[java-oidc-common] branch main updated: Move sign and encrypt handler tests from RP
Phil Smart
philip.smart at jisc.ac.uk
Fri Jan 6 09:54:35 UTC 2023
This is an automated email from the git hooks/post-receive script.
philsmart pushed a commit to branch main
in repository java-oidc-common.
View the commit online:
http://git.shibboleth.net/view/?p=java-oidc-common.git;a=commit;h=fd92aaba5cc5dadc0355335d707fe0f651413fff
The following commit(s) were added to refs/heads/main by this push:
new fd92aab Move sign and encrypt handler tests from RP
fd92aab is described below
commit fd92aaba5cc5dadc0355335d707fe0f651413fff
Author: Phil Smart <philip.smart at jisc.ac.uk>
AuthorDate: Fri Jan 6 09:54:32 2023 +0000
Move sign and encrypt handler tests from RP
---
.../oidc/security/impl/AbstractHandlerTest.java | 96 +++++++
.../oidc/security/impl/EncryptJWTHandlerTest.java | 308 +++++++++++++++++++++
.../oidc/security/impl/SignJWTHandlerTest.java | 175 ++++++++++++
3 files changed, 579 insertions(+)
diff --git a/oidc-common-crypto-impl/src/test/java/net/shibboleth/oidc/security/impl/AbstractHandlerTest.java b/oidc-common-crypto-impl/src/test/java/net/shibboleth/oidc/security/impl/AbstractHandlerTest.java
new file mode 100644
index 0000000..6da1eed
--- /dev/null
+++ b/oidc-common-crypto-impl/src/test/java/net/shibboleth/oidc/security/impl/AbstractHandlerTest.java
@@ -0,0 +1,96 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.oidc.security.impl;
+
+import java.util.Set;
+
+import org.opensaml.messaging.context.MessageContext;
+import org.opensaml.profile.context.ProfileRequestContext;
+import org.springframework.webflow.execution.RequestContext;
+
+import net.shibboleth.idp.authn.context.AuthenticationContext;
+import net.shibboleth.idp.profile.context.RelyingPartyContext;
+import net.shibboleth.idp.profile.context.navigate.WebflowRequestContextProfileRequestContextLookup;
+import net.shibboleth.idp.profile.testing.RequestContextBuilder;
+import net.shibboleth.idp.relyingparty.RelyingPartyConfiguration;
+import net.shibboleth.oidc.profile.config.OIDCAuthorizationConfiguration;
+
+/** Abstract class for tests that require context setup appropriate for message handlers.*/
+public abstract class AbstractHandlerTest {
+
+ /** A redirect_uri override.*/
+ private static final String REDIRECT_URI_OVERRIDE = "https://localhost/callback";
+
+ /** The client_id.*/
+ private static final String CLIENT_ID = "demo_rp";
+
+ /** The client_secret.*/
+ private static final String CLIENT_SECRET = "Xp2s5v8y/B?E(H+MbQeThWmYq3t6w9z$";
+
+ /** The root profile request context to use.*/
+ protected ProfileRequestContext rootPrc;
+
+ /** The profile request context to use.*/
+ protected ProfileRequestContext prc;
+
+ /** The request context to use.*/
+ protected RequestContext src;
+
+ /** The authentication context (above the nested prc).*/
+ protected AuthenticationContext ac;
+
+ /** The RP config.*/
+ protected OIDCAuthorizationConfiguration partyConfig;
+
+ /**
+ * Setup the various contexts.
+ *
+ * @throws Exception on error
+ */
+ public void setup() throws Exception {
+
+ src = new RequestContextBuilder().buildRequestContext();
+ rootPrc = new WebflowRequestContextProfileRequestContextLookup().apply(src);
+
+ ac = new AuthenticationContext();
+ ac.setAuthenticatingAuthority("https://op.example.com");
+
+ rootPrc.addSubcontext(ac);
+ // Add a nested proxy PRC under the authentication context.
