[java-idp-plugin-oidc-rp] branch main updated: Improve flow test success conditions.
Phil Smart
philip.smart at jisc.ac.uk
Tue Feb 14 11:54:03 UTC 2023
This is an automated email from the git hooks/post-receive script.
philsmart pushed a commit to branch main
in repository java-idp-plugin-oidc-rp.
View the commit online:
http://git.shibboleth.net/view/?p=java-idp-plugin-oidc-rp.git;a=commit;h=2a24b1544f070570c6c45434fdc6f33c5fd0037c
The following commit(s) were added to refs/heads/main by this push:
new 2a24b15 Improve flow test success conditions.
2a24b15 is described below
commit 2a24b1544f070570c6c45434fdc6f33c5fd0037c
Author: Phil Smart <philip.smart at jisc.ac.uk>
AuthorDate: Tue Feb 14 11:53:58 2023 +0000
Improve flow test success conditions.
---
.../OIDCRPFlowFromAuthenticationResponseTest.java | 131 ++++++++++--
.../plugin/authn/oidc/rp/impl/OIDCRPFlowTest.java | 219 ++++++++++++++++-----
.../plugin/authn/oidc/rp/impl/TestTokenHelper.java | 21 +-
3 files changed, 287 insertions(+), 84 deletions(-)
diff --git a/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/OIDCRPFlowFromAuthenticationResponseTest.java b/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/OIDCRPFlowFromAuthenticationResponseTest.java
index 83eb922..c8a38b6 100644
--- a/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/OIDCRPFlowFromAuthenticationResponseTest.java
+++ b/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/OIDCRPFlowFromAuthenticationResponseTest.java
@@ -13,17 +13,22 @@ import org.springframework.webflow.engine.impl.FlowExecutionImpl;
import com.nimbusds.jose.JOSEException;
import com.nimbusds.jose.JWEAlgorithm;
+import com.nimbusds.jose.JWSObject.State;
import com.nimbusds.jose.jwk.RSAKey;
+import com.nimbusds.jwt.SignedJWT;
import com.nimbusds.oauth2.sdk.ResponseType;
import com.nimbusds.oauth2.sdk.id.ClientID;
-import com.nimbusds.oauth2.sdk.id.State;
import com.nimbusds.openid.connect.sdk.AuthenticationResponseParser;
import net.shibboleth.idp.authn.context.AuthenticationContext;
import net.shibboleth.idp.authn.context.ExternalAuthenticationContext;
import net.shibboleth.idp.authn.context.SubjectCanonicalizationContext;
import net.shibboleth.idp.authn.impl.ExternalAuthenticationImpl;
+import net.shibboleth.idp.plugin.authn.oidc.rp.context.AccessTokenResponseContext;
import net.shibboleth.idp.plugin.authn.oidc.rp.context.EndUserClaimsContext;
+import net.shibboleth.idp.plugin.authn.oidc.rp.context.UserInfoResponseContext;
+import net.shibboleth.idp.plugin.authn.oidc.rp.messaging.JWTUserInfoResponse;
+import net.shibboleth.idp.plugin.authn.oidc.rp.messaging.PlainUserInfoResponse;
import net.shibboleth.idp.profile.context.RelyingPartyContext;
import net.shibboleth.idp.saml.authn.principal.AuthenticationMethodPrincipal;
import net.shibboleth.oidc.authn.principal.AuthenticationContextClassReferencePrincipal;
@@ -52,7 +57,7 @@ public class OIDCRPFlowFromAuthenticationResponseTest extends OIDCRPFlowTest {
/**
* Test the flow from the external authorization request to the end of the flow.
- * Using a MAC signed id_token and plain UserInfo JSON Response.
+ * Using a MAC-signed id_token and plain UserInfo JSON Response.
*
* @throws Exception on error.
