[java-idp-oidc] 01/02: JCOMOIDC-115 - Update Nimbus oauth2-oidc-sdk into 10.15
Henri Mikkonen
henri.mikkonen at iki.fi
Fri Aug 30 16:50:06 UTC 2024
This is an automated email from the git hooks/post-receive script.
hjmikkon pushed a commit to branch main
in repository java-idp-oidc.
View the commit online:
http://git.shibboleth.net/view/?p=java-idp-oidc.git;a=commit;h=892716b090cacc659ecd5ccbad7bd7c481569e4b
commit 892716b090cacc659ecd5ccbad7bd7c481569e4b
Author: Henri Mikkonen <henri.mikkonen at iki.fi>
AuthorDate: Fri Aug 30 19:06:47 2024 +0300
JCOMOIDC-115 - Update Nimbus oauth2-oidc-sdk into 10.15
https://shibboleth.atlassian.net/browse/JCOMOIDC-115
- Reverted the Nimbus v11 changes regarding HTTPRequest/HTTPResponse
- Updated CustomResourceHttpServletRequestWrapper to tackle customized resource parameter with POST
- Handle 'dpop_bound_access_tokens' flag on metadata via custom fields (Nimbus v11+ has the specific method)
---
.../oidc/op/messaging/JSONErrorResponse.java | 2 +-
.../oidc/op/messaging/JSONSuccessResponse.java | 2 +-
.../oidc/op/messaging/JSONErrorResponseTest.java | 4 ++--
.../oidc/op/messaging/JSONSuccessResponseTest.java | 4 ++--
.../impl/OIDCAuthenticationRequestDecoder.java | 4 ++--
.../impl/OIDCClientRegistrationRequestDecoder.java | 6 +++---
.../plugin/oidc/op/decoding/impl/RequestUtil.java | 4 ++--
.../plugin/oidc/op/encoding/impl/ResponseUtil.java | 2 +-
.../decoding/impl/BaseOAuth2RequestDecoder.java | 4 ++--
.../CustomResourceHttpServletRequestWrapper.java | 14 ++++++++++++-
.../impl/OAuth2AuthorizationRequestDecoder.java | 4 ++--
.../impl/AddRemainingClaimsToClientMetadata.java | 5 ++++-
.../idp/flows/oidc/token/token-beans.xml | 2 +-
.../impl/OIDCAuthenticationRequestDecoderTest.java | 24 ++++++++++++++++++++++
.../decoding/impl/OIDCTokenRequestDecoderTest.java | 12 +++--------
.../OAuth2AuthorizationRequestDecoderTest.java | 24 ++++++++++++++++++++++
.../op/profile/flow/ConfigurationFlowTest.java | 2 +-
.../oidc/op/profile/flow/KeySetFlowTest.java | 2 +-
.../oidc/op/profile/flow/RegistrationFlowTest.java | 4 ++--
.../plugin/oidc/op/profile/flow/TokenFlowTest.java | 2 +-
.../impl/FormOutboundDiscoveryResponseTest.java | 4 ++--
pom.xml | 4 ++--
22 files changed, 96 insertions(+), 39 deletions(-)
diff --git a/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/messaging/JSONErrorResponse.java b/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/messaging/JSONErrorResponse.java
index 56bc3009..afa55a85 100644
--- a/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/messaging/JSONErrorResponse.java
+++ b/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/messaging/JSONErrorResponse.java
@@ -98,7 +98,7 @@ public class JSONErrorResponse implements ErrorResponse {
if (pragma != null) {
httpResponse.setPragma(pragma);
}
- httpResponse.setBody(getContent());
+ httpResponse.setContent(getContent());
return httpResponse;
}
diff --git a/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/messaging/JSONSuccessResponse.java b/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/messaging/JSONSuccessResponse.java
index 200d0b22..2cdfd317 100644
--- a/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/messaging/JSONSuccessResponse.java
+++ b/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/messaging/JSONSuccessResponse.java
@@ -89,7 +89,7 @@ public class JSONSuccessResponse implements SuccessResponse {
if (pragma != null) {
httpResponse.setPragma(pragma);
}
- httpResponse.setBody(content.toJSONString());
+ httpResponse.setContent(content.toJSONString());
return httpResponse;
}
}
diff --git a/idp-oidc-extension-api/src/test/java/net/shibboleth/idp/plugin/oidc/op/messaging/JSONErrorResponseTest.java b/idp-oidc-extension-api/src/test/java/net/shibboleth/idp/plugin/oidc/op/messaging/JSONErrorResponseTest.java
index 3bfe4d61..d6ef5e52 100644
--- a/idp-oidc-extension-api/src/test/java/net/shibboleth/idp/plugin/oidc/op/messaging/JSONErrorResponseTest.java
+++ b/idp-oidc-extension-api/src/test/java/net/shibboleth/idp/plugin/oidc/op/messaging/JSONErrorResponseTest.java
