[java-oidc-common] branch main updated: Refactoring the ProviderMetadataCredentialResolver and its unit tests.
Henri Mikkonen
henri.mikkonen at iki.fi
Fri Jan 6 09:25:37 UTC 2023
This is an automated email from the git hooks/post-receive script.
hjmikkon pushed a commit to branch main
in repository java-oidc-common.
View the commit online:
http://git.shibboleth.net/view/?p=java-oidc-common.git;a=commit;h=4f85300cd1870f4c554a1a2983886a861081d9b8
The following commit(s) were added to refs/heads/main by this push:
new 4f85300 Refactoring the ProviderMetadataCredentialResolver and its unit tests.
4f85300 is described below
commit 4f85300cd1870f4c554a1a2983886a861081d9b8
Author: Henri Mikkonen <henri.mikkonen at iki.fi>
AuthorDate: Fri Jan 6 11:24:04 2023 +0200
Refactoring the ProviderMetadataCredentialResolver and its unit tests.
This way the generic parts can be exploited by other credential resolvers
such as upcoming ClientInformationCredentialResolver.
---
.../impl/BasicJOSEObjectCredentialResolver.java | 49 ++++-
.../impl/ProviderMetadataCredentialResolver.java | 43 +---
...ava => BaseMetadataCredentialResolverTest.java} | 115 ++++++-----
.../ProviderMetadataCredentialResolverTest.java | 230 +++------------------
4 files changed, 134 insertions(+), 303 deletions(-)
diff --git a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/credential/impl/BasicJOSEObjectCredentialResolver.java b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/credential/impl/BasicJOSEObjectCredentialResolver.java
index 8b52ade..0c1d282 100644
--- a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/credential/impl/BasicJOSEObjectCredentialResolver.java
+++ b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/credential/impl/BasicJOSEObjectCredentialResolver.java
@@ -18,6 +18,7 @@
package net.shibboleth.oidc.security.credential.impl;
import java.util.ArrayList;
+import java.util.Collection;
import java.util.List;
import javax.annotation.Nonnull;
@@ -34,12 +35,16 @@ import com.nimbusds.jose.JOSEObject;
import com.nimbusds.jose.JWEHeader;
import com.nimbusds.jose.JWSHeader;
import com.nimbusds.jose.jwk.AsymmetricJWK;
+import com.nimbusds.jose.jwk.ECKey;
import com.nimbusds.jose.jwk.JWK;
+import com.nimbusds.jose.jwk.JWKSet;
import com.nimbusds.jose.jwk.KeyType;
+import com.nimbusds.jose.jwk.RSAKey;
import net.shibboleth.oidc.security.credential.BasicJWKCredential;
import net.shibboleth.oidc.security.credential.JOSEObjectCredentialResolver;
import net.shibboleth.oidc.security.criterion.JOSEObjectCriterion;
+import net.shibboleth.oidc.security.criterion.KeyIdCriterion;
import net.shibboleth.oidc.security.impl.CredentialConversionUtil;
import net.shibboleth.utilities.java.support.annotation.constraint.NonnullElements;
import net.shibboleth.utilities.java.support.resolver.CriteriaSet;
@@ -188,5 +193,47 @@ public class BasicJOSEObjectCredentialResolver extends AbstractCriteriaFiltering
return credential;
}
-
+ /**
+ * Extract a KeyId from the criteria set if one exists. If not, return {@code null}.
+ *
+ * @param criteriaSet the criteria set to pull the keyId from
+ *
+ * @return a KeyId if one exists, {@code null} otherwise
+ */
+ @Nullable protected String extractKeyIdFromCriteria(@Nonnull final CriteriaSet criteriaSet) {
+ if (criteriaSet.contains(EvaluableKeyIDCredentialCriterion.class)) {
+ return criteriaSet.get(EvaluableKeyIDCredentialCriterion.class).getKeyId();
+ } else if (criteriaSet.contains(KeyIdCriterion.class)) {
+ return criteriaSet.get(KeyIdCriterion.class).getKeyId();
+ } else {
+ return null;
+ }
+ }
+
+ /**
+ * Convert the RSA and EC keys from the given {@link JWKSet} into the collection of credentials.
