[java-idp-oidc] branch main updated: JCOMOIDC-41 - Move OIDC Signature Validation resolvers and parameter classes to commons
Henri Mikkonen
henri.mikkonen at iki.fi
Fri Mar 17 16:12:26 UTC 2023
This is an automated email from the git hooks/post-receive script.
hjmikkon pushed a commit to branch main
in repository java-idp-oidc.
View the commit online:
http://git.shibboleth.net/view/?p=java-idp-oidc.git;a=commit;h=3f53caf5411f7f4c5d620a9704eeae844fb8ad29
The following commit(s) were added to refs/heads/main by this push:
new 3f53caf5 JCOMOIDC-41 - Move OIDC Signature Validation resolvers and parameter classes to commons
3f53caf5 is described below
commit 3f53caf5411f7f4c5d620a9704eeae844fb8ad29
Author: Henri Mikkonen <henri.mikkonen at iki.fi>
AuthorDate: Fri Mar 17 18:12:00 2023 +0200
JCOMOIDC-41 - Move OIDC Signature Validation resolvers and parameter classes to commons
https://shibboleth.atlassian.net/browse/JCOMOIDC-41
Globally exclude RSA-OAEP-384 and A192CBC-HS384 for testing.
---
.../op/profile/flow/IssuedEncryptedJWTTest.java | 66 ++++++++++++----------
.../src/test/resources/conf/relying-party.xml | 7 +++
2 files changed, 42 insertions(+), 31 deletions(-)
diff --git a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/IssuedEncryptedJWTTest.java b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/IssuedEncryptedJWTTest.java
index 9882a360..18cf40c4 100644
--- a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/IssuedEncryptedJWTTest.java
+++ b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/IssuedEncryptedJWTTest.java
@@ -133,32 +133,32 @@ public class IssuedEncryptedJWTTest extends AbstractIssuedJWTSecurityTest {
@Test
public void testJwtEncryption_a128kwAnd192cbcSpecified() throws Exception {
- assertSecretBasedEncryption(JWEAlgorithm.A128KW, EncryptionMethod.A192CBC_HS384);
+ assertExcludedAlgorithm(JWEAlgorithm.A128KW, EncryptionMethod.A192CBC_HS384);
}
@Test
public void testJwtEncryption_a192kwAnd192cbcSpecified() throws Exception {
- assertSecretBasedEncryption(JWEAlgorithm.A192KW, EncryptionMethod.A192CBC_HS384);
+ assertExcludedAlgorithm(JWEAlgorithm.A192KW, EncryptionMethod.A192CBC_HS384);
}
@Test
public void testJwtEncryption_a256kwAnd192cbcSpecified() throws Exception {
- assertSecretBasedEncryption(JWEAlgorithm.A256KW, EncryptionMethod.A192CBC_HS384);
+ assertExcludedAlgorithm(JWEAlgorithm.A256KW, EncryptionMethod.A192CBC_HS384);
}
@Test
public void testJwtEncryption_a128gcmkwAnd192cbcSpecified() throws Exception {
- assertSecretBasedEncryption(JWEAlgorithm.A128GCMKW, EncryptionMethod.A192CBC_HS384);
+ assertExcludedAlgorithm(JWEAlgorithm.A128GCMKW, EncryptionMethod.A192CBC_HS384);
}
@Test
public void testJwtEncryption_a192gcmkwAnd192cbcSpecified() throws Exception {
- assertSecretBasedEncryption(JWEAlgorithm.A192GCMKW, EncryptionMethod.A192CBC_HS384);
+ assertExcludedAlgorithm(JWEAlgorithm.A192GCMKW, EncryptionMethod.A192CBC_HS384);
}
@Test
public void testJwtEncryption_a256gcmkwAnd192cbcSpecified() throws Exception {
- assertSecretBasedEncryption(JWEAlgorithm.A256GCMKW, EncryptionMethod.A192CBC_HS384);
+ assertExcludedAlgorithm(JWEAlgorithm.A256GCMKW, EncryptionMethod.A192CBC_HS384);
}
@Test
