[java-idp-oidc] 02/03: JCOMOIDC-41 - Move OIDC Signature Validation resolvers and parameter classes to commons
Henri Mikkonen
henri.mikkonen at iki.fi
Tue Mar 28 15:07:35 UTC 2023
This is an automated email from the git hooks/post-receive script.
hjmikkon pushed a commit to branch main
in repository java-idp-oidc.
View the commit online:
http://git.shibboleth.net/view/?p=java-idp-oidc.git;a=commit;h=1a94f8cb47b63d37467fad2addb1eaeb7b0d280e
commit 1a94f8cb47b63d37467fad2addb1eaeb7b0d280e
Author: Henri Mikkonen <henri.mikkonen at iki.fi>
AuthorDate: Tue Mar 28 18:02:53 2023 +0300
JCOMOIDC-41 - Move OIDC Signature Validation resolvers and parameter classes to commons
https://shibboleth.atlassian.net/browse/JCOMOIDC-41
Improved JWT security flow tests
The test set should now cover all the currently supported JWT and JWE algorithms
and encryption methods, including all their combinations. Also one of each group
is excluded for testing, and the tests verify that the exclusion works as expected.
The tests were referring to the DataSealer defined in BaseOIDCResponseActionTest
whenever sealed authorization codes, access tokens or refresh tokens were created.
It caused multiple threads to be created during the flow tests all those sealer
instances had a thread for updating its contents. The flow tests now use the
data sealer from the Spring context.
---
.../flow/AbstractIssuedJWTSecurityTest.java | 22 +-
.../op/profile/flow/AbstractOidcApiFlowTest.java | 4 +-
.../oidc/op/profile/flow/AbstractOidcFlowTest.java | 54 ++-
.../op/profile/flow/IssuedEncryptedJWTTest.java | 437 ++++++++-------------
.../oidc/op/profile/flow/IssuedSignedJWTTest.java | 13 +-
.../plugin/oidc/op/profile/flow/TokenFlowTest.java | 4 +-
.../profile/impl/BaseOIDCResponseActionTest.java | 2 +
7 files changed, 234 insertions(+), 302 deletions(-)
diff --git a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/AbstractIssuedJWTSecurityTest.java b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/AbstractIssuedJWTSecurityTest.java
index be9f62cd..7e0530a1 100644
--- a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/AbstractIssuedJWTSecurityTest.java
+++ b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/AbstractIssuedJWTSecurityTest.java
@@ -90,6 +90,8 @@ public abstract class AbstractIssuedJWTSecurityTest extends AbstractOidcFlowTest
AUTHORIZE_ID_TOKEN,
AUTHORIZE_ACCESS_TOKEN,
+
+ REQUEST_OBJECT
}
protected final JWT_FETCHING_TYPE fetchingType;
@@ -133,8 +135,6 @@ public abstract class AbstractIssuedJWTSecurityTest extends AbstractOidcFlowTest
case TOKEN_ACCESS_TOKEN:
return obtainJwtAccessTokenFromTokenEndpoint(clientId, clientSecret, publicKey,
jwsAlgorithm, jweAlgorithm, encryptionMethod);
- //return obtainJwtAccessTokenFromTokenEndpoint("mockClientIdJwtAccessToken", clientSecret, publicKey,
- // jwsAlgorithm, jweAlgorithm, encryptionMethod);
case AUTHORIZE_ID_TOKEN:
return obtainIdTokenFromAuthorizeEndpoint(clientId, clientSecret, publicKey, jwsAlgorithm,
jweAlgorithm, encryptionMethod);
@@ -147,15 +147,15 @@ public abstract class AbstractIssuedJWTSecurityTest extends AbstractOidcFlowTest
return null;
}
- protected static void assertSignedJwt(final JWT jwt, final JWSAlgorithm algorithm, final String clientSecret) {
+ protected void assertSignedJwt(final JWT jwt, final JWSAlgorithm algorithm, final String clientSecret) {
assertSignedJwt(jwt, algorithm, null, clientSecret);
}
- protected static void assertSignedJwt(final JWT jwt, final JWSAlgorithm algorithm, final PublicKey publicKey) {
+ protected void assertSignedJwt(final JWT jwt, final JWSAlgorithm algorithm, final PublicKey publicKey) {
assertSignedJwt(jwt, algorithm, publicKey, null);
}
- protected static void assertSignedJwt(final JWT jwt, final JWSAlgorithm algorithm, final PublicKey publicKey,
+ protected void assertSignedJwt(final JWT jwt, final JWSAlgorithm algorithm, final PublicKey publicKey,
final String clientSecret) {
Assert.assertTrue(SignedJWT.class.isInstance(jwt), "The JWT was not SignedJWT: " + jwt);
final SignedJWT signedJwt = (SignedJWT) jwt;
@@ -165,7 +165,7 @@ public abstract class AbstractIssuedJWTSecurityTest extends AbstractOidcFlowTest
if (JWSAlgorithm.Family.HMAC_SHA.contains(algorithm)) {
verifier = new MACVerifier(clientSecret);
} else if (JWSAlgorithm.Family.RSA.contains(algorithm) && publicKey instanceof RSAPublicKey) {
- verifier = new RSASSAVerifier((RSAPublicKey) publicKey);
+ verifier = new RSASSAVerifier((RSAPublicKey) publicKey);
} else if (JWSAlgorithm.Family.EC.contains(algorithm) && publicKey instanceof ECPublicKey) {
verifier = new ECDSAVerifier((ECPublicKey) publicKey);
} else {
@@ -178,6 +178,8 @@ public abstract class AbstractIssuedJWTSecurityTest extends AbstractOidcFlowTest
}
}
+
+
protected static void assertEncryptedJwt(final JWT jwt, final JWEAlgorithm algorithm,
final EncryptionMethod method, final String clientSecret, final PrivateKey privateKey) {
final EncryptedJWT encryptedJwt = assertAndDecryptJwt(jwt, algorithm, method, clientSecret, privateKey);
@@ -217,12 +219,12 @@ public abstract class AbstractIssuedJWTSecurityTest extends AbstractOidcFlowTest
return encryptedJwt;
}
- protected static void assertEncryptedSignedJwt(final JWT jwt, final JWSAlgorithm jwsAlg, final JWEAlgorithm jweAlg,
+ protected void assertEncryptedSignedJwt(final JWT jwt, final JWSAlgorithm jwsAlg, final JWEAlgorithm jweAlg,
final EncryptionMethod method, final String clientSecret, final PublicKey jwsValidationKey) {
assertEncryptedSignedJwt(jwt, jwsAlg, jweAlg, method, clientSecret, null, null, jwsValidationKey);