*/
@@ -96,13 +101,31 @@ public class OIDCRPFlowFromAuthenticationResponseTest extends OIDCRPFlowTest {
mockOPServer.shutdown();
- assertStandardEndFlowSuccessConditions(prc);
+ final var nestedPrc = assertStandardEndFlowSuccessConditions(prc);
+
+ final var accessTokenResponse =
+ nestedPrc.getInboundMessageContext().getSubcontext(AccessTokenResponseContext.class);
+ final var userInfoResponse =
+ nestedPrc.getInboundMessageContext().getSubcontext(UserInfoResponseContext.class);
+ final var endUserClaims =
+ nestedPrc.getInboundMessageContext().getSubcontext(EndUserClaimsContext.class);
+
+ assertNotNull(accessTokenResponse.getIdToken());
+ assertNotNull(userInfoResponse.getUserInfo());
+ assertTrue(userInfoResponse.getUserInfo() instanceof PlainUserInfoResponse);
+ assertTrue(accessTokenResponse.getIdToken() instanceof SignedJWT);
+ final var signedJwt = (SignedJWT) accessTokenResponse.getIdToken();
+ assertEquals(signedJwt.getState(), State.VERIFIED);
+
+ assertStandardIdTokenClaimsSuccessCondition(signedJwt.getJWTClaimsSet());
+ assertStandardEndUserClaimsSuccessCondition(endUserClaims.getEndUserClaims());
+
}
/**
* Test the flow from the external authorization request to the end of the flow.
- * Using a MAC signed id_token and an invalid UserInfo JSON Response - it has not subject.
+ * Using a MAC signed id_token and an invalid UserInfo JSON Response - it has no subject.
*
* @throws Exception on error.
*/
@@ -146,10 +169,20 @@ public class OIDCRPFlowFromAuthenticationResponseTest extends OIDCRPFlowTest {
mockOPServer.shutdown();
- //assert success conditions
- assertFlowExecutionEnded();
- assertNotNull(prc.getSubcontext(AuthenticationContext.class));
- assertNull(prc.getSubcontext(SubjectCanonicalizationContext.class));
+ assertFlowExecutionEnded();
+
+ final var nestedPrc = prc.getSubcontext(AuthenticationContext.class).getSubcontext(ProfileRequestContext.class);
+ final var accessTokenResponse =
+ nestedPrc.getInboundMessageContext().getSubcontext(AccessTokenResponseContext.class);
+
+ assertNotNull(accessTokenResponse.getIdToken());
+ assertTrue(accessTokenResponse.getIdToken() instanceof SignedJWT);
+ final var signedJwt = (SignedJWT) accessTokenResponse.getIdToken();
+ assertEquals(signedJwt.getState(), State.VERIFIED);
+ assertStandardIdTokenClaimsSuccessCondition(signedJwt.getJWTClaimsSet());
+
+ // Should have failed to produce a result
+ assertFlowEndedInErrorConditions(prc, "InvalidUserInfoClaims");
}
@@ -196,7 +229,28 @@ public class OIDCRPFlowFromAuthenticationResponseTest extends OIDCRPFlowTest {
mockOPServer.shutdown();
- assertStandardEndFlowSuccessConditions(prc);
+ final var nestedPrc = assertStandardEndFlowSuccessConditions(prc);
+
+ final var accessTokenResponse =
+ nestedPrc.getInboundMessageContext().getSubcontext(AccessTokenResponseContext.class);
+ final var userInfoResponse =
+ nestedPrc.getInboundMessageContext().getSubcontext(UserInfoResponseContext.class);
+ final var endUserClaims =
+ nestedPrc.getInboundMessageContext().getSubcontext(EndUserClaimsContext.class);
+
+ assertNotNull(accessTokenResponse.getIdToken());
+ assertNotNull(userInfoResponse.getUserInfo());
+ assertTrue(accessTokenResponse.getIdToken() instanceof SignedJWT);
+ final var signedJwt = (SignedJWT) accessTokenResponse.getIdToken();
+ assertEquals(signedJwt.getState(), State.VERIFIED);
+
+ assertTrue(userInfoResponse.getUserInfo() instanceof JWTUserInfoResponse);
+ final var jwtUserInfoResponse = (JWTUserInfoResponse)(userInfoResponse.getUserInfo());
+ assertTrue(jwtUserInfoResponse.getResponseJwt() instanceof SignedJWT);