+ prc = new ProfileRequestContext();
+ ac.addSubcontext(prc);
+
+ final MessageContext outMsgCtx = new MessageContext();
+ prc.setOutboundMessageContext(outMsgCtx);
+
+ final RelyingPartyContext partyContext = new RelyingPartyContext();
+ partyConfig = new OIDCAuthorizationConfiguration();
+ partyContext.setProfileConfig(partyConfig);
+ partyConfig.setClientCredential(TestCredentialHelper.createClientSecretCredential(CLIENT_SECRET));
+ partyConfig.setTokenEndpointAuthMethods(Set.of("client_secret_basic"));
+ partyConfig.setClientId(CLIENT_ID);
+ partyConfig.setRedirectUriOverride(REDIRECT_URI_OVERRIDE);
+ final RelyingPartyConfiguration rPartyConfig = new RelyingPartyConfiguration();
+ rPartyConfig.setResponderId("http://idp.example.com/");
+ partyContext.setConfiguration(rPartyConfig);
+ prc.addSubcontext(partyContext);
+
+
+ }
+
+}
diff --git a/oidc-common-crypto-impl/src/test/java/net/shibboleth/oidc/security/impl/EncryptJWTHandlerTest.java b/oidc-common-crypto-impl/src/test/java/net/shibboleth/oidc/security/impl/EncryptJWTHandlerTest.java
new file mode 100644
index 0000000..23f54ca
--- /dev/null
+++ b/oidc-common-crypto-impl/src/test/java/net/shibboleth/oidc/security/impl/EncryptJWTHandlerTest.java
@@ -0,0 +1,308 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.oidc.security.impl;
+
+
+import static org.testng.Assert.assertEquals;
+import static org.testng.Assert.assertTrue;
+import static org.testng.Assert.fail;
+
+import java.text.ParseException;
+import java.util.Date;
+
+import javax.annotation.Nonnull;
+
+import org.opensaml.messaging.handler.MessageHandlerException;
+import org.testng.annotations.BeforeMethod;
+import org.testng.annotations.Test;
+
+import com.nimbusds.jose.JWEAlgorithm;
+import com.nimbusds.jose.JWEObject.State;
+import com.nimbusds.jose.Payload;
+import com.nimbusds.jose.crypto.AESDecrypter;
+import com.nimbusds.jose.crypto.DirectDecrypter;
+import com.nimbusds.jose.crypto.ECDHDecrypter;
+import com.nimbusds.jose.crypto.RSADecrypter;
+import com.nimbusds.jose.jwk.Curve;
+import com.nimbusds.jose.jwk.ECKey;
+import com.nimbusds.jose.jwk.KeyUse;
+import com.nimbusds.jose.jwk.RSAKey;
+import com.nimbusds.jose.jwk.gen.ECKeyGenerator;
+import com.nimbusds.jose.jwk.gen.RSAKeyGenerator;
+import com.nimbusds.jwt.EncryptedJWT;
+import com.nimbusds.jwt.JWT;
+import com.nimbusds.jwt.JWTClaimsSet;
+import com.nimbusds.jwt.PlainJWT;
+import com.nimbusds.jwt.SignedJWT;
+import com.nimbusds.oauth2.sdk.id.ClientID;
+import com.nimbusds.openid.connect.sdk.claims.ClaimsSet;
+
+import net.shibboleth.oidc.jwa.support.EncryptionConstants;
+import net.shibboleth.oidc.jwa.support.KeyManagementConstants;
+import net.shibboleth.oidc.profile.core.OIDCAuthenticationRequest;
+import net.shibboleth.oidc.security.JWTEncryptionParameters;
+import net.shibboleth.oidc.security.context.JWTSecurityParametersContext;
+
+/**
+ * Tests for the {@link EncryptJWTHandler} message handler.
