[java-idp-oidc] 02/02: Improved the JWT authentication tests.
Henri Mikkonen
henri.mikkonen at iki.fi
Tue Jan 10 15:47:19 UTC 2023
This is an automated email from the git hooks/post-receive script.
hjmikkon pushed a commit to branch main
in repository java-idp-oidc.
View the commit online:
http://git.shibboleth.net/view/?p=java-idp-oidc.git;a=commit;h=e3b0de65c383466d043877cf5377629d5fcb0072
commit e3b0de65c383466d043877cf5377629d5fcb0072
Author: Henri Mikkonen <henri.mikkonen at iki.fi>
AuthorDate: Tue Jan 10 17:46:14 2023 +0200
Improved the JWT authentication tests.
---
.../AbstractOidcClientAuthenticationFlowTest.java | 45 +++++++++++++++++++---
.../oidc/op/profile/flow/AbstractOidcFlowTest.java | 14 ++++++-
.../flow/ClientCredentialsTokenFlowTest.java | 3 +-
.../op/profile/flow/IntrospectionFlowTest.java | 3 +-
.../oidc/op/profile/flow/RevocationFlowTest.java | 3 +-
.../plugin/oidc/op/profile/flow/TokenFlowTest.java | 6 +--
6 files changed, 60 insertions(+), 14 deletions(-)
diff --git a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/AbstractOidcClientAuthenticationFlowTest.java b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/AbstractOidcClientAuthenticationFlowTest.java
index 91c4d65a..34a73319 100644
--- a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/AbstractOidcClientAuthenticationFlowTest.java
+++ b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/AbstractOidcClientAuthenticationFlowTest.java
@@ -35,7 +35,9 @@ import org.testng.annotations.Test;
import com.nimbusds.jose.JOSEException;
import com.nimbusds.jose.JWSAlgorithm;
+import com.nimbusds.jwt.JWT;
import com.nimbusds.jwt.JWTClaimsSet;
+import com.nimbusds.jwt.PlainJWT;
import com.nimbusds.jwt.SignedJWT;
import com.nimbusds.oauth2.sdk.auth.ClientAuthenticationMethod;
import com.nimbusds.oauth2.sdk.auth.ClientSecretJWT;
@@ -68,15 +70,19 @@ public abstract class AbstractOidcClientAuthenticationFlowTest extends AbstractO
@BeforeClass
public void initKeys() throws NoSuchAlgorithmException {
- KeyPairGenerator keyGen = KeyPairGenerator.getInstance("RSA");
- keyGen.initialize(2048);
- final KeyPair keyPair = keyGen.genKeyPair();
+ final KeyPair keyPair = generateNewKeyPair();
rsaPrivateKey = (RSAPrivateKey) keyPair.getPrivate();
rsaPublicKey = (RSAPublicKey) keyPair.getPublic();
}
-
+
+ protected KeyPair generateNewKeyPair() throws NoSuchAlgorithmException {
+ final KeyPairGenerator keyGen = KeyPairGenerator.getInstance("RSA");
+ keyGen.initialize(2048);
+ return keyGen.genKeyPair();
+ }
+
protected void populateClientAssertionParams(final Map<String, String> requestParameters,
- final SignedJWT jwt) {
+ final JWT jwt) {
requestParameters.put("client_assertion", jwt.serialize());
requestParameters.put("client_assertion_type", "urn:ietf:params:oauth:client-assertion-type:jwt-bearer");
}
@@ -154,6 +160,15 @@ public abstract class AbstractOidcClientAuthenticationFlowTest extends AbstractO
assertErrorDescriptionContains(result, getErrorDetaisForJWTValidation().getSecond());
}
+ @Test
+ public void testInvalidSecretJWT_invalidSecret() throws Exception {
+ final SignedJWT jwt = createSecretJWT(validClaimsSet(), clientSecret + "wrong");
+ final FlowExecutionResult result = launchWithJwtAuthentication(jwt, JWSAlgorithm.HS256,
+ ClientAuthenticationMethod.CLIENT_SECRET_JWT);
+ assertErrorCode(result, getErrorDetaisForJWTValidation().getFirst());
+ assertErrorDescriptionContains(result, getErrorDetaisForJWTValidation().getSecond());
+ }
+
@Test
public void testValidSecretJWT() throws Exception {
final SignedJWT jwt = createSecretJWT(validClaimsSet(), clientSecret);
@@ -235,6 +250,15 @@ public abstract class AbstractOidcClientAuthenticationFlowTest extends AbstractO
assertErrorDescriptionContains(result, getErrorDetaisForJWTValidation().getSecond());
}
+ @Test
+ public void testInvalidPrivateKeyJWT_invalidSignerKey() throws Exception {
+ final SignedJWT jwt = createPrivateKeyJWT(validClaimsSet(), (RSAPrivateKey)generateNewKeyPair().getPrivate());
+ final FlowExecutionResult result = launchWithJwtAuthentication(jwt, JWSAlgorithm.RS256,
+ ClientAuthenticationMethod.PRIVATE_KEY_JWT);
+ assertErrorCode(result, getErrorDetaisForJWTValidation().getFirst());
+ assertErrorDescriptionContains(result, getErrorDetaisForJWTValidation().getSecond());
+ }
+
@Test
public void testValidPrivateKeyJWT() throws Exception {
final SignedJWT jwt = createPrivateKeyJWT(validClaimsSet(), rsaPrivateKey);
@@ -243,6 +267,15 @@ public abstract class AbstractOidcClientAuthenticationFlowTest extends AbstractO
assertSuccessResponse(result);
}
+ @Test
+ public void testPlainJWT() throws Exception {
+ final PlainJWT jwt = new PlainJWT(validClaimsSet());
+ final FlowExecutionResult result = launchWithJwtAuthentication(jwt, JWSAlgorithm.RS256,
+ ClientAuthenticationMethod.PRIVATE_KEY_JWT);
+ assertErrorCode(result, "invalid_request");
+ assertErrorDescriptionContains(result, "UnableToDecode");
+ }
+
protected JWTClaimsSet claimsSetMissingSub() {
return new JWTClaimsSet.Builder()
.issuer(clientId)
@@ -344,7 +377,7 @@ public abstract class AbstractOidcClientAuthenticationFlowTest extends AbstractO
* @return The flow execution result.