+ assertEquals(State.VERIFIED, ((SignedJWT)jwtUserInfoResponse.getResponseJwt()).getState());
+
+ assertStandardIdTokenClaimsSuccessCondition(signedJwt.getJWTClaimsSet());
+ assertStandardEndUserClaimsSuccessCondition(endUserClaims.getEndUserClaims());
}
@@ -254,6 +308,7 @@ public class OIDCRPFlowFromAuthenticationResponseTest extends OIDCRPFlowTest {
final var decryptConfig = new BasicDecryptionConfiguration();
decryptConfig.setContentEncryptionKeyCredentialResolver(
new ClientSecretCriterionCredentialResolver());
+
decryptConfig.setKEKCredentialResolver(new JOSEObjectCredentialResolver() {
@Override
@@ -317,7 +372,28 @@ public class OIDCRPFlowFromAuthenticationResponseTest extends OIDCRPFlowTest {
mockOPServer.shutdown();
- assertStandardEndFlowSuccessConditions(prc);
+ final var nestedPrc = assertStandardEndFlowSuccessConditions(prc);
+
+ final var accessTokenResponse =
+ nestedPrc.getInboundMessageContext().getSubcontext(AccessTokenResponseContext.class);
+ final var userInfoResponse =
+ nestedPrc.getInboundMessageContext().getSubcontext(UserInfoResponseContext.class);
+ final var endUserClaims =
+ nestedPrc.getInboundMessageContext().getSubcontext(EndUserClaimsContext.class);
+
+ assertNotNull(accessTokenResponse.getIdToken());
+ assertNotNull(userInfoResponse.getUserInfo());
+ assertTrue(accessTokenResponse.getIdToken() instanceof SignedJWT);
+ final var signedJwt = (SignedJWT) accessTokenResponse.getIdToken();
+ assertEquals(signedJwt.getState(), State.VERIFIED);
+
+ assertTrue(userInfoResponse.getUserInfo() instanceof JWTUserInfoResponse);
+ final var jwtUserInfoResponse = (JWTUserInfoResponse)(userInfoResponse.getUserInfo());
+ assertTrue(jwtUserInfoResponse.getResponseJwt() instanceof SignedJWT);
+ assertEquals(State.VERIFIED, ((SignedJWT)jwtUserInfoResponse.getResponseJwt()).getState());
+
+ assertStandardIdTokenClaimsSuccessCondition(signedJwt.getJWTClaimsSet());
+ assertStandardEndUserClaimsSuccessCondition(endUserClaims.getEndUserClaims());
}
@@ -412,7 +488,25 @@ public class OIDCRPFlowFromAuthenticationResponseTest extends OIDCRPFlowTest {
mockOPServer.shutdown();
- assertStandardEndFlowSuccessConditions(prc);
+ final var nestedPrc = assertStandardEndFlowSuccessConditions(prc);
+
+ final var accessTokenResponse =
+ nestedPrc.getInboundMessageContext().getSubcontext(AccessTokenResponseContext.class);
+ final var userInfoResponse =
+ nestedPrc.getInboundMessageContext().getSubcontext(UserInfoResponseContext.class);
+ final var endUserClaims =
+ nestedPrc.getInboundMessageContext().getSubcontext(EndUserClaimsContext.class);
+
+ assertNotNull(accessTokenResponse.getIdToken());
+ assertNotNull(userInfoResponse.getUserInfo());
+ assertTrue(accessTokenResponse.getIdToken() instanceof SignedJWT);
+ final var signedJwt = (SignedJWT) accessTokenResponse.getIdToken();
+ assertEquals(signedJwt.getState(), State.VERIFIED);
+
+ assertTrue(userInfoResponse.getUserInfo() instanceof PlainUserInfoResponse);
+
+ assertStandardIdTokenClaimsSuccessCondition(signedJwt.getJWTClaimsSet());
+ assertStandardEndUserClaimsSuccessCondition(endUserClaims.getEndUserClaims());
}
@@ -464,10 +558,7 @@ public class OIDCRPFlowFromAuthenticationResponseTest extends OIDCRPFlowTest {
mockOPServer.shutdown();
- //assert success conditions
- assertFlowExecutionEnded();
- assertNotNull(prc.getSubcontext(AuthenticationContext.class));
- assertNull(prc.getSubcontext(SubjectCanonicalizationContext.class));
+ assertFlowEndedInErrorConditions(prc, "InvalidMessage");
}
@@ -565,8 +656,8 @@ public class OIDCRPFlowFromAuthenticationResponseTest extends OIDCRPFlowTest {
setCurrentState("AuthnRequest");