+ *
+ * <p>Note, These tests encrypt a RequestObject. </p>
+ */
+public class EncryptJWTHandlerTest extends AbstractHandlerTest {
+
+ /** A client_secret to use.*/
+ @Nonnull private static final String CLIENT_SECRET = "Xp2s5v8y/B?E(H+MbQeThWmYq3t6w9z$";
+
+ /** The signer to test.*/
+ private EncryptJWTHandler encrypter;
+
+ /** The authn request.*/
+ private OIDCAuthenticationRequest request;
+
+ @Override
+ @BeforeMethod
+ public void setup() throws Exception {
+ super.setup();
+ encrypter = new EncryptJWTHandler();
+
+ encrypter.setPayloadToEncryptLookupStrategy(mc -> {
+ final OIDCAuthenticationRequest authnRequest = (OIDCAuthenticationRequest)mc.getMessage();
+ if (authnRequest.getRequestObject() instanceof SignedJWT) {
+ return new Payload((SignedJWT) authnRequest.getRequestObject());
+ } else if (authnRequest.getRequestObject() instanceof PlainJWT) {
+ try {
+ return new Payload(authnRequest.getRequestObject().getJWTClaimsSet().getClaims());
+ } catch (final ParseException e) {
+ fail();
+ }
+ }
+ return null;
+ });
+ encrypter.setJwtUpdateConsumer((jwt, mc) -> {
+ final OIDCAuthenticationRequest ar = (OIDCAuthenticationRequest)mc.getMessage();
+ ar.setRequestObject(jwt);
+ });
+
+ request = new OIDCAuthenticationRequest(new ClientID("test-client"));
+ final JWTClaimsSet claims = new JWTClaimsSet.Builder()
+ .issuer("https://rp.example.com")
+ .audience("https://op.example.com")
+ .issueTime(new Date())
+ .build();
+ request.setRequestObject(new PlainJWT(claims));
+
+ prc.getOutboundMessageContext().setMessage(request);
+ }
+
+ private void assertStandardClaimsExist(final EncryptedJWT jwt) {
+ final ClaimsSet claims = new ClaimsSet();
+ claims.putAll(jwt.getPayload().toJSONObject());
+ assertTrue(jwt.getState() == State.DECRYPTED);
+ assertEquals(claims.getIssuer().getValue(), "https://rp.example.com");
+ assertEquals(claims.getAudience().get(0).getValue(),"https://op.example.com");
+ }
+
+ @Test
+ public void testEncryptRSA_Success() throws Exception {
+
+ final JWTSecurityParametersContext secParamCtx = new JWTSecurityParametersContext();
+ final var params = new JWTEncryptionParameters();
+ params.setDataEncryptionAlgorithm(EncryptionConstants.ALGO_ID_ENC_ALG_A256GCM);
+ params.setKeyTransportEncryptionAlgorithm(KeyManagementConstants.ALGO_ID_ALG_RSA_OAEP_256);
+
+ final RSAKey key = new RSAKeyGenerator(2048)
+ .algorithm(JWEAlgorithm.RSA_OAEP_256)
+ .keyUse(KeyUse.ENCRYPTION)
+ .keyID("mock-key-rsa")
+ .generate();
+ params.setKeyTransportEncryptionCredential(TestCredentialHelper.createKeyEncryptionCredential(key));
+
+
+ secParamCtx.setEncryptionParameters(params);
+ prc.getOutboundMessageContext().addSubcontext(secParamCtx);
+
+ encrypter.initialize();
+ encrypter.invoke(prc.getOutboundMessageContext());
+ final JWT jwt = request.getRequestObject();
+
+ assertTrue(JWEAlgorithm.Family.RSA.contains(jwt.getHeader().getAlgorithm()));
+ assertTrue(jwt instanceof EncryptedJWT);
+ final var encryptedJWT = (EncryptedJWT)jwt;
+ assertTrue(JWEAlgorithm.Family.ASYMMETRIC.contains(encryptedJWT.getHeader().getAlgorithm()));