@@ -252,17 +252,17 @@ public class IssuedEncryptedJWTTest extends AbstractIssuedJWTSecurityTest {
@Test
public void testJwtEncryption_a128gcmkwAnd192cbcSpecified_noKey() throws Exception {
- assertNoSymmetricKeyResponse(JWEAlgorithm.A128GCMKW, EncryptionMethod.A192CBC_HS384);
+ assertExcludedAlgorithm(JWEAlgorithm.A128GCMKW, EncryptionMethod.A192CBC_HS384);
}
@Test
public void testJwtEncryption_a192gcmkwAnd192cbcSpecified_noKey() throws Exception {
- assertNoSymmetricKeyResponse(JWEAlgorithm.A192GCMKW, EncryptionMethod.A192CBC_HS384);
+ assertExcludedAlgorithm(JWEAlgorithm.A192GCMKW, EncryptionMethod.A192CBC_HS384);
}
@Test
public void testJwtEncryption_a256gcmkwAnd192cbcSpecified_noKey() throws Exception {
- assertNoSymmetricKeyResponse(JWEAlgorithm.A256GCMKW, EncryptionMethod.A192CBC_HS384);
+ assertExcludedAlgorithm(JWEAlgorithm.A256GCMKW, EncryptionMethod.A192CBC_HS384);
}
@Test
@@ -337,26 +337,22 @@ public class IssuedEncryptedJWTTest extends AbstractIssuedJWTSecurityTest {
@Test
public void testJwtEncryption_ecdhAnd192cbcSpecified() throws Exception {
- assertPublicKeyBasedEncryption(ecKey.toPublicKey(), ecKey.toPrivateKey(), JWEAlgorithm.ECDH_ES,
- EncryptionMethod.A192CBC_HS384);
+ assertExcludedAlgorithm(JWEAlgorithm.ECDH_ES, EncryptionMethod.A192CBC_HS384);
}
@Test
public void testJwtEncryption_ecdh128kwAnd192cbcSpecified() throws Exception {
- assertPublicKeyBasedEncryption(ecKey.toPublicKey(), ecKey.toPrivateKey(), JWEAlgorithm.ECDH_ES_A128KW,
- EncryptionMethod.A192CBC_HS384);
+ assertExcludedAlgorithm(JWEAlgorithm.ECDH_ES_A128KW, EncryptionMethod.A192CBC_HS384);
}
@Test
public void testJwtEncryption_ecdh192kwAnd192cbcSpecified() throws Exception {
- assertPublicKeyBasedEncryption(ecKey.toPublicKey(), ecKey.toPrivateKey(), JWEAlgorithm.ECDH_ES_A192KW,
- EncryptionMethod.A192CBC_HS384);
+ assertExcludedAlgorithm(JWEAlgorithm.ECDH_ES_A192KW, EncryptionMethod.A192CBC_HS384);
}
@Test
public void testJwtEncryption_ecdh256kwAnd192cbcSpecified() throws Exception {
- assertPublicKeyBasedEncryption(ecKey.toPublicKey(), ecKey.toPrivateKey(), JWEAlgorithm.ECDH_ES_A256KW,
- EncryptionMethod.A192CBC_HS384);
+ assertExcludedAlgorithm(JWEAlgorithm.ECDH_ES_A256KW, EncryptionMethod.A192CBC_HS384);
}
@Test
@@ -403,8 +399,8 @@ public class IssuedEncryptedJWTTest extends AbstractIssuedJWTSecurityTest {
@Test
public void testJwtEncryption_rsaOaep384And128cbcSpecified() throws Exception {
- assertPublicKeyBasedEncryption(rsaPublicKey, rsaPrivateKey, JWEAlgorithm.RSA_OAEP_384,
- EncryptionMethod.A128CBC_HS256);
+ // RSA-OAEP384 is globally excluded
+ assertExcludedAlgorithm(JWEAlgorithm.RSA_OAEP_384, EncryptionMethod.A128CBC_HS256);
}
@Test
@@ -415,32 +411,28 @@ public class IssuedEncryptedJWTTest extends AbstractIssuedJWTSecurityTest {
@Test
public void testJwtEncryption_rsa15And192cbcSpecified() throws Exception {
- assertPublicKeyBasedEncryption(rsaPublicKey, rsaPrivateKey, JWEAlgorithm.RSA1_5,
- EncryptionMethod.A192CBC_HS384);
+ assertExcludedAlgorithm(JWEAlgorithm.RSA1_5, EncryptionMethod.A192CBC_HS384);
}
@Test
public void testJwtEncryption_rsaOaepAnd192cbcSpecified() throws Exception {
- assertPublicKeyBasedEncryption(rsaPublicKey, rsaPrivateKey, JWEAlgorithm.RSA_OAEP,
