),"248289761001");
}
@@ -182,6 +181,7 @@ public class UserInfoEndpointLookupTest extends AbstractOIDCTest {
final Event event = action.execute(src);
assertNotNull(event);
+ assert event != null;
assertEquals(event.getId(), OidcEventIds.INVALID_USERINFO_CLAIMS);
}
@@ -192,6 +192,8 @@ public class UserInfoEndpointLookupTest extends AbstractOIDCTest {
final HttpClient httpClient = Mockito.mock(HttpClient.class);
final ClassicHttpResponse httpResponse = Mockito.mock(ClassicHttpResponse.class);
Mockito.when(httpResponse.getCode()).thenReturn(200);
+ Mockito.when(httpClient.executeOpen((HttpHost) Mockito.any(), (HttpUriRequest) Mockito.any(), (
+ HttpContext) Mockito.any())).thenReturn(httpResponse);
// create new client with mock response
action.setHttpClient(httpClient);
@@ -222,6 +224,7 @@ public class UserInfoEndpointLookupTest extends AbstractOIDCTest {
//Null is success
assertNotNull(event);
+ assert event != null;
assertEquals(event.getId(),OidcEventIds.INVALID_USERINFO_CLAIMS);
}
diff --git a/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/ValidateAuthenticationResponseResultTest.java b/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/ValidateAuthenticationResponseResultTest.java
index 59d772a..7db509e 100644
--- a/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/ValidateAuthenticationResponseResultTest.java
+++ b/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/ValidateAuthenticationResponseResultTest.java
@@ -15,6 +15,7 @@
package net.shibboleth.idp.plugin.authn.oidc.rp.impl;
import static org.testng.Assert.assertEquals;
+import static org.testng.Assert.assertNotNull;
import static org.testng.Assert.assertNull;
import java.net.URI;
@@ -77,6 +78,8 @@ public class ValidateAuthenticationResponseResultTest extends AbstractOIDCTest {
action.initialize();
final Event event = action.execute(src);
+ assertNotNull(event);
+ assert event != null;
assertEquals(event.getId(), EventIds.INVALID_MSG_CTX);
}
@@ -89,6 +92,8 @@ public class ValidateAuthenticationResponseResultTest extends AbstractOIDCTest {
action.initialize();
final Event event = action.execute(src);
+ assertNotNull(event);
+ assert event != null;
assertEquals(event.getId(), EventIds.INVALID_MSG_CTX);
}
@@ -106,6 +111,8 @@ public class ValidateAuthenticationResponseResultTest extends AbstractOIDCTest {
action.initialize();
final Event event = action.execute(src);
+ assertNotNull(event);
+ assert event != null;
assertEquals(event.getId(), EventIds.MESSAGE_PROC_ERROR);
}
diff --git a/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/ValidateOAuthAccessTokenResponseTest.java b/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/ValidateOAuthAccessTokenResponseTest.java
index ec440d0..feaca31 100644
--- a/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/ValidateOAuthAccessTokenResponseTest.java
+++ b/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/ValidateOAuthAccessTokenResponseTest.java
@@ -138,7 +138,7 @@ public class ValidateOAuthAccessTokenResponseTest extends AbstractOIDCTest {
action.initialize();
final Event event = action.execute(src);
-
+ assertNotNull(event);
assertEquals(event.getId(), OidcEventIds.INVALID_ACCESS_TOKEN);
}
diff --git a/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/ValidateOIDCAuthenticationTest.java b/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/ValidateOIDCAuthenticationTest.java
index e3191b3..38c55eb 100644
--- a/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/ValidateOIDCAuthenticationTest.java
+++ b/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/ValidateOIDCAuthenticationTest.java
@@ -58,6 +58,7 @@ import net.shibboleth.idp.profile.context.navigate.WebflowRequestContextProfileR
import net.shibboleth.idp.saml.authn.principal.AuthenticationMethodPrincipal;
import net.shibboleth.idp.saml.authn.principal.AuthnContextClassRefPrincipal;
import net.shibboleth.oidc.attribute.transcoding.OIDCAttributeTranscoder;
+import net.shibboleth.shared.collection.CollectionSupport;
import net.shibboleth.shared.component.ComponentInitializationException;
import net.shibboleth.shared.testing.MockApplicationContext;
import net.shibboleth.shared.testing.MockReloadableService;
@@ -99,7 +100,7 @@ public class ValidateOIDCAuthenticationTest extends AbstractOIDCTest {
ruleset1.put("name", "bar");
- registry.setTranscoderRegistry(List.of(
+ registry.setTranscoderRegistry(CollectionSupport.listOf(
new TranscodingRule(ruleset1)));
registry.setApplicationContext(new MockApplicationContext());
registry.initialize();
@@ -152,15 +153,18 @@ public class ValidateOIDCAuthenticationTest extends AbstractOIDCTest {
.claim("amr", List.of("pwd", "otp"))
.expirationTime(Date.from(Instant.now().plusSeconds(120)))
.build());
-
+ final var claimsSet = jwt.getJWTClaimsSet();
+ assert claimsSet != null;
final EndUserClaimsContext endClaimsContext = new EndUserClaimsContext();
final ClaimsSet endUserClaims = new ClaimsSet();
// We put all the claims in the JWT in here, not just the 'sanitized' ones
- endUserClaims.putAll(jwt.getJWTClaimsSet().getClaims());
- endClaimsContext.setUnprocessedIdTokenClaims(jwt.getJWTClaimsSet());
+ endUserClaims.putAll(claimsSet.getClaims());
+ endClaimsContext.setUnprocessedIdTokenClaims(claimsSet);
endClaimsContext.setEndUserClaims(endUserClaims);
- prc.getInboundMessageContext().addSubcontext(endClaimsContext);
+ final var inboundMsgCtx = prc.getInboundMessageContext();
+ assert inboundMsgCtx != null;
+ inboundMsgCtx.addSubcontext(endClaimsContext);
setupTranscoderRegistry();
setupAttributeFilter();
@@ -197,8 +201,10 @@ public class ValidateOIDCAuthenticationTest extends AbstractOIDCTest {
assertNull(result);
assertNotNull(ac.getAuthenticationResult());