+ final RSADecrypter testDecrypter = new RSADecrypter(key.toPrivateKey());
+ encryptedJWT.decrypt(testDecrypter);
+
+ assertStandardClaimsExist(encryptedJWT);
+
+ }
+
+ @Test
+ public void testEncryptEC_Success() throws Exception {
+
+ final JWTSecurityParametersContext secParamCtx = new JWTSecurityParametersContext();
+ final var params = new JWTEncryptionParameters();
+ params.setDataEncryptionAlgorithm(EncryptionConstants.ALGO_ID_ENC_ALG_A256GCM);
+ params.setKeyTransportEncryptionAlgorithm(KeyManagementConstants.ALGO_ID_ALG_ECDH_ES);
+
+ final ECKey key = new ECKeyGenerator(Curve.P_256)
+ .algorithm(JWEAlgorithm.RSA_OAEP_256)
+ .keyUse(KeyUse.ENCRYPTION)
+ .keyID("mock-key-rsa")
+ .generate();
+ params.setKeyTransportEncryptionCredential(TestCredentialHelper.createKeyAgreementCredential(key));
+
+
+ secParamCtx.setEncryptionParameters(params);
+ prc.getOutboundMessageContext().addSubcontext(secParamCtx);
+
+ encrypter.initialize();
+ encrypter.invoke(prc.getOutboundMessageContext());
+ final JWT jwt = request.getRequestObject();
+
+ assertTrue(JWEAlgorithm.Family.ECDH_ES.contains(jwt.getHeader().getAlgorithm()));
+ assertTrue(jwt instanceof EncryptedJWT);
+ final var encryptedJWT = (EncryptedJWT)jwt;
+ assertTrue(JWEAlgorithm.Family.ASYMMETRIC.contains(encryptedJWT.getHeader().getAlgorithm()));
+ final ECDHDecrypter testDecrypter = new ECDHDecrypter(key);
+ encryptedJWT.decrypt(testDecrypter);
+
+ assertStandardClaimsExist(encryptedJWT);
+
+ }
+
+ @Test
+ public void testEncryptDirect_Success() throws Exception {
+
+ final JWTSecurityParametersContext secParamCtx = new JWTSecurityParametersContext();
+ final var params = new JWTEncryptionParameters();
+ params.setDataEncryptionAlgorithm(EncryptionConstants.ALGO_ID_ENC_ALG_A256GCM);
+ params.setKeyTransportEncryptionAlgorithm(KeyManagementConstants.ALGO_ID_ALG_DIR);
+
+ final var dirCred = TestCredentialHelper.createDirectEncryptionCredentialFromSharedSecret(CLIENT_SECRET);
+ params.setDataEncryptionCredential(dirCred);
+
+
+ secParamCtx.setEncryptionParameters(params);
+ prc.getOutboundMessageContext().addSubcontext(secParamCtx);
+
+ encrypter.initialize();
+ encrypter.invoke(prc.getOutboundMessageContext());
+ final JWT jwt = request.getRequestObject();
+
+ assertTrue(JWEAlgorithm.DIR.equals(jwt.getHeader().getAlgorithm()));
+ assertTrue(jwt instanceof EncryptedJWT);
+ final var encryptedJWT = (EncryptedJWT)jwt;
+
+ final DirectDecrypter testDecrypter = new DirectDecrypter(dirCred.getSecretKey());
+ encryptedJWT.decrypt(testDecrypter);
+
+ assertStandardClaimsExist(encryptedJWT);
+
+ }
+
+ @Test
+ public void testKeyWrap_Success() throws Exception {
+
+ final JWTSecurityParametersContext secParamCtx = new JWTSecurityParametersContext();
+ final var params = new JWTEncryptionParameters();
+ params.setDataEncryptionAlgorithm(EncryptionConstants.ALGO_ID_ENC_ALG_A256GCM);
+ params.setKeyTransportEncryptionAlgorithm(KeyManagementConstants.ALGO_ID_ALG_AES_256_KW);
+
+ final var kwCred = TestCredentialHelper.createClientSecretCredential(CLIENT_SECRET);
