[java-oidc-common] branch dev/JCOMOIDC-62 updated: Fix tests
Phil Smart
philip.smart at jisc.ac.uk
Fri Jan 27 11:31:09 UTC 2023
This is an automated email from the git hooks/post-receive script.
philsmart pushed a commit to branch dev/JCOMOIDC-62
in repository java-oidc-common.
View the commit online:
http://git.shibboleth.net/view/?p=java-oidc-common.git;a=commit;h=bc4d182ab8b96cc2ef3fd1ebc9c849a1382791ff
The following commit(s) were added to refs/heads/dev/JCOMOIDC-62 by this push:
new bc4d182 Fix tests
bc4d182 is described below
commit bc4d182ab8b96cc2ef3fd1ebc9c849a1382791ff
Author: Phil Smart <philip.smart at jisc.ac.uk>
AuthorDate: Fri Jan 27 11:31:06 2023 +0000
Fix tests
---
.../impl/BasicJOSEObjectCredentialResolver.java | 12 ++++++-----
...lientSecretCriterionCredentialResolverTest.java | 25 +++++++++++++++-------
.../oidc/security/impl/JWETokenDecrypterTest.java | 23 ++++++++++++++------
3 files changed, 41 insertions(+), 19 deletions(-)
diff --git a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/credential/impl/BasicJOSEObjectCredentialResolver.java b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/credential/impl/BasicJOSEObjectCredentialResolver.java
index bf90f17..60a605e 100644
--- a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/credential/impl/BasicJOSEObjectCredentialResolver.java
+++ b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/credential/impl/BasicJOSEObjectCredentialResolver.java
@@ -243,9 +243,10 @@ public class BasicJOSEObjectCredentialResolver extends AbstractCriteriaFiltering
}
/**
- * Use the usage type and information in the criteria to build a suitable signing or encryption credential.
+ * Use the usage type and algorithm information in the criteria to build a suitable signing or encryption
+ * credential.
*
- * <p>Only supports symmetric key encryption algorithms. Request for asymmetric key encryptiopn algorithms are
+ * <p>Only supports symmetric key encryption algorithms. Request for asymmetric key encryption algorithms are
* ignored.</p>
*
* @param usageType are we creating a key suitable for MAC signing or encryption
@@ -288,8 +289,8 @@ public class BasicJOSEObjectCredentialResolver extends AbstractCriteriaFiltering
// Can only derive symmetric key credentials, ignore if not
if (JWEAlgorithm.Family.SYMMETRIC.contains(JWEAlgorithm.parse(alg.getAlgorithm()))) {
try {
- final Credential derivedCred = secretCred.toEncryptionCredential(JWEAlgorithm.parse(alg.getAlgorithm()),
- EncryptionMethod.parse(enc.getEncAlgorithm()));
+ final Credential derivedCred = secretCred.toEncryptionCredential(
+ JWEAlgorithm.parse(alg.getAlgorithm()), EncryptionMethod.parse(enc.getEncAlgorithm()));
log.debug("Derived encryption credential '{}' from 'alg={}' and 'enc={}'", derivedCred.getKeyNames()
,alg.getAlgorithm(), enc.getEncAlgorithm());
@@ -304,7 +305,8 @@ public class BasicJOSEObjectCredentialResolver extends AbstractCriteriaFiltering
log.trace("Asymmetric key requested, client_secret not appropriate");
}
} else {
- log.trace("Client secret could not be derived, unknown usage type '{}'", usageType);
+ log.trace("Client secret could not be derived, unknown usage type '{}'", usageType);
+ throw new ResolverException("Unable to create key from client_secret, incompatible usage type");
}
