[java-idp-oidc] branch main updated: JOIDC-194 - Logging improvements for message tracing
Henri Mikkonen
henri.mikkonen at iki.fi
Wed Apr 3 07:33:26 UTC 2024
This is an automated email from the git hooks/post-receive script.
hjmikkon pushed a commit to branch main
in repository java-idp-oidc.
View the commit online:
http://git.shibboleth.net/view/?p=java-idp-oidc.git;a=commit;h=f5426492ca21f3dfdf8e9093a010be6a8d3a5868
The following commit(s) were added to refs/heads/main by this push:
new f5426492 JOIDC-194 - Logging improvements for message tracing
f5426492 is described below
commit f5426492ca21f3dfdf8e9093a010be6a8d3a5868
Author: Henri Mikkonen <henri.mikkonen at iki.fi>
AuthorDate: Wed Apr 3 10:30:52 2024 +0300
JOIDC-194 - Logging improvements for message tracing
https://shibboleth.atlassian.net/browse/JOIDC-194
Included JWT access token and ID token payload contents into
protocol messages on TRACE.
The Jackson object mapper bean defined in idp.oidc.logging.objectMapper is used
for pretty printing the JSON contents, defaulting to shibboleth.oidc.JSONObjectMapper.
---
.../plugin/oidc/op/encoding/impl/ResponseUtil.java | 68 ++++++++++++++++++++++
.../op/oauth2/profile/impl/BuildAccessToken.java | 34 ++++++++++-
.../profile/impl/ManipulateClaimsForIDToken.java | 57 +++++++++++++++++-
.../idp/flows/oidc/authorize/authorize-beans.xml | 9 ++-
.../idp/flows/oidc/token/token-beans.xml | 9 ++-
.../oauth2/profile/impl/BuildAccessTokenTest.java | 2 +
.../impl/ManipulateClaimsForIDTokenTest.java | 2 +
7 files changed, 173 insertions(+), 8 deletions(-)
diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/encoding/impl/ResponseUtil.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/encoding/impl/ResponseUtil.java
index bb77eac4..9b276762 100644
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/encoding/impl/ResponseUtil.java
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/encoding/impl/ResponseUtil.java
@@ -14,6 +14,7 @@
package net.shibboleth.idp.plugin.oidc.op.encoding.impl;
+import java.text.ParseException;
import java.util.Collection;
import java.util.List;
import java.util.Map;
@@ -25,6 +26,8 @@ import javax.annotation.Nullable;
import com.fasterxml.jackson.core.JsonProcessingException;
import com.fasterxml.jackson.databind.ObjectMapper;
import com.google.common.base.MoreObjects;
+import com.nimbusds.jwt.JWT;
+import com.nimbusds.jwt.JWTClaimsSet;
import com.nimbusds.oauth2.sdk.AccessTokenResponse;
import com.nimbusds.oauth2.sdk.AuthorizationErrorResponse;
import com.nimbusds.oauth2.sdk.AuthorizationResponse;
@@ -48,6 +51,7 @@ import com.nimbusds.openid.connect.sdk.AuthenticationSuccessResponse;
import com.nimbusds.openid.connect.sdk.UserInfoErrorResponse;
import com.nimbusds.openid.connect.sdk.UserInfoResponse;
import com.nimbusds.openid.connect.sdk.UserInfoSuccessResponse;
+import com.nimbusds.openid.connect.sdk.claims.IDTokenClaimsSet;
import com.nimbusds.openid.connect.sdk.rp.OIDCClientInformationResponse;
import com.nimbusds.openid.connect.sdk.token.OIDCTokens;
@@ -447,4 +451,68 @@ public final class ResponseUtil {
return null;
}
+ /**
+ * Helper method for getting protocol message for JWT payload.
+ *
+ * @param jwt The JWT whose payload is included in the message
+ * @param objectMapper object mapper used for pretty printing JSON content
+ * @return The protocol message containing JWT payload
+ * @throws ParseException IF the protocol message cannot be constructed
+ *
+ * @since 4.1.0
+ */
+ @Nonnull public static String getJwtProtocolMessage(@Nonnull final JWT jwt,
+ @Nonnull final ObjectMapper objectMapper) throws ParseException {
+ return getJwtProtocolMessage(jwt.getJWTClaimsSet(), objectMapper);
+ }
+
+ /**
+ * Helper method for getting protocol message for ID token payload.
