[java-oidc-common] branch main updated: JOIDC-162 - The default audit extractor for %fauth causes ClassCastException to be thrown
Henri Mikkonen
henri.mikkonen at iki.fi
Tue Jun 6 11:42:45 UTC 2023
This is an automated email from the git hooks/post-receive script.
hjmikkon pushed a commit to branch main
in repository java-oidc-common.
View the commit online:
http://git.shibboleth.net/view/?p=java-oidc-common.git;a=commit;h=1100f3ab395ccefeb11d191c55cda3089c1ec62a
The following commit(s) were added to refs/heads/main by this push:
new 1100f3a JOIDC-162 - The default audit extractor for %fauth causes ClassCastException to be thrown
1100f3a is described below
commit 1100f3ab395ccefeb11d191c55cda3089c1ec62a
Author: Henri Mikkonen <henri.mikkonen at iki.fi>
AuthorDate: Tue Jun 6 14:41:36 2023 +0300
JOIDC-162 - The default audit extractor for %fauth causes ClassCastException to be thrown
https://shibboleth.atlassian.net/browse/JOIDC-162
Updated 'ForceAuthnAuditExtractor' to tackle both Nimbus AuthenticationRequest and the
OIDCAuthenticationRequest object used by the RP plugin.
---
.../audit/impl/ForceAuthnAuditExtractor.java | 36 +++++---
.../audit/impl/ForceAuthnAuditExtractorTest.java | 95 ++++++++++++++++++++++
2 files changed, 121 insertions(+), 10 deletions(-)
diff --git a/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/audit/impl/ForceAuthnAuditExtractor.java b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/audit/impl/ForceAuthnAuditExtractor.java
index ce83238..fc55eb3 100644
--- a/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/audit/impl/ForceAuthnAuditExtractor.java
+++ b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/audit/impl/ForceAuthnAuditExtractor.java
@@ -24,12 +24,18 @@ import javax.annotation.Nullable;
import org.opensaml.profile.context.ProfileRequestContext;
+import com.nimbusds.openid.connect.sdk.AuthenticationRequest;
import com.nimbusds.openid.connect.sdk.Prompt;
import net.shibboleth.oidc.profile.core.OIDCAuthenticationRequest;
-/** {@link Function} that returns true if the OIDC prompt is set as 'login' in {@link OIDCAuthenticationRequest}. */
-public class ForceAuthnAuditExtractor extends AbstractAuthenticationRequestAuditExtractor<Boolean> {
+/** {@link Function} that returns true if the OIDC prompt is set as 'login' in the authentication request. Both
+ * {@link OIDCAuthenticationRequest} and {@link AuthenticationRequest} are supported. */
+public class ForceAuthnAuditExtractor implements Function<ProfileRequestContext, Boolean> {
+
+ /** Lookup strategy to locate the authentication request. */
+ @Nonnull
+ private final Function<ProfileRequestContext, Object> requestLookupStrategy;
/**
* Constructor.
@@ -37,22 +43,32 @@ public class ForceAuthnAuditExtractor extends AbstractAuthenticationRequestAudit
* @param strategy lookup strategy for locating the authentication request
*/
public ForceAuthnAuditExtractor(
- @Nonnull final Function<ProfileRequestContext, OIDCAuthenticationRequest> strategy) {
- super(strategy);
+ @Nonnull final Function<ProfileRequestContext, Object> strategy) {
+ requestLookupStrategy = strategy;
}
/** {@inheritDoc} */
@Override
@Nullable
public Boolean apply(@Nullable final ProfileRequestContext input) {
- final OIDCAuthenticationRequest request = getRequestLookupStrategy().apply(input);
- if (request != null && request.getPrompt() != null) {
- return request.getPrompt().contains(Prompt.Type.LOGIN);
- } else if (request != null && request.getPrompt() == null) {
- return false;
+ final Object requestObject = requestLookupStrategy.apply(input);
+ if (requestObject == null) {
+ return null;
+ }
+ if (requestObject instanceof OIDCAuthenticationRequest) {
+ final OIDCAuthenticationRequest request = (OIDCAuthenticationRequest) requestObject;
+ if (request.getPrompt() != null) {
+ return request.getPrompt().contains(Prompt.Type.LOGIN);
+ }
+ }
+ if (requestObject instanceof AuthenticationRequest) {
+ final AuthenticationRequest request = (AuthenticationRequest) requestObject;
+ if (request.getPrompt() != null) {
+ return request.getPrompt().contains(Prompt.Type.LOGIN);
+ }
}
- return null;
+ return false;
}
}
\ No newline at end of file
diff --git a/oidc-common-profile-impl/src/test/java/net/shibboleth/oidc/profile/audit/impl/ForceAuthnAuditExtractorTest.java b/oidc-common-profile-impl/src/test/java/net/shibboleth/oidc/profile/audit/impl/ForceAuthnAuditExtractorTest.java
new file mode 100644
index 0000000..23f0451
--- /dev/null
+++ b/oidc-common-profile-impl/src/test/java/net/shibboleth/oidc/profile/audit/impl/ForceAuthnAuditExtractorTest.java
@@ -0,0 +1,95 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.oidc.profile.audit.impl;
+
+import java.net.URI;
+import java.net.URISyntaxException;
+
+import org.opensaml.profile.context.ProfileRequestContext;
+import org.testng.Assert;
+import org.testng.annotations.Test;
+
+import com.nimbusds.oauth2.sdk.ParseException;
+import com.nimbusds.oauth2.sdk.ResponseType;
+import com.nimbusds.oauth2.sdk.Scope;
+import com.nimbusds.oauth2.sdk.id.ClientID;
+import com.nimbusds.openid.connect.sdk.AuthenticationRequest;
+import com.nimbusds.openid.connect.sdk.Prompt;
+
+import net.shibboleth.oidc.profile.core.OIDCAuthenticationRequest;
+
+/**
+ * Unit tests for {@link ForceAuthnAuditExtractor}.