}
- protected static void assertEncryptedSignedJwt(final JWT jwt, final JWSAlgorithm jwsAlg, final JWEAlgorithm jweAlg,
+ protected void assertEncryptedSignedJwt(final JWT jwt, final JWSAlgorithm jwsAlg, final JWEAlgorithm jweAlg,
final EncryptionMethod method, final String clientSecret, final PrivateKey privateKey,
final PublicKey publicKey, final PublicKey jwsValidationKey) {
final EncryptedJWT encryptedJwt = assertAndDecryptJwt(jwt, jweAlg, method, clientSecret, privateKey);
@@ -233,9 +235,6 @@ public abstract class AbstractIssuedJWTSecurityTest extends AbstractOidcFlowTest
} catch (ParseException e) {
Assert.fail("Could not parse SignedJWT from the unencrypted JWT", e);
}
- //Assert.assertNotNull(signedJwt,
- // "Could not parse SignedJWT from: " + encryptedJwt.getPayload() + ", with JWSAlg " + jwsAlg);
-
}
protected void assertNoJwtResponse(final String clientId, final String clientSecret,
@@ -539,6 +538,7 @@ public abstract class AbstractIssuedJWTSecurityTest extends AbstractOidcFlowTest
}
return null;
}
+
protected JWT parseEncryptedOrSignedJWT(final String input) {
try {
diff --git a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/AbstractOidcApiFlowTest.java b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/AbstractOidcApiFlowTest.java
index 268f4f6a..bee0730c 100644
--- a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/AbstractOidcApiFlowTest.java
+++ b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/AbstractOidcApiFlowTest.java
@@ -80,7 +80,7 @@ public class AbstractOidcApiFlowTest extends AbstractOidcFlowTest {
.setDlClaimsUI(userInfoDeliverySet)
.setRootTokenIdentifier(rootId)
.build();
- return new RefreshToken(claims.serialize(BaseOIDCResponseActionTest.initializeDataSealer()));
+ return new RefreshToken(claims.serialize(getDataSealer()));
}
protected BearerAccessToken buildLegacyToken(final String clientId, final String subject, final Scope scope,
@@ -88,7 +88,7 @@ public class AbstractOidcApiFlowTest extends AbstractOidcFlowTest {
throws URISyntaxException, NoSuchAlgorithmException, DataSealerException, ComponentInitializationException {
final String json = buildJsonForLegacyToken(subject, clientId, scope, "at", consentedClaims);
- return new BearerAccessToken(BaseOIDCResponseActionTest.initializeDataSealer().wrap(json,
+ return new BearerAccessToken(getDataSealer().wrap(json,
Instant.now().plusSeconds(30)));
}
diff --git a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/AbstractOidcFlowTest.java b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/AbstractOidcFlowTest.java
index 7aef9b12..fb58934d 100644
--- a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/AbstractOidcFlowTest.java
+++ b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/AbstractOidcFlowTest.java
@@ -18,6 +18,7 @@
package net.shibboleth.idp.plugin.oidc.op.profile.flow;
import java.io.IOException;
+import java.io.UnsupportedEncodingException;
import java.net.URI;
import java.net.URISyntaxException;
import java.security.KeyPair;
@@ -28,6 +29,7 @@ import java.security.interfaces.ECPrivateKey;
import java.security.interfaces.ECPublicKey;
import java.security.interfaces.RSAPrivateKey;
import java.security.interfaces.RSAPublicKey;
+import java.text.ParseException;
import java.time.Instant;
import java.util.ArrayList;
import java.util.Date;
@@ -35,6 +37,7 @@ import java.util.HashSet;
import java.util.List;
import java.util.Map;
+import javax.crypto.spec.SecretKeySpec;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
@@ -61,6 +64,7 @@ import com.nimbusds.jose.JWEObject;
import com.nimbusds.jose.JWSAlgorithm;
import com.nimbusds.jose.JWSHeader;
import com.nimbusds.jose.Payload;
+import com.nimbusds.jose.crypto.AESEncrypter;
import com.nimbusds.jose.crypto.ECDHEncrypter;
import com.nimbusds.jose.crypto.ECDSASigner;
import com.nimbusds.jose.crypto.MACSigner;
@@ -72,6 +76,7 @@ import com.nimbusds.jose.jwk.JWK;
import com.nimbusds.jose.jwk.JWKSet;
import com.nimbusds.jose.jwk.RSAKey;
import com.nimbusds.jose.jwk.gen.ECKeyGenerator;
+import com.nimbusds.jwt.EncryptedJWT;
import com.nimbusds.jwt.JWTClaimsSet;
import com.nimbusds.jwt.SignedJWT;
import com.nimbusds.oauth2.sdk.ErrorResponse;
@@ -93,6 +98,7 @@ import net.shibboleth.idp.plugin.oidc.op.token.support.TokenClaimsSet;
import net.shibboleth.idp.test.flows.AbstractFlowTest;
import net.shibboleth.oidc.metadata.impl.BaseStorageServiceClientInformationComponent;
import net.shibboleth.oidc.security.credential.BasicJWKCredential;
+import net.shibboleth.oidc.security.credential.JWKCredentialSupport;
import net.shibboleth.oidc.security.credential.impl.BasicJWKCredentialFactoryBean;
import net.shibboleth.utilities.java.support.component.ComponentInitializationException;
import net.shibboleth.utilities.java.support.net.HttpServletRequestResponseContext;
@@ -463,10 +469,14 @@ public abstract class AbstractOidcFlowTest extends AbstractFlowTest {
}
protected static SignedJWT createSecretJWT(final JWTClaimsSet claimsSet, final String clientSecret,
- final JWSAlgorithm algorithm) throws JOSEException {
+ final JWSAlgorithm algorithm) {
final SignedJWT jwt = new SignedJWT(new JWSHeader(algorithm), claimsSet);
- final MACSigner signer = new MACSigner(clientSecret);
- jwt.sign(signer);
+ try {
+ final MACSigner signer = new MACSigner(clientSecret);
+ jwt.sign(signer);
+ } catch (final JOSEException e) {
+ return null;
+ }
return jwt;
}
@@ -491,31 +501,41 @@ public abstract class AbstractOidcFlowTest extends AbstractFlowTest {
return jwt;
}