+ *
+ * @param keySet the keyset containing RSA/EC keys to convert
+ *
+ * @param credentials the target collection to include the converted credentials
+ */
+ protected void populateCredentialsFromKeySet(@Nonnull final JWKSet keySet,
+ @Nonnull final Collection<Credential> credentials) {
+ //TODO maybe the remote cache could cache the converted keys?
+ for (final JWK key : keySet.getKeys()) {
+ // Only RSA or EC public keys supplied by an OP
+ if (key instanceof RSAKey || key instanceof ECKey) {
+ try {
+ final Credential cred = CredentialConversionUtil.keyToCredential(key);
+ if (cred != null) {
+ log.trace("Found key '{}' of type '{}' with usage '{}' and alg '{}'",
+ key.getKeyID(), key.getKeyType(), key.getKeyUse(), key.getAlgorithm());
+ credentials.add(cred);
+ }
+ } catch (final JOSEException e) {
+ log.trace("Unable to convert key '{}' to credential", key.getKeyID(), e);
+ }
+ }
+ }
+ }
}
diff --git a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/credential/impl/ProviderMetadataCredentialResolver.java b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/credential/impl/ProviderMetadataCredentialResolver.java
index 2f50a10..99a4a61 100644
--- a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/credential/impl/ProviderMetadataCredentialResolver.java
+++ b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/credential/impl/ProviderMetadataCredentialResolver.java
@@ -24,24 +24,17 @@ import java.util.Collections;
import java.util.LinkedHashSet;
import javax.annotation.Nonnull;
-import javax.annotation.Nullable;
import org.opensaml.security.credential.Credential;
import org.opensaml.security.credential.impl.AbstractCriteriaFilteringCredentialResolver;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
-import com.nimbusds.jose.JOSEException;
-import com.nimbusds.jose.jwk.ECKey;
-import com.nimbusds.jose.jwk.JWK;
import com.nimbusds.jose.jwk.JWKSet;
-import com.nimbusds.jose.jwk.RSAKey;
import com.nimbusds.openid.connect.sdk.op.OIDCProviderMetadata;
import net.shibboleth.oidc.jwk.RemoteJwkSetCache;
-import net.shibboleth.oidc.security.criterion.KeyIdCriterion;
import net.shibboleth.oidc.security.criterion.ProviderMetadataCriterion;
-import net.shibboleth.oidc.security.impl.CredentialConversionUtil;
import net.shibboleth.utilities.java.support.annotation.constraint.NonnullAfterInit;
import net.shibboleth.utilities.java.support.annotation.constraint.Positive;
import net.shibboleth.utilities.java.support.component.ComponentInitializationException;
@@ -158,45 +151,11 @@ public class ProviderMetadataCredentialResolver extends BasicJOSEObjectCredentia
return Collections.emptyList();
}
- //TODO maybe the remote cache could cache the converted keys?
- for (final JWK key : keySet.getKeys()) {
- // Only RSA or EC public keys supplied by an OP
- if (key instanceof RSAKey || key instanceof ECKey) {
- try {
- final Credential cred = CredentialConversionUtil.keyToCredential(key);
- if (cred != null) {
- log.trace("Found key '{}' of type '{}' with usage '{}' and alg '{}'",
- key.getKeyID(), key.getKeyType(), key.getKeyUse(), key.getAlgorithm());
- credentials.add(cred);
- }
- } catch (final JOSEException e) {
- log.trace("Unable to convert key '{}' to credential", key.getKeyID(), e);
- }
- }
- }
+ populateCredentialsFromKeySet(keySet, credentials);
} else {
log.trace("No JWK Set available, no credentials returned");
}
return credentials;
}
- /**
- * Extract a KeyId from the criteria set if one exists. If not, return {@code null}.