+ *
+ * @param idToken The ID token whose payload is included in the message
+ * @param objectMapper object mapper used for pretty printing JSON content
+ * @return The protocol message containing JWT payload
+ * @throws ParseException IF the protocol message cannot be constructed
+ *
+ * @since 4.1.0
+ */
+ @Nonnull public static String getIdTokenProtocolMessage(@Nonnull final IDTokenClaimsSet idToken,
+ @Nonnull final ObjectMapper objectMapper) throws ParseException {
+ try {
+ return getJwtProtocolMessage(idToken.toJWTClaimsSet(), objectMapper);
+ } catch (final com.nimbusds.oauth2.sdk.ParseException e) {
+ final Throwable cause = e.getCause();
+ if (cause instanceof ParseException parseException) {
+ throw parseException;
+ }
+ throw new ParseException(e.getMessage(), 0);
+ }
+ }
+
+ /**
+ * Helper method for getting protocol message for JWT payload.
+ *
+ * @param claimsSet The claims set to be included in the message
+ * @param objectMapper object mapper used for pretty printing JSON content
+ * @return The protocol message containing JWT payload
+ * @throws ParseException IF the protocol message cannot be constructed
+ *
+ * @since 4.1.0
+ */
+ @Nonnull public static String getJwtProtocolMessage(@Nullable final JWTClaimsSet claimsSet,
+ @Nonnull final ObjectMapper objectMapper) throws ParseException {
+ if (claimsSet == null) {
+ return "<encrypted>";
+ }
+ try {
+ final Object jsonObject = objectMapper.readValue(claimsSet.toString(), Object.class);
+ final String content = objectMapper.writerWithDefaultPrettyPrinter().writeValueAsString(jsonObject);
+ if (content != null) {
+ return content;
+ }
+ } catch (final JsonProcessingException e) {
+ }
+ throw new ParseException("Could not parse the JSON output from the claims set", 0);
+ }
+
}
diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oauth2/profile/impl/BuildAccessToken.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oauth2/profile/impl/BuildAccessToken.java
index 76c5e013..d8c953d5 100644
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oauth2/profile/impl/BuildAccessToken.java
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oauth2/profile/impl/BuildAccessToken.java
@@ -32,6 +32,8 @@ import org.opensaml.profile.context.navigate.InboundMessageContextLookup;
import org.opensaml.profile.context.navigate.OutboundMessageContextLookup;
import org.slf4j.Logger;
+import com.fasterxml.jackson.databind.ObjectMapper;
+import com.nimbusds.jwt.JWT;
import com.nimbusds.jwt.JWTClaimsSet;
import com.nimbusds.jwt.PlainJWT;
import com.nimbusds.oauth2.sdk.Scope;
@@ -42,6 +44,7 @@ import com.nimbusds.openid.connect.sdk.claims.ClaimsSet;
import net.minidev.json.JSONArray;
import net.minidev.json.JSONObject;
import net.shibboleth.idp.authn.context.SubjectContext;
+import net.shibboleth.idp.plugin.oidc.op.encoding.impl.ResponseUtil;
import net.shibboleth.idp.plugin.oidc.op.messaging.context.AccessTokenContext;
import net.shibboleth.idp.plugin.oidc.op.messaging.context.OIDCAuthenticationResponseConsentContext;
import net.shibboleth.idp.plugin.oidc.op.messaging.context.OIDCAuthenticationResponseContext;
@@ -72,6 +75,7 @@ import net.shibboleth.shared.security.IdentifierGenerationStrategy;
import net.shibboleth.shared.security.impl.SecureRandomIdentifierGenerationStrategy;
import org.opensaml.messaging.context.navigate.ChildContextLookup;
+import org.opensaml.messaging.encoder.AbstractMessageEncoder;
import org.opensaml.profile.action.ActionSupport;
/**
@@ -100,6 +104,10 @@ public class BuildAccessToken extends AbstractOIDCResponseAction {
/** Class logger. */
@Nonnull private Logger log = LoggerFactory.getLogger(BuildAccessToken.class);
+ /** Used to log protocol messages. */
+ @Nonnull private Logger protocolMessageLog =
+ LoggerFactory.getLogger(AbstractMessageEncoder.BASE_PROTOCOL_MESSAGE_LOGGER_CATEGORY + ".OAUTH2");
+
/** Sealer to use for opaque tokens. */
@NonnullAfterInit private DataSealer dataSealer;
@@ -140,6 +148,9 @@ public class BuildAccessToken extends AbstractOIDCResponseAction {
/** The strategy used for manipulating the token claims set. */
@Nullable private BiFunction<ProfileRequestContext,Map<String,Object>,Map<String,Object>> manipulationStrategy;
+ /** Object mapper used for pretty-printing JWT contents. */
+ @NonnullAfterInit private ObjectMapper objectMapper;
+
/** Authorize Code / Refresh Token the access token is based on, if any. */
@Nullable private TokenClaimsSet tokenClaimsSet;
@@ -334,6 +345,18 @@ public class BuildAccessToken extends AbstractOIDCResponseAction {
Constraint.isNotNull(strategy, "Manipulation strategy lookup strategy cannot be null");
}
+ /**
+ * Set the object mapper used for pretty-printing JWT contents.