- protected static String createEncryptedJWT(final String contents, final JWEAlgorithm algorithm,
- final EncryptionMethod method) throws JOSEException {
- return createEncryptedJWT(contents, algorithm, method, loadEncryptionCredential());
+ protected static EncryptedJWT createEncryptedJWT(final String contents, final JWEAlgorithm algorithm,
+ final EncryptionMethod method) throws JOSEException, ParseException {
+ return createEncryptedJWT(contents, algorithm, method, loadEncryptionCredential(), null);
}
- protected static String createEncryptedJWT(final String contents, final JWEAlgorithm algorithm,
- final EncryptionMethod method, final BasicJWKCredential credential) throws JOSEException {
- return createEncryptedJWT(contents, algorithm, method, credential, true);
+ protected static EncryptedJWT createEncryptedJWT(final String contents, final JWEAlgorithm algorithm,
+ final EncryptionMethod method, final BasicJWKCredential credential, final String clientSecret)
+ throws JOSEException, ParseException {
+ return createEncryptedJWT(contents, algorithm, method, credential, clientSecret, true);
}
- protected static String createEncryptedJWT(final String contents, final JWEAlgorithm algorithm,
- final EncryptionMethod method, final BasicJWKCredential credential, boolean setKid) throws JOSEException {
+ protected static EncryptedJWT createEncryptedJWT(final String contents, final JWEAlgorithm algorithm,
+ final EncryptionMethod method, final BasicJWKCredential credential, final String clientSecret,
+ boolean setKid) throws JOSEException, ParseException {
final JWEObject jweObject = new JWEObject(new JWEHeader.Builder(algorithm, method)
.contentType("JWT").keyID(setKid ? credential.getKid() : null).build(),
new Payload(contents));
- final PublicKey publicKey = credential.getPublicKey();
- if (publicKey instanceof RSAPublicKey) {
+ final PublicKey publicKey = credential == null ? null : credential.getPublicKey();
+ if (publicKey instanceof RSAPublicKey && JWEAlgorithm.Family.RSA.contains(algorithm)) {
jweObject.encrypt(new RSAEncrypter((RSAPublicKey) publicKey));
- } else if (publicKey instanceof ECPublicKey) {
+ } else if (publicKey instanceof ECPublicKey && JWEAlgorithm.Family.ECDH_ES.contains(algorithm)) {
jweObject.encrypt(new ECDHEncrypter((ECPublicKey) publicKey));
+ } else if (clientSecret != null) {
+ try {
+ jweObject.encrypt(new AESEncrypter(JWKCredentialSupport.generateSymmetricKey(
+ clientSecret.getBytes("UTF-8"), algorithm, method)));
+ } catch (UnsupportedEncodingException | JOSEException e) {
+ Assert.fail("Could not encrypt with client secret", e);
+ return null;
+ }
} else {
- Assert.fail();
+ Assert.fail("Could not find encrypter for " + algorithm);
return null;
}
- return jweObject.serialize();
+ return EncryptedJWT.parse(jweObject.serialize());
}
protected static BasicJWKCredential loadEncryptionCredential() {
@@ -579,7 +599,7 @@ public abstract class AbstractOidcFlowTest extends AbstractFlowTest {
.setDlClaimsUI(userInfoDeliverySet)
.setRootTokenIdentifier(rootId)
.build();
- return new BearerAccessToken(claims.serialize(BaseOIDCResponseActionTest.initializeDataSealer()));
+ return new BearerAccessToken(claims.serialize(getDataSealer()));
}
}
diff --git a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/IssuedEncryptedJWTTest.java b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/IssuedEncryptedJWTTest.java
index 18cf40c4..6cb13c33 100644
--- a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/IssuedEncryptedJWTTest.java
+++ b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/IssuedEncryptedJWTTest.java
@@ -20,8 +20,6 @@ package net.shibboleth.idp.plugin.oidc.op.profile.flow;
import java.security.PrivateKey;
import java.security.PublicKey;
import java.util.List;
-import java.util.stream.Collectors;
-import java.util.stream.Stream;
import org.testng.Assert;
import org.testng.annotations.Test;
@@ -38,13 +36,23 @@ import com.nimbusds.openid.connect.sdk.UserInfoSuccessResponse;
*/
public class IssuedEncryptedJWTTest extends AbstractIssuedJWTSecurityTest {
- private final static List<JWSAlgorithm> JWS_RSA_ALGORITHMS = List.of(JWSAlgorithm.RS256, JWSAlgorithm.RS384,
- JWSAlgorithm.RS512, JWSAlgorithm.PS256, JWSAlgorithm.PS384, JWSAlgorithm.PS512);
-
- private final static List<JWSAlgorithm> JWS_HMAC_ALGORITHMS = List.of(JWSAlgorithm.HS256, JWSAlgorithm.HS384,
- JWSAlgorithm.HS512);
+ /** Enabled JWS algorithms to be iterated over in the tests. */
+ protected final static List<JWSAlgorithm> JWS_ALGORITHMS = List.of(JWSAlgorithm.RS256, JWSAlgorithm.RS384,
+ JWSAlgorithm.RS512, JWSAlgorithm.PS256, JWSAlgorithm.PS384, JWSAlgorithm.PS512, JWSAlgorithm.HS256,
+ JWSAlgorithm.HS384, JWSAlgorithm.HS512, JWSAlgorithm.ES256, JWSAlgorithm.ES512);
+
+ /** Enabled JWE algorithms to be iterated over in the tests. */
+ protected final static List<JWEAlgorithm> JWE_ALGORITHMS = List.of(JWEAlgorithm.ECDH_ES, JWEAlgorithm.ECDH_ES_A128KW,
+ JWEAlgorithm.ECDH_ES_A192KW, JWEAlgorithm.ECDH_ES_A256KW, JWEAlgorithm.RSA1_5, JWEAlgorithm.RSA_OAEP,
+ JWEAlgorithm.RSA_OAEP_256, JWEAlgorithm.RSA_OAEP_512, JWEAlgorithm.A128KW, JWEAlgorithm.A192KW,
+ JWEAlgorithm.A256KW, JWEAlgorithm.A128GCMKW, JWEAlgorithm.A192GCMKW, JWEAlgorithm.A256GCMKW);
+
+ /** Enabled encryption methods to be iterated over in the tests. */
+ protected static final List<EncryptionMethod> ENCRYPTION_METHODS = List.of(EncryptionMethod.A128CBC_HS256,
+ EncryptionMethod.A256CBC_HS512, EncryptionMethod.A128GCM, EncryptionMethod.A192GCM,
+ EncryptionMethod.A256GCM);
