[java-idp-oidc] branch main updated: JCOMOIDC-41 - Move OIDC Signature Validation resolvers and parameter classes to commons
Henri Mikkonen
henri.mikkonen at iki.fi
Fri Feb 17 07:36:59 UTC 2023
This is an automated email from the git hooks/post-receive script.
hjmikkon pushed a commit to branch main
in repository java-idp-oidc.
View the commit online:
http://git.shibboleth.net/view/?p=java-idp-oidc.git;a=commit;h=546f0be2350cdf2234956d5a39a0e3ad3da4361f
The following commit(s) were added to refs/heads/main by this push:
new 546f0be2 JCOMOIDC-41 - Move OIDC Signature Validation resolvers and parameter classes to commons
546f0be2 is described below
commit 546f0be2350cdf2234956d5a39a0e3ad3da4361f
Author: Henri Mikkonen <henri.mikkonen at iki.fi>
AuthorDate: Fri Feb 17 09:35:40 2023 +0200
JCOMOIDC-41 - Move OIDC Signature Validation resolvers and parameter classes to commons
https://shibboleth.atlassian.net/browse/JCOMOIDC-41
Improved flow tests:
- for signed JWTs by testing algorithm exclusion
- for encrypted request objects
---
.../navigate/RequestObjectUpdateStrategy.java | 3 +-
.../AbstractOidcClientAuthenticationFlowTest.java | 8 +-
.../oidc/op/profile/flow/AbstractOidcFlowTest.java | 77 +++++++++-
.../oidc/op/profile/flow/AuthorizeFlowTest.java | 159 +++++++++++----------
.../src/test/resources/conf/relying-party.xml | 6 +
5 files changed, 176 insertions(+), 77 deletions(-)
diff --git a/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/RequestObjectUpdateStrategy.java b/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/RequestObjectUpdateStrategy.java
index 6e28faab..80779337 100644
--- a/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/RequestObjectUpdateStrategy.java
+++ b/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/RequestObjectUpdateStrategy.java
@@ -38,7 +38,8 @@ public class RequestObjectUpdateStrategy implements BiConsumer<ProfileRequestCon
@Override
public void accept(@Nullable final ProfileRequestContext profileRequestContext, @Nullable final JWT jwt) {
if (profileRequestContext == null || profileRequestContext.getOutboundMessageContext() == null
- || profileRequestContext.getSubcontext(OIDCAuthenticationResponseContext.class) == null) {
+ || profileRequestContext.getOutboundMessageContext().getSubcontext(
+ OIDCAuthenticationResponseContext.class) == null) {
return;
}
final OIDCAuthenticationResponseContext oidcResponseCtx = profileRequestContext
diff --git a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/AbstractOidcClientAuthenticationFlowTest.java b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/AbstractOidcClientAuthenticationFlowTest.java
index 1b5b56b8..305c6fd5 100644
--- a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/AbstractOidcClientAuthenticationFlowTest.java
+++ b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/AbstractOidcClientAuthenticationFlowTest.java
@@ -452,7 +452,9 @@ public abstract class AbstractOidcClientAuthenticationFlowTest extends AbstractO
final SignedJWT jwt = createPrivateKeyJWT(validClaimsSet(), ecKey.toECPrivateKey(), JWSAlgorithm.ES384);
final FlowExecutionResult result = launchWithJwtAuthentication(jwt, null,
ClientAuthenticationMethod.PRIVATE_KEY_JWT, ecKey.toECPublicKey());
- assertSuccessResponse(result);
+ // ES-384 excluded in the test relying-party config
+ assertErrorCode(result, getErrorDetaisForJWTValidation().getFirst());
+ assertErrorDescriptionContains(result, getErrorDetaisForJWTValidation().getSecond());
