[java-oidc-common] branch main updated: Improve testing around included and exclude algorithms for encryption
Phil Smart
philip.smart at jisc.ac.uk
Thu Feb 9 10:31:04 UTC 2023
This is an automated email from the git hooks/post-receive script.
philsmart pushed a commit to branch main
in repository java-oidc-common.
View the commit online:
http://git.shibboleth.net/view/?p=java-oidc-common.git;a=commit;h=60771a3c7e23e01f0912b5de8397fcde97908c93
The following commit(s) were added to refs/heads/main by this push:
new 60771a3 Improve testing around included and exclude algorithms for encryption
60771a3 is described below
commit 60771a3c7e23e01f0912b5de8397fcde97908c93
Author: Phil Smart <philip.smart at jisc.ac.uk>
AuthorDate: Thu Feb 9 10:30:55 2023 +0000
Improve testing around included and exclude algorithms for encryption
---
.../BasicSignatureSigningParametersResolver.java | 3 +++
...aultDataEncryptionAlgorithmsLookupStrategy.java | 5 +++--
...ransportEncryptionAlgorithmsLookupStrategy.java | 5 +++--
...dataDataEncryptionAlgorithmsLookupStrategy.java | 4 ++--
...DataEncryptionAlgorithmsLookupStrategyTest.java | 2 +-
...DataEncryptionAlgorithmsLookupStrategyTest.java | 24 ++++++++++++++++++----
.../DefaultEncryptionParametersResolverTest.java | 22 +-------------------
...portEncryptionAlgorithmsLookupStrategyTest.java | 24 ++++++++++++++++++----
8 files changed, 53 insertions(+), 36 deletions(-)
diff --git a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/jose/impl/BasicSignatureSigningParametersResolver.java b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/jose/impl/BasicSignatureSigningParametersResolver.java
index 4886530..ce2cc50 100644
--- a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/jose/impl/BasicSignatureSigningParametersResolver.java
+++ b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/jose/impl/BasicSignatureSigningParametersResolver.java
@@ -55,6 +55,9 @@ import net.shibboleth.utilities.java.support.resolver.ResolverException;
* <ul>
* <li>{@link SignatureSigningConfigurationCriterion} - required</li>
* </ul>
+ *
+ * <p>The set of effective signature algorithms is filtered against those supported by the runtime and those configured
+ * by include/exclude policy.</p>
*/
public class BasicSignatureSigningParametersResolver
extends AbstractSecurityParametersResolver<SignatureSigningParameters>
diff --git a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/jose/impl/DefaultDataEncryptionAlgorithmsLookupStrategy.java b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/jose/impl/DefaultDataEncryptionAlgorithmsLookupStrategy.java
index 4eaf5d0..3656e96 100644
--- a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/jose/impl/DefaultDataEncryptionAlgorithmsLookupStrategy.java
+++ b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/jose/impl/DefaultDataEncryptionAlgorithmsLookupStrategy.java
@@ -35,14 +35,15 @@ import net.shibboleth.utilities.java.support.resolver.CriteriaSet;
/**
* A BiFunction which pulls data encryption (content encryption) algorithms to use from the
* encryption configuration and filters them. Algorithms are removed (filtered) if not supported
- * by the runtime or are explicitly excluded.
+ * by the runtime or are explicitly excluded or not included.
*/
public class DefaultDataEncryptionAlgorithmsLookupStrategy extends AbstractEncryptionAlgorithmsLookupStrategy {
/**
* Constructor.
*
- * @param registry the algorithm registry to use when resolving algorithm URIs. Can be {@code null}.
+ * @param registry the algorithm registry to use when resolving algorithm URIs. Can be {@code null} to use the
+ * global registry.
*/
protected DefaultDataEncryptionAlgorithmsLookupStrategy(@Nullable final AlgorithmRegistry registry) {
super(registry);
diff --git a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/jose/impl/DefaultKeyTransportEncryptionAlgorithmsLookupStrategy.java b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/jose/impl/DefaultKeyTransportEncryptionAlgorithmsLookupStrategy.java
index 7746cf0..940088a 100644
--- a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/jose/impl/DefaultKeyTransportEncryptionAlgorithmsLookupStrategy.java
+++ b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/jose/impl/DefaultKeyTransportEncryptionAlgorithmsLookupStrategy.java
@@ -36,14 +36,15 @@ import net.shibboleth.utilities.java.support.resolver.CriteriaSet;
/**
* A BiFunction that retrieves and filters the key transport encryption algorithms from the
* {@link EncryptionConfiguration} inside the criteria set. Algorithms are removed (filtered) if not supported
- * by the runtime or are explicitly excluded.