return null;
}
diff --git a/oidc-common-crypto-impl/src/test/java/net/shibboleth/oidc/security/credential/impl/ClientSecretCriterionCredentialResolverTest.java b/oidc-common-crypto-impl/src/test/java/net/shibboleth/oidc/security/credential/impl/ClientSecretCriterionCredentialResolverTest.java
index 6021c42..6dd5b2d 100644
--- a/oidc-common-crypto-impl/src/test/java/net/shibboleth/oidc/security/credential/impl/ClientSecretCriterionCredentialResolverTest.java
+++ b/oidc-common-crypto-impl/src/test/java/net/shibboleth/oidc/security/credential/impl/ClientSecretCriterionCredentialResolverTest.java
@@ -14,6 +14,7 @@ import javax.crypto.SecretKey;
import org.opensaml.security.credential.Credential;
import org.opensaml.security.credential.UsageType;
+import org.opensaml.security.criteria.UsageCriterion;
import org.testng.annotations.Test;
import com.nimbusds.jose.EncryptionMethod;
@@ -51,9 +52,10 @@ public class ClientSecretCriterionCredentialResolverTest {
@Test
public void testResolveSigningKey() throws ResolverException {
- resolver = new ClientSecretCriterionCredentialResolver(UsageType.SIGNING);
+ resolver = new ClientSecretCriterionCredentialResolver();
final CriteriaSet set = new CriteriaSet();
+ set.add(new UsageCriterion(UsageType.SIGNING));
set.add(new ClientSecretCredentialCriterion(new DefaultClientSecretCredential(CLIENT_SECRET)));
final Iterable<Credential> resolvedCredentials = resolver.resolve(set);
@@ -70,9 +72,10 @@ public class ClientSecretCriterionCredentialResolverTest {
@Test(expectedExceptions = ResolverException.class)
public void testResolveIncompatibleUsageType() throws ResolverException {
- resolver = new ClientSecretCriterionCredentialResolver(UsageType.UNSPECIFIED);
+ resolver = new ClientSecretCriterionCredentialResolver();
final CriteriaSet set = new CriteriaSet();
+ set.add(new UsageCriterion(UsageType.UNSPECIFIED));
set.add(new ClientSecretCredentialCriterion(new DefaultClientSecretCredential(CLIENT_SECRET)));
set.add(new KeyManagmentAlgorithmCriterion(JWEAlgorithm.A128KW.getName()));
set.add(new DataEncryptionAlgorithmCriterion(EncryptionMethod.A128CBC_HS256.getName()));
@@ -82,9 +85,10 @@ public class ClientSecretCriterionCredentialResolverTest {
@Test(expectedExceptions = ResolverException.class)
public void testResolveNoKeyAlogrithmCriterion() throws ResolverException {
- resolver = new ClientSecretCriterionCredentialResolver(UsageType.ENCRYPTION);
+ resolver = new ClientSecretCriterionCredentialResolver();
final CriteriaSet set = new CriteriaSet();
+ set.add(new UsageCriterion(UsageType.ENCRYPTION));
set.add(new ClientSecretCredentialCriterion(new DefaultClientSecretCredential(CLIENT_SECRET)));
set.add(new DataEncryptionAlgorithmCriterion(EncryptionMethod.A128CBC_HS256.getName()));
@@ -94,9 +98,10 @@ public class ClientSecretCriterionCredentialResolverTest {
@Test(expectedExceptions = ResolverException.class)
public void testResolveNoDataEncryptionAlogrithmCriterion() throws ResolverException {
- resolver = new ClientSecretCriterionCredentialResolver(UsageType.ENCRYPTION);
+ resolver = new ClientSecretCriterionCredentialResolver();
final CriteriaSet set = new CriteriaSet();
+ set.add(new UsageCriterion(UsageType.ENCRYPTION));
set.add(new ClientSecretCredentialCriterion(new DefaultClientSecretCredential(CLIENT_SECRET)));