}
@Test
@@ -461,7 +463,9 @@ public abstract class AbstractOidcClientAuthenticationFlowTest extends AbstractO
final SignedJWT jwt = createPrivateKeyJWT(validClaimsSet(), ecKey.toECPrivateKey(), JWSAlgorithm.ES384);
final FlowExecutionResult result = launchWithJwtAuthentication(jwt, JWSAlgorithm.ES384,
ClientAuthenticationMethod.PRIVATE_KEY_JWT, ecKey.toECPublicKey());
- assertSuccessResponse(result);
+ // ES-384 excluded in the test relying-party config
+ assertErrorCode(result, getErrorDetaisForJWTValidation().getFirst());
+ assertErrorDescriptionContains(result, getErrorDetaisForJWTValidation().getSecond());
}
@Test
diff --git a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/AbstractOidcFlowTest.java b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/AbstractOidcFlowTest.java
index 118e9deb..9ce472df 100644
--- a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/AbstractOidcFlowTest.java
+++ b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/AbstractOidcFlowTest.java
@@ -42,6 +42,7 @@ import org.opensaml.profile.context.ProfileRequestContext;
import org.opensaml.storage.StorageService;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.beans.factory.annotation.Qualifier;
+import org.springframework.core.io.ClassPathResource;
import org.springframework.mock.web.MockHttpServletRequest;
import org.springframework.mock.web.MockHttpServletResponse;
import org.springframework.test.context.ContextConfiguration;
@@ -54,10 +55,15 @@ import org.testng.annotations.BeforeMethod;
import com.nimbusds.jose.EncryptionMethod;
import com.nimbusds.jose.JOSEException;
import com.nimbusds.jose.JWEAlgorithm;
+import com.nimbusds.jose.JWEHeader;
+import com.nimbusds.jose.JWEObject;
import com.nimbusds.jose.JWSAlgorithm;
import com.nimbusds.jose.JWSHeader;
+import com.nimbusds.jose.Payload;
+import com.nimbusds.jose.crypto.ECDHEncrypter;
import com.nimbusds.jose.crypto.ECDSASigner;
import com.nimbusds.jose.crypto.MACSigner;
+import com.nimbusds.jose.crypto.RSAEncrypter;
import com.nimbusds.jose.crypto.RSASSASigner;
import com.nimbusds.jose.jwk.Curve;
import com.nimbusds.jose.jwk.ECKey;
@@ -79,6 +85,8 @@ import com.nimbusds.openid.connect.sdk.rp.OIDCClientMetadata;
import net.shibboleth.idp.test.flows.AbstractFlowTest;
import net.shibboleth.oidc.metadata.impl.BaseStorageServiceClientInformationComponent;
+import net.shibboleth.oidc.security.credential.BasicJWKCredential;
+import net.shibboleth.oidc.security.credential.impl.BasicJWKCredentialFactoryBean;
import net.shibboleth.utilities.java.support.net.HttpServletRequestResponseContext;
import net.shibboleth.utilities.java.support.security.DataSealer;
@@ -242,6 +250,15 @@ public abstract class AbstractOidcFlowTest extends AbstractFlowTest {
null, publicKey, false, requestObjectSigAlg, redirectUri);
}
+ protected void storeMetadata(final StorageService storageService, final String clientId, final String secret,
+ final Scope scope, final JWSAlgorithm requestObjectSigAlg, final PublicKey publicKey,
+ final JWEAlgorithm requestObjectEncAlg, final EncryptionMethod requestObjectEncMethod,
+ final String... redirectUri) throws IOException {
+ storeMetadata(storageService, clientId, secret, scope, null, null, null,
+ ClientAuthenticationMethod.CLIENT_SECRET_BASIC,
+ null, publicKey, false, requestObjectSigAlg, requestObjectEncAlg, requestObjectEncMethod, redirectUri);
+ }
+
protected void storeMetadata(final StorageService storageService, final String clientId, final String secret,