+ params.setKeyTransportEncryptionCredential(kwCred);
+
+
+ secParamCtx.setEncryptionParameters(params);
+ prc.getOutboundMessageContext().addSubcontext(secParamCtx);
+
+ encrypter.initialize();
+ encrypter.invoke(prc.getOutboundMessageContext());
+ final JWT jwt = request.getRequestObject();
+
+ assertTrue(JWEAlgorithm.A256KW.equals(jwt.getHeader().getAlgorithm()));
+ assertTrue(jwt instanceof EncryptedJWT);
+ final var encryptedJWT = (EncryptedJWT)jwt;
+
+ final AESDecrypter testDecrypter = new AESDecrypter(kwCred.getSecretKey());
+ encryptedJWT.decrypt(testDecrypter);
+
+ assertStandardClaimsExist(encryptedJWT);
+
+ }
+
+ @Test(expectedExceptions = MessageHandlerException.class)
+ public void testEncryptDirect_Fail_WrongAlgorithmForCredential() throws Exception {
+
+ final JWTSecurityParametersContext secParamCtx = new JWTSecurityParametersContext();
+ final var params = new JWTEncryptionParameters();
+ params.setDataEncryptionAlgorithm(EncryptionConstants.ALGO_ID_ENC_ALG_A256GCM);
+ params.setKeyTransportEncryptionAlgorithm(KeyManagementConstants.ALGO_ID_ALG_RSA_OAEP_256);
+
+ final var dirCred = TestCredentialHelper.createDirectEncryptionCredentialFromSharedSecret(CLIENT_SECRET);
+ params.setDataEncryptionCredential(dirCred);
+
+
+ secParamCtx.setEncryptionParameters(params);
+ prc.getOutboundMessageContext().addSubcontext(secParamCtx);
+
+ encrypter.initialize();
+ encrypter.invoke(prc.getOutboundMessageContext());
+
+ }
+
+ /* No exception, but should not have performed any operation on the plain JWT.*/
+ @Test
+ public void testFail_NoEncryptionParams() throws Exception {
+ encrypter.initialize();
+ encrypter.invoke(prc.getOutboundMessageContext());
+ final JWT jwt = request.getRequestObject();
+ assertTrue(jwt instanceof PlainJWT);
+
+ }
+
+ /* Both content and transport enc credentials defined*/
+ @Test(expectedExceptions = MessageHandlerException.class)
+ public void testFail_IncorrectParamState() throws Exception {
+
+ final JWTSecurityParametersContext secParamCtx = new JWTSecurityParametersContext();
+ final var params = new JWTEncryptionParameters();
+ params.setDataEncryptionAlgorithm(EncryptionConstants.ALGO_ID_ENC_ALG_A256GCM);
+ params.setKeyTransportEncryptionAlgorithm(KeyManagementConstants.ALGO_ID_ALG_RSA_OAEP_256);
+ final var dirCred = TestCredentialHelper.createDirectEncryptionCredentialFromSharedSecret(CLIENT_SECRET);
+ params.setDataEncryptionCredential(dirCred);
+
+ final ECKey key = new ECKeyGenerator(Curve.P_256)
+ .algorithm(JWEAlgorithm.RSA_OAEP_256)
+ .keyUse(KeyUse.ENCRYPTION)
+ .keyID("mock-key-rsa")
+ .generate();
+ params.setKeyTransportEncryptionCredential(TestCredentialHelper.createKeyAgreementCredential(key));
+
+ secParamCtx.setEncryptionParameters(params);
+ prc.getOutboundMessageContext().addSubcontext(secParamCtx);
+
+ encrypter.initialize();
+ encrypter.invoke(prc.getOutboundMessageContext());
+ final JWT jwt = request.getRequestObject();
+ assertTrue(jwt instanceof PlainJWT);
+
+ }
+
+
+
+}