+ *
+ * @param mapper What to set.
+ *
+ * @since 4.1.0
+ */
+ public void setObjectMapper(@Nonnull final ObjectMapper mapper) {
+ checkSetterPreconditions();
+ objectMapper = Constraint.isNotNull(mapper, "Object mapper cannot be null");
+ }
+
/**
* Set the xmlSafe-flag passed to the identifier generator
*
@@ -353,6 +376,9 @@ public class BuildAccessToken extends AbstractOIDCResponseAction {
if (dataSealer == null) {
throw new ComponentInitializationException("DataSealer cannot be null");
}
+ if (objectMapper == null) {
+ throw new ComponentInitializationException("Object mapper cannot be null");
+ }
}
// Checkstyle: CyclomaticComplexity|MethodLength OFF
@@ -581,8 +607,14 @@ public class BuildAccessToken extends AbstractOIDCResponseAction {
if (jwtTokenType) {
final JWTClaimsSet acClaimsSet = claimsSet.getClaimsSet();
assert acClaimsSet != null;
+ final JWT jwt = new PlainJWT(sealClaims(acClaimsSet));
assert accessTokenCtx != null;
- accessTokenCtx.setJWT(new PlainJWT(sealClaims(acClaimsSet)));
+ accessTokenCtx.setJWT(jwt);
+
+ assert objectMapper != null;
+ protocolMessageLog.trace("Access token payload contents:\n{}", ResponseUtil.getJwtProtocolMessage(jwt,
+ objectMapper));
+
log.debug("{} Claims stored to JWT access token: {}", getLogPrefix(), claimsSet.serialize());
} else {
assert dataSealer != null;
diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/ManipulateClaimsForIDToken.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/ManipulateClaimsForIDToken.java
index 244add20..12e62534 100644
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/ManipulateClaimsForIDToken.java
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/ManipulateClaimsForIDToken.java
@@ -21,17 +21,22 @@ import java.util.function.Function;
import javax.annotation.Nonnull;
+import org.opensaml.messaging.encoder.AbstractMessageEncoder;
import org.opensaml.profile.action.ActionSupport;
import org.opensaml.profile.action.EventIds;
import org.opensaml.profile.context.ProfileRequestContext;
import org.slf4j.Logger;
+import com.fasterxml.jackson.databind.ObjectMapper;
import com.nimbusds.jwt.JWTClaimsSet;
import com.nimbusds.openid.connect.sdk.claims.IDTokenClaimsSet;
+import net.shibboleth.idp.plugin.oidc.op.encoding.impl.ResponseUtil;
import net.shibboleth.idp.plugin.oidc.op.messaging.context.OIDCAuthenticationResponseContext;
import net.shibboleth.idp.profile.IdPEventIds;
import net.shibboleth.oidc.profile.config.navigate.IDTokenManipulationStrategyLookupFunction;
+import net.shibboleth.shared.annotation.constraint.NonnullAfterInit;
+import net.shibboleth.shared.component.ComponentInitializationException;
import net.shibboleth.shared.logic.Constraint;
import net.shibboleth.shared.primitive.LoggerFactory;
@@ -50,6 +55,10 @@ public class ManipulateClaimsForIDToken extends AbstractOIDCAuthenticationRespon
/** Class logger. */
@Nonnull private Logger log = LoggerFactory.getLogger(ManipulateClaimsForIDToken.class);
+ /** Used to log protocol messages. */
+ @Nonnull private Logger protocolMessageLog =
