[java-idp-plugin-oidc-rp] branch main updated: Move sign and encrypt functions to commons. Simplify enc/alg lookups
Phil Smart
philip.smart at jisc.ac.uk
Mon Jan 9 09:50:17 UTC 2023
This is an automated email from the git hooks/post-receive script.
philsmart pushed a commit to branch main
in repository java-idp-plugin-oidc-rp.
View the commit online:
http://git.shibboleth.net/view/?p=java-idp-plugin-oidc-rp.git;a=commit;h=2d45576475e1dc4aa180859c5fca0d5dd4d708db
The following commit(s) were added to refs/heads/main by this push:
new 2d45576 Move sign and encrypt functions to commons. Simplify enc/alg lookups
2d45576 is described below
commit 2d45576475e1dc4aa180859c5fca0d5dd4d708db
Author: Phil Smart <philip.smart at jisc.ac.uk>
AuthorDate: Mon Jan 9 09:50:14 2023 +0000
Move sign and encrypt functions to commons. Simplify enc/alg lookups
---
...questObjectEncryptionMethodsLookupFunction.java | 44 ---
...ObjectKeyTransportAlgorithmsLookupFunction.java | 44 ---
.../oidc-relying-party-authn-beans.xml | 7 +-
.../oidc/rp/conf/authn/oidc-rp-credentials.xml | 2 +-
.../oidc/rp/impl/AuthorizationControllerTest.java | 4 +-
.../plugin/authn/oidc/rp/impl/EncryptJWTTest.java | 250 -----------------
.../rp/messaging/impl/EncryptJWTHandlerTest.java | 310 ---------------------
.../oidc/rp/messaging/impl/SignJWTHandlerTest.java | 177 ------------
8 files changed, 7 insertions(+), 831 deletions(-)
diff --git a/idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/config/navigate/ProviderRequestObjectEncryptionMethodsLookupFunction.java b/idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/config/navigate/ProviderRequestObjectEncryptionMethodsLookupFunction.java
deleted file mode 100644
index a784db9..0000000
--- a/idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/config/navigate/ProviderRequestObjectEncryptionMethodsLookupFunction.java
+++ /dev/null
@@ -1,44 +0,0 @@
-/*
- * Licensed to the University Corporation for Advanced Internet Development,
- * Inc. (UCAID) under one or more contributor license agreements. See the
- * NOTICE file distributed with this work for additional information regarding
- * copyright ownership. The UCAID licenses this file to You under the Apache
- * License, Version 2.0 (the "License"); you may not use this file except in
- * compliance with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.plugin.authn.oidc.rp.config.navigate;
-
-import java.util.Collections;
-import java.util.List;
-import java.util.function.Function;
-
-import javax.annotation.Nonnull;
-import javax.annotation.Nullable;
-
-import com.nimbusds.jose.EncryptionMethod;
-import com.nimbusds.openid.connect.sdk.op.OIDCProviderMetadata;
-
-/** Lookup the request_object_encryption_alg_values_supported from the provider metadata.*/
-public class ProviderRequestObjectEncryptionMethodsLookupFunction
- implements Function<OIDCProviderMetadata, List<EncryptionMethod>> {
-
- @Override
- @Nonnull public List<EncryptionMethod> apply(@Nullable final OIDCProviderMetadata metadata) {
- if (metadata == null) {
- return Collections.emptyList();
- }
- return metadata.getRequestObjectJWEEncs() != null
- ? metadata.getRequestObjectJWEEncs() : Collections.emptyList();
-
- }
-
-}
diff --git a/idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/config/navigate/ProviderRequestObjectKeyTransportAlgorithmsLookupFunction.java b/idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/config/navigate/ProviderRequestObjectKeyTransportAlgorithmsLookupFunction.java
deleted file mode 100644
index 426c2a7..0000000
--- a/idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/config/navigate/ProviderRequestObjectKeyTransportAlgorithmsLookupFunction.java
+++ /dev/null
@@ -1,44 +0,0 @@
-/*
- * Licensed to the University Corporation for Advanced Internet Development,
- * Inc. (UCAID) under one or more contributor license agreements. See the
- * NOTICE file distributed with this work for additional information regarding
- * copyright ownership. The UCAID licenses this file to You under the Apache
- * License, Version 2.0 (the "License"); you may not use this file except in
- * compliance with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.plugin.authn.oidc.rp.config.navigate;
-
-import java.util.Collections;
-import java.util.List;
-import java.util.function.Function;
-
-import javax.annotation.Nonnull;
-import javax.annotation.Nullable;
-
-import com.nimbusds.jose.JWEAlgorithm;
-import com.nimbusds.openid.connect.sdk.op.OIDCProviderMetadata;
-
-/** Lookup the request_object_encryption_enc_values_supported from the provider metadata.*/
-public class ProviderRequestObjectKeyTransportAlgorithmsLookupFunction
- implements Function<OIDCProviderMetadata, List<JWEAlgorithm>> {
-