- EncryptionMethod.A192CBC_HS384);
+ assertExcludedAlgorithm(JWEAlgorithm.RSA_OAEP, EncryptionMethod.A192CBC_HS384);
}
@Test
public void testJwtEncryption_rsaOaep256And192cbcSpecified() throws Exception {
- assertPublicKeyBasedEncryption(rsaPublicKey, rsaPrivateKey, JWEAlgorithm.RSA_OAEP_256,
- EncryptionMethod.A192CBC_HS384);
+ assertExcludedAlgorithm(JWEAlgorithm.RSA_OAEP_256, EncryptionMethod.A192CBC_HS384);
}
@Test
public void testJwtEncryption_rsaOaep384And192cbcSpecified() throws Exception {
- assertPublicKeyBasedEncryption(rsaPublicKey, rsaPrivateKey, JWEAlgorithm.RSA_OAEP_384,
- EncryptionMethod.A192CBC_HS384);
+ // RSA-OAEP384 is globally excluded
+ assertExcludedAlgorithm(JWEAlgorithm.RSA_OAEP_384, EncryptionMethod.A192CBC_HS384);
}
@Test
public void testJwtEncryption_rsaOaep512And192cbcSpecified() throws Exception {
- assertPublicKeyBasedEncryption(rsaPublicKey, rsaPrivateKey, JWEAlgorithm.RSA_OAEP_512,
- EncryptionMethod.A192CBC_HS384);
+ assertExcludedAlgorithm(JWEAlgorithm.RSA_OAEP_512, EncryptionMethod.A192CBC_HS384);
}
@Test
@@ -463,8 +455,8 @@ public class IssuedEncryptedJWTTest extends AbstractIssuedJWTSecurityTest {
@Test
public void testJwtEncryption_rsaOaep384And256cbcSpecified() throws Exception {
- assertPublicKeyBasedEncryption(rsaPublicKey, rsaPrivateKey, JWEAlgorithm.RSA_OAEP_384,
- EncryptionMethod.A256CBC_HS512);
+ // RSA-OAEP384 is globally excluded
+ assertExcludedAlgorithm(JWEAlgorithm.RSA_OAEP_384, EncryptionMethod.A256CBC_HS512);
}
@Test
@@ -472,4 +464,16 @@ public class IssuedEncryptedJWTTest extends AbstractIssuedJWTSecurityTest {
assertPublicKeyBasedEncryption(rsaPublicKey, rsaPrivateKey, JWEAlgorithm.RSA_OAEP_512,
EncryptionMethod.A256CBC_HS512);
}
+
+ protected void assertExcludedAlgorithm(final JWEAlgorithm jweAlgorithm, final EncryptionMethod method) {
+ if (testSignedJwt) {
+ for (final JWSAlgorithm jwsAlgorithm : JWS_HMAC_ALGORITHMS) {
+ assertNoJwtResponse(defaultClientSecret64B, rsaPublicKey, jwsAlgorithm, jweAlgorithm, method,
+ fetchingType);
+ }
+ } else {
+ assertNoJwtResponse(defaultClientSecret64B, rsaPublicKey, null, jweAlgorithm, method, fetchingType);
+ }
+ }
+
}
diff --git a/idp-oidc-extension-impl/src/test/resources/conf/relying-party.xml b/idp-oidc-extension-impl/src/test/resources/conf/relying-party.xml
index 497c9c1a..a7f08090 100644
--- a/idp-oidc-extension-impl/src/test/resources/conf/relying-party.xml
+++ b/idp-oidc-extension-impl/src/test/resources/conf/relying-party.xml
@@ -18,6 +18,13 @@
static-field="net.shibboleth.oidc.jwa.support.SignatureConstants.ALGO_ID_SIGNATURE_ES_384" />
</util:list>
+ <util:list id="shibboleth.oidc.ExcludedEncryptionAlgorithms">
+ <util:constant
+ static-field="net.shibboleth.oidc.jwa.support.KeyManagementConstants.ALGO_ID_ALG_RSA_OAEP_384" />
+ <util:constant
+ static-field="net.shibboleth.oidc.jwa.support.EncryptionConstants.ALGO_ID_ENC_ALG_A192CBC_HS384" />
+ </util:list>
+
<!--
Unverified RP configuration, defaults to no support for any profiles. Add <ref> elements to the list
to enable specific default profile settings (as below), or create new beans inline to override defaults.
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list