+ LoggerFactory.getLogger(AbstractMessageEncoder.BASE_PROTOCOL_MESSAGE_LOGGER_CATEGORY + ".OIDC");
+
/** Lookup function to supply strategy bi-function for manipulating id_token claims. */
@Nonnull
private Function<ProfileRequestContext,BiFunction<ProfileRequestContext,Map<String,Object>,Map<String,Object>>>
@@ -58,6 +67,9 @@ public class ManipulateClaimsForIDToken extends AbstractOIDCAuthenticationRespon
/** The strategy used for manipulating the id_token. */
private BiFunction<ProfileRequestContext,Map<String,Object>,Map<String,Object>> manipulationStrategy;
+ /** Object mapper used for pretty-printing JWT contents. */
+ @NonnullAfterInit private ObjectMapper objectMapper;
+
/** The id_token to operate on. */
private IDTokenClaimsSet idToken;
@@ -82,6 +94,28 @@ public class ManipulateClaimsForIDToken extends AbstractOIDCAuthenticationRespon
Constraint.isNotNull(strategy, "IDToken manipulation strategy lookup strategy cannot be null");
}
+ /**
+ * Set the object mapper used for pretty-printing JWT contents.
+ *
+ * @param mapper What to set.
+ *
+ * @since 4.1.0
+ */
+ public void setObjectMapper(@Nonnull final ObjectMapper mapper) {
+ checkSetterPreconditions();
+ objectMapper = Constraint.isNotNull(mapper, "Object mapper cannot be null");
+ }
+
+ /** {@inheritDoc} */
+ @Override
+ protected void doInitialize() throws ComponentInitializationException {
+ super.doInitialize();
+
+ if (objectMapper == null) {
+ throw new ComponentInitializationException("Object mapper cannot be null");
+ }
+ }
+
/** {@inheritDoc} */
@Override
protected boolean doPreExecute(@Nonnull final ProfileRequestContext profileRequestContext) {
@@ -97,10 +131,11 @@ public class ManipulateClaimsForIDToken extends AbstractOIDCAuthenticationRespon
ActionSupport.buildEvent(profileRequestContext, EventIds.INVALID_MSG_CTX);
return false;
}
-
manipulationStrategy = idTokenManipulationStrategyLookupStrategy.apply(profileRequestContext);
if (manipulationStrategy == null) {
log.debug("{} No manipulation strategy resolved, nothing to do.", getLogPrefix());
+ assert idToken != null;
+ doProtocolLog(profileRequestContext, idToken);
return false;
}
@@ -113,6 +148,8 @@ public class ManipulateClaimsForIDToken extends AbstractOIDCAuthenticationRespon
final Map<String, Object> result = manipulationStrategy.apply(profileRequestContext, idToken.toJSONObject());
if (result == null) {
log.debug("{} Manipulation strategy retruned null, leaving id_token claims untouched.", getLogPrefix());
+ assert idToken != null;
+ doProtocolLog(profileRequestContext, idToken);
return;
}
log.debug("{} Applying the manipulated claims into the id_token", getLogPrefix());
@@ -128,6 +165,24 @@ public class ManipulateClaimsForIDToken extends AbstractOIDCAuthenticationRespon
final OIDCAuthenticationResponseContext oidcResponseContext = getOidcResponseContext();
assert oidcResponseContext != null;
oidcResponseContext.setIDToken(newIdToken);
+ doProtocolLog(profileRequestContext, newIdToken);
}
+ /**
+ * Create a protocol message containing the pretty-printed contents of the given claims set.