final Scope scope, final boolean addResources, final String... redirectUri) throws IOException {
storeMetadata(storageService, clientId, secret, scope, null, null, null,
@@ -287,6 +304,19 @@ public abstract class AbstractOidcFlowTest extends AbstractFlowTest {
final JWSAlgorithm userInfoSigAlg, final PublicKey publicKey,final boolean addResources,
final JWSAlgorithm requestObjectSigAlg, final String... redirectUri)
throws IOException {
+ storeMetadata(storageService, clientId, secret, scope, tokenEndpointSigAlg, tokenEncAlg, encMethod,
+ tokenEndpointMethod, userInfoSigAlg, publicKey, addResources, requestObjectSigAlg, null, null,
+ redirectUri);
+ }
+
+ protected void storeMetadata(final StorageService storageService, final String clientId, final String secret,
+ final Scope scope, final JWSAlgorithm tokenEndpointSigAlg, final JWEAlgorithm tokenEncAlg,
+ final EncryptionMethod encMethod, final ClientAuthenticationMethod tokenEndpointMethod,
+ final JWSAlgorithm userInfoSigAlg, final PublicKey publicKey,final boolean addResources,
+ final JWSAlgorithm requestObjectSigAlg, final JWEAlgorithm requestObjectEncAlg,
+ final EncryptionMethod requestObjectEncMethod, final String... redirectUri)
+ throws IOException {
+
final OIDCClientMetadata metadata = new OIDCClientMetadata();
metadata.setGrantTypes(new HashSet<GrantType>(List.of(GrantType.AUTHORIZATION_CODE,
GrantType.REFRESH_TOKEN, GrantType.CLIENT_CREDENTIALS)));
@@ -318,6 +348,8 @@ public abstract class AbstractOidcFlowTest extends AbstractFlowTest {
metadata.setTokenEndpointAuthMethod(tokenEndpointMethod);
metadata.setUserInfoJWSAlg(userInfoSigAlg);
metadata.setRequestObjectJWSAlg(requestObjectSigAlg);
+ metadata.setRequestObjectJWEAlg(requestObjectEncAlg);
+ metadata.setRequestObjectJWEEnc(requestObjectEncMethod);
if (addResources) {
metadata.setCustomField("audience", List.of("https://rp.example.org", "https://rp2.example.org",
"https://resource.example.org"));
@@ -421,6 +453,49 @@ public abstract class AbstractOidcFlowTest extends AbstractFlowTest {
final ECDSASigner signer = new ECDSASigner(ecPrivateKey);
jwt.sign(signer);
return jwt;
- }
+ }
+
+ protected static String createEncryptedJWT(final String contents, final JWEAlgorithm algorithm,
+ final EncryptionMethod method) throws JOSEException {
+ return createEncryptedJWT(contents, algorithm, method, loadEncryptionCredential());
+ }
+
+ protected static String createEncryptedJWT(final String contents, final JWEAlgorithm algorithm,
+ final EncryptionMethod method, final BasicJWKCredential credential) throws JOSEException {
+ return createEncryptedJWT(contents, algorithm, method, credential, true);
+ }
+
+ protected static String createEncryptedJWT(final String contents, final JWEAlgorithm algorithm,
+ final EncryptionMethod method, final BasicJWKCredential credential, boolean setKid) throws JOSEException {
+ final JWEObject jweObject = new JWEObject(new JWEHeader.Builder(algorithm, method)
+ .contentType("JWT").keyID(setKid ? credential.getKid() : null).build(),
+ new Payload(contents));
+ final PublicKey publicKey = credential.getPublicKey();
+ if (publicKey instanceof RSAPublicKey) {
+ jweObject.encrypt(new RSAEncrypter((RSAPublicKey) publicKey));
+ } else if (publicKey instanceof ECPublicKey) {
+ jweObject.encrypt(new ECDHEncrypter((ECPublicKey) publicKey));
+ } else {
+ Assert.fail();
+ return null;
+ }
+ return jweObject.serialize();
+ }
+