- *
- * @param criteriaSet the criteria set to pull the keyId from
- *
- * @return a KeyId if one exists, {@code null} otherwise
- */
- @Nullable private String extractKeyIdFromCriteria(@Nonnull final CriteriaSet criteriaSet) {
- if (criteriaSet.contains(EvaluableKeyIDCredentialCriterion.class)) {
- return criteriaSet.get(EvaluableKeyIDCredentialCriterion.class).getKeyId();
- } else if (criteriaSet.contains(KeyIdCriterion.class)) {
- return criteriaSet.get(KeyIdCriterion.class).getKeyId();
- } else {
- return null;
- }
-
- }
-
-
}
diff --git a/oidc-common-crypto-impl/src/test/java/net/shibboleth/oidc/security/credential/impl/ProviderMetadataCredentialResolverTest.java b/oidc-common-crypto-impl/src/test/java/net/shibboleth/oidc/security/credential/impl/BaseMetadataCredentialResolverTest.java
similarity index 81%
copy from oidc-common-crypto-impl/src/test/java/net/shibboleth/oidc/security/credential/impl/ProviderMetadataCredentialResolverTest.java
copy to oidc-common-crypto-impl/src/test/java/net/shibboleth/oidc/security/credential/impl/BaseMetadataCredentialResolverTest.java
index 439ea40..697f921 100644
--- a/oidc-common-crypto-impl/src/test/java/net/shibboleth/oidc/security/credential/impl/ProviderMetadataCredentialResolverTest.java
+++ b/oidc-common-crypto-impl/src/test/java/net/shibboleth/oidc/security/credential/impl/BaseMetadataCredentialResolverTest.java
@@ -52,62 +52,42 @@ import org.springframework.util.FileCopyUtils;
import org.testng.annotations.BeforeMethod;
import org.testng.annotations.Test;
-import com.nimbusds.openid.connect.sdk.op.OIDCProviderMetadata;
-
import net.shibboleth.oidc.jwk.RemoteJwkSetCache;
import net.shibboleth.oidc.security.criterion.KeyIdCriterion;
-import net.shibboleth.oidc.security.criterion.ProviderMetadataCriterion;
import net.shibboleth.utilities.java.support.component.ComponentInitializationException;
+import net.shibboleth.utilities.java.support.component.InitializableComponent;
import net.shibboleth.utilities.java.support.resolver.CriteriaSet;
import net.shibboleth.utilities.java.support.resolver.ResolverException;
-public class ProviderMetadataCredentialResolverTest {
-
- private ProviderMetadataCredentialResolver resolver;
-
+/**
+ * Base unit test for the credential resolvers fetching the credentials from metadata.
+ */
+public abstract class BaseMetadataCredentialResolverTest<T extends BasicJOSEObjectCredentialResolver> {
+
/** A remote JWKSet.*/
- private static final ClassPathResource REMOTE_JWKSET =
+ protected static final ClassPathResource REMOTE_JWKSET =
new ClassPathResource("/credentials/test-provider-resolver-remote-jwkset-response.jwk");
/** A remote JWKSet with no keys.*/
- private static final ClassPathResource REMOTE_JWKSET_NO_KEYS =
+ protected static final ClassPathResource REMOTE_JWKSET_NO_KEYS =
new ClassPathResource("/credentials/test-provider-resolver-remote-jwkset-response-nokeys.jwk");
/** A remote JWKSet with a rolled over key.*/
- private static final ClassPathResource REMOTE_JWKSET_ROLLOVER =
+ protected static final ClassPathResource REMOTE_JWKSET_ROLLOVER =
new ClassPathResource("/credentials/test-provider-resolver-remote-jwkset-response-rollover.jwk");
/** A remote JWKSet with no keys array.*/
- private static final ClassPathResource REMOTE_JWKSET_NO_KEY_ARRAY =
+ protected static final ClassPathResource REMOTE_JWKSET_NO_KEY_ARRAY =
new ClassPathResource("/credentials/test-provider-resolver-remote-jwkset-response-no-key-array.jwk");
-
- /**
- * Example of good provider metadata that supports request_object_encryption.
- */
- private static final ClassPathResource GOOD_PROVIDER_CONFIGURATION_INFO =
- new ClassPathResource("/metadata/test-resolver-provider-encryption.json");
-
- private CriteriaSet criteria;
+
+ /** The resolver to be tested. */
+ protected T resolver;
+
+ /** The default criteria when testing. */
+ protected CriteriaSet criteria;
/** The cache being used by the resolver.*/
- private RemoteJwkSetCache cache;
-
- /**
- * Read a file into a string.
