[java-idp-plugin-oidc-rp] branch main updated: Add acr_values to request object if claims claim is not supported

[Phil Smart]

This is an automated email from the git hooks/post-receive script.

philsmart pushed a commit to branch main
in repository java-idp-plugin-oidc-rp.

View the commit online:
http://git.shibboleth.net/view/?p=java-idp-plugin-oidc-rp.git;a=commit;h=91a102f113039b93a8739d5faf13ddc5e4462957

The following commit(s) were added to refs/heads/main by this push:
     new 91a102f  Add acr_values to request object if claims claim is not supported
91a102f is described below

commit 91a102f113039b93a8739d5faf13ddc5e4462957
Author: Phil Smart <philip.smart at jisc.ac.uk>
AuthorDate: Tue Jan 3 11:31:20 2023 +0000

    Add acr_values to request object if claims claim is not supported
---
 .../authn/oidc/rp/impl/BuildRequestObject.java     | 11 +++++++-
 .../authn/oidc/rp/impl/BuildRequestObjectTest.java | 29 ++++++++++++++++++++++
 2 files changed, 39 insertions(+), 1 deletion(-)

diff --git a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/BuildRequestObject.java b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/BuildRequestObject.java
index e18a555..5d983e1 100644
--- a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/BuildRequestObject.java
+++ b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/BuildRequestObject.java
@@ -20,6 +20,7 @@ package net.shibboleth.idp.plugin.authn.oidc.rp.impl;
 import java.time.Duration;
 import java.util.function.Function;
 import java.util.function.Predicate;
+import java.util.stream.Collectors;
 
 import javax.annotation.Nonnull;
 import javax.annotation.Nullable;
@@ -37,6 +38,7 @@ import com.google.common.base.Predicates;
 import com.nimbusds.jwt.JWT;
 import com.nimbusds.oauth2.sdk.id.Audience;
 import com.nimbusds.oauth2.sdk.id.Issuer;
+import com.nimbusds.openid.connect.sdk.claims.ACR;
 import com.nimbusds.openid.connect.sdk.claims.ClaimsSet;
 import com.nimbusds.openid.connect.sdk.op.OIDCProviderMetadata;
 
@@ -247,7 +249,14 @@ public class BuildRequestObject extends AbstractAuthenticationAction {
             if (authnRequest.getRequestedClaims() != null) {
                 requestObjectClaims.setClaim("claims", authnRequest.getRequestedClaims());
             }
-        }     
+        } else if (!authnRequest.getAcrs().isEmpty()) {        
+            // Only add ACR values as acr_values if the provider does not support the 'claims' claim.             
+            final String acrString = String.join(" ", authnRequest.getAcrs()
+                    .stream()
+                    .map(ACR::getValue)
+                    .collect(Collectors.toUnmodifiableList()));
+            requestObjectClaims.setClaim("acr_values", acrString);
+        }
         
         // Validate the request object
         if (!validateRequestObject(profileRequestContext, requestObjectClaims)) {
diff --git a/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/BuildRequestObjectTest.java b/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/BuildRequestObjectTest.java
index bf8da7f..afd2cff 100644
--- a/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/BuildRequestObjectTest.java
+++ b/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/BuildRequestObjectTest.java
@@ -127,6 +127,35 @@ public class BuildRequestObjectTest extends AbstractOIDCTest {
         assertTrue(isValidJSON(claims.toJSONString()));
     }
     
+    /* Test building acr_values when the claims claim is not supported.*/
+    @Test
+    public void testBuildRequestObject_WithACRs_ClaimsNotSupported_Success() throws ComponentInitializationException {
+        
+        authnRequest.setProviderSupportsClaimsParameter(false);
+        authnRequest.setAcrs(List.of(new ACR("urn:mace:incommon:iap:silver")));
+        
+        action.initialize();        
+        final Event event = action.execute(src);
+        assertNull(event);
+        assertNotNull(prc.getOutboundMessageContext().getMessage());
+        assertNotNull(((OIDCAuthenticationRequest)prc.getOutboundMessageContext()
+                .getMessage()).getRequestObjectClaimsSet());
+        final ClaimsSet claims = (((OIDCAuthenticationRequest)prc.getOutboundMessageContext()
+                .getMessage()).getRequestObjectClaimsSet());
+        assertEquals(claims.getStringClaim("scope"),"openid");
+        assertEquals(claims.getStringClaim("iss"),"https://rp.example.com");
+        assertEquals(claims.getStringClaim("client_id"),"https://rp.example.com");
+        assertEquals(claims.getStringClaim("response_type"),"code");
+        assertEquals(claims.getNumberClaim("max_age").longValue(),60);
+        assertEquals(claims.getStringClaim("redirect_uri"),"https://rp.example.com/callback");
+        assertNotNull(claims.getStringClaim("nonce"));
+        assertNotNull(claims.getClaim("aud"));
+        assertNull(claims.getClaim("claims"));
+        
+        // Now test acr_values
+        assertEquals(claims.getStringClaim("acr_values"),"urn:mace:incommon:iap:silver");
+    }
+    
     @Test
     public void testBuildRequestObject_WithACRsAndExistingRequestedClaims_Success() throws ComponentInitializationException {
         

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.