+ protected static BasicJWKCredential loadEncryptionCredential() {
+ return loadEncryptionCredential("/credentials/idp-encryption-rsa.jwk");
+ }
+
+ protected static BasicJWKCredential loadEncryptionCredential(final String classPathLocation) {
+ final BasicJWKCredentialFactoryBean factory = new BasicJWKCredentialFactoryBean();
+ factory.setResource(new ClassPathResource(classPathLocation));
+ try {
+ factory.afterPropertiesSet();
+ return factory.getObject();
+ } catch (Exception e) {
+ Assert.fail();
+ return null;
+ }
+ }
}
diff --git a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/AuthorizeFlowTest.java b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/AuthorizeFlowTest.java
index 987d7ac9..17fb4b7e 100644
--- a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/AuthorizeFlowTest.java
+++ b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/AuthorizeFlowTest.java
@@ -39,7 +39,9 @@ import org.testng.annotations.AfterMethod;
import org.testng.annotations.BeforeMethod;
import org.testng.annotations.Test;
+import com.nimbusds.jose.EncryptionMethod;
import com.nimbusds.jose.JOSEException;
+import com.nimbusds.jose.JWEAlgorithm;
import com.nimbusds.jose.JWSAlgorithm;
import com.nimbusds.jose.jwk.Curve;
import com.nimbusds.jose.jwk.ECKey;
@@ -1148,71 +1150,8 @@ public class AuthorizeFlowTest extends AbstractOidcFlowTest {
@Test
public void testWithPlainReqObjectClaimsRequest() throws IOException, SessionException,
DataSealerException, ParseException {
- final String payload = "{\n"
- + " \"iss\": \"" + clientId + "\",\n"
- + " \"response_type\": \"code\",\n"
- + " \"code_challenge_method\": \"S256\",\n"
- + " \"nonce\": \"k5r-Uwjw0KKr18XiKD2VbiLtD2adwt85_HiSvzBi8FI\",\n"
- + " \"client_id\": \"" + clientId + "\",\n"
- + " \"aud\": \"https://op.example.org\",\n"
- + " \"scope\": \"openid profile offline_access\",\n"
- + " \"claims\": {\n"
- + " \"id_token\": {\n"
- + " \"given_name\": {\n"
- + " \"essential\": true\n"
- + " }\n"
- + " },\n"
- + " \"userinfo\": {\n"
- + " \"family_name\": {\n"
- + " \"essential\": true\n"
- + " }\n"
- + " }\n"
- + " },\n"
- + " \"redirect_uri\": \"" + redirectUri + "\",\n"
- + " \"state\": \"81c33d57-59c7-4b41-9a15-80e2ed1482e21646857349537\",\n"
- + " \"code_challenge\": \"MiAR-UxCj6oVyPatcUnrb3MGEZbwLKBmIRSoOKLLTl0\"\n"
- + "}";
-
- final JWTClaimsSet ro = JWTClaimsSet.parse(payload);
- final PlainJWT requestObject = new PlainJWT(ro);
-
- request.setMethod("GET");
- setRequestParameters(List.of(new Pair<>("client_id", "mockClientId"),
- new Pair<>("response_type", "code"),
- new Pair<>("scope", "openid profile"),
- new Pair<>("redirect_uri", "https://invalid.org/cb"),
- new Pair<>("request", requestObject.serialize())));
- storeMetadata(storageService, clientId, clientSecret, scope, redirectUri);
-
- initializeThreadLocals();
-
- final FlowExecutionResult result = flowExecutor.launchExecution(FLOW_ID, null, externalContext);
- final AuthenticationResponse responseMessage = parseSuccessResponse(result, AuthenticationResponse.class);
- final AuthenticationSuccessResponse successResponse = responseMessage.toSuccessResponse();
- Assert.assertEquals(successResponse.getRedirectionURI().toString(), redirectUri);
- Assert.assertNull(successResponse.getIDToken());
- Assert.assertNull(successResponse.getAccessToken());
- Assert.assertNotNull(successResponse.getAuthorizationCode());
- Assert.assertNotNull(getSidFromAuthorizeCodeClaimsSet(successResponse));
- Assert.assertNull(successResponse.getIssuer());