- @Override
- @Nonnull public List<JWEAlgorithm> apply(@Nullable final OIDCProviderMetadata metadata) {
- if (metadata == null) {
- return Collections.emptyList();
- }
- return metadata.getRequestObjectJWEAlgs() != null
- ? metadata.getRequestObjectJWEAlgs() : Collections.emptyList();
-
- }
-
-}
diff --git a/idp-oidc-rp-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/OIDCRelyingParty/oidc-relying-party-authn-beans.xml b/idp-oidc-rp-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/OIDCRelyingParty/oidc-relying-party-authn-beans.xml
index a3ae92e..d37c8b4 100644
--- a/idp-oidc-rp-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/OIDCRelyingParty/oidc-relying-party-authn-beans.xml
+++ b/idp-oidc-rp-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/OIDCRelyingParty/oidc-relying-party-authn-beans.xml
@@ -72,7 +72,6 @@
</constructor-arg>
</bean>
-
<bean id="shibboleth.authn.oidc.rp.IssuerIDLookupStrategy"
class="net.shibboleth.idp.plugin.authn.oidc.rp.metadata.impl.DefaultIssuerIDLookupFunction" scope="prototype" />
@@ -207,7 +206,8 @@
class="net.shibboleth.oidc.security.impl.ProviderMetadataKeyTransportEncryptionAlgorithmsLookupStrategy">
<constructor-arg>
<bean
- class="net.shibboleth.idp.plugin.authn.oidc.rp.config.navigate.ProviderRequestObjectKeyTransportAlgorithmsLookupFunction" />
+ class="net.shibboleth.oidc.profile.config.navigate.ProviderMetadataStringValuesLookupFunction"
+ c:keyName="request_object_encryption_alg_values_supported"/>
</constructor-arg>
</bean>
</property>
@@ -215,7 +215,8 @@
<bean class="net.shibboleth.oidc.security.impl.ProviderMetadataDataEncryptionAlgorithmsLookupStrategy">
<constructor-arg>
<bean
- class="net.shibboleth.idp.plugin.authn.oidc.rp.config.navigate.ProviderRequestObjectEncryptionMethodsLookupFunction" />
+ class="net.shibboleth.oidc.profile.config.navigate.ProviderMetadataStringValuesLookupFunction"
+ c:keyName="request_object_encryption_enc_values_supported"/>
</constructor-arg>
</bean>
</property>
diff --git a/idp-oidc-rp-impl/src/main/resources/net/shibboleth/idp/plugin/authn/oidc/rp/conf/authn/oidc-rp-credentials.xml b/idp-oidc-rp-impl/src/main/resources/net/shibboleth/idp/plugin/authn/oidc/rp/conf/authn/oidc-rp-credentials.xml
index f3829ff..5cd12b4 100644
--- a/idp-oidc-rp-impl/src/main/resources/net/shibboleth/idp/plugin/authn/oidc/rp/conf/authn/oidc-rp-credentials.xml
+++ b/idp-oidc-rp-impl/src/main/resources/net/shibboleth/idp/plugin/authn/oidc/rp/conf/authn/oidc-rp-credentials.xml
@@ -13,7 +13,7 @@
The default credential is based on the client_secret, and will be the only used credential in most cases.
The algorithm is not specified, this way it supports both 'direct encryption' and key wrapping management modes.
UsageType is also not specified, this way making the credential also suitable for verifying message authentication
- codes.
+ codes. The actual key used for encryption is derived from this secret.
-->
<bean id="shibboleth.authn.oidc.rp.DefaultCredential" parent="shibboleth.authn.oidc.rp.ExpiringJWKCredential"
p:secret="%{idp.authn.oidc.rp.client.clientSecret:#{null}}"
diff --git a/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/AuthorizationControllerTest.java b/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/AuthorizationControllerTest.java
index 96e28a6..1301687 100644
--- a/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/AuthorizationControllerTest.java
+++ b/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/AuthorizationControllerTest.java
@@ -94,8 +94,6 @@ import net.shibboleth.idp.plugin.authn.oidc.rp.messaging.context.logic.JWTClaims
import net.shibboleth.idp.plugin.authn.oidc.rp.messaging.context.logic.PayloadFromRequestObjectLookupFunction;
import net.shibboleth.idp.plugin.authn.oidc.rp.messaging.impl.AddStateHandler;
import net.shibboleth.idp.plugin.authn.oidc.rp.messaging.impl.BuildPlainRequestObjectJWT;
-import net.shibboleth.idp.plugin.authn.oidc.rp.messaging.impl.EncryptJWTHandler;
-import net.shibboleth.idp.plugin.authn.oidc.rp.messaging.impl.SignJWTHandler;
import net.shibboleth.idp.plugin.authn.test.flow.mock.IdPPropertyConfigurer;
import net.shibboleth.idp.session.IdPSession;
import net.shibboleth.idp.session.context.SessionContext;
@@ -106,6 +104,8 @@ import net.shibboleth.oidc.profile.decoding.OIDCMessageDecoder;
import net.shibboleth.oidc.profile.encoding.impl.AbstractOIDCMessageEncoder;
import net.shibboleth.oidc.security.JWTSignatureSigningParameters;
import net.shibboleth.oidc.security.context.JWTSecurityParametersContext;
+import net.shibboleth.oidc.security.impl.EncryptJWTHandler;
+import net.shibboleth.oidc.security.impl.SignJWTHandler;
import net.shibboleth.utilities.java.support.component.ComponentInitializationException;
