[java-idp-oidc] branch main updated: JOIDC-158 - client_secret_post method is not anymore enabled by default
Henri Mikkonen
henri.mikkonen at iki.fi
Fri May 19 13:09:18 UTC 2023
This is an automated email from the git hooks/post-receive script.
hjmikkon pushed a commit to branch main
in repository java-idp-oidc.
View the commit online:
http://git.shibboleth.net/view/?p=java-idp-oidc.git;a=commit;h=4fcbdf9cb2c853567db0ff8aea136340b80c4a31
The following commit(s) were added to refs/heads/main by this push:
new 4fcbdf9c JOIDC-158 - client_secret_post method is not anymore enabled by default
4fcbdf9c is described below
commit 4fcbdf9cb2c853567db0ff8aea136340b80c4a31
Author: Henri Mikkonen <henri.mikkonen at iki.fi>
AuthorDate: Fri May 19 16:08:54 2023 +0300
JOIDC-158 - client_secret_post method is not anymore enabled by default
https://shibboleth.atlassian.net/browse/JOIDC-158
Added client_secret_post -tests for token, revocation and introspection endpoints.
They're now run against two clients: with and without MDDriven configuration.
Also switched the client_secret_basic -tests to run against both configurations.
---
.../flow/ClientCredentialsTokenFlowTest.java | 41 ++++++++++++----
.../op/profile/flow/IntrospectionFlowTest.java | 55 ++++++++++++++++------
.../oidc/op/profile/flow/RevocationFlowTest.java | 36 ++++++++++----
.../plugin/oidc/op/profile/flow/TokenFlowTest.java | 53 ++++++++++++++++-----
4 files changed, 140 insertions(+), 45 deletions(-)
diff --git a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/ClientCredentialsTokenFlowTest.java b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/ClientCredentialsTokenFlowTest.java
index 7643bb69..fce5d8f5 100644
--- a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/ClientCredentialsTokenFlowTest.java
+++ b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/ClientCredentialsTokenFlowTest.java
@@ -162,16 +162,37 @@ public class ClientCredentialsTokenFlowTest extends AbstractOidcClientAuthentica
@Test
public void testRequestedScope() throws Exception {
- setHttpFormRequest("POST", createRequestParameters(clientId, scope, resource));
- storeMetadata(storageService, clientId, clientSecret, scope);
- setBasicAuth(clientId, clientSecret);
- final FlowExecutionResult result = flowExecutor.launchExecution(FLOW_ID, null, externalContext);
- final AccessTokenResponse response = parseSuccessResponse(result, AccessTokenResponse.class);
- Assert.assertNotNull(response.getTokens().getBearerAccessToken());
- Assert.assertEquals(response.getTokens().getBearerAccessToken().getLifetime(), 600);
- Assert.assertEquals(response.getTokens().getBearerAccessToken().getScope(), scope);
- verifyClaims(null, response.getTokens().getBearerAccessToken(), clientId, scope,
- Collections.singletonList(resource), "email", "eduPersonScopedAffiliation");
+ for (final String clientId : clientIds) {
+ setHttpFormRequest("POST", createRequestParameters(clientId, scope, resource));
+ storeMetadata(storageService, clientId, clientSecret, scope);
+ setBasicAuth(clientId, clientSecret);
+ final FlowExecutionResult result = flowExecutor.launchExecution(FLOW_ID, null, externalContext);
+ final AccessTokenResponse response = parseSuccessResponse(result, AccessTokenResponse.class);
+ Assert.assertNotNull(response.getTokens().getBearerAccessToken());
+ Assert.assertEquals(response.getTokens().getBearerAccessToken().getLifetime(), 600);
+ Assert.assertEquals(response.getTokens().getBearerAccessToken().getScope(), scope);
+ verifyClaims(null, response.getTokens().getBearerAccessToken(), clientId, scope,
+ Collections.singletonList(resource), "email", "eduPersonScopedAffiliation");
+ }
+ }
+
+ @Test
+ public void testRequestedScopeWithPostAuthn() throws Exception {
+ for (final String clientId : clientIds) {
+ final Map<String, String> requestParams = createRequestParameters(clientId, scope, resource);
+ addNonNullValue(requestParams, "client_id", clientId);