- private final boolean testSignedJwt;
+ protected final boolean testSignedJwt;
public IssuedEncryptedJWTTest(final JWT_FETCHING_TYPE type, final String flowId) {
this(type, flowId, false, false);
@@ -79,22 +87,31 @@ public class IssuedEncryptedJWTTest extends AbstractIssuedJWTSecurityTest {
}
}
+ protected static PublicKey getSignatureVerificationKey(final JWSAlgorithm jwsAlgorithm) {
+ if (JWSAlgorithm.ES256.equals(jwsAlgorithm)) {
+ return loadESSigningCredential().getPublicKey();
+ } else if (JWSAlgorithm.ES512.equals(jwsAlgorithm)) {
+ return loadES512SigningCredential().getPublicKey();
+ }
+ return loadRSSigningCredential().getPublicKey();
+ }
+
+ protected static PrivateKey getSigningKey(final JWSAlgorithm jwsAlgorithm) {
+ if (JWSAlgorithm.ES256.equals(jwsAlgorithm)) {
+ return loadESSigningCredential().getPrivateKey();
+ } else if (JWSAlgorithm.ES512.equals(jwsAlgorithm)) {
+ return loadES512SigningCredential().getPrivateKey();
+ }
+ return loadRSSigningCredential().getPrivateKey();
+ }
+
protected void assertSecretBasedEncryption(final JWEAlgorithm jweAlgorithm, final EncryptionMethod method) {
if (testSignedJwt) {
- final List<JWSAlgorithm> jwsAlgs = Stream.concat(JWS_RSA_ALGORITHMS.stream(), JWS_HMAC_ALGORITHMS.stream())
- .collect(Collectors.toList());
- for (final JWSAlgorithm jwsAlgorithm : jwsAlgs) {
+ for (final JWSAlgorithm jwsAlgorithm : JWS_ALGORITHMS) {
final JWT jwt = obtainJwt(defaultClientSecret64B, null, jwsAlgorithm, jweAlgorithm, method);
assertEncryptedSignedJwt(jwt, jwsAlgorithm, jweAlgorithm, method, defaultClientSecret64B,
- loadRSSigningCredential().getPublicKey());
+ getSignatureVerificationKey(jwsAlgorithm));
}
- final JWT ec2Jwt = obtainJwt(defaultClientSecret64B, null, JWSAlgorithm.ES256, jweAlgorithm, method);
- assertEncryptedSignedJwt(ec2Jwt, JWSAlgorithm.ES256, jweAlgorithm, method, defaultClientSecret64B,
- loadESSigningCredential().getPublicKey());
- final JWT ec5Jwt = obtainJwt(defaultClientSecret64B, null, JWSAlgorithm.ES512, jweAlgorithm, method);
- assertEncryptedSignedJwt(ec5Jwt, JWSAlgorithm.ES512, jweAlgorithm, method, defaultClientSecret64B,
- loadES512SigningCredential().getPublicKey());
-
} else {
final JWT jwt = obtainJwt(defaultClientSecret, null, null, jweAlgorithm, method);
assertEncryptedJwt(jwt, jweAlgorithm, method, defaultClientSecret, null);
@@ -102,208 +119,109 @@ public class IssuedEncryptedJWTTest extends AbstractIssuedJWTSecurityTest {
}
@Test
- public void testJwtEncryption_a128kwAnd128cbcSpecified() throws Exception {
- assertSecretBasedEncryption(JWEAlgorithm.A128KW, EncryptionMethod.A128CBC_HS256);
- }
-
- @Test
- public void testJwtEncryption_a192kwAnd128cbcSpecified() throws Exception {
- assertSecretBasedEncryption(JWEAlgorithm.A192KW, EncryptionMethod.A128CBC_HS256);
- }
-
- @Test
- public void testJwtEncryption_a256kwAnd128cbcSpecified() throws Exception {
- assertSecretBasedEncryption(JWEAlgorithm.A256KW, EncryptionMethod.A128CBC_HS256);
- }
-
- @Test
- public void testJwtEncryption_a128gcmkwAnd128cbcSpecified() throws Exception {
- assertSecretBasedEncryption(JWEAlgorithm.A128GCMKW, EncryptionMethod.A128CBC_HS256);
- }
-
- @Test
- public void testJwtEncryption_a192gcmkwAnd128cbcSpecified() throws Exception {
- assertSecretBasedEncryption(JWEAlgorithm.A192GCMKW, EncryptionMethod.A128CBC_HS256);
- }
-
- @Test
- public void testJwtEncryption_a256gcmkwAnd128cbcSpecified() throws Exception {
- assertSecretBasedEncryption(JWEAlgorithm.A256GCMKW, EncryptionMethod.A128CBC_HS256);
+ public void testJwtEncryption_a128kwWithEnabledMethods() throws Exception {
+ for (final EncryptionMethod method : ENCRYPTION_METHODS) {
+ assertSecretBasedEncryption(JWEAlgorithm.A128KW, method);
+ }
}
@Test
- public void testJwtEncryption_a128kwAnd192cbcSpecified() throws Exception {
+ public void testJwtEncryption_a128kwWithExcludedMethod() throws Exception {
assertExcludedAlgorithm(JWEAlgorithm.A128KW, EncryptionMethod.A192CBC_HS384);
}
@Test
- public void testJwtEncryption_a192kwAnd192cbcSpecified() throws Exception {
- assertExcludedAlgorithm(JWEAlgorithm.A192KW, EncryptionMethod.A192CBC_HS384);
- }
-
- @Test
- public void testJwtEncryption_a256kwAnd192cbcSpecified() throws Exception {
- assertExcludedAlgorithm(JWEAlgorithm.A256KW, EncryptionMethod.A192CBC_HS384);
+ public void testJwtEncryption_a192kwWithEnabledMethods() throws Exception {
+ for (final EncryptionMethod method : ENCRYPTION_METHODS) {
+ assertSecretBasedEncryption(JWEAlgorithm.A192KW, method);
+ }
}
@Test
- public void testJwtEncryption_a128gcmkwAnd192cbcSpecified() throws Exception {
- assertExcludedAlgorithm(JWEAlgorithm.A128GCMKW, EncryptionMethod.A192CBC_HS384);
+ public void testJwtEncryption_a192kwWithExcludedMethod() throws Exception {
+ assertExcludedAlgorithm(JWEAlgorithm.A192KW, EncryptionMethod.A192CBC_HS384);
}
@Test
- public void testJwtEncryption_a192gcmkwAnd192cbcSpecified() throws Exception {
- assertExcludedAlgorithm(JWEAlgorithm.A192GCMKW, EncryptionMethod.A192CBC_HS384);
+ public void testJwtEncryption_a256kwWithEnabledMethods() throws Exception {
+ for (final EncryptionMethod method : ENCRYPTION_METHODS) {
+ assertSecretBasedEncryption(JWEAlgorithm.A256KW, method);
+ }
}
@Test
- public void testJwtEncryption_a256gcmkwAnd192cbcSpecified() throws Exception {
- assertExcludedAlgorithm(JWEAlgorithm.A256GCMKW, EncryptionMethod.A192CBC_HS384);
+ public void testJwtEncryption_a256kwWithExcludedMethod() throws Exception {
+ assertExcludedAlgorithm(JWEAlgorithm.A256KW, EncryptionMethod.A192CBC_HS384);
}
@Test