+ *
+ * @param profileRequestContext Profile request context where to publish possible error event
+ * @param claimsSet The claims set to be logged
+ */
+ protected void doProtocolLog(@Nonnull final ProfileRequestContext profileRequestContext,
+ @Nonnull final IDTokenClaimsSet claimsSet) {
+ try {
+ assert objectMapper != null;
+ protocolMessageLog.trace("ID Token payload contents\n:{}",
+ ResponseUtil.getIdTokenProtocolMessage(claimsSet, objectMapper));
+ } catch (ParseException e) {
+ log.error("{} Could not produce the protocol logger message", getLogPrefix(), e);
+ ActionSupport.buildEvent(profileRequestContext, IdPEventIds.INVALID_PROFILE_CONFIG);
+ }
+ }
}
diff --git a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/authorize/authorize-beans.xml b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/authorize/authorize-beans.xml
index 4f7b51f0..e343b556 100644
--- a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/authorize/authorize-beans.xml
+++ b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/authorize/authorize-beans.xml
@@ -566,7 +566,8 @@
p:dataSealer="#{getObject('%{idp.oidc.tokenSealer:shibboleth.oidc.TokenSealer}'.trim())}"
p:clientIDLookupStrategy-ref="RequestClientIDLookup"
p:xmlSafeIdentifier="%{idp.oidc.xmlSafeIdentifiers:true}"
- p:identifierGeneratorLookupStrategy-ref="shibboleth.oidc.DefaultIdentifierGenerationStrategy" />
+ p:identifierGeneratorLookupStrategy-ref="shibboleth.oidc.DefaultIdentifierGenerationStrategy"
+ p:objectMapper-ref="#{'%{idp.oidc.logging.objectMapper:shibboleth.oidc.JSONObjectMapper}'.trim()}" />
<bean id="RequestClientIDLookup" parent="shibboleth.Functions.Compose"
c:g-ref="shibboleth.ClientIDLookupStrategy"
@@ -688,7 +689,8 @@
p:accessTokenTypeLookupStrategy-ref="AccessTokenTypeLookupFunction"
p:accessTokenLifetimeLookupStrategy-ref="AccessTokenLifetimeLookupFunction"
p:xmlSafeIdentifier="%{idp.oidc.xmlSafeIdentifiers:true}"
- p:identifierGeneratorLookupStrategy-ref="shibboleth.oidc.DefaultIdentifierGenerationStrategy" />
+ p:identifierGeneratorLookupStrategy-ref="shibboleth.oidc.DefaultIdentifierGenerationStrategy"
+ p:objectMapper-ref="#{'%{idp.oidc.logging.objectMapper:shibboleth.oidc.JSONObjectMapper}'.trim()}" />
<bean id="AccessTokenTypeLookupFunction"
class="net.shibboleth.oidc.profile.config.navigate.AccessTokenTypeLookupFunction"
@@ -848,7 +850,8 @@
</bean>
<bean id="ManipulateClaimsForIDToken"
- class="net.shibboleth.idp.plugin.oidc.op.profile.impl.ManipulateClaimsForIDToken" scope="prototype" />
+ class="net.shibboleth.idp.plugin.oidc.op.profile.impl.ManipulateClaimsForIDToken" scope="prototype"
+ p:objectMapper-ref="#{'%{idp.oidc.logging.objectMapper:shibboleth.oidc.JSONObjectMapper}'.trim()}" />
<bean id="SignIDToken" class="net.shibboleth.idp.profile.impl.WebFlowMessageHandlerAdaptor"
scope="prototype" c:executionDirection="OUTBOUND ">
diff --git a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/token/token-beans.xml b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/token/token-beans.xml
index 48370dfb..a790ab8b 100644
--- a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/token/token-beans.xml
+++ b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/token/token-beans.xml
@@ -369,7 +369,8 @@
class="net.shibboleth.idp.plugin.oidc.op.oauth2.profile.impl.BuildAccessToken" scope="prototype"
p:dataSealer="#{getObject('%{idp.oidc.tokenSealer:shibboleth.oidc.TokenSealer}'.trim())}"
p:xmlSafeIdentifier="%{idp.oidc.xmlSafeIdentifiers:true}"
- p:identifierGeneratorLookupStrategy-ref="shibboleth.oidc.DefaultIdentifierGenerationStrategy" />
+ p:identifierGeneratorLookupStrategy-ref="shibboleth.oidc.DefaultIdentifierGenerationStrategy"