-
- final AuthorizeCodeClaimsSet code =
- AuthorizeCodeClaimsSet.parse(successResponse.getAuthorizationCode().getValue(), getDataSealer());
- Assert.assertNotNull(code.getClaimsRequest());
- Assert.assertNotNull(code.getClaimsRequest().getIDTokenClaimsRequest());
- Assert.assertNotNull(code.getClaimsRequest().getUserInfoClaimsRequest());
- Assert.assertTrue(code.getClaimsRequest().getUserInfoClaimsRequest().getClaimNames(false)
- .contains("family_name"));
- Assert.assertTrue(code.getClaimsRequest().getIDTokenClaimsRequest().getClaimNames(false)
- .contains("given_name"));
- final ClaimsSetRequest.Entry familyName = code.getClaimsRequest().getUserInfoClaimsRequest().get("family_name",
- null);
- Assert.assertEquals(familyName.getClaimName(), "family_name");
- Assert.assertEquals(familyName.getClaimRequirement(), ClaimRequirement.ESSENTIAL);
- final ClaimsSetRequest.Entry givenName = code.getClaimsRequest().getIDTokenClaimsRequest().get("given_name",
- null);
- Assert.assertEquals(givenName.getClaimName(), "given_name");
- Assert.assertEquals(givenName.getClaimRequirement(), ClaimRequirement.ESSENTIAL);
+ final JWTClaimsSet ro = JWTClaimsSet.parse(getRequestObjectWithClaimsRequestPayload());
+ assertSuccessRequestObjectWithClaimsRequestResponse(new PlainJWT(ro));
}
@Test
@@ -1483,7 +1422,8 @@ public class AuthorizeFlowTest extends AbstractOidcFlowTest {
SessionException, JOSEException, DataSealerException, ParseException {
final JWTClaimsSet ro = JWTClaimsSet.parse(getRequestObjectWithClaimsRequestPayload());
final ECKey ecKey = initializeECKey(Curve.P_384, "384");
- assertSuccessRequestObjectWithClaimsRequestResponse(createPrivateKeyJWT(ro, ecKey.toECPrivateKey(),
+ // ES384 is excluded by the test relying-party.xml
+ assertRequestObjectError(createPrivateKeyJWT(ro, ecKey.toECPrivateKey(),
JWSAlgorithm.ES384), null, ecKey.toECPublicKey());
}
@@ -1517,7 +1457,8 @@ public class AuthorizeFlowTest extends AbstractOidcFlowTest {
SessionException, JOSEException, DataSealerException, ParseException {
final JWTClaimsSet ro = JWTClaimsSet.parse(getRequestObjectWithClaimsRequestPayload());
final ECKey ecKey = initializeECKey(Curve.P_384, "384");
- assertSuccessRequestObjectWithClaimsRequestResponse(createPrivateKeyJWT(ro, ecKey.toECPrivateKey(),
+ // ES384 is excluded by the test relying-party.xml
+ assertRequestObjectError(createPrivateKeyJWT(ro, ecKey.toECPrivateKey(),
JWSAlgorithm.ES384), JWSAlgorithm.ES384, ecKey.toECPublicKey());
}
@@ -1548,6 +1489,56 @@ public class AuthorizeFlowTest extends AbstractOidcFlowTest {
JWSAlgorithm.ES384, ecKey.toECPublicKey());
}
+ @SuppressWarnings("deprecation") // JWEAlgorithm.RSA_OAEP is deprecated as it's not recommended
+ @Test
+ public void testWithEncryptedPlainRequestObjectWithKid() throws IOException,
+ SessionException, JOSEException, DataSealerException, ParseException {
+ final JWTClaimsSet ro = JWTClaimsSet.parse(getRequestObjectWithClaimsRequestPayload());
+ final PlainJWT jwt = new PlainJWT(ro);
+ final String encryptedJwt = createEncryptedJWT(jwt.serialize(), JWEAlgorithm.RSA_OAEP,
+ EncryptionMethod.A128CBC_HS256, loadEncryptionCredential(), false);
+ assertSuccessRequestObjectWithClaimsRequestResponse(encryptedJwt,
+ null, null, JWEAlgorithm.RSA_OAEP, EncryptionMethod.A128CBC_HS256);
+ }
+
+ @SuppressWarnings("deprecation") // JWEAlgorithm.RSA_OAEP is deprecated as it's not recommended
+ @Test
+ public void testWithEncryptedPlainRequestObjectNoKid() throws IOException,