import net.shibboleth.utilities.java.support.net.HttpServletSupport;
import net.shibboleth.utilities.java.support.net.URLBuilder;
diff --git a/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/EncryptJWTTest.java b/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/EncryptJWTTest.java
deleted file mode 100644
index a136638..0000000
--- a/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/EncryptJWTTest.java
+++ /dev/null
@@ -1,250 +0,0 @@
-/*
- * Licensed to the University Corporation for Advanced Internet Development,
- * Inc. (UCAID) under one or more contributor license agreements. See the
- * NOTICE file distributed with this work for additional information regarding
- * copyright ownership. The UCAID licenses this file to You under the Apache
- * License, Version 2.0 (the "License"); you may not use this file except in
- * compliance with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.plugin.authn.oidc.rp.impl;
-
-import static org.testng.Assert.assertEquals;
-import static org.testng.Assert.assertNotNull;
-import static org.testng.Assert.assertTrue;
-import static org.testng.Assert.fail;
-
-import java.util.Date;
-
-import org.opensaml.messaging.handler.MessageHandlerException;
-import org.testng.annotations.BeforeMethod;
-import org.testng.annotations.Test;
-
-import com.nimbusds.jose.JOSEException;
-import com.nimbusds.jose.JWEAlgorithm;
-import com.nimbusds.jose.JWEObject.State;
-import com.nimbusds.jose.crypto.AESDecrypter;
-import com.nimbusds.jose.crypto.DirectDecrypter;
-import com.nimbusds.jose.crypto.ECDHDecrypter;
-import com.nimbusds.jose.crypto.RSADecrypter;
-import com.nimbusds.jose.jwk.Curve;
-import com.nimbusds.jose.jwk.ECKey;
-import com.nimbusds.jose.jwk.KeyUse;
-import com.nimbusds.jose.jwk.RSAKey;
-import com.nimbusds.jose.jwk.gen.ECKeyGenerator;
-import com.nimbusds.jose.jwk.gen.RSAKeyGenerator;
-import com.nimbusds.jwt.EncryptedJWT;
-import com.nimbusds.jwt.JWTClaimsSet;
-
-import net.shibboleth.idp.plugin.authn.oidc.rp.messaging.impl.EncryptJWTHandler;
-import net.shibboleth.oidc.jwa.support.EncryptionConstants;
-import net.shibboleth.oidc.jwa.support.KeyManagementConstants;
-import net.shibboleth.oidc.security.JWTEncryptionParameters;
-import net.shibboleth.oidc.security.context.JWTSecurityParametersContext;
-
-/** Tests for EncryptJWT.*/
-public class EncryptJWTTest extends AbstractOIDCTest {
-
- /** The client_secret.*/
- private static final String CLIENT_SECRET = "Xp2s5v8y/B?E(H+MbQeThWmYq3t6w9z$";
-
- /** Decrypt action to test.*/
- private EncryptJWTHandler action;
-
- /** The Security Params to use.*/
- private JWTSecurityParametersContext secContext;
-
- /** The encryption params to use.*/
- private JWTEncryptionParameters params;
-
- @Override
- @BeforeMethod
- public void setup() throws Exception {
- super.setup();
- action = new EncryptJWTHandler();
-
- action.setPayloadToEncryptLookupStrategy(prc -> {
-
- final JWTClaimsSet claims = new JWTClaimsSet.Builder()
- .audience("https://op.example.com")
- .issuer("https://rp.example.com")
- .issueTime(new Date())
- .build();
- try {
- return TestTokenHelper.createHMACSignedJWT(claims, CLIENT_SECRET).getPayload();
- } catch (final JOSEException e) {
- fail();
- }
- fail();
- return null;
-
- });
-
- action.setJwtUpdateConsumer((jwt, mc) -> {
- // Add the EncryptedJWT to the message context directly, so we can test it later
- mc.setMessage(jwt);
- });
-
- secContext =
- prc.getOutboundMessageContext().getSubcontext(JWTSecurityParametersContext.class, true);
- params = new JWTEncryptionParameters();
- secContext.setEncryptionParameters(params);
-
- }
-
- @Test
- public void testEncryptWithKeyEncryption() throws Exception {
-
- params.setKeyTransportEncryptionAlgorithm(KeyManagementConstants.ALGO_ID_ALG_RSA_OAEP_256);
- params.setDataEncryptionAlgorithm(EncryptionConstants.ALGO_ID_ENC_ALG_A128GCM);
- final RSAKey key = new RSAKeyGenerator(2048)
- .algorithm(JWEAlgorithm.RSA_OAEP_256)
- .keyUse(KeyUse.ENCRYPTION)
- .keyID("mock-key")
- .generate();
- params.setKeyTransportEncryptionCredential(TestCredentialHelper.createKeyEncryptionCredential(key));
-
- action.initialize();
- action.invoke(prc.getOutboundMessageContext());
-
- assertNotNull(prc.getOutboundMessageContext().getMessage());
- assertTrue(prc.getOutboundMessageContext().getMessage() instanceof EncryptedJWT);
-
- final EncryptedJWT encryptedJWT = (EncryptedJWT) prc.getOutboundMessageContext().getMessage();
- final RSADecrypter decrypter = new RSADecrypter(key);
- encryptedJWT.decrypt(decrypter);
- assertTrue(encryptedJWT.getState() == State.DECRYPTED);
- final JWTClaimsSet claims = encryptedJWT.getJWTClaimsSet();
- assertEquals(claims.getIssuer(), "https://rp.example.com");