diff --git a/oidc-common-crypto-impl/src/test/java/net/shibboleth/oidc/security/impl/SignJWTHandlerTest.java b/oidc-common-crypto-impl/src/test/java/net/shibboleth/oidc/security/impl/SignJWTHandlerTest.java
new file mode 100644
index 0000000..14c69e7
--- /dev/null
+++ b/oidc-common-crypto-impl/src/test/java/net/shibboleth/oidc/security/impl/SignJWTHandlerTest.java
@@ -0,0 +1,175 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.oidc.security.impl;
+
+import static org.testng.Assert.fail;
+
+import java.text.ParseException;
+import java.util.Date;
+
+import javax.annotation.Nonnull;
+
+import org.testng.AssertJUnit;
+import org.testng.annotations.BeforeMethod;
+import org.testng.annotations.Test;
+
+import com.nimbusds.jose.JWSAlgorithm;
+import com.nimbusds.jose.jwk.Curve;
+import com.nimbusds.jose.jwk.ECKey;
+import com.nimbusds.jose.jwk.KeyUse;
+import com.nimbusds.jose.jwk.RSAKey;
+import com.nimbusds.jose.jwk.gen.ECKeyGenerator;
+import com.nimbusds.jose.jwk.gen.RSAKeyGenerator;
+import com.nimbusds.jwt.JWT;
+import com.nimbusds.jwt.JWTClaimsSet;
+import com.nimbusds.jwt.PlainJWT;
+import com.nimbusds.jwt.SignedJWT;
+import com.nimbusds.oauth2.sdk.id.ClientID;
+
+import net.shibboleth.oidc.profile.core.OIDCAuthenticationRequest;
+import net.shibboleth.oidc.security.JWTSignatureSigningParameters;
+import net.shibboleth.oidc.security.context.JWTSecurityParametersContext;
+
+/**
+ * Tests for the SignJWT message handler.
+ *
+ * <p>Note, These tests sign a RequestObject. </p>
+ */
+public class SignJWTHandlerTest extends AbstractHandlerTest {
+
+ /** A client_secret to use.*/
+ @Nonnull private static final String CLIENT_SECRET = "Xp2s5v8y/B?E(H+MbQeThWmYq3t6w9z$";
+
+ /** The signer to test.*/
+ private SignJWTHandler signer;
+
+ /** The authn request.*/
+ private OIDCAuthenticationRequest request;
+
+ @Override
+ @BeforeMethod
+ public void setup() throws Exception {
+ super.setup();
+ signer = new SignJWTHandler();
+
+ signer.setClaimsToSignLookupStrategy(mc -> {
+ final OIDCAuthenticationRequest ar = (OIDCAuthenticationRequest)mc.getMessage();
+ try {
+ return ar.getRequestObject().getJWTClaimsSet();
+ } catch (final ParseException e) {
+ fail();
+ }
+ return null;
+ });
+ signer.setJwtUpdateConsumer((jwt, mc) -> {
+ final OIDCAuthenticationRequest ar = (OIDCAuthenticationRequest)mc.getMessage();
+ ar.setRequestObject(jwt);
+ });
+
+ request = new OIDCAuthenticationRequest(new ClientID("test-client"));
+ final JWTClaimsSet claims = new JWTClaimsSet.Builder()
+ .issuer("test-client")
+ .audience("test-op")
+ .issueTime(new Date())
+ .build();
+ request.setRequestObject(new PlainJWT(claims));
+
+ prc.getOutboundMessageContext().setMessage(request);
+ }
+
+ @Test
+ public void testSignHMAC_Success() throws Exception {
+
+ final JWTSecurityParametersContext secParamCtx = new JWTSecurityParametersContext();
+ final var params = new JWTSignatureSigningParameters();
+ params.setSigningCredential(TestCredentialHelper.createClientSecretCredential(CLIENT_SECRET));
+ params.setSignatureAlgorithm("HS256");
+ secParamCtx.setSignatureSigningParameters(params);