resumeFlow(externalContext);
- assertFlowExecutionEnded();
- // Flow did not produce an end-user message context
+ assertFlowEndedInErrorConditions(prc);
+ // Ensure flow did not produce an end-user message context
assertNull(prc.getSubcontext(AuthenticationContext.class).getSubcontext(ProfileRequestContext.class)
.getInboundMessageContext().getSubcontext(EndUserClaimsContext.class));
@@ -607,7 +698,7 @@ public class OIDCRPFlowFromAuthenticationResponseTest extends OIDCRPFlowTest {
final MessageContext outMsgCtx = new MessageContext();
final OIDCAuthenticationRequest request = new OIDCAuthenticationRequest(new ClientID(OP_ISSUER_ID));
- request.setState(new State("8df98fd63a53fa5b5433d6f8754bca5d.65317332"));
+ request.setState(new com.nimbusds.oauth2.sdk.id.State("8df98fd63a53fa5b5433d6f8754bca5d.65317332"));
outMsgCtx.setMessage(request);
nestPrc.setOutboundMessageContext(outMsgCtx);
@@ -627,9 +718,7 @@ public class OIDCRPFlowFromAuthenticationResponseTest extends OIDCRPFlowTest {
resumeFlow(externalContext);
//assert success conditions
- assertFlowExecutionEnded();
- assertNotNull(prc.getSubcontext(AuthenticationContext.class));
- assertNull(prc.getSubcontext(SubjectCanonicalizationContext.class));
+ assertFlowEndedInErrorConditions(prc, "MessageProcessingError");
}
diff --git a/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/OIDCRPFlowTest.java b/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/OIDCRPFlowTest.java
index c8d9816..f02bf00 100644
--- a/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/OIDCRPFlowTest.java
+++ b/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/OIDCRPFlowTest.java
@@ -37,6 +37,7 @@ import org.apache.http.ssl.SSLContextBuilder;
import org.opensaml.core.config.InitializationException;
import org.opensaml.core.metrics.impl.MetricRegistryInitializer;
import org.opensaml.messaging.context.MessageContext;
+import org.opensaml.profile.context.PreviousEventContext;
import org.opensaml.profile.context.ProfileRequestContext;
import org.opensaml.xmlsec.config.GlobalAlgorithmRegistryInitializer;
import org.slf4j.Logger;
@@ -47,6 +48,7 @@ import org.springframework.webflow.engine.Flow;
import org.springframework.webflow.engine.impl.FlowExecutionImpl;
import org.springframework.webflow.test.MockFlowBuilderContext;
+import com.nimbusds.jwt.JWTClaimsSet;
import com.nimbusds.oauth2.sdk.ParseException;
import com.nimbusds.oauth2.sdk.ResponseMode;
import com.nimbusds.oauth2.sdk.ResponseType;
@@ -64,8 +66,11 @@ import net.shibboleth.idp.authn.context.AuthenticationContext;
import net.shibboleth.idp.authn.context.ExternalAuthenticationContext;
import net.shibboleth.idp.authn.context.SubjectCanonicalizationContext;
import net.shibboleth.idp.authn.impl.ExternalAuthenticationImpl;
+import net.shibboleth.idp.plugin.authn.oidc.rp.context.AccessTokenResponseContext;
+import net.shibboleth.idp.plugin.authn.oidc.rp.context.EndUserClaimsContext;
import net.shibboleth.idp.plugin.authn.oidc.rp.context.OAuth2ClientContext;
import net.shibboleth.idp.plugin.authn.oidc.rp.context.OIDCPeerEntityContext;
+import net.shibboleth.idp.plugin.authn.oidc.rp.context.UserInfoResponseContext;
import net.shibboleth.idp.plugin.authn.oidc.rp.principal.OIDCSubjectIdentifierPrincipal;
import net.shibboleth.idp.plugin.authn.test.flow.AbstractAuthnXmlFlowExecutionTests;
import net.shibboleth.idp.plugin.authn.test.flow.mock.MockFlowBuilder;
@@ -420,60 +425,6 @@ public class OIDCRPFlowTest extends AbstractAuthnXmlFlowExecutionTests {
return securityConfig;
}
- /**
- * Assert the basic set of conditions expected at the end of the entire authentication flow.