- }
-
- @Test(expectedExceptions = MessageHandlerException.class)
- public void testEncryptWithKeyEncryption_WrongAlgorithmForKey() throws Exception {
-
- params.setKeyTransportEncryptionAlgorithm(KeyManagementConstants.ALGO_ID_ALG_AES_256_KW);
- params.setDataEncryptionAlgorithm(EncryptionConstants.ALGO_ID_ENC_ALG_A128GCM);
- final RSAKey key = new RSAKeyGenerator(2048)
- .algorithm(JWEAlgorithm.RSA_OAEP_256)
- .keyUse(KeyUse.ENCRYPTION)
- .keyID("mock-key")
- .generate();
- params.setKeyTransportEncryptionCredential(TestCredentialHelper.createKeyEncryptionCredential(key));
-
- action.initialize();
- action.invoke(prc.getOutboundMessageContext());
- }
-
- @Test(expectedExceptions = MessageHandlerException.class)
- public void testEncryptWithKeyEncryption_WrongKeyType() throws Exception {
-
- params.setKeyTransportEncryptionAlgorithm(KeyManagementConstants.ALGO_ID_ALG_RSA_OAEP_256);
- params.setDataEncryptionAlgorithm(EncryptionConstants.ALGO_ID_ENC_ALG_A128GCM);
- final ECKey key = new ECKeyGenerator(new Curve("P-256"))
- .algorithm(JWEAlgorithm.RSA_OAEP_256)
- .keyUse(KeyUse.ENCRYPTION)
- .keyID("mock-key")
- .generate();
- params.setKeyTransportEncryptionCredential(TestCredentialHelper.createKeyAgreementCredential(key));
-
- action.initialize();
- action.invoke(prc.getOutboundMessageContext());
- }
-
- @Test(expectedExceptions = MessageHandlerException.class)
- public void testEncryptWithUnsupportedAlgorithm() throws Exception {
-
- params.setKeyTransportEncryptionAlgorithm("NotSupported");
- params.setDataEncryptionAlgorithm(EncryptionConstants.ALGO_ID_ENC_ALG_A128GCM);
- final RSAKey key = new RSAKeyGenerator(2048)
- .algorithm(JWEAlgorithm.RSA_OAEP_256)
- .keyUse(KeyUse.ENCRYPTION)
- .keyID("mock-key")
- .generate();
- params.setKeyTransportEncryptionCredential(TestCredentialHelper.createKeyEncryptionCredential(key));
-
- action.initialize();
- action.invoke(prc.getOutboundMessageContext());
- }
-
- @Test
- public void testEncryptWithKeyWrap() throws Exception {
-
- params.setKeyTransportEncryptionAlgorithm(KeyManagementConstants.ALGO_ID_ALG_AES_256_KW);
- params.setDataEncryptionAlgorithm(EncryptionConstants.ALGO_ID_ENC_ALG_A128GCM);
- final var sharedKey = TestCredentialHelper.createClientSecretCredential(CLIENT_SECRET);
- params.setKeyTransportEncryptionCredential(sharedKey);
-
- action.initialize();
- action.invoke(prc.getOutboundMessageContext());
-
- assertNotNull(prc.getOutboundMessageContext().getMessage());
- assertTrue(prc.getOutboundMessageContext().getMessage() instanceof EncryptedJWT);
-
- final EncryptedJWT encryptedJWT = (EncryptedJWT) prc.getOutboundMessageContext().getMessage();
- final AESDecrypter decrypter = new AESDecrypter(sharedKey.getSecretKey());
- encryptedJWT.decrypt(decrypter);
- assertTrue(encryptedJWT.getState() == State.DECRYPTED);
- final JWTClaimsSet claims = encryptedJWT.getJWTClaimsSet();
- assertEquals(claims.getIssuer(), "https://rp.example.com");
- }
-
- /* Dir is not supported by the runtime at the minute.*/
- @Test(enabled = false)
- public void testEncryptWithDirectEncryption() throws Exception {
-
- params.setKeyTransportEncryptionAlgorithm(KeyManagementConstants.ALGO_ID_ALG_DIR);
- params.setDataEncryptionAlgorithm(EncryptionConstants.ALGO_ID_ENC_ALG_A256GCM);
- final var sharedKey = TestCredentialHelper.createClientSecretCredential(CLIENT_SECRET);
- params.setKeyTransportEncryptionCredential(sharedKey);
-
- action.initialize();
- action.invoke(prc.getOutboundMessageContext());
-
- assertNotNull(prc.getOutboundMessageContext().getMessage());
- assertTrue(prc.getOutboundMessageContext().getMessage() instanceof EncryptedJWT);
-
- final EncryptedJWT encryptedJWT = (EncryptedJWT) prc.getOutboundMessageContext().getMessage();
- final DirectDecrypter decrypter = new DirectDecrypter(sharedKey.getSecretKey());
- encryptedJWT.decrypt(decrypter);
- assertTrue(encryptedJWT.getState() == State.DECRYPTED);
- final JWTClaimsSet claims = encryptedJWT.getJWTClaimsSet();
- assertEquals(claims.getIssuer(), "https://rp.example.com");
- }
-
- @Test
- public void testEncryptWithKeyAgreement() throws Exception {
-
- params.setKeyTransportEncryptionAlgorithm(KeyManagementConstants.ALGO_ID_ALG_ECDH_ES_AES_128_KW);
- params.setDataEncryptionAlgorithm(EncryptionConstants.ALGO_ID_ENC_ALG_A128GCM);
-
- final var key = new ECKeyGenerator(Curve.P_256)
- .keyUse(KeyUse.ENCRYPTION)
- .keyID("1")
- .generate();
-
- final var sharedKey = TestCredentialHelper.createKeyAgreementCredential(key);
- params.setKeyTransportEncryptionCredential(sharedKey);
-
- action.initialize();
- action.invoke(prc.getOutboundMessageContext());
-
- assertNotNull(prc.getOutboundMessageContext().getMessage());