- assertNotNull(ac.getAuthenticationResult().getSubject());
- final var subject = ac.getAuthenticationResult().getSubject();
+ final var authnResult = ac.getAuthenticationResult();
+ assert authnResult != null;
+ assertNotNull(authnResult.getSubject());
+ final var subject = authnResult.getSubject();
assertEquals(subject.getPrincipals(OIDCSubjectIdentifierPrincipal.class).size(), 1);
assertEquals(subject.getPrincipals(IdPAttributePrincipal.class).size(), 1);
assertEquals(subject.getPrincipals(IdPAttributePrincipal.class)
@@ -215,8 +221,10 @@ public class ValidateOIDCAuthenticationTest extends AbstractOIDCTest {
assertNull(result);
assertNotNull(ac.getAuthenticationResult());
- assertNotNull(ac.getAuthenticationResult().getSubject());
- final var subject = ac.getAuthenticationResult().getSubject();
+ final var authnResult = ac.getAuthenticationResult();
+ assert authnResult != null;
+ assertNotNull(authnResult.getSubject());
+ final var subject = authnResult.getSubject();
assertEquals(subject.getPrincipals(OIDCSubjectIdentifierPrincipal.class).size(), 1);
assertEquals(subject.getPrincipals(IdPAttributePrincipal.class).size(), 1);
assertEquals(subject.getPrincipals(IdPAttributePrincipal.class)
@@ -238,8 +246,10 @@ public class ValidateOIDCAuthenticationTest extends AbstractOIDCTest {
assertNull(result);
assertNotNull(ac.getAuthenticationResult());
- assertNotNull(ac.getAuthenticationResult().getSubject());
- final var subject = ac.getAuthenticationResult().getSubject();
+ final var authnResult = ac.getAuthenticationResult();
+ assert authnResult != null;
+ assertNotNull(authnResult.getSubject());
+ final var subject = authnResult.getSubject();
assertEquals(subject.getPrincipals(OIDCSubjectIdentifierPrincipal.class).size(), 1);
assertEquals(subject.getPrincipals(IdPAttributePrincipal.class).size(), 1);
assertEquals(subject.getPrincipals(IdPAttributePrincipal.class)
diff --git a/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/ValidateResponseStateTest.java b/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/ValidateResponseStateTest.java
index 6f96126..9b628cb 100644
--- a/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/ValidateResponseStateTest.java
+++ b/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/ValidateResponseStateTest.java
@@ -15,6 +15,7 @@
package net.shibboleth.idp.plugin.authn.oidc.rp.impl;
import static org.testng.Assert.assertEquals;
+import static org.testng.Assert.assertNotNull;
import static org.testng.Assert.assertNull;
import java.net.URI;
@@ -75,10 +76,8 @@ public class ValidateResponseStateTest extends AbstractOIDCTest {
public void testSuccess() throws ComponentInitializationException, URISyntaxException {
action.initialize();
- final Event event = action.execute(src);
-
- assertNull(event);
-
+ final Event event = action.execute(src);
+ assertNull(event);
}
@Test
@@ -87,19 +86,23 @@ public class ValidateResponseStateTest extends AbstractOIDCTest {
authnRequest.setState(null);
action.initialize();
final Event event = action.execute(src);
-
+ assertNotNull(event);
+ assert event != null;
assertEquals(event.getId(), AuthnEventIds.NO_CREDENTIALS);
}
@Test
public void testNoStateInResponse() throws Exception {
- prc.getInboundMessageContext().setMessage(AuthenticationResponseParser.parse(
+ final var inboundMsgCtx = prc.getInboundMessageContext();
+ assert inboundMsgCtx != null;
+ inboundMsgCtx.setMessage(AuthenticationResponseParser.parse(
new URI("/idp/profile/Authn/OIDC/RP/callback"
+ "?state=wrong-state&code=z8C2DCp6sn0D9aGbEqlrFesdPVRXPtDX")));
action.initialize();
final Event event = action.execute(src);
-
+ assertNotNull(event);
+ assert event != null;
assertEquals(event.getId(), AuthnEventIds.NO_CREDENTIALS);
}
@@ -109,7 +112,8 @@ public class ValidateResponseStateTest extends AbstractOIDCTest {
authnRequest.setState(new State("does-not-match"));
action.initialize();
final Event event = action.execute(src);
-
+ assertNotNull(event);
+ assert event != null;
assertEquals(event.getId(), AuthnEventIds.NO_CREDENTIALS);
}
diff --git a/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/impl/AddAuthenticationContextClassReferencesHandlerTest.java b/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/impl/AddAuthenticationContextClassReferencesHandlerTest.java
index 4bfe7ed..aabdb5f 100644
--- a/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/impl/AddAuthenticationContextClassReferencesHandlerTest.java
+++ b/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/impl/AddAuthenticationContextClassReferencesHandlerTest.java
@@ -68,8 +68,8 @@ public class AddAuthenticationContextClassReferencesHandlerTest extends Abstrac
@Test
public void testSuccess() throws Exception {
handler.initialize();
-
- handler.invoke(prc.getOutboundMessageContext());
+ final var outboundMsgCtx = getOutboundMessageContextFailIfNull(prc);
+ handler.invoke(outboundMsgCtx);
assertEquals(authnRequest.getAcrs().size(),3);
assertEquals(authnRequest.getAcrs().get(0).getValue(),"test-value-1");
@@ -85,9 +85,9 @@ public class AddAuthenticationContextClassReferencesHandlerTest extends Abstrac
public void testSuccess_NoPrincipals() throws Exception {
oidcAuthzConfig.setDefaultAuthenticationMethods(Collections.emptyList());
- handler.initialize();
-
- handler.invoke(prc.getOutboundMessageContext());
+ handler.initialize();
+ final var outboundMsgCtx = getOutboundMessageContextFailIfNull(prc);
+ handler.invoke(outboundMsgCtx);
assertEquals(authnRequest.getAcrs().size(),0);
diff --git a/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/impl/AddEndpointURIHandlerTest.java b/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/impl/AddEndpointURIHandlerTest.java
index 8ed967e..62b119c 100644