- public void testJwtEncryption_a128kwAnd256cbcSpecified() throws Exception {
- assertSecretBasedEncryption(JWEAlgorithm.A128KW, EncryptionMethod.A256CBC_HS512);
+ public void testJwtEncryption_a128gcmkwWithEnabledMethods() throws Exception {
+ for (final EncryptionMethod method : ENCRYPTION_METHODS) {
+ assertSecretBasedEncryption(JWEAlgorithm.A128GCMKW, method);
+ }
}
@Test
- public void testJwtEncryption_a192kwAnd256cbcSpecified() throws Exception {
- assertSecretBasedEncryption(JWEAlgorithm.A192KW, EncryptionMethod.A256CBC_HS512);
+ public void testJwtEncryption_a128gcmkwWithExcludedMethod() throws Exception {
+ assertExcludedAlgorithm(JWEAlgorithm.A128GCMKW, EncryptionMethod.A192CBC_HS384);
}
@Test
- public void testJwtEncryption_a256kwAnd256cbcSpecified() throws Exception {
- assertSecretBasedEncryption(JWEAlgorithm.A256KW, EncryptionMethod.A256CBC_HS512);
+ public void testJwtEncryption_a192gcmkwWithEnabledMethods() throws Exception {
+ for (final EncryptionMethod method : ENCRYPTION_METHODS) {
+ assertSecretBasedEncryption(JWEAlgorithm.A192GCMKW, method);
+ }
}
@Test
- public void testJwtEncryption_a128gcmkwAnd256cbcSpecified() throws Exception {
- assertSecretBasedEncryption(JWEAlgorithm.A128GCMKW, EncryptionMethod.A256CBC_HS512);
+ public void testJwtEncryption_a192gcmkwWithExcludedMethod() throws Exception {
+ assertExcludedAlgorithm(JWEAlgorithm.A192GCMKW, EncryptionMethod.A192CBC_HS384);
}
@Test
- public void testJwtEncryption_a192gcmkwAnd256cbcSpecified() throws Exception {
- assertSecretBasedEncryption(JWEAlgorithm.A192GCMKW, EncryptionMethod.A256CBC_HS512);
+ public void testJwtEncryption_a256gcmkwWithEnabledMethods() throws Exception {
+ for (final EncryptionMethod method : ENCRYPTION_METHODS) {
+ assertSecretBasedEncryption(JWEAlgorithm.A256GCMKW, method);
+ }
}
@Test
- public void testJwtEncryption_a256gcmkwAnd256cbcSpecified() throws Exception {
- assertSecretBasedEncryption(JWEAlgorithm.A256GCMKW, EncryptionMethod.A256CBC_HS512);
+ public void testJwtEncryption_a256gcmkwWithExcludedMethod() throws Exception {
+ assertExcludedAlgorithm(JWEAlgorithm.A256GCMKW, EncryptionMethod.A192CBC_HS384);
}
- protected void assertNoSymmetricKeyResponse(final JWEAlgorithm jweAlgorithm, final EncryptionMethod method) {
+ protected void assertNoSymmetricKeyResponse(final JWEAlgorithm jweAlgorithm, final EncryptionMethod method)
+ throws Exception {
if (testSignedJwt) {
- for (final JWSAlgorithm jwsAlgorithm : JWS_RSA_ALGORITHMS) {
- assertNoJwtResponse(null, rsaPublicKey, jwsAlgorithm, jweAlgorithm, method, fetchingType);
+ for (final JWSAlgorithm jwsAlgorithm : JWS_ALGORITHMS) {
+ if (!JWSAlgorithm.Family.HMAC_SHA.contains(jwsAlgorithm)) {
+ assertNoJwtResponse(null, getSignatureVerificationKey(jwsAlgorithm), jwsAlgorithm, jweAlgorithm,
+ method, fetchingType);
+ }
}
- assertNoJwtResponse(null, loadESSigningCredential().getPublicKey(), JWSAlgorithm.ES256, jweAlgorithm,
- method, fetchingType);
- assertNoJwtResponse(null, loadES512SigningCredential().getPublicKey(), JWSAlgorithm.ES512, jweAlgorithm,
- method, fetchingType);
} else {
assertNoJwtResponse(null, null, null, jweAlgorithm, method, fetchingType);
}
}
-
- @Test
- public void testJwtEncryption_a128kwAnd128cbcSpecified_noKey() throws Exception {
- assertNoSymmetricKeyResponse(JWEAlgorithm.A128KW, EncryptionMethod.A128CBC_HS256);
- }
-
- @Test
- public void testJwtEncryption_a192kwAnd128cbcSpecified_noKey() throws Exception {
- assertNoSymmetricKeyResponse(JWEAlgorithm.A192KW, EncryptionMethod.A128CBC_HS256);
- }
-
- @Test
- public void testJwtEncryption_a256kwAnd128cbcSpecified_noKey() throws Exception {
- assertNoSymmetricKeyResponse(JWEAlgorithm.A256KW, EncryptionMethod.A128CBC_HS256);
- }
-
- @Test
- public void testJwtEncryption_a128gcmkwAnd128cbcSpecified_noKey() throws Exception {
- assertNoSymmetricKeyResponse(JWEAlgorithm.A128GCMKW, EncryptionMethod.A128CBC_HS256);
- }
-
- @Test
- public void testJwtEncryption_a192gcmkwAnd128cbcSpecified_noKey() throws Exception {
- assertNoSymmetricKeyResponse(JWEAlgorithm.A192GCMKW, EncryptionMethod.A128CBC_HS256);
- }
-
- @Test
- public void testJwtEncryption_a256gcmkwAnd128cbcSpecified_noKey() throws Exception {
- assertNoSymmetricKeyResponse(JWEAlgorithm.A256GCMKW, EncryptionMethod.A128CBC_HS256);
- }
-
- @Test
- public void testJwtEncryption_a128kwAnd192cbcSpecified_noKey() throws Exception {
- assertNoSymmetricKeyResponse(JWEAlgorithm.A128KW, EncryptionMethod.A192CBC_HS384);
- }
-
- @Test
- public void testJwtEncryption_a192kwAnd192cbcSpecified_noKey() throws Exception {
- assertNoSymmetricKeyResponse(JWEAlgorithm.A192KW, EncryptionMethod.A192CBC_HS384);
- }
-
- @Test
- public void testJwtEncryption_a256kwAnd192cbcSpecified_noKey() throws Exception {
- assertNoSymmetricKeyResponse(JWEAlgorithm.A256KW, EncryptionMethod.A192CBC_HS384);
- }
-
- @Test
- public void testJwtEncryption_a128gcmkwAnd192cbcSpecified_noKey() throws Exception {
- assertExcludedAlgorithm(JWEAlgorithm.A128GCMKW, EncryptionMethod.A192CBC_HS384);
- }
-
- @Test
- public void testJwtEncryption_a192gcmkwAnd192cbcSpecified_noKey() throws Exception {
- assertExcludedAlgorithm(JWEAlgorithm.A192GCMKW, EncryptionMethod.A192CBC_HS384);
- }
-
- @Test
- public void testJwtEncryption_a256gcmkwAnd192cbcSpecified_noKey() throws Exception {
- assertExcludedAlgorithm(JWEAlgorithm.A256GCMKW, EncryptionMethod.A192CBC_HS384);
- }
-
- @Test
- public void testJwtEncryption_a128kwAnd256cbcSpecified_noKey() throws Exception {
- assertNoSymmetricKeyResponse(JWEAlgorithm.A128KW, EncryptionMethod.A256CBC_HS512);