- assertTrue(prc.getOutboundMessageContext().getMessage() instanceof EncryptedJWT);
-
- final EncryptedJWT encryptedJWT = (EncryptedJWT) prc.getOutboundMessageContext().getMessage();
- final ECDHDecrypter decrypter = new ECDHDecrypter(key);
- encryptedJWT.decrypt(decrypter);
- assertTrue(encryptedJWT.getState() == State.DECRYPTED);
- final JWTClaimsSet claims = encryptedJWT.getJWTClaimsSet();
- assertEquals(claims.getIssuer(), "https://rp.example.com");
- }
-
-}
diff --git a/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/impl/EncryptJWTHandlerTest.java b/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/impl/EncryptJWTHandlerTest.java
deleted file mode 100644
index 8148554..0000000
--- a/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/impl/EncryptJWTHandlerTest.java
+++ /dev/null
@@ -1,310 +0,0 @@
-/*
- * Licensed to the University Corporation for Advanced Internet Development,
- * Inc. (UCAID) under one or more contributor license agreements. See the
- * NOTICE file distributed with this work for additional information regarding
- * copyright ownership. The UCAID licenses this file to You under the Apache
- * License, Version 2.0 (the "License"); you may not use this file except in
- * compliance with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.plugin.authn.oidc.rp.messaging.impl;
-
-
-import static org.testng.Assert.assertEquals;
-import static org.testng.Assert.assertTrue;
-import static org.testng.Assert.fail;
-
-import java.text.ParseException;
-import java.util.Date;
-
-import javax.annotation.Nonnull;
-
-import org.opensaml.messaging.handler.MessageHandlerException;
-import org.testng.annotations.BeforeMethod;
-import org.testng.annotations.Test;
-
-import com.nimbusds.jose.JWEAlgorithm;
-import com.nimbusds.jose.JWEObject.State;
-import com.nimbusds.jose.Payload;
-import com.nimbusds.jose.crypto.AESDecrypter;
-import com.nimbusds.jose.crypto.DirectDecrypter;
-import com.nimbusds.jose.crypto.ECDHDecrypter;
-import com.nimbusds.jose.crypto.RSADecrypter;
-import com.nimbusds.jose.jwk.Curve;
-import com.nimbusds.jose.jwk.ECKey;
-import com.nimbusds.jose.jwk.KeyUse;
-import com.nimbusds.jose.jwk.RSAKey;
-import com.nimbusds.jose.jwk.gen.ECKeyGenerator;
-import com.nimbusds.jose.jwk.gen.RSAKeyGenerator;
-import com.nimbusds.jwt.EncryptedJWT;
-import com.nimbusds.jwt.JWT;
-import com.nimbusds.jwt.JWTClaimsSet;
-import com.nimbusds.jwt.PlainJWT;
-import com.nimbusds.jwt.SignedJWT;
-import com.nimbusds.oauth2.sdk.id.ClientID;
-import com.nimbusds.openid.connect.sdk.claims.ClaimsSet;
-
-import net.shibboleth.idp.plugin.authn.oidc.rp.impl.AbstractOIDCTest;
-import net.shibboleth.idp.plugin.authn.oidc.rp.impl.TestCredentialHelper;
-import net.shibboleth.oidc.jwa.support.EncryptionConstants;
-import net.shibboleth.oidc.jwa.support.KeyManagementConstants;
-import net.shibboleth.oidc.profile.core.OIDCAuthenticationRequest;
-import net.shibboleth.oidc.security.JWTEncryptionParameters;
-import net.shibboleth.oidc.security.context.JWTSecurityParametersContext;
-
-/**
- * Tests for the {@link EncryptJWTHandler} message handler.
- *
- * <p>Note, These tests encrypt a RequestObject. </p>
- */
-public class EncryptJWTHandlerTest extends AbstractOIDCTest {
-
- /** A client_secret to use.*/
- @Nonnull private static final String CLIENT_SECRET = "Xp2s5v8y/B?E(H+MbQeThWmYq3t6w9z$";
-
- /** The signer to test.*/
- private EncryptJWTHandler encrypter;
-
- /** The authn request.*/
- private OIDCAuthenticationRequest request;
-
- @Override
- @BeforeMethod
- public void setup() throws Exception {
- super.setup();
- encrypter = new EncryptJWTHandler();
-
- encrypter.setPayloadToEncryptLookupStrategy(mc -> {
- final OIDCAuthenticationRequest authnRequest = (OIDCAuthenticationRequest)mc.getMessage();
- if (authnRequest.getRequestObject() instanceof SignedJWT) {
- return new Payload((SignedJWT) authnRequest.getRequestObject());
- } else if (authnRequest.getRequestObject() instanceof PlainJWT) {
- try {
- return new Payload(authnRequest.getRequestObject().getJWTClaimsSet().getClaims());
- } catch (final ParseException e) {
- fail();
- }
- }
- return null;
- });
- encrypter.setJwtUpdateConsumer((jwt, mc) -> {
- final OIDCAuthenticationRequest ar = (OIDCAuthenticationRequest)mc.getMessage();
- ar.setRequestObject(jwt);
- });
-
- request = new OIDCAuthenticationRequest(new ClientID("test-client"));
- final JWTClaimsSet claims = new JWTClaimsSet.Builder()
- .issuer("https://rp.example.com")
- .audience("https://op.example.com")
- .issueTime(new Date())
- .build();
- request.setRequestObject(new PlainJWT(claims));
-
- prc.getOutboundMessageContext().setMessage(request);
- }
-
- private void assertStandardClaimsExist(final EncryptedJWT jwt) {
- final ClaimsSet claims = new ClaimsSet();