--- a/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/impl/AddEndpointURIHandlerTest.java
+++ b/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/impl/AddEndpointURIHandlerTest.java
@@ -15,6 +15,7 @@
package net.shibboleth.idp.plugin.authn.oidc.rp.messaging.impl;
import static org.testng.Assert.assertEquals;
+import static org.testng.Assert.assertNotNull;
import org.opensaml.messaging.handler.MessageHandlerException;
import org.testng.annotations.BeforeMethod;
@@ -62,10 +63,13 @@ public class AddEndpointURIHandlerTest extends AbstractOIDCTest {
public void testSuccess() throws Exception {
handler.initialize();
- handler.invoke(prc.getOutboundMessageContext());
+ final var outboundMsgCtx = getOutboundMessageContextFailIfNull(prc);
+ handler.invoke(outboundMsgCtx);
- assertEquals(authnRequest.getEndpointURI(),
- providerCtx.getProviderInformation().getAuthorizationEndpointURI());
+ final var providerInfo = providerCtx.getProviderInformation();
+ assertNotNull(providerInfo);
+ assert providerInfo != null;
+ assertEquals(authnRequest.getEndpointURI(), providerInfo.getAuthorizationEndpointURI());
}
/**
@@ -76,10 +80,14 @@ public class AddEndpointURIHandlerTest extends AbstractOIDCTest {
@Test(expectedExceptions = MessageHandlerException.class)
public void testNoAuthzEndpoint() throws Exception {
- providerCtx.getProviderInformation().setAuthorizationEndpointURI(null);
+ final var providerInfo = providerCtx.getProviderInformation();
+ assertNotNull(providerInfo);
+ assert providerInfo != null;
+ providerInfo.setAuthorizationEndpointURI(null);
+ final var outboundMsgCtx = getOutboundMessageContextFailIfNull(prc);
handler.initialize();
- handler.invoke(prc.getOutboundMessageContext());
+ handler.invoke(outboundMsgCtx);
}
diff --git a/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/impl/AddForceAuthenticationPromptHandlerTest.java b/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/impl/AddForceAuthenticationPromptHandlerTest.java
index f549b74..87ee714 100644
--- a/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/impl/AddForceAuthenticationPromptHandlerTest.java
+++ b/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/impl/AddForceAuthenticationPromptHandlerTest.java
@@ -15,6 +15,7 @@
package net.shibboleth.idp.plugin.authn.oidc.rp.messaging.impl;
import static org.testng.Assert.assertEquals;
+import static org.testng.Assert.assertNotNull;
import static org.testng.Assert.assertNull;
import org.testng.annotations.BeforeMethod;
@@ -25,8 +26,6 @@ import com.nimbusds.openid.connect.sdk.Prompt;
import net.shibboleth.idp.plugin.authn.oidc.rp.impl.AbstractOIDCTest;
import net.shibboleth.oidc.profile.config.impl.DefaultOIDCAuthorizationConfiguration;
import net.shibboleth.profile.context.RelyingPartyContext;
-import net.shibboleth.profile.relyingparty.BasicRelyingPartyConfiguration;
-import net.shibboleth.profile.relyingparty.RelyingPartyConfiguration;
/** Tests for {@link AddForceAuthenticationHandler}.*/
public class AddForceAuthenticationPromptHandlerTest extends AbstractOIDCTest {
@@ -48,7 +47,6 @@ public class AddForceAuthenticationPromptHandlerTest extends AbstractOIDCTest {
rpc = prc.ensureSubcontext(RelyingPartyContext.class);
oidcAuthzConfig = new DefaultOIDCAuthorizationConfiguration();
- final RelyingPartyConfiguration rpConfig = new BasicRelyingPartyConfiguration();
rpc.setProfileConfig(oidcAuthzConfig);
}
@@ -64,10 +62,14 @@ public class AddForceAuthenticationPromptHandlerTest extends AbstractOIDCTest {
oidcAuthzConfig.setForceAuthn(true);
handler.initialize();
- handler.invoke(prc.getOutboundMessageContext());
+ final var outboundMsgCtx = getOutboundMessageContextFailIfNull(prc);
+ handler.invoke(outboundMsgCtx);
- assertEquals(authnRequest.getPrompt().size(), 1);
- assertEquals(authnRequest.getPrompt().iterator().next(), Prompt.Type.LOGIN);
+ final var prompt = authnRequest.getPrompt();
+ assertNotNull(prompt);
+ assert prompt != null;
+ assertEquals(prompt.size(), 1);
+ assertEquals(prompt.iterator().next(), Prompt.Type.LOGIN);
}
/**
@@ -80,8 +82,9 @@ public class AddForceAuthenticationPromptHandlerTest extends AbstractOIDCTest {
oidcAuthzConfig.setForceAuthn(false);
- handler.initialize();
- handler.invoke(prc.getOutboundMessageContext());
+ handler.initialize();
+ final var outboundMsgCtx = getOutboundMessageContextFailIfNull(prc);
+ handler.invoke(outboundMsgCtx);
assertNull(authnRequest.getPrompt());
diff --git a/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/impl/AddPassiveAuthenticationHandlerTest.java b/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/impl/AddPassiveAuthenticationHandlerTest.java
index 13ad0a3..6d43076 100644
--- a/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/impl/AddPassiveAuthenticationHandlerTest.java
+++ b/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/impl/AddPassiveAuthenticationHandlerTest.java
@@ -15,6 +15,7 @@
package net.shibboleth.idp.plugin.authn.oidc.rp.messaging.impl;
import static org.testng.Assert.assertEquals;
+import static org.testng.Assert.assertNotNull;
import static org.testng.Assert.assertNull;
import org.testng.annotations.BeforeMethod;
@@ -61,10 +62,14 @@ public class AddPassiveAuthenticationHandlerTest extends AbstractOIDCTest {
ac.setIsPassive(true);
handler.initialize();
- handler.invoke(prc.getOutboundMessageContext());
+ final var outboundMsgCtx = getOutboundMessageContextFailIfNull(prc);
+ handler.invoke(outboundMsgCtx);
- assertEquals(authnRequest.getPrompt().size(), 1);
- assertEquals(authnRequest.getPrompt().iterator().next(), Prompt.Type.NONE);
+ final var prompt = authnRequest.getPrompt();
+ assertNotNull(prompt);
+ assert prompt != null;
+ assertEquals(prompt.size(), 1);