set.add(new KeyManagmentAlgorithmCriterion(JWEAlgorithm.A128KW.getName()));
final Iterable<Credential> resolvedCredentials = resolver.resolve(set);
@@ -105,9 +110,10 @@ public class ClientSecretCriterionCredentialResolverTest {
@Test
public void testResolveKeyWrappingKey() throws ResolverException {
- resolver = new ClientSecretCriterionCredentialResolver(UsageType.ENCRYPTION);
+ resolver = new ClientSecretCriterionCredentialResolver();
final CriteriaSet set = new CriteriaSet();
+ set.add(new UsageCriterion(UsageType.ENCRYPTION));
set.add(new ClientSecretCredentialCriterion(new DefaultClientSecretCredential(CLIENT_SECRET)));
set.add(new KeyManagmentAlgorithmCriterion(JWEAlgorithm.A128KW.getName()));
set.add(new DataEncryptionAlgorithmCriterion(EncryptionMethod.A128CBC_HS256.getName()));
@@ -136,9 +142,10 @@ public class ClientSecretCriterionCredentialResolverTest {
.build(),
new Payload(createdSignedJWT()));
- resolver = new ClientSecretCriterionCredentialResolver(UsageType.ENCRYPTION);
+ resolver = new ClientSecretCriterionCredentialResolver();
final CriteriaSet set = new CriteriaSet();
+ set.add(new UsageCriterion(UsageType.ENCRYPTION));
set.add(new ClientSecretCredentialCriterion(new DefaultClientSecretCredential(CLIENT_SECRET)));
set.add(new KeyManagmentAlgorithmCriterion(JWEAlgorithm.A128KW.getName()));
set.add(new DataEncryptionAlgorithmCriterion(EncryptionMethod.A128GCM.getName()));
@@ -190,10 +197,11 @@ public class ClientSecretCriterionCredentialResolverTest {
@Test
public void testResolveDirectEncryptionKey() throws ResolverException {
- resolver = new ClientSecretCriterionCredentialResolver(UsageType.ENCRYPTION);
+ resolver = new ClientSecretCriterionCredentialResolver();
final CriteriaSet set = new CriteriaSet();
set.add(new ClientSecretCredentialCriterion(new DefaultClientSecretCredential(CLIENT_SECRET)));
+ set.add(new UsageCriterion(UsageType.ENCRYPTION));
set.add(new KeyManagmentAlgorithmCriterion(JWEAlgorithm.DIR.getName()));
set.add(new DataEncryptionAlgorithmCriterion(EncryptionMethod.A128CBC_HS256.getName()));
final Iterable<Credential> resolvedCredentials = resolver.resolve(set);
@@ -212,9 +220,10 @@ public class ClientSecretCriterionCredentialResolverTest {
/* Should fail, as asymmetric key can not be created from client_secret.*/
@Test
public void testIncompatibleAlg() throws ResolverException {
- resolver = new ClientSecretCriterionCredentialResolver(UsageType.ENCRYPTION);
+ resolver = new ClientSecretCriterionCredentialResolver();
final CriteriaSet set = new CriteriaSet();
+ set.add(new UsageCriterion(UsageType.ENCRYPTION));
set.add(new ClientSecretCredentialCriterion(new DefaultClientSecretCredential(CLIENT_SECRET)));
set.add(new KeyManagmentAlgorithmCriterion(JWEAlgorithm.RSA_OAEP_256.getName()));
set.add(new DataEncryptionAlgorithmCriterion(EncryptionMethod.A128CBC_HS256.getName()));
diff --git a/oidc-common-crypto-impl/src/test/java/net/shibboleth/oidc/security/impl/JWETokenDecrypterTest.java b/oidc-common-crypto-impl/src/test/java/net/shibboleth/oidc/security/impl/JWETokenDecrypterTest.java
index faee700..93f97b4 100644
--- a/oidc-common-crypto-impl/src/test/java/net/shibboleth/oidc/security/impl/JWETokenDecrypterTest.java
+++ b/oidc-common-crypto-impl/src/test/java/net/shibboleth/oidc/security/impl/JWETokenDecrypterTest.java