- *
- * @param location the location of the file to read
- *
- * @return the file as a string
- */
- private String readJsonFromFile(@Nonnull final Resource location) {
- try (Reader reader = new InputStreamReader(location.getInputStream(), StandardCharsets.UTF_8)) {
- return FileCopyUtils.copyToString(reader);
- } catch (final Exception ex) {
- fail();
- return null;
- }
- }
-
+ protected RemoteJwkSetCache cache;
protected HttpClient createMockHttpClient(final String output) throws ClientProtocolException, IOException {
final HttpClient httpClient = Mockito.mock(HttpClient.class);
@@ -128,28 +108,37 @@ public class ProviderMetadataCredentialResolverTest {
@BeforeMethod
public void setup() throws Exception {
- resolver = new ProviderMetadataCredentialResolver();
cache = new RemoteJwkSetCache();
cache.setStorage(buildStorageService());
cache.setHttpClient(createMockHttpClient(readJsonFromFile(REMOTE_JWKSET)));
- resolver.setRemoteJwkSetCache(cache);
- criteria = new CriteriaSet();
-
- criteria.add(new ProviderMetadataCriterion(
- OIDCProviderMetadata.parse(readJsonFromFile(GOOD_PROVIDER_CONFIGURATION_INFO))));
+ resolver = constructResolver(cache);
+ criteria = buildInitialCriteriaSet();
}
-
+
+ /**
+ * Construct the resolver to be tested.
+ * @param cache the cache being used by the resolver
+ * @return the resolver to be tested with the given cache configured
+ */
+ protected abstract T constructResolver(final RemoteJwkSetCache cache);
+
+ /**
+ * Build the criteria to be used by default in the test cases.
+ * @return the criteria set
+ * @throws Exception
+ */
+ protected abstract CriteriaSet buildInitialCriteriaSet() throws Exception;
+
@Test(expectedExceptions = ResolverException.class)
- public void testFail_IncorrectCriteria() throws Exception {
- resolver.initialize();
- // Needs ProviderMetadataCriterion
+ public void testFail_EmptyCriteria() throws Exception {
+ ((InitializableComponent) resolver).initialize();
criteria = new CriteriaSet();
- final Iterable<Credential> creds = resolver.resolve(criteria);
+ resolver.resolve(criteria);
}
-
+
@Test
public void testSuccess_ForEncryption() throws Exception {
- resolver.initialize();
+ ((InitializableComponent) resolver).initialize();
criteria.add(new UsageCriterion(UsageType.ENCRYPTION));
@@ -165,7 +154,7 @@ public class ProviderMetadataCredentialResolverTest {
@Test
public void testSuccess_NoKeyArray() throws Exception {
cache.setHttpClient(createMockHttpClient(readJsonFromFile(REMOTE_JWKSET_NO_KEY_ARRAY)));
- resolver.initialize();
+ ((InitializableComponent) resolver).initialize();
criteria.add(new UsageCriterion(UsageType.ENCRYPTION));
@@ -181,7 +170,7 @@ public class ProviderMetadataCredentialResolverTest {
@Test
public void testSuccess_NoKeys() throws Exception {
cache.setHttpClient(createMockHttpClient(readJsonFromFile(REMOTE_JWKSET_NO_KEYS)));
- resolver.initialize();
+ ((InitializableComponent) resolver).initialize();
criteria.add(new UsageCriterion(UsageType.ENCRYPTION));
@@ -200,7 +189,7 @@ public class ProviderMetadataCredentialResolverTest {
// Cache the keyset, then fetch a new keyID later
cache.fetch(new URI("https://localhost:9921/oauth2/v3/certs"),
Instant.now().plus(Duration.ofMinutes(10)));
- resolver.initialize();
+ ((InitializableComponent) resolver).initialize();
//Roll over the keyset document
cache.setHttpClient(createMockHttpClient(readJsonFromFile(REMOTE_JWKSET_ROLLOVER)));
@@ -219,7 +208,7 @@ public class ProviderMetadataCredentialResolverTest {
@Test
public void testSuccess_ForEncryptionAndKeyAlg() throws Exception {
- resolver.initialize();
+ ((InitializableComponent) resolver).initialize();
criteria.add(new UsageCriterion(UsageType.ENCRYPTION));
criteria.add(new KeyAlgorithmCriterion("RSA"));
@@ -235,7 +224,7 @@ public class ProviderMetadataCredentialResolverTest {
@Test
public void testSuccess_ForSigning() throws Exception {
- resolver.initialize();
+ ((InitializableComponent) resolver).initialize();
criteria.add(new UsageCriterion(UsageType.SIGNING));
@@ -248,4 +237,20 @@ public class ProviderMetadataCredentialResolverTest {
assertEquals(credsList.size(), 5);
}
+ /**
+ * Read a file into a string.