@@ -46,7 +46,7 @@ public class JSONErrorResponseTest {
Assert.assertEquals("no-store", httpResponse.getCacheControl());
Assert.assertEquals("no-cache", httpResponse.getPragma());
JSONObject parsedContent =
- (JSONObject) new JSONParser(JSONParser.MODE_PERMISSIVE).parse(httpResponse.getBody());
+ (JSONObject) new JSONParser(JSONParser.MODE_PERMISSIVE).parse(httpResponse.getContent());
Assert.assertEquals("errorCode", parsedContent.get("error"));
Assert.assertEquals("errorDescription", parsedContent.get("error_description"));
}
@@ -60,7 +60,7 @@ public class JSONErrorResponseTest {
Assert.assertNull(httpResponse.getCacheControl());
Assert.assertNull(httpResponse.getPragma());
JSONObject parsedContent =
- (JSONObject) new JSONParser(JSONParser.MODE_PERMISSIVE).parse(httpResponse.getBody());
+ (JSONObject) new JSONParser(JSONParser.MODE_PERMISSIVE).parse(httpResponse.getContent());
Assert.assertEquals("errorCode", parsedContent.get("error"));
Assert.assertEquals("errorDescription", parsedContent.get("error_description"));
}
diff --git a/idp-oidc-extension-api/src/test/java/net/shibboleth/idp/plugin/oidc/op/messaging/JSONSuccessResponseTest.java b/idp-oidc-extension-api/src/test/java/net/shibboleth/idp/plugin/oidc/op/messaging/JSONSuccessResponseTest.java
index 53803f6c..eeb0f12f 100644
--- a/idp-oidc-extension-api/src/test/java/net/shibboleth/idp/plugin/oidc/op/messaging/JSONSuccessResponseTest.java
+++ b/idp-oidc-extension-api/src/test/java/net/shibboleth/idp/plugin/oidc/op/messaging/JSONSuccessResponseTest.java
@@ -46,7 +46,7 @@ public class JSONSuccessResponseTest {
Assert.assertEquals("no-store", httpResponse.getCacheControl());
Assert.assertEquals("no-cache", httpResponse.getPragma());
JSONObject parsedContent =
- (JSONObject) new JSONParser(JSONParser.MODE_PERMISSIVE).parse(httpResponse.getBody());
+ (JSONObject) new JSONParser(JSONParser.MODE_PERMISSIVE).parse(httpResponse.getContent());
Assert.assertEquals(content.get("field1"), parsedContent.get("field1"));
Assert.assertEquals(content.get("field2"), parsedContent.get("field2"));
}
@@ -60,7 +60,7 @@ public class JSONSuccessResponseTest {
Assert.assertNull(httpResponse.getCacheControl());
Assert.assertNull(httpResponse.getPragma());
JSONObject parsedContent =
- (JSONObject) new JSONParser(JSONParser.MODE_PERMISSIVE).parse(httpResponse.getBody());
+ (JSONObject) new JSONParser(JSONParser.MODE_PERMISSIVE).parse(httpResponse.getContent());
Assert.assertEquals(content.get("field1"), parsedContent.get("field1"));
Assert.assertEquals(content.get("field2"), parsedContent.get("field2"));
}
diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/decoding/impl/OIDCAuthenticationRequestDecoder.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/decoding/impl/OIDCAuthenticationRequestDecoder.java
index ba2567dc..8db0381b 100644
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/decoding/impl/OIDCAuthenticationRequestDecoder.java
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/decoding/impl/OIDCAuthenticationRequestDecoder.java
@@ -48,12 +48,12 @@ public class OIDCAuthenticationRequestDecoder extends BaseOAuth2RequestDecoder<A
try {
final HttpServletRequest httpServletRequest = getHttpServletRequest();
if (httpServletRequest != null) {
+ getProtocolMessageLogger().trace("Inbound request {}",
+ RequestUtil.toString(JakartaServletUtils.createHTTPRequest(httpServletRequest)));
final HttpServletRequestWrapper httpServletRequestWrapper =
new CustomResourceHttpServletRequestWrapper(httpServletRequest);
final HTTPRequest httpReq = JakartaServletUtils.createHTTPRequest(httpServletRequestWrapper);
- getProtocolMessageLogger().trace("Inbound request {}", RequestUtil.toString(httpReq));
if (httpReq != null) {
- switchIntoCustomResource(httpReq);
return AuthenticationRequest.parse(httpReq);
}
}
diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/decoding/impl/OIDCClientRegistrationRequestDecoder.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/decoding/impl/OIDCClientRegistrationRequestDecoder.java