+ * by the runtime or are explicitly excluded or not included.
*/
public class DefaultKeyTransportEncryptionAlgorithmsLookupStrategy extends AbstractEncryptionAlgorithmsLookupStrategy {
/**
* Constructor.
*
- * @param registry the algorithm registry to used when resolving algorithm URIs. Can be {@code null}.
+ * @param registry the algorithm registry to used when resolving algorithm URIs. Can be {@code null} to use the
+ * global registry.
*/
protected DefaultKeyTransportEncryptionAlgorithmsLookupStrategy(@Nullable final AlgorithmRegistry registry) {
super(registry);
diff --git a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/jose/impl/ProviderMetadataDataEncryptionAlgorithmsLookupStrategy.java b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/jose/impl/ProviderMetadataDataEncryptionAlgorithmsLookupStrategy.java
index f31e6a8..f8c33d6 100644
--- a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/jose/impl/ProviderMetadataDataEncryptionAlgorithmsLookupStrategy.java
+++ b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/jose/impl/ProviderMetadataDataEncryptionAlgorithmsLookupStrategy.java
@@ -38,7 +38,7 @@ import net.shibboleth.utilities.java.support.resolver.CriteriaSet;
/**
* A lookup strategy that finds data/content encryption algorithms from local configuration that are compatible
- * with those advertised by the downstream OpenID Provider.
+ * with those advertised by the OpenID Provider.
*
* <p>The set of supported and configured encryption methods ('enc') are derived from the intersection of
* those supported by local configuration and those supported by the downstream OpenID Provider.
@@ -117,7 +117,7 @@ public class ProviderMetadataDataEncryptionAlgorithmsLookupStrategy
log.trace("Resolved supported data encryption algorithms from config: {}", dataEncryptionAlgorithmsSupported);
final List<String> supportedAndConfiguredDataEncryptionAlgorithms =
- findAlgorithmIntersection(dataEncryptionMethods,dataEncryptionAlgorithmsSupported);
+ findAlgorithmIntersection(dataEncryptionMethods,dataEncryptionAlgorithmsSupported);
log.debug("Supported and configured data encryption algorithms: {}",
supportedAndConfiguredDataEncryptionAlgorithms);
diff --git a/oidc-common-crypto-impl/src/test/java/net/shibboleth/oidc/security/impl/ProviderMetadataDataEncryptionAlgorithmsLookupStrategyTest.java b/oidc-common-crypto-impl/src/test/java/net/shibboleth/oidc/security/impl/ProviderMetadataDataEncryptionAlgorithmsLookupStrategyTest.java
index 8b98964..a439588 100644
--- a/oidc-common-crypto-impl/src/test/java/net/shibboleth/oidc/security/impl/ProviderMetadataDataEncryptionAlgorithmsLookupStrategyTest.java
+++ b/oidc-common-crypto-impl/src/test/java/net/shibboleth/oidc/security/impl/ProviderMetadataDataEncryptionAlgorithmsLookupStrategyTest.java
@@ -136,7 +136,7 @@ public class ProviderMetadataDataEncryptionAlgorithmsLookupStrategyTest {
/* One of the configured algs is excluded.*/
@Test
- public void testSuccess_SomeAlgsEcluded() {
+ public void testSuccess_SomeAlgsExluded() {
final List<String> encAlgs = strategy.apply(
criteria, alg -> !EncryptionConstants.ALGO_ID_ENC_ALG_A128CBC_HS256.equals(alg));
assertNotNull(encAlgs);
diff --git a/oidc-common-crypto-impl/src/test/java/net/shibboleth/oidc/security/jose/impl/DefaultDataEncryptionAlgorithmsLookupStrategyTest.java b/oidc-common-crypto-impl/src/test/java/net/shibboleth/oidc/security/jose/impl/DefaultDataEncryptionAlgorithmsLookupStrategyTest.java