+ assertEquals(prompt.iterator().next(), Prompt.Type.NONE);
}
/**
@@ -78,7 +83,8 @@ public class AddPassiveAuthenticationHandlerTest extends AbstractOIDCTest {
ac.setIsPassive(false);
handler.initialize();
- handler.invoke(prc.getOutboundMessageContext());
+ final var outboundMsgCtx = getOutboundMessageContextFailIfNull(prc);
+ handler.invoke(outboundMsgCtx);
assertNull(authnRequest.getPrompt());
diff --git a/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/impl/AddRedirectURIHandlerTest.java b/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/impl/AddRedirectURIHandlerTest.java
index a22d36d..568ac5e 100644
--- a/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/impl/AddRedirectURIHandlerTest.java
+++ b/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/impl/AddRedirectURIHandlerTest.java
@@ -67,7 +67,8 @@ public class AddRedirectURIHandlerTest extends AbstractOIDCTest {
handler.setRedirectUriCreationStrategy((http, prc) -> redirectUri);
handler.initialize();
- handler.invoke(prc.getOutboundMessageContext());
+ final var outboundMsgCtx = getOutboundMessageContextFailIfNull(prc);
+ handler.invoke(outboundMsgCtx);
assertEquals(authnRequest.getRedirectURI(),redirectUri);
}
@@ -83,7 +84,8 @@ public class AddRedirectURIHandlerTest extends AbstractOIDCTest {
handler.setRedirectUriCreationStrategy((http, prc) -> null);
handler.initialize();
- handler.invoke(prc.getOutboundMessageContext());
+ final var outboundMsgCtx = getOutboundMessageContextFailIfNull(prc);
+ handler.invoke(outboundMsgCtx);
}
diff --git a/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/impl/AddRequestedClaimsHandlerTest.java b/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/impl/AddRequestedClaimsHandlerTest.java
index 36932b3..eef2807 100644
--- a/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/impl/AddRequestedClaimsHandlerTest.java
+++ b/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/impl/AddRequestedClaimsHandlerTest.java
@@ -73,14 +73,18 @@ public class AddRequestedClaimsHandlerTest extends AbstractOIDCTest {
handler.initialize();
- handler.invoke(prc.getOutboundMessageContext());
- assertNotNull(prc.getOutboundMessageContext().getMessage());
- assertNotNull(((OIDCAuthenticationRequest)prc.getOutboundMessageContext()
- .getMessage()).getRequestedClaims());
- assertNotNull(((OIDCAuthenticationRequest)prc.getOutboundMessageContext()
- .getMessage()).getRequestedClaims().getIDTokenClaimsRequest().get("given_name", null));
- assertNotNull(((OIDCAuthenticationRequest)prc.getOutboundMessageContext()
- .getMessage()).getRequestedClaims().getUserInfoClaimsRequest().get("family_name", null));
+ final var outboundMsgCtx = getOutboundMessageContextFailIfNull(prc);
+
+ handler.invoke(outboundMsgCtx);
+ final var message = outboundMsgCtx.getMessage();
+ assertNotNull(message);
+ assert message != null;
+ assertNotNull(((OIDCAuthenticationRequest)message).getRequestedClaims());
+ final var claims = ((OIDCAuthenticationRequest)message).getRequestedClaims();
+ assertNotNull(claims);
+ assert claims != null;
+ assertNotNull(claims.getIDTokenClaimsRequest().get("given_name", null));
+ assertNotNull(claims.getUserInfoClaimsRequest().get("family_name", null));
}
/**
@@ -92,11 +96,12 @@ public class AddRequestedClaimsHandlerTest extends AbstractOIDCTest {
public void testNoRequestedClaims() throws Exception {
handler.initialize();
-
- handler.invoke(prc.getOutboundMessageContext());
- assertNotNull(prc.getOutboundMessageContext().getMessage());
- assertNull(((OIDCAuthenticationRequest)prc.getOutboundMessageContext()
- .getMessage()).getRequestedClaims());
+ final var outboundMsgCtx = getOutboundMessageContextFailIfNull(prc);
+ handler.invoke(outboundMsgCtx);
+ final var message = outboundMsgCtx.getMessage();
+ assertNotNull(message);
+ assert message != null;
+ assertNull(((OIDCAuthenticationRequest)message).getRequestedClaims());
}
}
diff --git a/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/impl/AddResponseTypeAndModeHandlerTest.java b/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/impl/AddResponseTypeAndModeHandlerTest.java
index 1c008cd..f4c9369 100644
--- a/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/impl/AddResponseTypeAndModeHandlerTest.java
+++ b/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/impl/AddResponseTypeAndModeHandlerTest.java
@@ -68,15 +68,22 @@ public class AddResponseTypeAndModeHandlerTest extends AbstractOIDCTest {
oidcAuthzConfig.setResponseMode(ResponseMode.FORM_POST.toString());
handler.initialize();
- handler.invoke(prc.getOutboundMessageContext());
- assertNotNull(prc.getOutboundMessageContext().getMessage());
- assertNotNull(((OIDCAuthenticationRequest)prc.getOutboundMessageContext().getMessage()).getResponseMode());
- assertNotNull(((OIDCAuthenticationRequest)prc.getOutboundMessageContext().getMessage()).getResponseType());
+ final var outboundMsgCtx = getOutboundMessageContextFailIfNull(prc);
+ handler.invoke(outboundMsgCtx);
+
+ final var message = outboundMsgCtx.getMessage();
+ assertNotNull(message);
+ assert message != null;
+
+ assertNotNull(message);
+ assertNotNull(((OIDCAuthenticationRequest)message).getResponseMode());
+ assertNotNull(((OIDCAuthenticationRequest)message).getResponseType());
assertEquals(ResponseMode.FORM_POST, (
- (OIDCAuthenticationRequest)prc.getOutboundMessageContext().getMessage()).getResponseMode());
+ (OIDCAuthenticationRequest)message).getResponseMode());
assertEquals(ResponseType.CODE, (
- (OIDCAuthenticationRequest)prc.getOutboundMessageContext().getMessage()).getResponseType());
+ (OIDCAuthenticationRequest)message).getResponseType());
}
+
/**
* Test the unsupported response type (IDTOKEN).