- }
@Test
- public void testJwtEncryption_a192kwAnd256cbcSpecified_noKey() throws Exception {
- assertNoSymmetricKeyResponse(JWEAlgorithm.A192KW, EncryptionMethod.A256CBC_HS512);
- }
-
- @Test
- public void testJwtEncryption_a256kwAnd256cbcSpecified_noKey() throws Exception {
- assertNoSymmetricKeyResponse(JWEAlgorithm.A256KW, EncryptionMethod.A256CBC_HS512);
- }
-
- @Test
- public void testJwtEncryption_a128gcmkwAnd256cbcSpecified_noKey() throws Exception {
- assertNoSymmetricKeyResponse(JWEAlgorithm.A128GCMKW, EncryptionMethod.A256CBC_HS512);
- }
-
- @Test
- public void testJwtEncryption_a192gcmkwAnd256cbcSpecified_noKey() throws Exception {
- assertNoSymmetricKeyResponse(JWEAlgorithm.A192GCMKW, EncryptionMethod.A256CBC_HS512);
- }
-
- @Test
- public void testJwtEncryption_a256gcmkwAnd256cbcSpecified_noKey() throws Exception {
- assertNoSymmetricKeyResponse(JWEAlgorithm.A256GCMKW, EncryptionMethod.A256CBC_HS512);
+ public void testJwtEncryption_symmetricKeyEncryption_noKey() throws Exception {
+ for (final JWEAlgorithm jwe : JWE_ALGORITHMS) {
+ if (JWEAlgorithm.Family.SYMMETRIC.contains(jwe)) {
+ for (final EncryptionMethod method : ENCRYPTION_METHODS) {
+ assertNoSymmetricKeyResponse(jwe, method);
+ }
+ }
+ }
}
protected void assertPublicKeyBasedEncryption(final PublicKey publicKey, final PrivateKey privateKey,
final JWEAlgorithm jweAlgorithm, final EncryptionMethod method) {
if (testSignedJwt) {
- final List<JWSAlgorithm> jwsAlgs = Stream.concat(JWS_RSA_ALGORITHMS.stream(), JWS_HMAC_ALGORITHMS.stream())
- .collect(Collectors.toList());
- for (final JWSAlgorithm jwsAlgorithm : jwsAlgs) {
+ for (final JWSAlgorithm jwsAlgorithm : JWS_ALGORITHMS) {
final JWT jwt = obtainJwt(defaultClientSecret64B, publicKey, jwsAlgorithm, jweAlgorithm, method);
assertEncryptedSignedJwt(jwt, jwsAlgorithm, jweAlgorithm, method, defaultClientSecret64B, privateKey,
- publicKey, loadRSSigningCredential().getPublicKey());
+ publicKey, getSignatureVerificationKey(jwsAlgorithm));
}
} else {
final JWT jwt = obtainJwt(defaultClientSecret, publicKey, null, jweAlgorithm, method);
@@ -312,162 +230,121 @@ public class IssuedEncryptedJWTTest extends AbstractIssuedJWTSecurityTest {
}
@Test
- public void testJwtEncryption_ecdhAnd128cbcSpecified() throws Exception {
- assertPublicKeyBasedEncryption(ecKey.toPublicKey(), ecKey.toPrivateKey(), JWEAlgorithm.ECDH_ES,
- EncryptionMethod.A128CBC_HS256);
- }
-
- @Test
- public void testJwtEncryption_ecdh128kwAnd128cbcSpecified() throws Exception {
- assertPublicKeyBasedEncryption(ecKey.toPublicKey(), ecKey.toPrivateKey(), JWEAlgorithm.ECDH_ES_A128KW,
- EncryptionMethod.A128CBC_HS256);
- }
-
- @Test
- public void testJwtEncryption_ecdh192kwAnd128cbcSpecified() throws Exception {
- assertPublicKeyBasedEncryption(ecKey.toPublicKey(), ecKey.toPrivateKey(), JWEAlgorithm.ECDH_ES_A192KW,
- EncryptionMethod.A128CBC_HS256);
- }
-
- @Test
- public void testJwtEncryption_ecdh256kwAnd128cbcSpecified() throws Exception {
- assertPublicKeyBasedEncryption(ecKey.toPublicKey(), ecKey.toPrivateKey(), JWEAlgorithm.ECDH_ES_A256KW,
- EncryptionMethod.A128CBC_HS256);
+ public void testJwtEncryption_ecdhWithEnabledMethods() throws Exception {
+ for (final EncryptionMethod method : ENCRYPTION_METHODS) {
+ assertPublicKeyBasedEncryption(ecKey.toPublicKey(), ecKey.toPrivateKey(), JWEAlgorithm.ECDH_ES, method);
+ }
}
@Test
- public void testJwtEncryption_ecdhAnd192cbcSpecified() throws Exception {
+ public void testJwtEncryption_ecdhWithExcludedMethod() throws Exception {
assertExcludedAlgorithm(JWEAlgorithm.ECDH_ES, EncryptionMethod.A192CBC_HS384);
}
@Test
- public void testJwtEncryption_ecdh128kwAnd192cbcSpecified() throws Exception {
- assertExcludedAlgorithm(JWEAlgorithm.ECDH_ES_A128KW, EncryptionMethod.A192CBC_HS384);
- }
-
- @Test
- public void testJwtEncryption_ecdh192kwAnd192cbcSpecified() throws Exception {
- assertExcludedAlgorithm(JWEAlgorithm.ECDH_ES_A192KW, EncryptionMethod.A192CBC_HS384);
- }
-
- @Test
- public void testJwtEncryption_ecdh256kwAnd192cbcSpecified() throws Exception {
- assertExcludedAlgorithm(JWEAlgorithm.ECDH_ES_A256KW, EncryptionMethod.A192CBC_HS384);
- }
-
- @Test
- public void testJwtEncryption_ecdhAnd256cbcSpecified() throws Exception {
- assertPublicKeyBasedEncryption(ecKey.toPublicKey(), ecKey.toPrivateKey(), JWEAlgorithm.ECDH_ES,
- EncryptionMethod.A256CBC_HS512);
+ public void testJwtEncryption_ecdh128kwWithEnabledMethods() throws Exception {
+ for (final EncryptionMethod method : ENCRYPTION_METHODS) {
+ assertPublicKeyBasedEncryption(ecKey.toPublicKey(), ecKey.toPrivateKey(), JWEAlgorithm.ECDH_ES_A128KW,
+ method);
+ }
}
@Test
- public void testJwtEncryption_ecdh128kwAnd256cbcSpecified() throws Exception {
- assertPublicKeyBasedEncryption(ecKey.toPublicKey(), ecKey.toPrivateKey(), JWEAlgorithm.ECDH_ES_A128KW,
- EncryptionMethod.A256CBC_HS512);
+ public void testJwtEncryption_ecdh128kwWithExcludedMethod() throws Exception {
+ assertExcludedAlgorithm(JWEAlgorithm.ECDH_ES_A128KW, EncryptionMethod.A192CBC_HS384);
}
@Test
- public void testJwtEncryption_ecdh192kwAnd256cbcSpecified() throws Exception {
- assertPublicKeyBasedEncryption(ecKey.toPublicKey(), ecKey.toPrivateKey(), JWEAlgorithm.ECDH_ES_A192KW,
- EncryptionMethod.A256CBC_HS512);
+ public void testJwtEncryption_ecdh192kwWithEnabledMethods() throws Exception {
+ for (final EncryptionMethod method : ENCRYPTION_METHODS) {
+ assertPublicKeyBasedEncryption(ecKey.toPublicKey(), ecKey.toPrivateKey(), JWEAlgorithm.ECDH_ES_A192KW,