index b481b48..643c2d4 100644
--- a/oidc-common-crypto-impl/src/test/java/net/shibboleth/oidc/security/jose/impl/DefaultDataEncryptionAlgorithmsLookupStrategyTest.java
+++ b/oidc-common-crypto-impl/src/test/java/net/shibboleth/oidc/security/jose/impl/DefaultDataEncryptionAlgorithmsLookupStrategyTest.java
@@ -34,8 +34,6 @@ import net.shibboleth.oidc.jwa.algorithm.descriptors.EncryptionA192CBCHS384;
import net.shibboleth.oidc.jwa.algorithm.descriptors.EncryptionA256CBCHS512;
import net.shibboleth.oidc.jwa.support.EncryptionConstants;
import net.shibboleth.oidc.security.jose.criterion.EncryptionConfigurationCriterion;
-import net.shibboleth.oidc.security.jose.impl.BasicEncryptionConfiguration;
-import net.shibboleth.oidc.security.jose.impl.DefaultDataEncryptionAlgorithmsLookupStrategy;
import net.shibboleth.utilities.java.support.resolver.CriteriaSet;
public class DefaultDataEncryptionAlgorithmsLookupStrategyTest {
@@ -75,7 +73,7 @@ public class DefaultDataEncryptionAlgorithmsLookupStrategyTest {
}
@Test
- public void testSuccess_SomeAlgsNotSupported() {
+ public void testSuccess_SomeAlgsNotSupportedByRegistry() {
final AlgorithmRegistry algorithmRegistry = new AlgorithmRegistry();
algorithmRegistry.register(new EncryptionA128GCM());
algorithmRegistry.register(new EncryptionA128CBCHS256());
@@ -88,11 +86,29 @@ public class DefaultDataEncryptionAlgorithmsLookupStrategyTest {
}
@Test
- public void testSuccess_SomeAlgsEcluded() {
+ public void testSuccess_SomeAlgsExcluded() {
final List<String> keyAlgs = strategy.apply(
criteria, alg -> !EncryptionConstants.ALGO_ID_ENC_ALG_A128CBC_HS256.equals(alg));
assertNotNull(keyAlgs);
assertEquals(keyAlgs.size(), 3);
}
+
+ @Test
+ public void testSuccess_SomeAlgsIncluded() {
+ // Set only one included alg
+ final List<String> keyAlgs = strategy.apply(
+ criteria, alg -> EncryptionConstants.ALGO_ID_ENC_ALG_A128CBC_HS256.equals(alg));
+ assertNotNull(keyAlgs);
+ assertEquals(keyAlgs.size(), 1);
+ }
+
+ @Test
+ public void testFail_AlgsNotIncluded() {
+ // Set the only included alg as the A256GCM algorithm
+ final List<String> keyAlgs = strategy.apply(
+ criteria, alg -> EncryptionConstants.ALGO_ID_ENC_ALG_A256GCM.equals(alg));
+ assertNotNull(keyAlgs);
+ assertEquals(keyAlgs.size(), 0);
+ }
}
diff --git a/oidc-common-crypto-impl/src/test/java/net/shibboleth/oidc/security/jose/impl/DefaultEncryptionParametersResolverTest.java b/oidc-common-crypto-impl/src/test/java/net/shibboleth/oidc/security/jose/impl/DefaultEncryptionParametersResolverTest.java
index 2d8902a..5c213e0 100644
--- a/oidc-common-crypto-impl/src/test/java/net/shibboleth/oidc/security/jose/impl/DefaultEncryptionParametersResolverTest.java
+++ b/oidc-common-crypto-impl/src/test/java/net/shibboleth/oidc/security/jose/impl/DefaultEncryptionParametersResolverTest.java
@@ -82,28 +82,8 @@ public class DefaultEncryptionParametersResolverTest {
resolver = new DefaultEncryptionParametersResolver();
}
-
- /** Mock static credential resolver that is filterable.*/
- private static class MockStaticCriteriaFilteringCredentialResolver extends AbstractCriteriaFilteringCredentialResolver
- implements JOSEObjectCredentialResolver {
-
- @Override
- protected Iterable<Credential> resolveFromSource(final CriteriaSet criteriaSet) throws ResolverException {
