[java-idp-plugin-oidc-rp] branch main updated: Add more signing parameter resolver tests

[Phil Smart]

This is an automated email from the git hooks/post-receive script.

philsmart pushed a commit to branch main
in repository java-idp-plugin-oidc-rp.

View the commit online:
http://git.shibboleth.net/view/?p=java-idp-plugin-oidc-rp.git;a=commit;h=e1d05d07c0ea3ae49c587fec3595a6d3ef20e8f9

The following commit(s) were added to refs/heads/main by this push:
     new e1d05d0  Add more signing parameter resolver tests
e1d05d0 is described below

commit e1d05d07c0ea3ae49c587fec3595a6d3ef20e8f9
Author: Phil Smart <philip.smart at jisc.ac.uk>
AuthorDate: Fri Feb 10 09:54:24 2023 +0000

    Add more signing parameter resolver tests
---
 ...RelyingPartyProxySigningParametersResolver.java |  4 +-
 ...ingPartyProxySigningParametersResolverTest.java | 54 +++++++++++++++++++++-
 2 files changed, 55 insertions(+), 3 deletions(-)

diff --git a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/RelyingPartyProxySigningParametersResolver.java b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/RelyingPartyProxySigningParametersResolver.java
index 486aac6..f2bf391 100644
--- a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/RelyingPartyProxySigningParametersResolver.java
+++ b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/RelyingPartyProxySigningParametersResolver.java
@@ -49,7 +49,7 @@ import net.shibboleth.utilities.java.support.resolver.CriteriaSet;
 
 /**
  * A specialization of {@link BasicSignatureSigningParametersResolver} which supports selecting signing credentials
- * from client secret credential criterion (e.g. from the reyling party configuration) in addition to the configured 
+ * from client secret credential criterion (e.g. from the relying party configuration) in addition to the configured 
  * signing credentials inside the signing configuration (determined by the superclass). 
  * 
  * <p>The upstream OP's metadata is also used to filter for those algorithms supported by the OP in addition to
@@ -117,7 +117,7 @@ public class RelyingPartyProxySigningParametersResolver extends BasicSignatureSi
         
         // Get effective signature algorithms from configuration and include/exclude predicate
         final List<String> algorithms = getEffectiveSignatureAlgorithms(criteria, includeExcludePredicate);      
-        log.debug("Resolved effectice signature algorithms from config: '{}'", algorithms);
+        log.debug("Resolved effective signature algorithms from config: '{}'", algorithms);
         
         // Filter by those supported by the upstream OP
         final List<String> filteredAlgorithms = filterForProviderSupportedAlgorithms(criteria, algorithms);
diff --git a/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/RelyingPartyProxySigningParametersResolverTest.java b/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/RelyingPartyProxySigningParametersResolverTest.java
index 8117a65..0b9d740 100644
--- a/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/RelyingPartyProxySigningParametersResolverTest.java
+++ b/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/RelyingPartyProxySigningParametersResolverTest.java
@@ -56,9 +56,9 @@ import net.shibboleth.oidc.security.credential.BasicExpiringJWKCredential;
 import net.shibboleth.oidc.security.credential.DefaultClientSecretCredential;
 import net.shibboleth.oidc.security.credential.JWKCredential;
 import net.shibboleth.oidc.security.jose.SignatureSigningParameters;
+import net.shibboleth.oidc.security.jose.criterion.ClientSecretCredentialCriterion;
 import net.shibboleth.oidc.security.jose.criterion.ProviderMetadataCriterion;
 import net.shibboleth.oidc.security.jose.criterion.SignatureSigningConfigurationCriterion;
-import net.shibboleth.oidc.security.jose.criterion.ClientSecretCredentialCriterion;
 import net.shibboleth.oidc.security.jose.impl.BasicSignatureSigningConfiguration;
 import net.shibboleth.utilities.java.support.resolver.CriteriaSet;
 import net.shibboleth.utilities.java.support.resolver.ResolverException;
@@ -236,6 +236,58 @@ public class RelyingPartyProxySigningParametersResolverTest extends AbstractOIDC
         assertTrue(params.iterator().next().getSigningCredential().getPrivateKey() instanceof ECPrivateKey);
     }
     
+    @Test
+    public void testResolveFail_AlgorithmExcluded() throws Exception {
+        
+        final CriteriaSet criteria = buildCriteria(List.of(SignatureConstants.ALGO_ID_SIGNATURE_HS_256));
+        
+        // Create the normal client_secret
+        criteria.add(new ClientSecretCredentialCriterion(
+                new DefaultClientSecretCredential("atestsecret")));
+        
+        final BasicSignatureSigningConfiguration config = 
+                (BasicSignatureSigningConfiguration) 
+                criteria.get(SignatureSigningConfigurationCriterion.class).getConfigurations().get(0);
+        
+        // Explicitly exclude the algorithm
+        config.setExcludedAlgorithms(List.of(SignatureConstants.ALGO_ID_SIGNATURE_HS_256));
+        
+        final OIDCProviderMetadata metadata = 
+                new OIDCProviderMetadata(new Issuer("test"), List.of(SubjectType.PUBLIC), new URI("nowhere"));
+        metadata.setRequestObjectJWSAlgs(List.of(JWSAlgorithm.HS256));
+        criteria.add(new ProviderMetadataCriterion(metadata));
+        
+        final Iterable<SignatureSigningParameters> params = resolver.resolve(criteria);
+        assertNotNull(params);
+        assertFalse(params.iterator().hasNext());
+    }
+    
+    @Test
+    public void testResolveFail_AlgorithmNotInIncludeList() throws Exception {
+        
+        final CriteriaSet criteria = buildCriteria(List.of(SignatureConstants.ALGO_ID_SIGNATURE_HS_256));
+        
+        // Create the normal client_secret
+        criteria.add(new ClientSecretCredentialCriterion(
+                new DefaultClientSecretCredential("atestsecret")));
+        
+        final BasicSignatureSigningConfiguration config = 
+                (BasicSignatureSigningConfiguration) 
+                criteria.get(SignatureSigningConfigurationCriterion.class).getConfigurations().get(0);
+        
+        // Do not include the algorithm
+        config.setIncludedAlgorithms(List.of(SignatureConstants.ALGO_ID_SIGNATURE_HS_512));
+        
+        final OIDCProviderMetadata metadata = 
+                new OIDCProviderMetadata(new Issuer("test"), List.of(SubjectType.PUBLIC), new URI("nowhere"));
+        metadata.setRequestObjectJWSAlgs(List.of(JWSAlgorithm.HS256));
+        criteria.add(new ProviderMetadataCriterion(metadata));
+        
+        final Iterable<SignatureSigningParameters> params = resolver.resolve(criteria);
+        assertNotNull(params);
+        assertFalse(params.iterator().hasNext());
+    }
+    
     
     private CriteriaSet buildCriteria(final List<String> supportedSigningAlgos) {
         final CriteriaSet crit = new CriteriaSet();

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.