@@ -130,7 +130,7 @@ public class JWETokenDecrypterTest {
.build(),
new Payload(createdSignedJWT()));
final JWKCredential cred = TestCredentialHelper.createClientSecretCredential(CLIENT_SECRET)
- .toEncryptionCredential(JWEAlgorithm.DIR, EncryptionMethod.A256GCM);
+ .toEncryptionCredential(JWEAlgorithm.A256KW, EncryptionMethod.A256GCM);
jweObject.encrypt(new AESEncrypter(cred.getSecretKey()));
final EncryptedJWT jwe = EncryptedJWT.parse(jweObject.serialize());
@@ -141,7 +141,7 @@ public class JWETokenDecrypterTest {
public Credential resolveSingle(final CriteriaSet criteria) throws ResolverException {
try {
return TestCredentialHelper.createClientSecretCredential(CLIENT_SECRET)
- .toEncryptionCredential(JWEAlgorithm.DIR, EncryptionMethod.A256GCM);
+ .toEncryptionCredential(JWEAlgorithm.A256KW, EncryptionMethod.A256GCM);
} catch (KeyException | JOSEException e) {
fail();
return null;
@@ -170,12 +170,12 @@ public class JWETokenDecrypterTest {
.build(),
new Payload(createdSignedJWT()));
final JWKCredential cred = TestCredentialHelper.createClientSecretCredential(CLIENT_SECRET)
- .toEncryptionCredential(JWEAlgorithm.DIR, EncryptionMethod.A256GCM);
+ .toEncryptionCredential(JWEAlgorithm.A256KW, EncryptionMethod.A256GCM);
jweObject.encrypt(new AESEncrypter(cred.getSecretKey()));
final EncryptedJWT jwe = EncryptedJWT.parse(jweObject.serialize());
final var params = new DecryptionParameters();
- params.setKEKCredentialResolver(new MockKeyWrapCriteriaFilteringCredentialResolver());
+ params.setKEKCredentialResolver(new MockKeyWrapCriteriaFilteringCredentialResolver(JWEAlgorithm.A256KW, EncryptionMethod.A256GCM));
decrypter = new JWETokenDecrypter(params);
final JWT decryptedJWE = decrypter.decrypt(jwe);
assertTrue(jwe.getState() == State.DECRYPTED);
@@ -321,7 +321,8 @@ public class JWETokenDecrypterTest {
final EncryptedJWT jwe = EncryptedJWT.parse(jweObject.serialize());
final var params = new DecryptionParameters();
- params.setContentEncryptionKeyCredentialResolver(new MockKeyWrapCriteriaFilteringCredentialResolver());
+ params.setContentEncryptionKeyCredentialResolver(
+ new MockKeyWrapCriteriaFilteringCredentialResolver(JWEAlgorithm.DIR, EncryptionMethod.A256GCM));
decrypter = new JWETokenDecrypter(params);
final JWT decryptedJWE = decrypter.decrypt(jwe);
assertTrue(jwe.getState() == State.DECRYPTED);
@@ -744,12 +745,22 @@ public class JWETokenDecrypterTest {
private static class MockKeyWrapCriteriaFilteringCredentialResolver extends AbstractCriteriaFilteringCredentialResolver
implements JOSEObjectCredentialResolver {
+
+ private final JWEAlgorithm alg;
+
+ private final EncryptionMethod enc;
+
+ public MockKeyWrapCriteriaFilteringCredentialResolver(
+ final JWEAlgorithm algorithm, final EncryptionMethod encryption) {
+ alg = algorithm;
+ enc = encryption;
+ }
@Override
protected Iterable<Credential> resolveFromSource(final CriteriaSet criteriaSet) throws ResolverException {
try {
return List.of(TestCredentialHelper.createClientSecretCredential(CLIENT_SECRET)
- .toEncryptionCredential(JWEAlgorithm.DIR, EncryptionMethod.A256GCM));
+ .toEncryptionCredential(alg, enc));
} catch (KeyException | JOSEException e) {
fail();
return null;
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list