- *
- * @param prc the profile request context.
- */
- protected void assertStandardEndFlowSuccessConditions(final ProfileRequestContext prc) {
- //assert success conditions.
- assertFlowExecutionEnded();
- assertNotNull(prc.getSubcontext(AuthenticationContext.class));
- assertNotNull(prc.getSubcontext(SubjectCanonicalizationContext.class));
- assertNotNull(prc.getSubcontext(SubjectCanonicalizationContext.class).getSubject().getPrincipals());
- //As SimpleSubjectCanonicalization has not been run, we pull out the subject
- final OIDCSubjectIdentifierPrincipal subjectIndentifierPrincipal =
- prc.getSubcontext(SubjectCanonicalizationContext.class).getSubject()
- .getPrincipals(OIDCSubjectIdentifierPrincipal.class).iterator().next();
- assertNotNull(subjectIndentifierPrincipal);
- assertEquals(subjectIndentifierPrincipal.getName(),"jdoe");
- }
-
- /**
- * Assert the basic set of conditions expected when the authentication flow is at the authentication redirect.
- *
- * @param rootPrc the root profile request context.
- *
- * @return the nested profile request context to perform further checks over.
- */
- protected ProfileRequestContext assertStandardAuthenticationRedirectFlowSuccessConditions(
- final ProfileRequestContext rootPrc) {
- //assert success conditions.
- assertCurrentStateEquals("AuthnRequest");
- assertNotNull(rootPrc.getSubcontext(AuthenticationContext.class));
- assertNotNull(rootPrc.getSubcontext(AuthenticationContext.class).getSubcontext(ProfileRequestContext.class));
- assertNotNull(rootPrc.getSubcontext(AuthenticationContext.class).getSubcontext(ProfileRequestContext.class)
- .getOutboundMessageContext());
- assertTrue(rootPrc.getSubcontext(AuthenticationContext.class).getSubcontext(ProfileRequestContext.class)
- .getOutboundMessageContext().getMessage() instanceof OIDCAuthenticationRequest);
- final OIDCAuthenticationRequest request =
- (OIDCAuthenticationRequest) rootPrc.getSubcontext(AuthenticationContext.class)
- .getSubcontext(ProfileRequestContext.class).getOutboundMessageContext().getMessage();
- assertEquals(request.getResponseType(), ResponseType.CODE);
- assertEquals(request.getRedirectURI().toASCIIString(), "https://localhost/callback");
- assertEquals(request.getResponseMode(), ResponseMode.QUERY);
-
- return rootPrc.getSubcontext(AuthenticationContext.class).getSubcontext(ProfileRequestContext.class);
- }
-
- protected void assertStandardRequestObjectSuccessConditions(final ClaimsSet roClaims, final String audience) {
- assertEquals("https://localhost/callback",roClaims.getStringClaim("redirect_uri"));
- assertEquals("openid", roClaims.getStringClaim("scope"));
- assertEquals("demo_rp", roClaims.getStringClaim("client_id"));
- assertEquals("code", roClaims.getStringClaim("response_type"));
- assertTrue(roClaims.getAudience().contains(new Audience(audience)));
- }
-
/**
* Create an authentication response.