+ addNonNullValue(requestParams, "client_secret", clientSecret);
+ setHttpFormRequest("POST", requestParams);
+ storeMetadata(storageService, clientId, clientSecret, scope, null,
+ ClientAuthenticationMethod.CLIENT_SECRET_POST);
+ final FlowExecutionResult result = flowExecutor.launchExecution(FLOW_ID, null, externalContext);
+ final AccessTokenResponse response = parseSuccessResponse(result, AccessTokenResponse.class);
+ Assert.assertNotNull(response.getTokens().getBearerAccessToken());
+ Assert.assertEquals(response.getTokens().getBearerAccessToken().getLifetime(), 600);
+ Assert.assertEquals(response.getTokens().getBearerAccessToken().getScope(), scope);
+ verifyClaims(null, response.getTokens().getBearerAccessToken(), clientId, scope,
+ Collections.singletonList(resource), "email", "eduPersonScopedAffiliation");
+ }
}
@Test
diff --git a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/IntrospectionFlowTest.java b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/IntrospectionFlowTest.java
index f623f88d..a34eae59 100644
--- a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/IntrospectionFlowTest.java
+++ b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/IntrospectionFlowTest.java
@@ -156,20 +156,47 @@ public class IntrospectionFlowTest extends AbstractOidcClientAuthenticationFlowT
@Test
public void testSuccess() throws IOException, NoSuchAlgorithmException, URISyntaxException, DataSealerException,
ComponentInitializationException {
- storeMetadata(storageService, clientId, clientSecret, scope);
- setBasicAuth(clientId, clientSecret);
- setHttpFormRequest("POST", Map.of(
- "token",
- buildToken(clientId, "sub", Scope.parse("openid")).toJSONObject().getAsString("access_token"),
- "token_type",
- "access_token"));
- final FlowExecutionResult result = flowExecutor.launchExecution(FLOW_ID, null, externalContext);
- final TokenIntrospectionSuccessResponse resp =
- parseSuccessResponse(result, TokenIntrospectionSuccessResponse.class);
- Assert.assertTrue(resp.isActive());
- Assert.assertEquals(resp.getClientID().getValue(), clientId);
- Assert.assertEquals(resp.getScope(), Scope.parse("openid"));
- Assert.assertNull(resp.getAudience());
+ for (final String clientId : clientIds) {
+ storeMetadata(storageService, clientId, clientSecret, scope);
+ setBasicAuth(clientId, clientSecret);
+ setHttpFormRequest("POST", Map.of(
+ "token",
+ buildToken(clientId, "sub", Scope.parse("openid")).toJSONObject().getAsString("access_token"),
+ "token_type",
+ "access_token"));
+ final FlowExecutionResult result = flowExecutor.launchExecution(FLOW_ID, null, externalContext);
+ final TokenIntrospectionSuccessResponse resp =
+ parseSuccessResponse(result, TokenIntrospectionSuccessResponse.class);
+ Assert.assertTrue(resp.isActive());
+ Assert.assertEquals(resp.getClientID().getValue(), clientId);
+ Assert.assertEquals(resp.getScope(), Scope.parse("openid"));
+ Assert.assertNull(resp.getAudience());
+ }
+ }
+
+ @Test
+ public void testSuccessWithPostAuth() throws IOException, NoSuchAlgorithmException, URISyntaxException,
+ DataSealerException, ComponentInitializationException {
+ for (final String clientId : clientIds) {
+ storeMetadata(storageService, clientId, clientSecret, scope, null,
+ ClientAuthenticationMethod.CLIENT_SECRET_POST);
+ setHttpFormRequest("POST", Map.of(
+ "token",
+ buildToken(clientId, "sub", Scope.parse("openid")).toJSONObject().getAsString("access_token"),
+ "token_type",
+ "access_token",
+ "client_id",
+ clientId,
+ "client_secret",
+ clientSecret));
+ final FlowExecutionResult result = flowExecutor.launchExecution(FLOW_ID, null, externalContext);
+ final TokenIntrospectionSuccessResponse resp =
+ parseSuccessResponse(result, TokenIntrospectionSuccessResponse.class);
+ Assert.assertTrue(resp.isActive());
+ Assert.assertEquals(resp.getClientID().getValue(), clientId);
+ Assert.assertEquals(resp.getScope(), Scope.parse("openid"));
+ Assert.assertNull(resp.getAudience());
+ }
}