- if (criteriaSet.contains(ClientSecretCredentialCriterion.class)) {
- final ClientSecretCredentialCriterion credentialCriterion =
- criteriaSet.get(ClientSecretCredentialCriterion.class);
- final ClientSecretCredential credential = credentialCriterion.getCredential();
- return List.of(credential.toSigningCredential());
-
- } else {
- return Collections.emptyList();
- }
- }
-
- }
-
- /** Mock static credential resolver that is filterable.*/
+ /** Mock static credential resolver that builds the wrong type of credential for encryption.*/
private static class MockStaticCriteriaFilteringCredentialResolver_WrongKeyType
extends AbstractCriteriaFilteringCredentialResolver
implements JOSEObjectCredentialResolver {
diff --git a/oidc-common-crypto-impl/src/test/java/net/shibboleth/oidc/security/jose/impl/DefaultKeyTransportEncryptionAlgorithmsLookupStrategyTest.java b/oidc-common-crypto-impl/src/test/java/net/shibboleth/oidc/security/jose/impl/DefaultKeyTransportEncryptionAlgorithmsLookupStrategyTest.java
index 8418639..5954d0f 100644
--- a/oidc-common-crypto-impl/src/test/java/net/shibboleth/oidc/security/jose/impl/DefaultKeyTransportEncryptionAlgorithmsLookupStrategyTest.java
+++ b/oidc-common-crypto-impl/src/test/java/net/shibboleth/oidc/security/jose/impl/DefaultKeyTransportEncryptionAlgorithmsLookupStrategyTest.java
@@ -34,8 +34,6 @@ import net.shibboleth.oidc.jwa.algorithm.descriptors.KeyTransportRSAOAEP256;
import net.shibboleth.oidc.jwa.algorithm.descriptors.SymmetricKeyWrapA128KW;
import net.shibboleth.oidc.jwa.support.KeyManagementConstants;
import net.shibboleth.oidc.security.jose.criterion.EncryptionConfigurationCriterion;
-import net.shibboleth.oidc.security.jose.impl.BasicEncryptionConfiguration;
-import net.shibboleth.oidc.security.jose.impl.DefaultKeyTransportEncryptionAlgorithmsLookupStrategy;
import net.shibboleth.utilities.java.support.resolver.CriteriaSet;
public class DefaultKeyTransportEncryptionAlgorithmsLookupStrategyTest {
@@ -82,7 +80,7 @@ public class DefaultKeyTransportEncryptionAlgorithmsLookupStrategyTest {
}
@Test
- public void testSuccess_SomeAlgsNotSupported() {
+ public void testSuccess_SomeAlgsNotSupportedByRegistry() {
final AlgorithmRegistry algorithmRegistry = new AlgorithmRegistry();
algorithmRegistry.register(new SymmetricKeyWrapA128KW());
algorithmRegistry.register(new KeyTransportRSAOAEP256());
@@ -95,11 +93,29 @@ public class DefaultKeyTransportEncryptionAlgorithmsLookupStrategyTest {
}
@Test
- public void testSuccess_SomeAlgsEcluded() {
+ public void testSuccess_SomeAlgsExcluded() {
final List<String> keyAlgs = strategy.apply(
criteria, alg -> !KeyManagementConstants.ALGO_ID_ALG_AES_128_KW.equals(alg));
assertNotNull(keyAlgs);
assertEquals(keyAlgs.size(), 3);
}
+
+ @Test
+ public void testSuccess_SomeAlgsIncluded() {
+ // Set only one included alg
+ final List<String> keyAlgs = strategy.apply(
+ criteria, alg -> KeyManagementConstants.ALGO_ID_ALG_AES_128_KW.equals(alg));
+ assertNotNull(keyAlgs);
+ assertEquals(keyAlgs.size(), 1);
+ }
+
+ @Test
+ public void testFail_AlgsNotIncluded() {
+ // Set the only included alg as the Dir algorithm
+ final List<String> keyAlgs = strategy.apply(
+ criteria, alg -> KeyManagementConstants.ALGO_ID_ALG_DIR.equals(alg));
+ assertNotNull(keyAlgs);
+ assertEquals(keyAlgs.size(), 0);
+ }
}
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list