+ *
+ * @param location the location of the file to read
+ *
+ * @return the file as a string
+ */
+ protected String readJsonFromFile(@Nonnull final Resource location) {
+ try (Reader reader = new InputStreamReader(location.getInputStream(), StandardCharsets.UTF_8)) {
+ return FileCopyUtils.copyToString(reader);
+ } catch (final Exception ex) {
+ fail();
+ return null;
+ }
+ }
+
}
diff --git a/oidc-common-crypto-impl/src/test/java/net/shibboleth/oidc/security/credential/impl/ProviderMetadataCredentialResolverTest.java b/oidc-common-crypto-impl/src/test/java/net/shibboleth/oidc/security/credential/impl/ProviderMetadataCredentialResolverTest.java
index 439ea40..f182ca8 100644
--- a/oidc-common-crypto-impl/src/test/java/net/shibboleth/oidc/security/credential/impl/ProviderMetadataCredentialResolverTest.java
+++ b/oidc-common-crypto-impl/src/test/java/net/shibboleth/oidc/security/credential/impl/ProviderMetadataCredentialResolverTest.java
@@ -17,235 +17,55 @@
package net.shibboleth.oidc.security.credential.impl;
-import static org.testng.Assert.assertEquals;
-import static org.testng.Assert.assertNotNull;
-import static org.testng.Assert.fail;
-
-import java.io.IOException;
-import java.io.InputStreamReader;
-import java.io.Reader;
-import java.net.URI;
-import java.nio.charset.StandardCharsets;
-import java.time.Duration;
-import java.time.Instant;
-import java.util.ArrayList;
-import java.util.List;
-
-import javax.annotation.Nonnull;
-
-import org.apache.http.HttpResponse;
-import org.apache.http.client.ClientProtocolException;
-import org.apache.http.client.HttpClient;
-import org.apache.http.client.methods.HttpUriRequest;
-import org.apache.http.entity.StringEntity;
-import org.apache.http.protocol.HttpContext;
-import org.mockito.Mockito;
-import org.opensaml.security.credential.Credential;
-import org.opensaml.security.credential.UsageType;
-import org.opensaml.security.criteria.KeyAlgorithmCriterion;
-import org.opensaml.security.criteria.UsageCriterion;
-import org.opensaml.storage.StorageService;
-import org.opensaml.storage.impl.MemoryStorageService;
import org.springframework.core.io.ClassPathResource;
-import org.springframework.core.io.Resource;
-import org.springframework.util.FileCopyUtils;
-import org.testng.annotations.BeforeMethod;
import org.testng.annotations.Test;
+import com.nimbusds.oauth2.sdk.id.ClientID;
import com.nimbusds.openid.connect.sdk.op.OIDCProviderMetadata;
+import com.nimbusds.openid.connect.sdk.rp.OIDCClientInformation;
+import com.nimbusds.openid.connect.sdk.rp.OIDCClientMetadata;
import net.shibboleth.oidc.jwk.RemoteJwkSetCache;
-import net.shibboleth.oidc.security.criterion.KeyIdCriterion;
+import net.shibboleth.oidc.security.criterion.ClientInformationCriterion;
import net.shibboleth.oidc.security.criterion.ProviderMetadataCriterion;
-import net.shibboleth.utilities.java.support.component.ComponentInitializationException;
+import net.shibboleth.utilities.java.support.component.InitializableComponent;
import net.shibboleth.utilities.java.support.resolver.CriteriaSet;
import net.shibboleth.utilities.java.support.resolver.ResolverException;
-public class ProviderMetadataCredentialResolverTest {
-
- private ProviderMetadataCredentialResolver resolver;
-
- /** A remote JWKSet.*/
- private static final ClassPathResource REMOTE_JWKSET =
- new ClassPathResource("/credentials/test-provider-resolver-remote-jwkset-response.jwk");
-
- /** A remote JWKSet with no keys.*/