+ method);
+ }
}
@Test
- public void testJwtEncryption_ecdh256kwAnd256cbcSpecified() throws Exception {
- assertPublicKeyBasedEncryption(ecKey.toPublicKey(), ecKey.toPrivateKey(), JWEAlgorithm.ECDH_ES_A256KW,
- EncryptionMethod.A256CBC_HS512);
+ public void testJwtEncryption_ecdh192kwWithExcludedMethod() throws Exception {
+ assertExcludedAlgorithm(JWEAlgorithm.ECDH_ES_A192KW, EncryptionMethod.A192CBC_HS384);
}
@Test
- public void testJwtEncryption_rsa15And128cbcSpecified() throws Exception {
- assertPublicKeyBasedEncryption(rsaPublicKey, rsaPrivateKey, JWEAlgorithm.RSA1_5,
- EncryptionMethod.A128CBC_HS256);
+ public void testJwtEncryption_ecdh256kwWithEnabledMethods() throws Exception {
+ for (final EncryptionMethod method : ENCRYPTION_METHODS) {
+ assertPublicKeyBasedEncryption(ecKey.toPublicKey(), ecKey.toPrivateKey(), JWEAlgorithm.ECDH_ES_A256KW,
+ method);
+ }
}
@Test
- public void testJwtEncryption_rsaOaepAnd128cbcSpecified() throws Exception {
- assertPublicKeyBasedEncryption(rsaPublicKey, rsaPrivateKey, JWEAlgorithm.RSA_OAEP,
- EncryptionMethod.A128CBC_HS256);
+ public void testJwtEncryption_ecdh256kwWithExcludedMethod() throws Exception {
+ assertExcludedAlgorithm(JWEAlgorithm.ECDH_ES_A256KW, EncryptionMethod.A192CBC_HS384);
}
@Test
- public void testJwtEncryption_rsaOaep256And128cbcSpecified() throws Exception {
- assertPublicKeyBasedEncryption(rsaPublicKey, rsaPrivateKey, JWEAlgorithm.RSA_OAEP_256,
- EncryptionMethod.A128CBC_HS256);
+ public void testJwtEncryption_rsa15WithEnabledMethods() throws Exception {
+ for (final EncryptionMethod method : ENCRYPTION_METHODS) {
+ assertPublicKeyBasedEncryption(rsaPublicKey, rsaPrivateKey, JWEAlgorithm.RSA1_5, method);
+ }
}
@Test
- public void testJwtEncryption_rsaOaep384And128cbcSpecified() throws Exception {
- // RSA-OAEP384 is globally excluded
- assertExcludedAlgorithm(JWEAlgorithm.RSA_OAEP_384, EncryptionMethod.A128CBC_HS256);
+ public void testJwtEncryption_rsa15WithExcludedMethod() throws Exception {
+ assertExcludedAlgorithm(JWEAlgorithm.RSA1_5, EncryptionMethod.A192CBC_HS384);
}
@Test
- public void testJwtEncryption_rsaOaep512And128cbcSpecified() throws Exception {
- assertPublicKeyBasedEncryption(rsaPublicKey, rsaPrivateKey, JWEAlgorithm.RSA_OAEP_512,
- EncryptionMethod.A128CBC_HS256);
+ public void testJwtEncryption_rsaOaepWithEnabledMethods() throws Exception {
+ for (final EncryptionMethod method : ENCRYPTION_METHODS) {
+ assertPublicKeyBasedEncryption(rsaPublicKey, rsaPrivateKey, JWEAlgorithm.RSA_OAEP, method);
+ }
}
@Test
- public void testJwtEncryption_rsa15And192cbcSpecified() throws Exception {
- assertExcludedAlgorithm(JWEAlgorithm.RSA1_5, EncryptionMethod.A192CBC_HS384);
+ public void testJwtEncryption_rsaOaepWithExcludedMethod() throws Exception {
+ assertExcludedAlgorithm(JWEAlgorithm.RSA_OAEP, EncryptionMethod.A192CBC_HS384);
}
@Test
- public void testJwtEncryption_rsaOaepAnd192cbcSpecified() throws Exception {
- assertExcludedAlgorithm(JWEAlgorithm.RSA_OAEP, EncryptionMethod.A192CBC_HS384);
+ public void testJwtEncryption_rsaOaep256WithEnabledMethods() throws Exception {
+ for (final EncryptionMethod method : ENCRYPTION_METHODS) {
+ assertPublicKeyBasedEncryption(rsaPublicKey, rsaPrivateKey, JWEAlgorithm.RSA_OAEP_256, method);
+ }
}
@Test
- public void testJwtEncryption_rsaOaep256And192cbcSpecified() throws Exception {
+ public void testJwtEncryption_rsaOaep256WithExcludedMethod() throws Exception {
assertExcludedAlgorithm(JWEAlgorithm.RSA_OAEP_256, EncryptionMethod.A192CBC_HS384);
}
@Test
- public void testJwtEncryption_rsaOaep384And192cbcSpecified() throws Exception {
+ public void testJwtEncryption_rsaOaep384WithEnabledMethods() throws Exception {
// RSA-OAEP384 is globally excluded
- assertExcludedAlgorithm(JWEAlgorithm.RSA_OAEP_384, EncryptionMethod.A192CBC_HS384);
- }
-
- @Test
- public void testJwtEncryption_rsaOaep512And192cbcSpecified() throws Exception {
- assertExcludedAlgorithm(JWEAlgorithm.RSA_OAEP_512, EncryptionMethod.A192CBC_HS384);
- }
-
- @Test
- public void testJwtEncryption_rsa15And256cbcSpecified() throws Exception {
- assertPublicKeyBasedEncryption(rsaPublicKey, rsaPrivateKey, JWEAlgorithm.RSA1_5,
- EncryptionMethod.A256CBC_HS512);
- }
-
- @Test
- public void testJwtEncryption_rsaOaepAnd256cbcSpecified() throws Exception {
- assertPublicKeyBasedEncryption(rsaPublicKey, rsaPrivateKey, JWEAlgorithm.RSA_OAEP,
- EncryptionMethod.A256CBC_HS512);
+ for (final EncryptionMethod method : ENCRYPTION_METHODS) {
+ assertExcludedAlgorithm(JWEAlgorithm.RSA_OAEP_384, method);
+ }
}
@Test
- public void testJwtEncryption_rsaOaep256And256cbcSpecified() throws Exception {
- assertPublicKeyBasedEncryption(rsaPublicKey, rsaPrivateKey, JWEAlgorithm.RSA_OAEP_256,
- EncryptionMethod.A256CBC_HS512);
+ public void testJwtEncryption_rsaOaep384WithExcludedMethod() throws Exception {
+ assertExcludedAlgorithm(JWEAlgorithm.RSA_OAEP_384, EncryptionMethod.A192CBC_HS384);
}
@Test
- public void testJwtEncryption_rsaOaep384And256cbcSpecified() throws Exception {
- // RSA-OAEP384 is globally excluded
- assertExcludedAlgorithm(JWEAlgorithm.RSA_OAEP_384, EncryptionMethod.A256CBC_HS512);
+ public void testJwtEncryption_rsaOaep512WithEnabledMethods() throws Exception {
+ for (final EncryptionMethod method : ENCRYPTION_METHODS) {
+ assertPublicKeyBasedEncryption(rsaPublicKey, rsaPrivateKey, JWEAlgorithm.RSA_OAEP_512, method);
+ }
}
@Test
- public void testJwtEncryption_rsaOaep512And256cbcSpecified() throws Exception {
- assertPublicKeyBasedEncryption(rsaPublicKey, rsaPrivateKey, JWEAlgorithm.RSA_OAEP_512,