@@ -89,7 +96,8 @@ public class AddResponseTypeAndModeHandlerTest extends AbstractOIDCTest {
oidcAuthzConfig.setResponseType(ResponseType.IDTOKEN.toString());
handler.initialize();
- handler.invoke(prc.getOutboundMessageContext());
+ final var outboundMsgCtx = getOutboundMessageContextFailIfNull(prc);
+ handler.invoke(outboundMsgCtx);
}
/**
@@ -103,7 +111,9 @@ public class AddResponseTypeAndModeHandlerTest extends AbstractOIDCTest {
oidcAuthzConfig.setResponseMode(ResponseMode.JWT.toString());
handler.initialize();
- handler.invoke(prc.getOutboundMessageContext());
+ final var outboundMsgCtx = prc.getOutboundMessageContext();
+ assert outboundMsgCtx != null;
+ handler.invoke(outboundMsgCtx);
}
/**
@@ -117,15 +127,20 @@ public class AddResponseTypeAndModeHandlerTest extends AbstractOIDCTest {
oidcAuthzConfig.setResponseType(ResponseType.CODE.toString());
handler.initialize();
- handler.invoke(prc.getOutboundMessageContext());
+ final var outboundMsgCtx = getOutboundMessageContextFailIfNull(prc);
+ handler.invoke(outboundMsgCtx);
+
+ final var message = outboundMsgCtx.getMessage();
+ assertNotNull(message);
+ assert message != null;
- assertNotNull((prc.getOutboundMessageContext().getMessage()));
- assertNotNull(((OIDCAuthenticationRequest)prc.getOutboundMessageContext().getMessage()).getResponseMode());
- assertNotNull(((OIDCAuthenticationRequest)prc.getOutboundMessageContext().getMessage()).getResponseType());
+ assertNotNull((outboundMsgCtx.getMessage()));
+ assertNotNull(((OIDCAuthenticationRequest)message).getResponseMode());
+ assertNotNull(((OIDCAuthenticationRequest)message).getResponseType());
assertEquals(ResponseMode.QUERY,
- ((OIDCAuthenticationRequest)prc.getOutboundMessageContext().getMessage()).getResponseMode());
+ ((OIDCAuthenticationRequest)message).getResponseMode());
assertEquals(ResponseType.CODE,
- ((OIDCAuthenticationRequest)prc.getOutboundMessageContext().getMessage()).getResponseType());
+ ((OIDCAuthenticationRequest)message).getResponseType());
}
/**
@@ -139,7 +154,8 @@ public class AddResponseTypeAndModeHandlerTest extends AbstractOIDCTest {
oidcAuthzConfig.setResponseType("unknown");
handler.initialize();
- handler.invoke(prc.getOutboundMessageContext());
+ final var outboundMsgCtx = getOutboundMessageContextFailIfNull(prc);
+ handler.invoke(outboundMsgCtx);
}
}
diff --git a/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/impl/AddScopesHandlerTest.java b/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/impl/AddScopesHandlerTest.java
index 1410f21..855634b 100644
--- a/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/impl/AddScopesHandlerTest.java
+++ b/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/impl/AddScopesHandlerTest.java
@@ -63,7 +63,8 @@ public class AddScopesHandlerTest extends AbstractOIDCTest {
public void testSuccessWithDefaultScope() throws Exception {
handler.initialize();
- handler.invoke(prc.getOutboundMessageContext());
+ final var outboundMsgCtx = getOutboundMessageContextFailIfNull(prc);
+ handler.invoke(outboundMsgCtx);
// Always one more scope as openid is default
assertEquals(authnRequest.getScope().size(), 1);
@@ -81,7 +82,8 @@ public class AddScopesHandlerTest extends AbstractOIDCTest {
oidcAuthzConfig.setScopes(Set.of("profile","email"));
handler.initialize();
- handler.invoke(prc.getOutboundMessageContext());
+ final var outboundMsgCtx = getOutboundMessageContextFailIfNull(prc);
+ handler.invoke(outboundMsgCtx);
// Always one more scope as openid is default
assertEquals(authnRequest.getScope().size(), 3);
@@ -102,7 +104,8 @@ public class AddScopesHandlerTest extends AbstractOIDCTest {
oidcAuthzConfig.setScopes(null);
handler.initialize();
- handler.invoke(prc.getOutboundMessageContext());
+ final var outboundMsgCtx = getOutboundMessageContextFailIfNull(prc);
+ handler.invoke(outboundMsgCtx);
// Always one more scope as openid is default
assertEquals(authnRequest.getScope().size(), 1);
diff --git a/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/impl/AddStateHandlerTest.java b/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/impl/AddStateHandlerTest.java
index ccb21a7..1fb0c4a 100644
--- a/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/impl/AddStateHandlerTest.java
+++ b/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/impl/AddStateHandlerTest.java
@@ -61,9 +61,11 @@ public class AddStateHandlerTest extends AbstractOIDCTest {
.build();
request.setRequestObject(new PlainJWT(claims));
- prc.getOutboundMessageContext().setMessage(request);
+ final var outboundMsgCtx = prc.getOutboundMessageContext();
+ assert outboundMsgCtx != null;
+ outboundMsgCtx.setMessage(request);
handlerContext = new OutboundMessageHandlerContext(SWF_KEY);
- prc.getOutboundMessageContext().addSubcontext(handlerContext);
+ outboundMsgCtx.addSubcontext(handlerContext);
}
/**
@@ -74,16 +76,20 @@ public class AddStateHandlerTest extends AbstractOIDCTest {
@Test
public void testSuccess() throws Exception {
handler.initialize();
- handler.invoke(prc.getOutboundMessageContext());
+ final var outboundMsgCtx = getOutboundMessageContextFailIfNull(prc);
+ handler.invoke(outboundMsgCtx);
- assertTrue(prc.getOutboundMessageContext().getMessage() instanceof OIDCAuthenticationRequest);
+ assertTrue(outboundMsgCtx.getMessage() instanceof OIDCAuthenticationRequest);
assertNotNull(request.getState());
final var keyHex = Hex.encodeHexString(SWF_KEY.getBytes());
- assertTrue(request.getState().getValue().contains("."));
- assertEquals(request.getState().getValue().split("\\.").length, 2);
- assertTrue(request.getState().getValue().split("\\.")[1].equals(keyHex));
+ final var state = request.getState();
+ assertNotNull(state);
+ assert state != null;
+ assertTrue(state.getValue().contains("."));
+ assertEquals(state.getValue().split("\\.").length, 2);
+ assertTrue(state.getValue().split("\\.")[1].equals(keyHex));
}
/**
@@ -93,9 +99,10 @@ public class AddStateHandlerTest extends AbstractOIDCTest {
*/
@Test(expectedExceptions = MessageHandlerException.class)
public void testFailure_NoOutBoundContext() throws Exception {
- prc.getOutboundMessageContext().removeSubcontext(OutboundMessageHandlerContext.class);
+ final var outboundMsgCtx = getOutboundMessageContextFailIfNull(prc);
+ outboundMsgCtx.removeSubcontext(OutboundMessageHandlerContext.class);
handler.initialize();
- handler.invoke(prc.getOutboundMessageContext());