+ p:objectMapper-ref="#{'%{idp.oidc.logging.objectMapper:shibboleth.oidc.JSONObjectMapper}'.trim()}" />
<bean id="SignOIDCAccessToken" class="net.shibboleth.idp.profile.impl.WebFlowMessageHandlerAdaptor"
scope="prototype" c:executionDirection="OUTBOUND">
@@ -596,7 +597,8 @@
</bean>
<bean id="ManipulateClaimsForIDToken"
- class="net.shibboleth.idp.plugin.oidc.op.profile.impl.ManipulateClaimsForIDToken" scope="prototype" />
+ class="net.shibboleth.idp.plugin.oidc.op.profile.impl.ManipulateClaimsForIDToken" scope="prototype"
+ p:objectMapper-ref="#{'%{idp.oidc.logging.objectMapper:shibboleth.oidc.JSONObjectMapper}'.trim()}" />
<bean id="SignIDToken" class="net.shibboleth.idp.profile.impl.WebFlowMessageHandlerAdaptor"
scope="prototype" c:executionDirection="OUTBOUND">
@@ -745,7 +747,8 @@
p:accessTokenTypeLookupStrategy-ref="AccessTokenTypeLookupFunction"
p:accessTokenLifetimeLookupStrategy-ref="AccessTokenLifetimeLookupFunction"
p:xmlSafeIdentifier="%{idp.oidc.xmlSafeIdentifiers:true}"
- p:identifierGeneratorLookupStrategy-ref="shibboleth.oidc.DefaultIdentifierGenerationStrategy" />
+ p:identifierGeneratorLookupStrategy-ref="shibboleth.oidc.DefaultIdentifierGenerationStrategy"
+ p:objectMapper-ref="#{'%{idp.oidc.logging.objectMapper:shibboleth.oidc.JSONObjectMapper}'.trim()}" />
<bean id="AccessTokenTypeLookupFunction"
class="net.shibboleth.oidc.profile.config.navigate.AccessTokenTypeLookupFunction"
diff --git a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/oauth2/profile/impl/BuildAccessTokenTest.java b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/oauth2/profile/impl/BuildAccessTokenTest.java
index 3a576248..a4bacfa3 100644
--- a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/oauth2/profile/impl/BuildAccessTokenTest.java
+++ b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/oauth2/profile/impl/BuildAccessTokenTest.java
@@ -50,6 +50,7 @@ import org.testng.Assert;
import org.testng.annotations.BeforeMethod;
import org.testng.annotations.Test;
+import com.fasterxml.jackson.databind.ObjectMapper;
import com.nimbusds.jwt.JWT;
import com.nimbusds.jwt.JWTClaimsSet;
import com.nimbusds.oauth2.sdk.Scope;
@@ -77,6 +78,7 @@ public class BuildAccessTokenTest extends BaseOIDCResponseActionTest {
respCtx.getAudience().add("https://rp.example.org");
action = new BuildAccessToken();
+ action.setObjectMapper(new ObjectMapper());
}
/**
diff --git a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/ManipulateClaimsForIDTokenTest.java b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/ManipulateClaimsForIDTokenTest.java
index ff942111..0b825ffc 100644
--- a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/ManipulateClaimsForIDTokenTest.java
+++ b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/ManipulateClaimsForIDTokenTest.java
@@ -26,6 +26,7 @@ import org.springframework.webflow.execution.Event;
import org.testng.Assert;
import org.testng.annotations.Test;
+import com.fasterxml.jackson.databind.ObjectMapper;
import com.nimbusds.oauth2.sdk.ParseException;
import com.nimbusds.oauth2.sdk.id.Audience;
import com.nimbusds.openid.connect.sdk.claims.AMR;
@@ -48,6 +49,7 @@ public class ManipulateClaimsForIDTokenTest extends BaseOIDCResponseActionTest {
private void init(final BiFunction<ProfileRequestContext,Map<String,Object>,Map<String,Object>> strategy)
throws ComponentInitializationException {
action = new ManipulateClaimsForIDToken();
+ action.setObjectMapper(new ObjectMapper());
action.initialize();
final DefaultOIDCAuthorizationConfiguration config = new DefaultOIDCAuthorizationConfiguration();
config.setIDTokenManipulationStrategy(strategy);
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list