- claims.putAll(jwt.getPayload().toJSONObject());
- assertTrue(jwt.getState() == State.DECRYPTED);
- assertEquals(claims.getIssuer().getValue(), "https://rp.example.com");
- assertEquals(claims.getAudience().get(0).getValue(),"https://op.example.com");
- }
-
- @Test
- public void testEncryptRSA_Success() throws Exception {
-
- final JWTSecurityParametersContext secParamCtx = new JWTSecurityParametersContext();
- final var params = new JWTEncryptionParameters();
- params.setDataEncryptionAlgorithm(EncryptionConstants.ALGO_ID_ENC_ALG_A256GCM);
- params.setKeyTransportEncryptionAlgorithm(KeyManagementConstants.ALGO_ID_ALG_RSA_OAEP_256);
-
- final RSAKey key = new RSAKeyGenerator(2048)
- .algorithm(JWEAlgorithm.RSA_OAEP_256)
- .keyUse(KeyUse.ENCRYPTION)
- .keyID("mock-key-rsa")
- .generate();
- params.setKeyTransportEncryptionCredential(TestCredentialHelper.createKeyEncryptionCredential(key));
-
-
- secParamCtx.setEncryptionParameters(params);
- prc.getOutboundMessageContext().addSubcontext(secParamCtx);
-
- encrypter.initialize();
- encrypter.invoke(prc.getOutboundMessageContext());
- final JWT jwt = request.getRequestObject();
-
- assertTrue(JWEAlgorithm.Family.RSA.contains(jwt.getHeader().getAlgorithm()));
- assertTrue(jwt instanceof EncryptedJWT);
- final var encryptedJWT = (EncryptedJWT)jwt;
- assertTrue(JWEAlgorithm.Family.ASYMMETRIC.contains(encryptedJWT.getHeader().getAlgorithm()));
- final RSADecrypter testDecrypter = new RSADecrypter(key.toPrivateKey());
- encryptedJWT.decrypt(testDecrypter);
-
- assertStandardClaimsExist(encryptedJWT);
-
- }
-
- @Test
- public void testEncryptEC_Success() throws Exception {
-
- final JWTSecurityParametersContext secParamCtx = new JWTSecurityParametersContext();
- final var params = new JWTEncryptionParameters();
- params.setDataEncryptionAlgorithm(EncryptionConstants.ALGO_ID_ENC_ALG_A256GCM);
- params.setKeyTransportEncryptionAlgorithm(KeyManagementConstants.ALGO_ID_ALG_ECDH_ES);
-
- final ECKey key = new ECKeyGenerator(Curve.P_256)
- .algorithm(JWEAlgorithm.RSA_OAEP_256)
- .keyUse(KeyUse.ENCRYPTION)
- .keyID("mock-key-rsa")
- .generate();
- params.setKeyTransportEncryptionCredential(TestCredentialHelper.createKeyAgreementCredential(key));
-
-
- secParamCtx.setEncryptionParameters(params);
- prc.getOutboundMessageContext().addSubcontext(secParamCtx);
-
- encrypter.initialize();
- encrypter.invoke(prc.getOutboundMessageContext());
- final JWT jwt = request.getRequestObject();
-
- assertTrue(JWEAlgorithm.Family.ECDH_ES.contains(jwt.getHeader().getAlgorithm()));
- assertTrue(jwt instanceof EncryptedJWT);
- final var encryptedJWT = (EncryptedJWT)jwt;
- assertTrue(JWEAlgorithm.Family.ASYMMETRIC.contains(encryptedJWT.getHeader().getAlgorithm()));
- final ECDHDecrypter testDecrypter = new ECDHDecrypter(key);
- encryptedJWT.decrypt(testDecrypter);
-
- assertStandardClaimsExist(encryptedJWT);
-
- }
-
- @Test
- public void testEncryptDirect_Success() throws Exception {
-
- final JWTSecurityParametersContext secParamCtx = new JWTSecurityParametersContext();
- final var params = new JWTEncryptionParameters();
- params.setDataEncryptionAlgorithm(EncryptionConstants.ALGO_ID_ENC_ALG_A256GCM);
- params.setKeyTransportEncryptionAlgorithm(KeyManagementConstants.ALGO_ID_ALG_DIR);
-
- final var dirCred = TestCredentialHelper.createDirectEncryptionCredentialFromSharedSecret(CLIENT_SECRET);
- params.setDataEncryptionCredential(dirCred);
-
-
- secParamCtx.setEncryptionParameters(params);
- prc.getOutboundMessageContext().addSubcontext(secParamCtx);
-
- encrypter.initialize();
- encrypter.invoke(prc.getOutboundMessageContext());
- final JWT jwt = request.getRequestObject();
-
- assertTrue(JWEAlgorithm.DIR.equals(jwt.getHeader().getAlgorithm()));
- assertTrue(jwt instanceof EncryptedJWT);
- final var encryptedJWT = (EncryptedJWT)jwt;
-
- final DirectDecrypter testDecrypter = new DirectDecrypter(dirCred.getSecretKey());
- encryptedJWT.decrypt(testDecrypter);
-
- assertStandardClaimsExist(encryptedJWT);
-
- }
-
- @Test
- public void testKeyWrap_Success() throws Exception {
-
- final JWTSecurityParametersContext secParamCtx = new JWTSecurityParametersContext();
- final var params = new JWTEncryptionParameters();
- params.setDataEncryptionAlgorithm(EncryptionConstants.ALGO_ID_ENC_ALG_A256GCM);
- params.setKeyTransportEncryptionAlgorithm(KeyManagementConstants.ALGO_ID_ALG_AES_256_KW);
-
- final var kwCred = TestCredentialHelper.createClientSecretCredential(CLIENT_SECRET);
- params.setKeyTransportEncryptionCredential(kwCred);
-
-
- secParamCtx.setEncryptionParameters(params);
- prc.getOutboundMessageContext().addSubcontext(secParamCtx);
-
- encrypter.initialize();
- encrypter.invoke(prc.getOutboundMessageContext());