- EncryptionMethod.A256CBC_HS512);
+ public void testJwtEncryption_rsaOaep512WithExcludedMethod() throws Exception {
+ assertExcludedAlgorithm(JWEAlgorithm.RSA_OAEP_512, EncryptionMethod.A192CBC_HS384);
}
- protected void assertExcludedAlgorithm(final JWEAlgorithm jweAlgorithm, final EncryptionMethod method) {
+ protected void assertExcludedAlgorithm(final JWEAlgorithm jweAlgorithm, final EncryptionMethod method)
+ throws Exception{
if (testSignedJwt) {
- for (final JWSAlgorithm jwsAlgorithm : JWS_HMAC_ALGORITHMS) {
+ for (final JWSAlgorithm jwsAlgorithm : JWS_ALGORITHMS) {
assertNoJwtResponse(defaultClientSecret64B, rsaPublicKey, jwsAlgorithm, jweAlgorithm, method,
fetchingType);
}
@@ -476,4 +353,26 @@ public class IssuedEncryptedJWTTest extends AbstractIssuedJWTSecurityTest {
}
}
+ protected void assertNoPublicKeyResponse(final JWEAlgorithm jweAlgorithm, final EncryptionMethod method)
+ throws Exception {
+ if (testSignedJwt) {
+ for (final JWSAlgorithm jwsAlgorithm : JWS_ALGORITHMS) {
+ assertNoJwtResponse(defaultClientSecret64B, null, jwsAlgorithm, jweAlgorithm, method, fetchingType);
+ }
+ } else {
+ assertNoJwtResponse(null, null, null, jweAlgorithm, method, fetchingType);
+ }
+ }
+
+ @Test
+ public void testJwtEncryption_publicKeyEncryption_noKey() throws Exception {
+ for (final JWEAlgorithm jwe : JWE_ALGORITHMS) {
+ if (JWEAlgorithm.Family.ASYMMETRIC.contains(jwe)) {
+ for (final EncryptionMethod method : ENCRYPTION_METHODS) {
+ assertNoPublicKeyResponse(jwe, method);
+ }
+ }
+ }
+ }
+
}
diff --git a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/IssuedSignedJWTTest.java b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/IssuedSignedJWTTest.java
index 19be55ce..899e31dd 100644
--- a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/IssuedSignedJWTTest.java
+++ b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/IssuedSignedJWTTest.java
@@ -17,6 +17,10 @@
package net.shibboleth.idp.plugin.oidc.op.profile.flow;
+import java.io.IOException;
+import java.security.PublicKey;
+import java.text.ParseException;
+
import org.testng.Assert;
import org.testng.annotations.Test;
@@ -24,6 +28,8 @@ import com.nimbusds.jose.JWSAlgorithm;
import com.nimbusds.jwt.JWT;
import com.nimbusds.openid.connect.sdk.UserInfoSuccessResponse;
+import net.shibboleth.utilities.java.support.security.DataSealerException;
+
/**
* Tests for verifying that the signature on JWT issued by OP matches the expected configuration. OP may issue JWTs
* from authorize, token and userinfo endpoints, depending on the RP or resource metadata.
@@ -92,7 +98,12 @@ public class IssuedSignedJWTTest extends AbstractIssuedJWTSecurityTest {
@Test
public void testJwtSecurity_jwtES384SigAlgAndEncNotSpecified() throws Exception {
// ES384 is globally excluded
- assertNoJwtResponse(defaultClientId, defaultClientSecret, rsaPublicKey, JWSAlgorithm.ES384, null, null,
+ assertExcludedAlgorithm(defaultClientId, defaultClientSecret, rsaPublicKey, JWSAlgorithm.ES384);
+ }
+
+ protected void assertExcludedAlgorithm(final String clientId, final String clientSecret, final PublicKey publicKey,
+ final JWSAlgorithm jwsAlgorithm) throws ParseException, DataSealerException, IOException {
+ assertNoJwtResponse(clientId, clientSecret, publicKey, jwsAlgorithm, null, null,
fetchingType);
}
diff --git a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/TokenFlowTest.java b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/TokenFlowTest.java
index bb74fa16..214cff7c 100644
--- a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/TokenFlowTest.java
+++ b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/TokenFlowTest.java
@@ -523,7 +523,7 @@ public class TokenFlowTest extends AbstractOidcClientAuthenticationFlowTest {
.setRootTokenIdentifier(rootId)
.setJWTID(id)
.build();
- return new RefreshToken(rtClaims.serialize(new ValidateGrantTest().getDataSealer())).getValue();
+ return new RefreshToken(rtClaims.serialize(getDataSealer())).getValue();
}
protected String buildRefreshTokenWithSid(final String clientId, final String id, final String rootId,
@@ -536,7 +536,7 @@ public class TokenFlowTest extends AbstractOidcClientAuthenticationFlowTest {
.setJWTID(id)
.setSessionIdentifier(sid)
.build();
- return new RefreshToken(rtClaims.serialize(new ValidateGrantTest().getDataSealer())).getValue();
+ return new RefreshToken(rtClaims.serialize(getDataSealer())).getValue();
}
@Test
diff --git a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/BaseOIDCResponseActionTest.java b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/BaseOIDCResponseActionTest.java
index 20638931..1bed38c6 100644
--- a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/BaseOIDCResponseActionTest.java
+++ b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/BaseOIDCResponseActionTest.java
@@ -19,6 +19,7 @@ package net.shibboleth.idp.plugin.oidc.op.profile.impl;
import java.security.NoSuchAlgorithmException;
import java.security.SecureRandom;
+import java.time.Duration;
import java.time.Instant;
import java.util.ArrayList;
import java.util.Date;
@@ -221,6 +222,7 @@ public abstract class BaseOIDCResponseActionTest extends OpenSAMLInitBaseTestCas
strategy.setKeystorePassword("password");
strategy.setKeyAlias("secret");
strategy.setKeyPassword("password");
+ strategy.setUpdateInterval(Duration.ZERO);
strategy.initialize();
final DataSealer dataSealer = new DataSealer();
dataSealer.setKeyStrategy(strategy);
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list