+ handler.invoke(outboundMsgCtx);
}
}
diff --git a/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/impl/BuildPlainRequestObjectJWTTest.java b/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/impl/BuildPlainRequestObjectJWTTest.java
index 138960d..84d7f62 100644
--- a/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/impl/BuildPlainRequestObjectJWTTest.java
+++ b/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/impl/BuildPlainRequestObjectJWTTest.java
@@ -53,9 +53,13 @@ public class BuildPlainRequestObjectJWTTest extends AbstractOIDCTest {
request = new OIDCAuthenticationRequest(new ClientID("test-client"));
- handlerContext = new OutboundMessageHandlerContext(SWF_KEY);
- prc.getOutboundMessageContext().addSubcontext(handlerContext);
- prc.getOutboundMessageContext().setMessage(request);
+ final var localHandlerContext = handlerContext =
+ new OutboundMessageHandlerContext(SWF_KEY);
+ assert localHandlerContext != null;
+ final var outboundMsgCtx = prc.getOutboundMessageContext();
+ assert outboundMsgCtx != null;
+ outboundMsgCtx.addSubcontext(localHandlerContext);
+ outboundMsgCtx.setMessage(request);
final var claims = new ClaimsSet();
claims.setAudience(new Audience("https://op.example.com"));
@@ -74,13 +78,16 @@ public class BuildPlainRequestObjectJWTTest extends AbstractOIDCTest {
@Test
public void testSuccess() throws Exception {
handler.initialize();
- handler.invoke(prc.getOutboundMessageContext());
+ final var outboundMsgCtx = getOutboundMessageContextFailIfNull(prc);
+ handler.invoke(outboundMsgCtx);
- assertTrue(prc.getOutboundMessageContext().getMessage() instanceof OIDCAuthenticationRequest);
+ assertTrue(outboundMsgCtx.getMessage() instanceof OIDCAuthenticationRequest);
+ final var requestObject = request.getRequestObject();
+ assert requestObject != null;
assertNotNull(request.getRequestObject());
- assertTrue(request.getRequestObject().getJWTClaimsSet().getAudience().get(0).equals("https://op.example.com"));
- assertTrue(request.getRequestObject().getJWTClaimsSet().getIssuer().equals("https://rp.example.com"));
- assertTrue(request.getRequestObject().getJWTClaimsSet().getClaim("redirect_uri")
+ assertTrue(requestObject.getJWTClaimsSet().getAudience().get(0).equals("https://op.example.com"));
+ assertTrue(requestObject.getJWTClaimsSet().getIssuer().equals("https://rp.example.com"));
+ assertTrue(requestObject.getJWTClaimsSet().getClaim("redirect_uri")
.equals("http://rp.example.com/callback"));
}
@@ -93,9 +100,10 @@ public class BuildPlainRequestObjectJWTTest extends AbstractOIDCTest {
public void testFail_NoClaims() throws Exception {
request.setRequestObjectClaimsSet(null);
handler.initialize();
- handler.invoke(prc.getOutboundMessageContext());
+ final var outboundMsgCtx = getOutboundMessageContextFailIfNull(prc);
+ handler.invoke(outboundMsgCtx);
- assertTrue(prc.getOutboundMessageContext().getMessage() instanceof OIDCAuthenticationRequest);
+ assertTrue(outboundMsgCtx.getMessage() instanceof OIDCAuthenticationRequest);
assertNull(request.getRequestObject());
}
diff --git a/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/metadata/impl/OIDCProviderMetadataLookupHandlerTest.java b/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/metadata/impl/OIDCProviderMetadataLookupHandlerTest.java
index a87e297..081d91f 100644
--- a/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/metadata/impl/OIDCProviderMetadataLookupHandlerTest.java
+++ b/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/metadata/impl/OIDCProviderMetadataLookupHandlerTest.java
@@ -34,6 +34,7 @@ import net.shibboleth.oidc.metadata.ProviderMetadataResolver;
import net.shibboleth.oidc.metadata.context.OIDCProviderMetadataContext;
import net.shibboleth.oidc.metadata.criterion.IssuerIDCriterion;
import net.shibboleth.oidc.profile.messaging.context.AbstractOIDCEntityContext;
+import net.shibboleth.shared.collection.CollectionSupport;
import net.shibboleth.shared.resolver.CriteriaSet;
import net.shibboleth.shared.resolver.ResolverException;
@@ -61,7 +62,10 @@ public class OIDCProviderMetadataLookupHandlerTest extends AbstractOIDCTest {
try {
final OIDCProviderMetadata metadata =
OIDCProviderMetadata.parse(GOOD_PROVIDER_CONFIGURATION_INFO);
- if (criteria.get(IssuerIDCriterion.class).getIssuerID().equals(metadata.getIssuer())) {
+ assert criteria != null;
+ final IssuerIDCriterion criterion = criteria.get(IssuerIDCriterion.class);
+ assert criterion != null;
+ if (criterion.getIssuerID().equals(metadata.getIssuer())) {
return metadata;
}
return null;
@@ -72,7 +76,9 @@ public class OIDCProviderMetadataLookupHandlerTest extends AbstractOIDCTest {
}
@Override
public Iterable<OIDCProviderMetadata> resolve(final CriteriaSet criteria) throws ResolverException {
- return List.of(resolveSingle(criteria));
+ final var resolvedSingle = resolveSingle(criteria);
+ assert resolvedSingle != null;
+ return CollectionSupport.listOf(resolvedSingle);
}
});
ctx = new AbstractOIDCEntityContext();
@@ -83,12 +89,19 @@ public class OIDCProviderMetadataLookupHandlerTest extends AbstractOIDCTest {
@Test
public void testLookupSuccess() throws Exception {
handler.initialize();
+
+ handler.invoke(getOutboundMessageContextFailIfNull(prc));
+
+ final var providerMetadataCtx = ctx.getSubcontext(OIDCProviderMetadataContext.class);
+ assertNotNull(providerMetadataCtx);
+ assert providerMetadataCtx != null;
+
+ assertNotNull(providerMetadataCtx.getProviderInformation());
- handler.invoke(prc.getOutboundMessageContext());
- assertNotNull(ctx.getSubcontext(OIDCProviderMetadataContext.class));
- assertNotNull(ctx.getSubcontext(OIDCProviderMetadataContext.class).getProviderInformation());
- assertEquals(ctx.getSubcontext(OIDCProviderMetadataContext.class)
- .getProviderInformation().getIssuer().getValue(),"https://op.example.com/");
+ final var providerInfo = providerMetadataCtx.getProviderInformation();
+ assertNotNull(providerInfo);
+ assert providerInfo != null;
+ assertEquals(providerInfo.getIssuer().getValue(),"https://op.example.com/");
}
@Test
@@ -106,11 +119,17 @@ public class OIDCProviderMetadataLookupHandlerTest extends AbstractOIDCTest {
handler.initialize();
- handler.invoke(prc.getOutboundMessageContext());
- assertNotNull(ctx.getSubcontext(OIDCProviderMetadataContext.class));
- assertNotNull(ctx.getSubcontext(OIDCProviderMetadataContext.class).getProviderInformation());