- final JWT jwt = request.getRequestObject();
-
- assertTrue(JWEAlgorithm.A256KW.equals(jwt.getHeader().getAlgorithm()));
- assertTrue(jwt instanceof EncryptedJWT);
- final var encryptedJWT = (EncryptedJWT)jwt;
-
- final AESDecrypter testDecrypter = new AESDecrypter(kwCred.getSecretKey());
- encryptedJWT.decrypt(testDecrypter);
-
- assertStandardClaimsExist(encryptedJWT);
-
- }
-
- @Test(expectedExceptions = MessageHandlerException.class)
- public void testEncryptDirect_Fail_WrongAlgorithmForCredential() throws Exception {
-
- final JWTSecurityParametersContext secParamCtx = new JWTSecurityParametersContext();
- final var params = new JWTEncryptionParameters();
- params.setDataEncryptionAlgorithm(EncryptionConstants.ALGO_ID_ENC_ALG_A256GCM);
- params.setKeyTransportEncryptionAlgorithm(KeyManagementConstants.ALGO_ID_ALG_RSA_OAEP_256);
-
- final var dirCred = TestCredentialHelper.createDirectEncryptionCredentialFromSharedSecret(CLIENT_SECRET);
- params.setDataEncryptionCredential(dirCred);
-
-
- secParamCtx.setEncryptionParameters(params);
- prc.getOutboundMessageContext().addSubcontext(secParamCtx);
-
- encrypter.initialize();
- encrypter.invoke(prc.getOutboundMessageContext());
-
- }
-
- /* No exception, but should not have performed any operation on the plain JWT.*/
- @Test
- public void testFail_NoEncryptionParams() throws Exception {
- encrypter.initialize();
- encrypter.invoke(prc.getOutboundMessageContext());
- final JWT jwt = request.getRequestObject();
- assertTrue(jwt instanceof PlainJWT);
-
- }
-
- /* Both content and transport enc credentials defined*/
- @Test(expectedExceptions = MessageHandlerException.class)
- public void testFail_IncorrectParamState() throws Exception {
-
- final JWTSecurityParametersContext secParamCtx = new JWTSecurityParametersContext();
- final var params = new JWTEncryptionParameters();
- params.setDataEncryptionAlgorithm(EncryptionConstants.ALGO_ID_ENC_ALG_A256GCM);
- params.setKeyTransportEncryptionAlgorithm(KeyManagementConstants.ALGO_ID_ALG_RSA_OAEP_256);
- final var dirCred = TestCredentialHelper.createDirectEncryptionCredentialFromSharedSecret(CLIENT_SECRET);
- params.setDataEncryptionCredential(dirCred);
-
- final ECKey key = new ECKeyGenerator(Curve.P_256)
- .algorithm(JWEAlgorithm.RSA_OAEP_256)
- .keyUse(KeyUse.ENCRYPTION)
- .keyID("mock-key-rsa")
- .generate();
- params.setKeyTransportEncryptionCredential(TestCredentialHelper.createKeyAgreementCredential(key));
-
- secParamCtx.setEncryptionParameters(params);
- prc.getOutboundMessageContext().addSubcontext(secParamCtx);
-
- encrypter.initialize();
- encrypter.invoke(prc.getOutboundMessageContext());
- final JWT jwt = request.getRequestObject();
- assertTrue(jwt instanceof PlainJWT);
-
- }
-
-
-
-}
diff --git a/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/impl/SignJWTHandlerTest.java b/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/impl/SignJWTHandlerTest.java
deleted file mode 100644
index 61759a9..0000000
--- a/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/impl/SignJWTHandlerTest.java
+++ /dev/null
@@ -1,177 +0,0 @@
-/*
- * Licensed to the University Corporation for Advanced Internet Development,
- * Inc. (UCAID) under one or more contributor license agreements. See the
- * NOTICE file distributed with this work for additional information regarding
- * copyright ownership. The UCAID licenses this file to You under the Apache
- * License, Version 2.0 (the "License"); you may not use this file except in
- * compliance with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.plugin.authn.oidc.rp.messaging.impl;
-
-import static org.testng.Assert.fail;
-
-import java.text.ParseException;
-import java.util.Date;
-
-import javax.annotation.Nonnull;
-
-import org.testng.AssertJUnit;
-import org.testng.annotations.BeforeMethod;
-import org.testng.annotations.Test;
-
-import com.nimbusds.jose.JWSAlgorithm;
-import com.nimbusds.jose.jwk.Curve;
-import com.nimbusds.jose.jwk.ECKey;
-import com.nimbusds.jose.jwk.KeyUse;
-import com.nimbusds.jose.jwk.RSAKey;
-import com.nimbusds.jose.jwk.gen.ECKeyGenerator;
-import com.nimbusds.jose.jwk.gen.RSAKeyGenerator;
-import com.nimbusds.jwt.JWT;
-import com.nimbusds.jwt.JWTClaimsSet;
-import com.nimbusds.jwt.PlainJWT;
-import com.nimbusds.jwt.SignedJWT;
-import com.nimbusds.oauth2.sdk.id.ClientID;
-
-import net.shibboleth.idp.plugin.authn.oidc.rp.impl.AbstractOIDCTest;
-import net.shibboleth.idp.plugin.authn.oidc.rp.impl.TestCredentialHelper;
-import net.shibboleth.oidc.profile.core.OIDCAuthenticationRequest;
-import net.shibboleth.oidc.security.JWTSignatureSigningParameters;
-import net.shibboleth.oidc.security.context.JWTSecurityParametersContext;
-
-/**
- * Tests for the SignJWT message handler.