*
@@ -569,5 +520,165 @@ public class OIDCRPFlowTest extends AbstractAuthnXmlFlowExecutionTests {
return principals;
});
}
+
+ /**
+ * Assert the basic set of conditions expected at the end of the entire authentication flow.
+ *
+ * @param rootPrc the profile request context.
+ *
+ * @return the nested profile request context to perform further checks over.
+ */
+ protected ProfileRequestContext assertStandardEndFlowSuccessConditions(final ProfileRequestContext rootPrc) {
+ //assert success conditions.
+ assertFlowExecutionEnded();
+ assertNotNull(rootPrc.getSubcontext(AuthenticationContext.class));
+ // Is there an authn result?
+ assertNotNull(rootPrc.getSubcontext(AuthenticationContext.class).getAuthenticationResult());
+ assertNotNull(rootPrc.getSubcontext(SubjectCanonicalizationContext.class));
+ assertNotNull(rootPrc.getSubcontext(SubjectCanonicalizationContext.class).getSubject().getPrincipals());
+ //As SimpleSubjectCanonicalization has not been run, we pull out the subject
+ final OIDCSubjectIdentifierPrincipal subjectIndentifierPrincipal =
+ rootPrc.getSubcontext(SubjectCanonicalizationContext.class).getSubject()
+ .getPrincipals(OIDCSubjectIdentifierPrincipal.class).iterator().next();
+ assertNotNull(subjectIndentifierPrincipal);
+ assertEquals(subjectIndentifierPrincipal.getName(),"jdoe");
+
+ final var nestedPrc = rootPrc.getSubcontext(AuthenticationContext.class)
+ .getSubcontext(ProfileRequestContext.class);
+ assertTrue(nestedPrc.getInboundMessageContext().getMessage() instanceof AuthenticationResponse);
+ assertNotNull(nestedPrc.getInboundMessageContext().getSubcontext(AccessTokenResponseContext.class));
+ assertNotNull(nestedPrc.getInboundMessageContext().getSubcontext(UserInfoResponseContext.class));
+ assertNotNull(nestedPrc.getInboundMessageContext().getSubcontext(EndUserClaimsContext.class));
+
+ return nestedPrc;
+ }
+
+ /**
+ * Assert the basic set of conditions expected when the authentication flow is at the authentication redirect.
+ *
+ * @param rootPrc the root profile request context.
+ *
+ * @return the nested profile request context to perform further checks over.
+ */
+ protected ProfileRequestContext assertStandardAuthenticationRedirectFlowSuccessConditions(
+ final ProfileRequestContext rootPrc) {
+ //assert success conditions.
+ assertCurrentStateEquals("AuthnRequest");
+ assertNotNull(rootPrc.getSubcontext(AuthenticationContext.class));
+
+ assertNotNull(rootPrc.getSubcontext(AuthenticationContext.class).getSubcontext(ProfileRequestContext.class));
+ assertNotNull(rootPrc.getSubcontext(AuthenticationContext.class).getSubcontext(ProfileRequestContext.class)
+ .getOutboundMessageContext());
+ assertTrue(rootPrc.getSubcontext(AuthenticationContext.class).getSubcontext(ProfileRequestContext.class)
+ .getOutboundMessageContext().getMessage() instanceof OIDCAuthenticationRequest);
+ final OIDCAuthenticationRequest request =
+ (OIDCAuthenticationRequest) rootPrc.getSubcontext(AuthenticationContext.class)
+ .getSubcontext(ProfileRequestContext.class).getOutboundMessageContext().getMessage();
+ assertEquals(request.getResponseType(), ResponseType.CODE);
+ assertEquals(request.getRedirectURI().toASCIIString(), "https://localhost/callback");
+ assertEquals(request.getResponseMode(), ResponseMode.QUERY);
+
+ return rootPrc.getSubcontext(AuthenticationContext.class).getSubcontext(ProfileRequestContext.class);
+ }
+
+ /**
+ * Assert the conditions expected when the flow has ended in error. No authentication result is produced, and the
+ * previous event was an error event with the given value.