- assertEquals(ctx.getSubcontext(OIDCProviderMetadataContext.class)
- .getProviderInformation().getIssuer().getValue(),"https://op.example.com/");
+ handler.invoke(getOutboundMessageContextFailIfNull(prc));
+
+ final var providerMetadataCtx = ctx.getSubcontext(OIDCProviderMetadataContext.class);
+ assertNotNull(providerMetadataCtx);
+ assert providerMetadataCtx != null;
+
+ final var providerInfo = providerMetadataCtx.getProviderInformation();
+ assertNotNull(providerInfo);
+ assert providerInfo != null;
+
+ assertEquals(providerInfo.getIssuer().getValue(),"https://op.example.com/");
}
@Test
@@ -137,7 +156,8 @@ public class OIDCProviderMetadataLookupHandlerTest extends AbstractOIDCTest {
handler.initialize();
- handler.invoke(prc.getOutboundMessageContext());
+ handler.invoke(getOutboundMessageContextFailIfNull(prc));
+
assertNull(ctx.getSubcontext(OIDCProviderMetadataContext.class));
}
@@ -158,7 +178,8 @@ public class OIDCProviderMetadataLookupHandlerTest extends AbstractOIDCTest {
handler.initialize();
- handler.invoke(prc.getOutboundMessageContext());
+ handler.invoke(getOutboundMessageContextFailIfNull(prc));
+
assertNull(ctx.getSubcontext(OIDCProviderMetadataContext.class));
}
@@ -183,7 +204,8 @@ public class OIDCProviderMetadataLookupHandlerTest extends AbstractOIDCTest {
handler.initialize();
- handler.invoke(prc.getOutboundMessageContext());
+ handler.invoke(getOutboundMessageContextFailIfNull(prc));
+
assertNull(ctx.getSubcontext(OIDCProviderMetadataContext.class));
}
@@ -195,7 +217,8 @@ public class OIDCProviderMetadataLookupHandlerTest extends AbstractOIDCTest {
handler.initialize();
- handler.invoke(prc.getOutboundMessageContext());
+ handler.invoke(getOutboundMessageContextFailIfNull(prc));
+
assertNull(ctx.getSubcontext(OIDCProviderMetadataContext.class));
}
@@ -219,7 +242,7 @@ public class OIDCProviderMetadataLookupHandlerTest extends AbstractOIDCTest {
handler.initialize();
- handler.invoke(prc.getOutboundMessageContext());
+ handler.invoke(getOutboundMessageContextFailIfNull(prc));
}
diff --git a/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/security/impl/ClientAuthenticationConfigurationLookupFunctionTest.java b/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/security/impl/ClientAuthenticationConfigurationLookupFunctionTest.java
index 8a339c5..7f9be60 100644
--- a/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/security/impl/ClientAuthenticationConfigurationLookupFunctionTest.java
+++ b/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/security/impl/ClientAuthenticationConfigurationLookupFunctionTest.java
@@ -34,7 +34,8 @@ import net.shibboleth.oidc.profile.config.JSONSecurityConfiguration;
import net.shibboleth.oidc.profile.config.impl.DefaultOIDCAuthorizationConfiguration;
import net.shibboleth.oidc.security.credential.DefaultClientSecretCredential;
import net.shibboleth.oidc.security.jose.impl.BasicSignatureSigningConfiguration;
-import net.shibboleth.utilities.java.support.logic.FunctionSupport;
+import net.shibboleth.shared.logic.FunctionSupport;
+
/** Tests for {@link ClientAuthenticationConfigurationLookupFunction}.*/
public class ClientAuthenticationConfigurationLookupFunctionTest extends AbstractOIDCTest {
@@ -70,8 +71,10 @@ public class ClientAuthenticationConfigurationLookupFunctionTest extends Abstrac
// Ensure it chooses the RS algorithm here.
partyConfig.setTokenEndpointAuthMethod("private_key_jwt");
signingConfig.setSignatureAlgorithms(List.of("RS256","HS256"));
- final var sigConfigs = function.apply(prc.getOutboundMessageContext());
+ final var outboundMsgCtx = getOutboundMessageContextFailIfNull(prc);
+ final var sigConfigs = function.apply(outboundMsgCtx);
assertNotNull(sigConfigs);
+ assert sigConfigs != null;
assertEquals(sigConfigs.size(), 1);
assertNotNull(sigConfigs.get(0).getSignatureAlgorithms());
assertNotNull(sigConfigs.get(0).getSigningCredentials());
@@ -85,7 +88,8 @@ public class ClientAuthenticationConfigurationLookupFunctionTest extends Abstrac
// Ensure it chooses the RS algorithm here.
partyConfig.setTokenEndpointAuthMethod("private_key_jwt");
signingConfig.setSignatureAlgorithms(List.of("HS256"));
- final var sigConfigs = function.apply(prc.getOutboundMessageContext());
+ final var outboundMsgCtx = getOutboundMessageContextFailIfNull(prc);
+ final var sigConfigs = function.apply(outboundMsgCtx);
assertNotNull(sigConfigs);
assertEquals(sigConfigs.size(), 1);
assertNotNull(sigConfigs.get(0).getSignatureAlgorithms());
@@ -99,7 +103,8 @@ public class ClientAuthenticationConfigurationLookupFunctionTest extends Abstrac
// Ensure it chooses the RS algorithm here.
partyConfig.setTokenEndpointAuthMethod("client_secret_jwt");
signingConfig.setSignatureAlgorithms(List.of("RS256","HS256"));
- final var sigConfigs = function.apply(prc.getOutboundMessageContext());
+ final var outboundMsgCtx = getOutboundMessageContextFailIfNull(prc);
+ final var sigConfigs = function.apply(outboundMsgCtx);
assertNotNull(sigConfigs);
assertEquals(sigConfigs.size(), 1);
assertNotNull(sigConfigs.get(0).getSigningCredentials());
@@ -113,7 +118,8 @@ public class ClientAuthenticationConfigurationLookupFunctionTest extends Abstrac
// Ensure it chooses the RS algorithm here.
partyConfig.setTokenEndpointAuthMethod("client_secret_jwt");
signingConfig.setSignatureAlgorithms(List.of("RS256"));
- final var sigConfigs = function.apply(prc.getOutboundMessageContext());
+ final var outboundMsgCtx = getOutboundMessageContextFailIfNull(prc);
+ final var sigConfigs = function.apply(outboundMsgCtx);
assertNotNull(sigConfigs);
assertEquals(sigConfigs.size(), 1);
assertNotNull(sigConfigs.get(0).getSigningCredentials());
@@ -127,7 +133,8 @@ public class ClientAuthenticationConfigurationLookupFunctionTest extends Abstrac
// Ensure it chooses the RS algorithm here.
partyConfig.setTokenEndpointAuthMethodLookupStrategy(FunctionSupport.constant(null));
signingConfig.setSignatureAlgorithms(List.of("RS256"));
- final var sigConfigs = function.apply(prc.getOutboundMessageContext());
+ final var outboundMsgCtx = getOutboundMessageContextFailIfNull(prc);
+ final var sigConfigs = function.apply(outboundMsgCtx);
assertNotNull(sigConfigs);
assertEquals(sigConfigs.size(), 0);
}
@@ -137,7 +144,8 @@ public class ClientAuthenticationConfigurationLookupFunctionTest extends Abstrac
// Ensure it chooses the RS algorithm here.