- private static final ClassPathResource REMOTE_JWKSET_NO_KEYS =
- new ClassPathResource("/credentials/test-provider-resolver-remote-jwkset-response-nokeys.jwk");
-
- /** A remote JWKSet with a rolled over key.*/
- private static final ClassPathResource REMOTE_JWKSET_ROLLOVER =
- new ClassPathResource("/credentials/test-provider-resolver-remote-jwkset-response-rollover.jwk");
-
- /** A remote JWKSet with no keys array.*/
- private static final ClassPathResource REMOTE_JWKSET_NO_KEY_ARRAY =
- new ClassPathResource("/credentials/test-provider-resolver-remote-jwkset-response-no-key-array.jwk");
+/**
+ * Unit tests for {@link ProviderMetadataCredentialResolver}.
+ */
+public class ProviderMetadataCredentialResolverTest extends BaseMetadataCredentialResolverTest<ProviderMetadataCredentialResolver> {
/**
* Example of good provider metadata that supports request_object_encryption.
*/
private static final ClassPathResource GOOD_PROVIDER_CONFIGURATION_INFO =
new ClassPathResource("/metadata/test-resolver-provider-encryption.json");
-
- private CriteriaSet criteria;
-
- /** The cache being used by the resolver.*/
- private RemoteJwkSetCache cache;
-
- /**
- * Read a file into a string.
- *
- * @param location the location of the file to read
- *
- * @return the file as a string
- */
- private String readJsonFromFile(@Nonnull final Resource location) {
- try (Reader reader = new InputStreamReader(location.getInputStream(), StandardCharsets.UTF_8)) {
- return FileCopyUtils.copyToString(reader);
- } catch (final Exception ex) {
- fail();
- return null;
- }
- }
-
-
- protected HttpClient createMockHttpClient(final String output) throws ClientProtocolException, IOException {
- final HttpClient httpClient = Mockito.mock(HttpClient.class);
- final HttpResponse httpResponse = Mockito.mock(HttpResponse.class);
- Mockito.when(httpResponse.getEntity()).thenReturn(new StringEntity(output));
- Mockito.when(httpClient.execute((HttpUriRequest) Mockito.any(),
- (HttpContext) Mockito.any())).thenReturn(httpResponse);
- return httpClient;
- }
-
- private StorageService buildStorageService() throws ComponentInitializationException {
- final MemoryStorageService storageService = new MemoryStorageService();
- storageService.setId("mockId");
- storageService.initialize();
- return storageService;
- }
-
-
- @BeforeMethod
- public void setup() throws Exception {
+
+ @Override
+ protected ProviderMetadataCredentialResolver constructResolver(final RemoteJwkSetCache cache) {
resolver = new ProviderMetadataCredentialResolver();
- cache = new RemoteJwkSetCache();
- cache.setStorage(buildStorageService());
- cache.setHttpClient(createMockHttpClient(readJsonFromFile(REMOTE_JWKSET)));
resolver.setRemoteJwkSetCache(cache);
+ return resolver;
+ }
+
+ @Override
+ protected CriteriaSet buildInitialCriteriaSet() throws Exception {
criteria = new CriteriaSet();
criteria.add(new ProviderMetadataCriterion(
OIDCProviderMetadata.parse(readJsonFromFile(GOOD_PROVIDER_CONFIGURATION_INFO))));
+ return criteria;
}
-
+
@Test(expectedExceptions = ResolverException.class)
public void testFail_IncorrectCriteria() throws Exception {
- resolver.initialize();
- // Needs ProviderMetadataCriterion
- criteria = new CriteriaSet();
- final Iterable<Credential> creds = resolver.resolve(criteria);
- }
-
- @Test
- public void testSuccess_ForEncryption() throws Exception {
- resolver.initialize();
-
- criteria.add(new UsageCriterion(UsageType.ENCRYPTION));