* @throws Exception
*/
- protected abstract FlowExecutionResult launchWithJwtAuthentication(final SignedJWT jwt,
+ protected abstract FlowExecutionResult launchWithJwtAuthentication(final JWT jwt,
final JWSAlgorithm algorithm, final ClientAuthenticationMethod method) throws Exception;
/**
diff --git a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/AbstractOidcFlowTest.java b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/AbstractOidcFlowTest.java
index fa2b45f7..4db032a9 100644
--- a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/AbstractOidcFlowTest.java
+++ b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/AbstractOidcFlowTest.java
@@ -321,7 +321,12 @@ public abstract class AbstractOidcFlowTest extends AbstractFlowTest {
protected static SignedJWT createSecretJWT(final JWTClaimsSet claimsSet, final String clientSecret)
throws JOSEException {
- final SignedJWT jwt = new SignedJWT(new JWSHeader(JWSAlgorithm.HS256), claimsSet);
+ return createSecretJWT(claimsSet, clientSecret, JWSAlgorithm.HS256);
+ }
+
+ protected static SignedJWT createSecretJWT(final JWTClaimsSet claimsSet, final String clientSecret,
+ final JWSAlgorithm algorithm) throws JOSEException {
+ final SignedJWT jwt = new SignedJWT(new JWSHeader(algorithm), claimsSet);
final MACSigner signer = new MACSigner(clientSecret);
jwt.sign(signer);
return jwt;
@@ -329,7 +334,12 @@ public abstract class AbstractOidcFlowTest extends AbstractFlowTest {
protected static SignedJWT createPrivateKeyJWT(final JWTClaimsSet claimsSet, final RSAPrivateKey rsaPrivateKey)
throws JOSEException {
- final SignedJWT jwt = new SignedJWT(new JWSHeader(JWSAlgorithm.RS256), claimsSet);
+ return createPrivateKeyJWT(claimsSet, rsaPrivateKey, JWSAlgorithm.RS256);
+ }
+
+ protected static SignedJWT createPrivateKeyJWT(final JWTClaimsSet claimsSet, final RSAPrivateKey rsaPrivateKey,
+ final JWSAlgorithm algorithm) throws JOSEException {
+ final SignedJWT jwt = new SignedJWT(new JWSHeader(algorithm), claimsSet);
final RSASSASigner signer = new RSASSASigner(rsaPrivateKey);
jwt.sign(signer);
return jwt;
diff --git a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/ClientCredentialsTokenFlowTest.java b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/ClientCredentialsTokenFlowTest.java
index dbac6db9..1d7d40fc 100644
--- a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/ClientCredentialsTokenFlowTest.java
+++ b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/ClientCredentialsTokenFlowTest.java
@@ -49,6 +49,7 @@ import com.nimbusds.jose.JWEDecrypter;
import com.nimbusds.jose.JWSAlgorithm;
import com.nimbusds.jose.crypto.RSADecrypter;
import com.nimbusds.jwt.EncryptedJWT;
+import com.nimbusds.jwt.JWT;
import com.nimbusds.jwt.JWTClaimsSet;
import com.nimbusds.jwt.SignedJWT;
import com.nimbusds.oauth2.sdk.AccessTokenResponse;
@@ -298,7 +299,7 @@ public class ClientCredentialsTokenFlowTest extends AbstractOidcClientAuthentica
return flowExecutor.launchExecution(FLOW_ID, null, externalContext);
}
- protected FlowExecutionResult launchWithJwtAuthentication(final SignedJWT jwt, final JWSAlgorithm algorithm,
+ protected FlowExecutionResult launchWithJwtAuthentication(final JWT jwt, final JWSAlgorithm algorithm,
final ClientAuthenticationMethod method) throws Exception {
if (ClientAuthenticationMethod.CLIENT_SECRET_JWT.equals(method)) {
storeMetadata(storageService, clientId, clientSecret, scope, algorithm, method);
diff --git a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/IntrospectionFlowTest.java b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/IntrospectionFlowTest.java
index 83d3848c..d27d5a6a 100644
--- a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/IntrospectionFlowTest.java
+++ b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/IntrospectionFlowTest.java
@@ -37,6 +37,7 @@ import org.testng.annotations.Test;
import com.nimbusds.jose.JOSEException;
import com.nimbusds.jose.JWSAlgorithm;