partyConfig.setTokenEndpointAuthMethod("client_secret_jwt");
signingConfig.setSignatureAlgorithms(Collections.emptyList());
- final var sigConfigs = function.apply(prc.getOutboundMessageContext());
+ final var outboundMsgCtx = getOutboundMessageContextFailIfNull(prc);
+ final var sigConfigs = function.apply(outboundMsgCtx);
assertNotNull(sigConfigs);
assertEquals(sigConfigs.size(), 1);
assertNotNull(sigConfigs.get(0).getSignatureAlgorithms());
@@ -151,7 +159,8 @@ public class ClientAuthenticationConfigurationLookupFunctionTest extends Abstrac
// Ensure it chooses the RS algorithm here.
partyConfig.setTokenEndpointAuthMethod("client_secret_jwt");
signingConfig.setSignatureAlgorithms(null);
- final var sigConfigs = function.apply(prc.getOutboundMessageContext());
+ final var outboundMsgCtx = getOutboundMessageContextFailIfNull(prc);
+ final var sigConfigs = function.apply(outboundMsgCtx);
assertNotNull(sigConfigs);
assertEquals(sigConfigs.size(), 1);
assertNotNull(sigConfigs.get(0).getSignatureAlgorithms());
diff --git a/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/test/flow/AbstractAuthnXmlFlowExecutionTests.java b/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/test/flow/AbstractAuthnXmlFlowExecutionTests.java
index 5c94e34..2dc8c75 100644
--- a/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/test/flow/AbstractAuthnXmlFlowExecutionTests.java
+++ b/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/test/flow/AbstractAuthnXmlFlowExecutionTests.java
@@ -31,7 +31,6 @@ import org.opensaml.profile.context.ProfileRequestContext;
import org.opensaml.profile.context.navigate.InboundMessageContextLookup;
import org.opensaml.profile.context.navigate.OutboundMessageContextLookup;
import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
import org.springframework.beans.factory.BeanFactory;
import org.springframework.beans.factory.config.BeanDefinition;
import org.springframework.beans.factory.support.BeanDefinitionBuilder;
@@ -77,8 +76,10 @@ import net.shibboleth.profile.context.navigate.IssuerLookupFunction;
import net.shibboleth.profile.context.navigate.RelyingPartyIdLookupFunction;
import net.shibboleth.shared.annotation.constraint.NonnullElements;
import net.shibboleth.shared.annotation.constraint.NotEmpty;
+import net.shibboleth.shared.collection.CollectionSupport;
import net.shibboleth.shared.logic.FunctionSupport;
import net.shibboleth.shared.logic.ScriptedFunction;
+import net.shibboleth.shared.primitive.LoggerFactory;
import net.shibboleth.shared.security.impl.SecureRandomIdentifierGenerationStrategy;
import net.shibboleth.shared.servlet.impl.HttpServletRequestResponseContext;
import net.shibboleth.shared.servlet.impl.ThreadLocalHttpServletRequestSupplier;
@@ -145,7 +146,7 @@ public abstract class AbstractAuthnXmlFlowExecutionTests extends CustomAbstractX
@Nonnull private final Logger log = LoggerFactory.getLogger(AbstractAuthnXmlFlowExecutionTests.class);
/** The path resource to the authentication flow to be tested. */
- @Nonnull private String flowPath;
+ @Nullable private String flowPath;
/**
* Map of additional flow resources used to support the construction of the test flow.
@@ -172,9 +173,9 @@ public abstract class AbstractAuthnXmlFlowExecutionTests extends CustomAbstractX
* @param idpEntityID The mocked entityID of this IdP instance
*/
public AbstractAuthnXmlFlowExecutionTests(@Nonnull final String idpEntityID) {
- flowModelResources = Collections.emptyMap();
- subflows = Collections.emptyList();
- mockProperties = Collections.emptyMap();
+ flowModelResources = CollectionSupport.emptyMap();
+ subflows = CollectionSupport.emptyList();
+ mockProperties = CollectionSupport.emptyMap();
entityId = Objects.requireNonNull(idpEntityID);
}
@@ -270,6 +271,7 @@ public abstract class AbstractAuthnXmlFlowExecutionTests extends CustomAbstractX
@Override
protected void configureFlowBuilderContext(final MockFlowBuilderContext builderContext) {
+ assert builderContext != null;
registerMockBeanDefinitions(builderContext);
registerMockPropertySource(builderContext);
registerMockSubflows(builderContext);
@@ -309,6 +311,7 @@ public abstract class AbstractAuthnXmlFlowExecutionTests extends CustomAbstractX
.getBeanDefinition());
// Load the request and final response context into the holder.
+ assert mockRequest != null && mockResponse != null;
HttpServletRequestResponseContext.loadCurrent(mockRequest, mockResponse);
builderContext.registerBean("shibboleth.PostLoginSubjectCanonicalizationFlows", Collections.emptyList());
@@ -524,11 +527,11 @@ public abstract class AbstractAuthnXmlFlowExecutionTests extends CustomAbstractX
*
* @return a set of converters.
*/
- private Set<Converter<?, ?>> createConverters(){
+ @Nonnull private Set<Converter<?, ?>> createConverters(){
final Converter<String,Duration> durationConverter = new Converter<>(){
@Override
- public Duration convert(final String source) {
+ public Duration convert(@Nonnull final String source) {
if (source.startsWith("P") || source.startsWith("-P")) {
return DOMTypeSupport.stringToDuration(source.trim());
}
@@ -540,7 +543,7 @@ public abstract class AbstractAuthnXmlFlowExecutionTests extends CustomAbstractX
//some of these may not work comming from the spring-ext IdP project and may need specifying explicitly
//like the above converter. TODO check why.
- return Set.of(durationConverter, new StringToResourceConverter(), new StringToIPRangeConverter(),
+ return CollectionSupport.setOf(durationConverter, new StringToResourceConverter(), new StringToIPRangeConverter(),
new BooleanToPredicateConverter(),new StringBooleanToPredicateConverter(),
new StringToResourceConverter());
}
diff --git a/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/test/flow/mock/MockFlowBuilder.java b/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/test/flow/mock/MockFlowBuilder.java
index 560f1e4..1429901 100644
--- a/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/test/flow/mock/MockFlowBuilder.java
+++ b/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/test/flow/mock/MockFlowBuilder.java
@@ -47,7 +47,7 @@ public final class MockFlowBuilder {
*
* @return the constructed mock flow.
*/
- public static Flow MockNoOpFlow(@Nonnull @NotEmpty final String flowId) {
+ @Nonnull public static Flow MockNoOpFlow(@Nonnull @NotEmpty final String flowId) {
Assert.notNull(flowId, "Flow to mock must have an ID");
final Flow flow = new Flow(flowId);
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list