+ prc.getOutboundMessageContext().addSubcontext(secParamCtx);
+
+ signer.initialize();
+ signer.invoke(prc.getOutboundMessageContext());
+ final JWT jwt = request.getRequestObject();
+ AssertJUnit.assertTrue(jwt instanceof SignedJWT);
+ final var signedJWT = (SignedJWT)jwt;
+ AssertJUnit.assertTrue(JWSAlgorithm.Family.HMAC_SHA.contains(signedJWT.getHeader().getAlgorithm()));
+ }
+
+ @Test(expectedExceptions = Exception.class)
+ public void testSignHMAC_WrongCredentialType() throws Exception {
+
+ final JWTSecurityParametersContext secParamCtx = new JWTSecurityParametersContext();
+ final var params = new JWTSignatureSigningParameters();
+ params.setSigningCredential(TestCredentialHelper.createClientSecretCredential(CLIENT_SECRET));
+ params.setSignatureAlgorithm("RS256");
+ secParamCtx.setSignatureSigningParameters(params);
+ prc.getOutboundMessageContext().addSubcontext(secParamCtx);
+
+ signer.initialize();
+ signer.invoke(prc.getOutboundMessageContext());
+ final JWT jwt = request.getRequestObject();
+ AssertJUnit.assertTrue(jwt instanceof SignedJWT);
+ final var signedJWT = (SignedJWT)jwt;
+ AssertJUnit.assertTrue(JWSAlgorithm.Family.HMAC_SHA.contains(signedJWT.getHeader().getAlgorithm()));
+ }
+
+ @Test
+ public void testSignRS256_Success() throws Exception {
+
+ final JWTSecurityParametersContext secParamCtx = new JWTSecurityParametersContext();
+ final var params = new JWTSignatureSigningParameters();
+ final RSAKey rsaKey = new RSAKeyGenerator(2048)
+ .keyID("1")
+ .keyUse(KeyUse.SIGNATURE)
+ .generate();
+ params.setSigningCredential(TestCredentialHelper.createAsymmetricSigningCredential(rsaKey));
+ params.setSignatureAlgorithm("RS256");
+ secParamCtx.setSignatureSigningParameters(params);
+ prc.getOutboundMessageContext().addSubcontext(secParamCtx);
+
+ signer.initialize();
+ signer.invoke(prc.getOutboundMessageContext());
+ final JWT jwt = request.getRequestObject();
+ AssertJUnit.assertTrue(jwt instanceof SignedJWT);
+ final var signedJWT = (SignedJWT)jwt;
+ AssertJUnit.assertTrue(JWSAlgorithm.Family.RSA.contains(signedJWT.getHeader().getAlgorithm()));
+ }
+
+ @Test
+ public void testSignES256_Success() throws Exception {
+
+ final JWTSecurityParametersContext secParamCtx = new JWTSecurityParametersContext();
+ final var params = new JWTSignatureSigningParameters();
+ final ECKey ecKey = new ECKeyGenerator(Curve.P_256)
+ .keyID("1")
+ .keyUse(KeyUse.SIGNATURE)
+ .generate();
+ params.setSigningCredential(TestCredentialHelper.createAsymmetricSigningCredential(ecKey));
+ params.setSignatureAlgorithm("ES256");
+ secParamCtx.setSignatureSigningParameters(params);
+ prc.getOutboundMessageContext().addSubcontext(secParamCtx);
+
+ signer.initialize();
+ signer.invoke(prc.getOutboundMessageContext());
+ final JWT jwt = request.getRequestObject();
+ AssertJUnit.assertTrue(jwt instanceof SignedJWT);
+ final var signedJWT = (SignedJWT)jwt;
+ AssertJUnit.assertTrue(JWSAlgorithm.Family.EC.contains(signedJWT.getHeader().getAlgorithm()));
+ }
+
+}
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list