+ SessionException, JOSEException, DataSealerException, ParseException {
+ final JWTClaimsSet ro = JWTClaimsSet.parse(getRequestObjectWithClaimsRequestPayload());
+ final PlainJWT jwt = new PlainJWT(ro);
+ final String encryptedJwt = createEncryptedJWT(jwt.serialize(), JWEAlgorithm.RSA_OAEP,
+ EncryptionMethod.A128CBC_HS256, loadEncryptionCredential(), false);
+ assertSuccessRequestObjectWithClaimsRequestResponse(encryptedJwt,
+ null, null, JWEAlgorithm.RSA_OAEP, EncryptionMethod.A128CBC_HS256);
+ }
+
+ @SuppressWarnings("deprecation") // JWEAlgorithm.RSA_OAEP is deprecated as it's not recommended
+ @Test
+ public void testWithEncryptedSignedRequestObjectWithKid() throws IOException,
+ SessionException, JOSEException, DataSealerException, ParseException {
+ final JWTClaimsSet ro = JWTClaimsSet.parse(getRequestObjectWithClaimsRequestPayload());
+ final ECKey ecKey = initializeECKey(Curve.P_521, "521");
+ final SignedJWT jwt = createPrivateKeyJWT(ro, ecKey.toECPrivateKey(), JWSAlgorithm.ES512);
+ final String encryptedJwt = createEncryptedJWT(jwt.serialize(), JWEAlgorithm.RSA_OAEP,
+ EncryptionMethod.A128CBC_HS256, loadEncryptionCredential(), true);
+ assertSuccessRequestObjectWithClaimsRequestResponse(encryptedJwt,
+ JWSAlgorithm.ES512, ecKey.toECPublicKey(), JWEAlgorithm.RSA_OAEP, EncryptionMethod.A128CBC_HS256);
+ }
+
+ @SuppressWarnings("deprecation") // JWEAlgorithm.RSA_OAEP is deprecated as it's not recommended
+ @Test
+ public void testWithEncryptedSignedRequestObjectNoKid() throws IOException,
+ SessionException, JOSEException, DataSealerException, ParseException {
+ final JWTClaimsSet ro = JWTClaimsSet.parse(getRequestObjectWithClaimsRequestPayload());
+ final ECKey ecKey = initializeECKey(Curve.P_521, "521");
+ final SignedJWT jwt = createPrivateKeyJWT(ro, ecKey.toECPrivateKey(), JWSAlgorithm.ES512);
+ final String encryptedJwt = createEncryptedJWT(jwt.serialize(), JWEAlgorithm.RSA_OAEP,
+ EncryptionMethod.A128CBC_HS256, loadEncryptionCredential(), false);
+ assertSuccessRequestObjectWithClaimsRequestResponse(encryptedJwt,
+ JWSAlgorithm.ES512, ecKey.toECPublicKey(), JWEAlgorithm.RSA_OAEP, EncryptionMethod.A128CBC_HS256);
+ }
+
protected String getRequestObjectWithClaimsRequestPayload() {
return "{\n"
+ " \"iss\": \"" + clientId + "\",\n"
@@ -1575,26 +1566,42 @@ public class AuthorizeFlowTest extends AbstractOidcFlowTest {
+ "}";
}
- protected void assertSuccessRequestObjectWithClaimsRequestResponse(final SignedJWT requestObject)
+ protected void assertSuccessRequestObjectWithClaimsRequestResponse(final JWT requestObject)
throws ParseException, DataSealerException, IOException {
assertSuccessRequestObjectWithClaimsRequestResponse(requestObject, null);
}
- protected void assertSuccessRequestObjectWithClaimsRequestResponse(final SignedJWT requestObject,
+ protected void assertSuccessRequestObjectWithClaimsRequestResponse(final JWT requestObject,
final JWSAlgorithm requestObjectSigAlg) throws ParseException, DataSealerException, IOException {
assertSuccessRequestObjectWithClaimsRequestResponse(requestObject, requestObjectSigAlg, null);
}
- protected void assertSuccessRequestObjectWithClaimsRequestResponse(final SignedJWT requestObject,
+ protected void assertSuccessRequestObjectWithClaimsRequestResponse(final JWT requestObject,
final JWSAlgorithm requestObjectSigAlg, final PublicKey publicKey)
throws ParseException, DataSealerException, IOException {