+ *
+ * @param rootPrc the root profile request context
+ * @param error the error message to check.
+ */
+ protected void assertFlowEndedInErrorConditions(@Nonnull final ProfileRequestContext rootPrc,
+ @Nonnull final String error) {
+
+ assertFlowExecutionEnded();
+ // No result
+ assertNull(rootPrc.getSubcontext(SubjectCanonicalizationContext.class));
+ // Is there an authn result?
+ assertNull(rootPrc.getSubcontext(AuthenticationContext.class).getAuthenticationResult());
+
+ assertPreviousEventContextError(rootPrc, error);
+ }
+
+ /**
+ * Assert the conditions expected when the flow has ended in error. No authentication result is produced.
+ *
+ * @param rootPrc the root profile request context
+ */
+ protected void assertFlowEndedInErrorConditions(@Nonnull final ProfileRequestContext rootPrc) {
+
+ assertFlowExecutionEnded();
+ // No result
+ assertNull(rootPrc.getSubcontext(SubjectCanonicalizationContext.class));
+ // Is there an authn result?
+ assertNull(rootPrc.getSubcontext(AuthenticationContext.class).getAuthenticationResult());
+ }
+
+ /**
+ * Assert the claims (belonging to the request object) have the correct set of basic claims.
+ *
+ * @param roClaims the request object claims
+ * @param audience the audience value to check
+ */
+ protected void assertStandardRequestObjectSuccessConditions(final ClaimsSet roClaims, final String audience) {
+ assertEquals("https://localhost/callback",roClaims.getStringClaim("redirect_uri"));
+ assertEquals("openid", roClaims.getStringClaim("scope"));
+ assertEquals("demo_rp", roClaims.getStringClaim("client_id"));
+ assertEquals("code", roClaims.getStringClaim("response_type"));
+ assertTrue(roClaims.getAudience().contains(new Audience(audience)));
+ }
+
+ /**
+ * Assert that a previous event context exists and that the event recorded is a string with the value given.
+ *
+ * @param rootPrc the root profile request context
+ *
+ * @param error the error event value to test
+ */
+ protected void assertPreviousEventContextError(@Nonnull final ProfileRequestContext rootPrc,
+ @Nonnull final String error) {
+
+ assertNotNull(rootPrc.getSubcontext(AuthenticationContext.class));
+ assertNotNull(rootPrc.getSubcontext(AuthenticationContext.class).getSubcontext(ProfileRequestContext.class));
+ assertNotNull(rootPrc.getSubcontext(AuthenticationContext.class).getSubcontext(ProfileRequestContext.class)
+ .getSubcontext(PreviousEventContext.class));
+ final var previousEvent = rootPrc.getSubcontext(AuthenticationContext.class)
+ .getSubcontext(ProfileRequestContext.class)
+ .getSubcontext(PreviousEventContext.class);
+
+ assertTrue(previousEvent.getEvent() instanceof String);
+ assertEquals(error, (String)previousEvent.getEvent());
+ }
+
+ /**
+ * Assert the standard set of claims exist in the id_token's claimsset.
+ *
+ * @param claims the claims to test.
+ */
+ protected void assertStandardIdTokenClaimsSuccessCondition(final JWTClaimsSet claims) {
+ assertEquals("https://localhost:9918", claims.getIssuer());
+ assertEquals("jdoe", claims.getSubject());
+ assertEquals("abadnonce", claims.getClaim("nonce"));
+ assertEquals(CLIENT_ID, claims.getClaim("azp"));
+ assertEquals( "Demo T. User", claims.getClaim("name"));
+ assertTrue(claims.getAudience().contains(CLIENT_ID));
+ assertNotNull(claims.getExpirationTime());
+ }
+
+ /**
+ * Assert the standard set of claims exist in the end-user context claimsset.