+import com.nimbusds.jwt.JWT;
import com.nimbusds.jwt.SignedJWT;
import com.nimbusds.oauth2.sdk.OAuth2Error;
import com.nimbusds.oauth2.sdk.Scope;
@@ -409,7 +410,7 @@ public class IntrospectionFlowTest extends AbstractOidcClientAuthenticationFlowT
Assert.assertFalse(resp.isActive());
}
- protected FlowExecutionResult launchWithJwtAuthentication(final SignedJWT jwt, final JWSAlgorithm algorithm,
+ protected FlowExecutionResult launchWithJwtAuthentication(final JWT jwt, final JWSAlgorithm algorithm,
final ClientAuthenticationMethod method) throws Exception {
if (ClientAuthenticationMethod.CLIENT_SECRET_JWT.equals(method)) {
storeMetadata(storageService, clientId, clientSecret, scope, algorithm, method);
diff --git a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/RevocationFlowTest.java b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/RevocationFlowTest.java
index 30aa859a..e0f9cc71 100644
--- a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/RevocationFlowTest.java
+++ b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/RevocationFlowTest.java
@@ -37,6 +37,7 @@ import org.testng.annotations.Test;
import com.nimbusds.jose.JOSEException;
import com.nimbusds.jose.JWSAlgorithm;
+import com.nimbusds.jwt.JWT;
import com.nimbusds.jwt.SignedJWT;
import com.nimbusds.oauth2.sdk.OAuth2Error;
import com.nimbusds.oauth2.sdk.ParseException;
@@ -195,7 +196,7 @@ public class RevocationFlowTest extends AbstractOidcClientAuthenticationFlowTest
parseSuccessResponse(result, OAuth2RevocationSuccessResponse.class);
}
- protected FlowExecutionResult launchWithJwtAuthentication(final SignedJWT jwt, final JWSAlgorithm algorithm,
+ protected FlowExecutionResult launchWithJwtAuthentication(final JWT jwt, final JWSAlgorithm algorithm,
final ClientAuthenticationMethod method) throws Exception {
if (ClientAuthenticationMethod.CLIENT_SECRET_JWT.equals(method)) {
storeMetadata(storageService, clientId, clientSecret, scope, algorithm, method);
diff --git a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/TokenFlowTest.java b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/TokenFlowTest.java
index 1ff133bf..5972fb9f 100644
--- a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/TokenFlowTest.java
+++ b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/TokenFlowTest.java
@@ -38,7 +38,6 @@ import org.testng.annotations.Test;
import com.nimbusds.jose.JWSAlgorithm;
import com.nimbusds.jwt.JWT;
-import com.nimbusds.jwt.SignedJWT;
import com.nimbusds.oauth2.sdk.AccessTokenResponse;
import com.nimbusds.oauth2.sdk.AuthorizationCode;
import com.nimbusds.oauth2.sdk.OAuth2Error;
@@ -880,7 +879,8 @@ public class TokenFlowTest extends AbstractOidcClientAuthenticationFlowTest {
protected FlowExecutionResult launchWithJwtAuthentication(final JWTAuthentication authnMethod, final JWSAlgorithm algorithm,
final String requestedScope)
throws Exception {
- final String code = ValidateGrantTest.buildAuthorizationCode(clientId, "https://op.example.org", "jdoe", "mock",
+ final String code = ValidateGrantTest.buildAuthorizationCode(clientId, "https://op.example.org", "jdoe"
+ , "mock",
redirectUri, scope.toString()).toString();
storeMetadata(storageService, clientId, clientSecret, scope, JWSAlgorithm.HS256,
ClientAuthenticationMethod.CLIENT_SECRET_JWT);
@@ -894,7 +894,7 @@ public class TokenFlowTest extends AbstractOidcClientAuthenticationFlowTest {
return flowExecutor.launchExecution(FLOW_ID, null, externalContext);
}
- protected FlowExecutionResult launchWithJwtAuthentication(final SignedJWT jwt, final JWSAlgorithm algorithm,
+ protected FlowExecutionResult launchWithJwtAuthentication(final JWT jwt, final JWSAlgorithm algorithm,
final ClientAuthenticationMethod method) throws Exception {
final String code = ValidateGrantTest.buildAuthorizationCode(clientId, "https://op.example.org", "jdoe", "mock",
redirectUri, scope.toString()).toString();
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list