+ assertSuccessRequestObjectWithClaimsRequestResponse(requestObject, requestObjectSigAlg, publicKey, null, null);
+ }
+
+ protected void assertSuccessRequestObjectWithClaimsRequestResponse(final JWT requestObject,
+ final JWSAlgorithm requestObjectSigAlg, final PublicKey publicKey, final JWEAlgorithm requestObjectEncAlg,
+ final EncryptionMethod requestObjectEncMethod)
+ throws ParseException, DataSealerException, IOException {
+ assertSuccessRequestObjectWithClaimsRequestResponse(requestObject.serialize(), requestObjectSigAlg, publicKey,
+ requestObjectEncAlg, requestObjectEncMethod);
+ }
+
+ protected void assertSuccessRequestObjectWithClaimsRequestResponse(final String requestObject,
+ final JWSAlgorithm requestObjectSigAlg, final PublicKey publicKey, final JWEAlgorithm requestObjectEncAlg,
+ final EncryptionMethod requestObjectEncMethod)
+ throws ParseException, DataSealerException, IOException {
request.setMethod("GET");
setRequestParameters(List.of(new Pair<>("client_id", "mockClientId"),
new Pair<>("response_type", "code"),
new Pair<>("scope", "openid profile"),
new Pair<>("redirect_uri", redirectUri),
- new Pair<>("request", requestObject.serialize())));
- storeMetadata(storageService, clientId, clientSecret, scope, requestObjectSigAlg, publicKey, redirectUri);
+ new Pair<>("request", requestObject)));
+ storeMetadata(storageService, clientId, clientSecret, scope, requestObjectSigAlg, publicKey,
+ requestObjectEncAlg, requestObjectEncMethod, redirectUri);
initializeThreadLocals();
@@ -1640,12 +1647,18 @@ public class AuthorizeFlowTest extends AbstractOidcFlowTest {
protected void assertRequestObjectError(final JWT requestObject, final JWSAlgorithm requestObjectSigAlg,
final PublicKey publicKey) throws IOException {
+ assertRequestObjectError(requestObject.serialize(), requestObjectSigAlg, publicKey, null, null);
+ }
+
+ protected void assertRequestObjectError(final String requestObject, final JWSAlgorithm requestObjectSigAlg,
+ final PublicKey publicKey, final JWEAlgorithm requestObjectEncAlg,
+ final EncryptionMethod requestObjectEncMethod) throws IOException {
request.setMethod("GET");
setRequestParameters(List.of(new Pair<>("client_id", "mockClientId"),
new Pair<>("response_type", "code"),
new Pair<>("scope", "openid profile"),
new Pair<>("redirect_uri", redirectUri),
- new Pair<>("request", requestObject.serialize())));
+ new Pair<>("request", requestObject)));
storeMetadata(storageService, clientId, clientSecret, scope, requestObjectSigAlg, publicKey, redirectUri);
initializeThreadLocals();
diff --git a/idp-oidc-extension-impl/src/test/resources/conf/relying-party.xml b/idp-oidc-extension-impl/src/test/resources/conf/relying-party.xml
index 9e7dfb46..d2bc1e84 100644
--- a/idp-oidc-extension-impl/src/test/resources/conf/relying-party.xml
+++ b/idp-oidc-extension-impl/src/test/resources/conf/relying-party.xml
@@ -12,6 +12,12 @@
default-init-method="initialize"
default-destroy-method="destroy">
+ <!-- Exclude single ES-algorithm for testing -->
+ <util:list id="shibboleth.oidc.ExcludedSignatureAlgorithms">
+ <util:constant
+ static-field="net.shibboleth.oidc.jwa.support.SignatureConstants.ALGO_ID_SIGNATURE_ES_384" />
+ </util:list>
+
<!--
Unverified RP configuration, defaults to no support for any profiles. Add <ref> elements to the list
to enable specific default profile settings (as below), or create new beans inline to override defaults.
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list