@Test
diff --git a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/RevocationFlowTest.java b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/RevocationFlowTest.java
index 005b45d8..5b23e464 100644
--- a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/RevocationFlowTest.java
+++ b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/RevocationFlowTest.java
@@ -125,14 +125,34 @@ public class RevocationFlowTest extends AbstractOidcClientAuthenticationFlowTest
DataSealerException, ComponentInitializationException {
final String id = idGenerator.generateIdentifier();
final String rootId = idGenerator.generateIdentifier();
- setBasicAuth(clientId, clientSecret);
- storeMetadata(storageService, clientId, clientSecret, scope);
- setHttpFormRequest("POST", Collections.singletonMap("token", super.buildToken(clientId, "sub",
- Scope.parse("openid"), null, id, rootId).toJSONObject().getAsString("access_token")));
- final FlowExecutionResult result = flowExecutor.launchExecution(FLOW_ID, null, externalContext);
- parseSuccessResponse(result, OAuth2RevocationSuccessResponse.class);
- Assert.assertFalse(revocationCache.isRevoked(RevocationCacheContexts.SINGLE_ACCESS_OR_REFRESH_TOKENS, id));
- Assert.assertTrue(revocationCache.isRevoked(RevocationCacheContexts.AUTHORIZATION_CODE, rootId));
+ for (final String clientId : clientIds) {
+ setBasicAuth(clientId, clientSecret);
+ storeMetadata(storageService, clientId, clientSecret, scope);
+ setHttpFormRequest("POST", Collections.singletonMap("token", super.buildToken(clientId, "sub",
+ Scope.parse("openid"), null, id, rootId).toJSONObject().getAsString("access_token")));
+ final FlowExecutionResult result = flowExecutor.launchExecution(FLOW_ID, null, externalContext);
+ parseSuccessResponse(result, OAuth2RevocationSuccessResponse.class);
+ Assert.assertFalse(revocationCache.isRevoked(RevocationCacheContexts.SINGLE_ACCESS_OR_REFRESH_TOKENS, id));
+ Assert.assertTrue(revocationCache.isRevoked(RevocationCacheContexts.AUTHORIZATION_CODE, rootId));
+ }
+ }
+
+ @Test
+ public void testSuccessWithPostAuthn() throws IOException, NoSuchAlgorithmException, URISyntaxException,
+ DataSealerException, ComponentInitializationException {
+ final String id = idGenerator.generateIdentifier();
+ final String rootId = idGenerator.generateIdentifier();
+ for (final String clientId : clientIds) {
+ storeMetadata(storageService, clientId, clientSecret, scope, null,
+ ClientAuthenticationMethod.CLIENT_SECRET_POST);
+ setHttpFormRequest("POST", Map.of("token", buildToken(clientId, "sub", Scope.parse("openid"), null, id,
+ rootId).toJSONObject().getAsString("access_token"),
+ "client_id", clientId, "client_secret", clientSecret));
+ final FlowExecutionResult result = flowExecutor.launchExecution(FLOW_ID, null, externalContext);
+ parseSuccessResponse(result, OAuth2RevocationSuccessResponse.class);
+ Assert.assertFalse(revocationCache.isRevoked(RevocationCacheContexts.SINGLE_ACCESS_OR_REFRESH_TOKENS, id));
+ Assert.assertTrue(revocationCache.isRevoked(RevocationCacheContexts.AUTHORIZATION_CODE, rootId));
+ }
}
@Test
diff --git a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/TokenFlowTest.java b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/TokenFlowTest.java
index db9fc492..4c6a33a8 100644
--- a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/TokenFlowTest.java
+++ b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/TokenFlowTest.java
@@ -220,18 +220,39 @@ public class TokenFlowTest extends AbstractOidcClientAuthenticationFlowTest {
@Test
public void testValidGrant() throws Exception {
- initializeGrantAndRequest(clientId, createRequestParameters(redirectUri, "authorization_code",
- buildAuthorizationCode(clientId), clientId));
- storeConsent(storageService, "jdoe", clientId, "mail");
- final FlowExecutionResult result = flowExecutor.launchExecution(FLOW_ID, null, externalContext);
- final OIDCTokenResponse response = parseSuccessResponse(result, OIDCTokenResponse.class);