- *
- * <p>Note, These tests sign a RequestObject. </p>
- */
-public class SignJWTHandlerTest extends AbstractOIDCTest {
-
- /** A client_secret to use.*/
- @Nonnull private static final String CLIENT_SECRET = "Xp2s5v8y/B?E(H+MbQeThWmYq3t6w9z$";
-
- /** The signer to test.*/
- private SignJWTHandler signer;
-
- /** The authn request.*/
- private OIDCAuthenticationRequest request;
-
- @Override
- @BeforeMethod
- public void setup() throws Exception {
- super.setup();
- signer = new SignJWTHandler();
-
- signer.setClaimsToSignLookupStrategy(mc -> {
- final OIDCAuthenticationRequest ar = (OIDCAuthenticationRequest)mc.getMessage();
- try {
- return ar.getRequestObject().getJWTClaimsSet();
- } catch (final ParseException e) {
- fail();
- }
- return null;
- });
- signer.setJwtUpdateConsumer((jwt, mc) -> {
- final OIDCAuthenticationRequest ar = (OIDCAuthenticationRequest)mc.getMessage();
- ar.setRequestObject(jwt);
- });
-
- request = new OIDCAuthenticationRequest(new ClientID("test-client"));
- final JWTClaimsSet claims = new JWTClaimsSet.Builder()
- .issuer("test-client")
- .audience("test-op")
- .issueTime(new Date())
- .build();
- request.setRequestObject(new PlainJWT(claims));
-
- prc.getOutboundMessageContext().setMessage(request);
- }
-
- @Test
- public void testSignHMAC_Success() throws Exception {
-
- final JWTSecurityParametersContext secParamCtx = new JWTSecurityParametersContext();
- final var params = new JWTSignatureSigningParameters();
- params.setSigningCredential(TestCredentialHelper.createClientSecretCredential(CLIENT_SECRET));
- params.setSignatureAlgorithm("HS256");
- secParamCtx.setSignatureSigningParameters(params);
- prc.getOutboundMessageContext().addSubcontext(secParamCtx);
-
- signer.initialize();
- signer.invoke(prc.getOutboundMessageContext());
- final JWT jwt = request.getRequestObject();
- AssertJUnit.assertTrue(jwt instanceof SignedJWT);
- final var signedJWT = (SignedJWT)jwt;
- AssertJUnit.assertTrue(JWSAlgorithm.Family.HMAC_SHA.contains(signedJWT.getHeader().getAlgorithm()));
- }
-
- @Test(expectedExceptions = Exception.class)
- public void testSignHMAC_WrongCredentialType() throws Exception {
-
- final JWTSecurityParametersContext secParamCtx = new JWTSecurityParametersContext();
- final var params = new JWTSignatureSigningParameters();
- params.setSigningCredential(TestCredentialHelper.createClientSecretCredential(CLIENT_SECRET));
- params.setSignatureAlgorithm("RS256");
- secParamCtx.setSignatureSigningParameters(params);
- prc.getOutboundMessageContext().addSubcontext(secParamCtx);
-
- signer.initialize();
- signer.invoke(prc.getOutboundMessageContext());
- final JWT jwt = request.getRequestObject();
- AssertJUnit.assertTrue(jwt instanceof SignedJWT);
- final var signedJWT = (SignedJWT)jwt;
- AssertJUnit.assertTrue(JWSAlgorithm.Family.HMAC_SHA.contains(signedJWT.getHeader().getAlgorithm()));
- }
-
- @Test
- public void testSignRS256_Success() throws Exception {
-
- final JWTSecurityParametersContext secParamCtx = new JWTSecurityParametersContext();
- final var params = new JWTSignatureSigningParameters();
- final RSAKey rsaKey = new RSAKeyGenerator(2048)
- .keyID("1")
- .keyUse(KeyUse.SIGNATURE)
- .generate();
- params.setSigningCredential(TestCredentialHelper.createAsymmetricSigningCredential(rsaKey));
- params.setSignatureAlgorithm("RS256");
- secParamCtx.setSignatureSigningParameters(params);
- prc.getOutboundMessageContext().addSubcontext(secParamCtx);
-
- signer.initialize();
- signer.invoke(prc.getOutboundMessageContext());
- final JWT jwt = request.getRequestObject();
- AssertJUnit.assertTrue(jwt instanceof SignedJWT);
- final var signedJWT = (SignedJWT)jwt;
- AssertJUnit.assertTrue(JWSAlgorithm.Family.RSA.contains(signedJWT.getHeader().getAlgorithm()));
- }
-
- @Test
- public void testSignES256_Success() throws Exception {
-
- final JWTSecurityParametersContext secParamCtx = new JWTSecurityParametersContext();
- final var params = new JWTSignatureSigningParameters();
- final ECKey ecKey = new ECKeyGenerator(Curve.P_256)
- .keyID("1")
- .keyUse(KeyUse.SIGNATURE)
- .generate();
- params.setSigningCredential(TestCredentialHelper.createAsymmetricSigningCredential(ecKey));
- params.setSignatureAlgorithm("ES256");
- secParamCtx.setSignatureSigningParameters(params);
- prc.getOutboundMessageContext().addSubcontext(secParamCtx);
-
- signer.initialize();
- signer.invoke(prc.getOutboundMessageContext());
- final JWT jwt = request.getRequestObject();
- AssertJUnit.assertTrue(jwt instanceof SignedJWT);
- final var signedJWT = (SignedJWT)jwt;
- AssertJUnit.assertTrue(JWSAlgorithm.Family.EC.contains(signedJWT.getHeader().getAlgorithm()));
- }
-
-}
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list