+ *
+ * @param claims the claims to test.
+ */
+ protected void assertStandardEndUserClaimsSuccessCondition(final ClaimsSet claims) {
+ assertEquals("jdoe", claims.getClaim("sub"));
+ assertEquals("d.tu", claims.getClaim("preferred_username"));
+ assertEquals("Demo", claims.getClaim("given_name"));
+ assertEquals("Dee", claims.getClaim("nickname"));
+ assertEquals("User", claims.getClaim("family_name"));
+
+ }
+
+
}
diff --git a/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/TestTokenHelper.java b/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/TestTokenHelper.java
index ba68509..21ac7ba 100644
--- a/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/TestTokenHelper.java
+++ b/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/TestTokenHelper.java
@@ -72,17 +72,20 @@ public final class TestTokenHelper {
* @return the JWT claims set.
*/
public static JWTClaimsSet createBasicClaims(
- final String subject, final String nonce, final String name,
final String opIssuerId, final String clientId,
final List<String> audience) {
return new JWTClaimsSet.Builder()
.issuer(opIssuerId)
.audience(audience)
- .subject(subject)
- .claim("nonce", nonce)
+ .subject("jdoe")
+ .claim("preferred_username", "d.tu")
+ .claim("given_name", "Demo")
+ .claim("family_name", "User")
+ .claim("nonce", "abadnonce")
+ .claim("nickname", "Dee")
.claim("azp", clientId)
- .claim("name",name)
+ .claim("name","Demo T. User")
.claim("acr","urn:mace:incommon:iap:silver")
.claim("amr", List.of("pwd", "otp"))
.claim("auth_time", new Date())
@@ -113,7 +116,7 @@ public final class TestTokenHelper {
.type(JOSEObjectType.JWT)
.build();
- final var payload = createBasicClaims("jdoe", "abadnonce", "jdoe", opIssuerId, clientId, audience);
+ final var payload = createBasicClaims(opIssuerId, clientId, audience);
final var signedJWT = new SignedJWT(header,payload);
signedJWT.sign(new MACSigner(clientSecret));
@@ -147,7 +150,7 @@ public final class TestTokenHelper {
TestCredentialHelper.createClientSecretCredential(clientSecret).toSigningCredential(),
JWEAlgorithm.DIR, EncryptionMethod.A256GCM);
- final var payload = createBasicClaims("jdoe", "abadnonce", "jdoe", opIssuerId, clientId, audience);
+ final var payload = createBasicClaims(opIssuerId, clientId, audience);
final var signedJWT = new SignedJWT(header,payload);
// sign off the client_secret octets directly
signedJWT.sign(new MACSigner(clientSecret));
@@ -185,7 +188,7 @@ public final class TestTokenHelper {
.type(JOSEObjectType.JWT)
.build();
- final var payload = createBasicClaims("jdoe", "abadnonce", "jdoe", opIssuerId, clientId, audience);
+ final var payload = createBasicClaims(opIssuerId, clientId, audience);
final var signedJWT = new SignedJWT(header,payload);
signedJWT.sign(new MACSigner(clientSecret));
@@ -262,7 +265,7 @@ public final class TestTokenHelper {
.keyID(key.getKeyID())
.build();
- final var payload = createBasicClaims("jdoe", "adbadnonce", "Jdoe", opIssuerId, clientId, audience);
+ final var payload = createBasicClaims(opIssuerId, clientId, audience);
final var signedJWT = new SignedJWT(header, payload);
signedJWT.sign(new ECDSASigner(key.toECPrivateKey()));
@@ -289,7 +292,7 @@ public final class TestTokenHelper {
.type(JOSEObjectType.JWT)
.build();
- final var payload = createBasicClaims("jdoe", "adbadnonce", "Jdoe", opIssuerId, clientId, audience);
+ final var payload = createBasicClaims(opIssuerId, clientId, audience);
final var signedJWT = new SignedJWT(header, payload);
signedJWT.sign(new MACSigner(clientSecret));
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list