- Assert.assertNotNull(response.getTokens().getAccessToken());
- Assert.assertNotNull(response.getTokens().getRefreshToken());
- Assert.assertNotNull(response.getOIDCTokens().getIDToken());
- Assert.assertNotNull(response.getOIDCTokens().getIDToken().getJWTClaimsSet().getClaim("at_hash"));
- Assert.assertNull(getSidFromAccessToken(response.getTokens().getAccessToken()));
- Assert.assertNull(getSidFromRefreshToken(response.getTokens().getRefreshToken()));
- Assert.assertNull(getSidFromJWT(response.getOIDCTokens().getIDToken()));
+ for (final String clientId : clientIds) {
+ initializeGrantAndRequest(clientId, createRequestParameters(redirectUri, "authorization_code",
+ buildAuthorizationCode(clientId), clientId));
+ storeConsent(storageService, "jdoe", clientId, "mail");
+ final FlowExecutionResult result = flowExecutor.launchExecution(FLOW_ID, null, externalContext);
+ final OIDCTokenResponse response = parseSuccessResponse(result, OIDCTokenResponse.class);
+ Assert.assertNotNull(response.getTokens().getAccessToken());
+ Assert.assertNotNull(response.getTokens().getRefreshToken());
+ Assert.assertNotNull(response.getOIDCTokens().getIDToken());
+ Assert.assertNotNull(response.getOIDCTokens().getIDToken().getJWTClaimsSet().getClaim("at_hash"));
+ Assert.assertNull(getSidFromAccessToken(response.getTokens().getAccessToken()));
+ Assert.assertNull(getSidFromRefreshToken(response.getTokens().getRefreshToken()));
+ Assert.assertNull(getSidFromJWT(response.getOIDCTokens().getIDToken()));
+ }
+ }
+
+ @Test
+ public void testValidGrantWithPostAuthn() throws Exception {
+ for (final String clientId : clientIds) {
+ initializeGrantAndRequest(clientId, createRequestParameters(redirectUri, "authorization_code",
+ buildAuthorizationCode(clientId), clientId, clientSecret), false,
+ ClientAuthenticationMethod.CLIENT_SECRET_POST);
+ storeConsent(storageService, "jdoe", clientId, "mail");
+ final FlowExecutionResult result = flowExecutor.launchExecution(FLOW_ID, null, externalContext);
+ final OIDCTokenResponse response = parseSuccessResponse(result, OIDCTokenResponse.class);
+ Assert.assertNotNull(response.getTokens().getAccessToken());
+ Assert.assertNotNull(response.getTokens().getRefreshToken());
+ Assert.assertNotNull(response.getOIDCTokens().getIDToken());
+ Assert.assertNotNull(response.getOIDCTokens().getIDToken().getJWTClaimsSet().getClaim("at_hash"));
+ Assert.assertNull(getSidFromAccessToken(response.getTokens().getAccessToken()));
+ Assert.assertNull(getSidFromRefreshToken(response.getTokens().getRefreshToken()));
+ Assert.assertNull(getSidFromJWT(response.getOIDCTokens().getIDToken()));
+ }
}
@Test
@@ -1154,6 +1175,11 @@ public class TokenFlowTest extends AbstractOidcClientAuthenticationFlowTest {
protected static Map<String, String> createRequestParameters(final String redirectUri, final String grantType,
final String code, final String clientId) {
+ return createRequestParameters(redirectUri, grantType, code, clientId, null);
+ }
+
+ protected static Map<String, String> createRequestParameters(final String redirectUri, final String grantType,
+ final String code, final String clientId, final String clientSecret) {
final Map<String, String> parameters = new HashMap<>();
addNonNullValue(parameters, "redirect_uri", redirectUri);
addNonNullValue(parameters, "grant_type", grantType);
@@ -1163,9 +1189,10 @@ public class TokenFlowTest extends AbstractOidcClientAuthenticationFlowTest {
addNonNullValue(parameters, "code", code);
}
addNonNullValue(parameters, "client_id", clientId);
+ addNonNullValue(parameters, "client_secret", clientSecret);
return parameters;
}
-
+
protected static Map<String, String> createRequestParameters(final String redirectUri, final String grantType,
final String code, final String clientId, final String codeChallenge, final String codeChallengeMethod,
final String codeVerifier) {
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list