-
- final Iterable<Credential> creds = resolver.resolve(criteria);
-
- assertNotNull(creds);
- final List<Credential> credsList = new ArrayList<>();
- creds.forEach(credsList::add);
- // There are two 'enc' keys in the keyset, which should match the usage criterion
- assertEquals(credsList.size(), 2);
- }
-
- @Test
- public void testSuccess_NoKeyArray() throws Exception {
- cache.setHttpClient(createMockHttpClient(readJsonFromFile(REMOTE_JWKSET_NO_KEY_ARRAY)));
- resolver.initialize();
-
- criteria.add(new UsageCriterion(UsageType.ENCRYPTION));
-
- final Iterable<Credential> creds = resolver.resolve(criteria);
-
- assertNotNull(creds);
- final List<Credential> credsList = new ArrayList<>();
- creds.forEach(credsList::add);
- // No keys
- assertEquals(credsList.size(), 0);
- }
-
- @Test
- public void testSuccess_NoKeys() throws Exception {
- cache.setHttpClient(createMockHttpClient(readJsonFromFile(REMOTE_JWKSET_NO_KEYS)));
- resolver.initialize();
-
- criteria.add(new UsageCriterion(UsageType.ENCRYPTION));
-
- final Iterable<Credential> creds = resolver.resolve(criteria);
-
- assertNotNull(creds);
- final List<Credential> credsList = new ArrayList<>();
- creds.forEach(credsList::add);
- // No keys
- assertEquals(credsList.size(), 0);
- }
-
- /* Test refetching the keyset if the keyset is cached but the key ID did not exist.*/
- @Test
- public void testSuccess_KeyRotatedRefetch() throws Exception {
- // Cache the keyset, then fetch a new keyID later
- cache.fetch(new URI("https://localhost:9921/oauth2/v3/certs"),
- Instant.now().plus(Duration.ofMinutes(10)));
- resolver.initialize();
-
- //Roll over the keyset document
- cache.setHttpClient(createMockHttpClient(readJsonFromFile(REMOTE_JWKSET_ROLLOVER)));
-
- criteria.add(new UsageCriterion(UsageType.SIGNING));
- criteria.add(new EvaluableKeyIDCredentialCriterion(new KeyIdCriterion("not-in-original-cache")));
-
- final Iterable<Credential> creds = resolver.resolve(criteria);
-
- assertNotNull(creds);
- final List<Credential> credsList = new ArrayList<>();
- creds.forEach(credsList::add);
- // A key
- assertEquals(credsList.size(), 1);
- }
-
- @Test
- public void testSuccess_ForEncryptionAndKeyAlg() throws Exception {
- resolver.initialize();
-
- criteria.add(new UsageCriterion(UsageType.ENCRYPTION));
- criteria.add(new KeyAlgorithmCriterion("RSA"));
-
- final Iterable<Credential> creds = resolver.resolve(criteria);
-
- assertNotNull(creds);
- final List<Credential> credsList = new ArrayList<>();
- creds.forEach(credsList::add);
- // There is one 'enc' RSA-OAEP in the keyset.
- assertEquals(credsList.size(), 1);
- }
-
- @Test
- public void testSuccess_ForSigning() throws Exception {
- resolver.initialize();
-
- criteria.add(new UsageCriterion(UsageType.SIGNING));
-
- final Iterable<Credential> creds = resolver.resolve(criteria);
-
- assertNotNull(creds);
- final List<Credential> credsList = new ArrayList<>();
- creds.forEach(credsList::add);
- // There are 5 'sig' keys in the keyset, which should match the usage criterion
- assertEquals(credsList.size(), 5);
+ ((InitializableComponent) resolver).initialize();
+ // Needs ProviderMetadataCriterion or ClientInformationCriterion
+ criteria = new CriteriaSet();
+ criteria.add(new ClientInformationCriterion(new OIDCClientInformation(new ClientID("mockClientId"),
+ new OIDCClientMetadata())));
+ resolver.resolve(criteria);
}
-
}
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list