+ */
+public class ForceAuthnAuditExtractorTest {
+
+ private ForceAuthnAuditExtractor extractor;
+
+ @Test
+ public void apply_noRequestReturnsNull() {
+ extractor = new ForceAuthnAuditExtractor(prc -> null);
+ Assert.assertNull(extractor.apply(new ProfileRequestContext()));
+ }
+
+ @Test
+ public void apply_oidcAuthenticationRequestWithoutPromptReturnsFalse() {
+ extractor = new ForceAuthnAuditExtractor(prc -> new OIDCAuthenticationRequest(new ClientID("mockId")));
+ Assert.assertFalse(extractor.apply(new ProfileRequestContext()));
+ }
+
+ @Test
+ public void apply_nimbusAuthenticationRequestWithoutPromptReturnsFalse() throws URISyntaxException {
+ final AuthenticationRequest request = new AuthenticationRequest.Builder(ResponseType.CODE, Scope.parse("openid"),
+ new ClientID("mockId"), new URI("http://localhost/cb")).build();
+ extractor = new ForceAuthnAuditExtractor(prc -> request);
+ Assert.assertFalse(extractor.apply(new ProfileRequestContext()));
+ }
+
+ @Test
+ public void apply_oidcAuthenticationRequestWithNonePromptReturnsFalse() throws ParseException {
+ final OIDCAuthenticationRequest request = new OIDCAuthenticationRequest(new ClientID("mockId"));
+ request.setPrompt(Prompt.parse("none"));
+ extractor = new ForceAuthnAuditExtractor(prc -> request);
+ Assert.assertFalse(extractor.apply(new ProfileRequestContext()));
+ }
+
+ @Test
+ public void apply_nimbusAuthenticationRequestWithNonePromptReturnsFalse() throws ParseException, URISyntaxException {
+ final AuthenticationRequest request = new AuthenticationRequest.Builder(ResponseType.CODE, Scope.parse("openid"),
+ new ClientID("mockId"), new URI("http://localhost/cb")).prompt(Prompt.parse("none")).build();
+ extractor = new ForceAuthnAuditExtractor(prc -> request);
+ Assert.assertFalse(extractor.apply(new ProfileRequestContext()));
+ }
+
+ @Test
+ public void apply_oidcAuthenticationRequestWithLoginPromptReturnsTrue() throws ParseException {
+ final OIDCAuthenticationRequest request = new OIDCAuthenticationRequest(new ClientID("mockId"));
+ request.setPrompt(Prompt.parse("login"));
+ extractor = new ForceAuthnAuditExtractor(prc -> request);
+ Assert.assertTrue(extractor.apply(new ProfileRequestContext()));
+ }
+
+ @Test
+ public void apply_nimbusAuthenticationRequestWithLoginPromptReturnsFalse() throws ParseException, URISyntaxException {
+ final AuthenticationRequest request = new AuthenticationRequest.Builder(ResponseType.CODE, Scope.parse("openid"),
+ new ClientID("mockId"), new URI("http://localhost/cb")).prompt(Prompt.parse("login")).build();
+ extractor = new ForceAuthnAuditExtractor(prc -> request);
+ Assert.assertTrue(extractor.apply(new ProfileRequestContext()));
+ }
+
+}
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list