index 7f676f13..283a2759 100644
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/decoding/impl/OIDCClientRegistrationRequestDecoder.java
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/decoding/impl/OIDCClientRegistrationRequestDecoder.java
@@ -76,16 +76,16 @@ public class OIDCClientRegistrationRequestDecoder extends BaseOAuth2RequestDecod
try {
final HTTPRequest httpRequest = JakartaServletUtils.createHTTPRequest(getHttpServletRequest());
getProtocolMessageLogger().trace("Inbound request {}", RequestUtil.toString(httpRequest, objectMapper));
- final JSONObject requestJson = httpRequest.getBodyAsJSONObject();
+ final JSONObject requestJson = httpRequest.getQueryAsJSONObject();
//TODO: Nimbus seems to be interpreting scope in different way as many RPs, currently the scope
//is removed in this phase, better solution TODO.
if (requestJson.containsKey("scope")) {
log.debug("Removed 'scope'");
requestJson.remove("scope");
- httpRequest.setBody(requestJson.toJSONString());
+ httpRequest.setQuery(requestJson.toJSONString());
}
- log.trace("JSON object: {}", httpRequest.getBody());
+ log.trace("JSON object: {}", httpRequest.getQueryAsJSONObject().toJSONString());
return OIDCClientRegistrationRequest.parse(httpRequest);
} catch (final IOException e) {
log.error("Could not create HTTP request from the request", e);
diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/decoding/impl/RequestUtil.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/decoding/impl/RequestUtil.java
index afcf0cba..4a83b43b 100644
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/decoding/impl/RequestUtil.java
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/decoding/impl/RequestUtil.java
@@ -59,7 +59,7 @@ public final class RequestUtil {
ret += "\t" + entry.getKey() + ":" + entry.getValue() + nl;
}
}
- final Map<String, List<String>> parameters = httpReq.getQueryStringParameters();
+ final Map<String, List<String>> parameters = httpReq.getQueryParameters();
if (parameters != null) {
ret += "Parameters:" + nl;
for (final Entry<String, List<String>> entry : parameters.entrySet()) {
@@ -92,7 +92,7 @@ public final class RequestUtil {
ret += "\t" + entry.getKey() + ":" + entry.getValue() + nl;
}
}
- final Map<String, List<String>> parameters = httpReq.getQueryStringParameters();
+ final Map<String, List<String>> parameters = httpReq.getQueryParameters();
if (parameters != null) {
if (objectMapper != null && !parameters.isEmpty()) {
final String rawValue = parameters.keySet().iterator().next();
diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/encoding/impl/ResponseUtil.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/encoding/impl/ResponseUtil.java
index a13b5e55..2ff37364 100644
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/encoding/impl/ResponseUtil.java
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/encoding/impl/ResponseUtil.java
@@ -103,7 +103,7 @@ public final class ResponseUtil {
ret += "\t" + entry.getKey() + ":" + entry.getValue().get(0) + nl;
}
}
- final String rawContent = httpResponse.getBody();
+ final String rawContent = httpResponse.getContent();
if (rawContent != null) {
if (objectMapper != null) {
try {
diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oauth2/decoding/impl/BaseOAuth2RequestDecoder.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oauth2/decoding/impl/BaseOAuth2RequestDecoder.java
index 3d81d2f2..0b77e9ce 100644
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oauth2/decoding/impl/BaseOAuth2RequestDecoder.java
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oauth2/decoding/impl/BaseOAuth2RequestDecoder.java
@@ -141,9 +141,9 @@ public abstract class BaseOAuth2RequestDecoder<T extends Request> extends Abstra
* @param httpRequest The HTTP request object where the parameter names are switched
*/
protected void switchIntoCustomResource(@Nonnull final HTTPRequest httpRequest) {
- final String body = httpRequest.getBody();
+ final String body = httpRequest.getQuery();
if (body != null) {
- httpRequest.setBody(transformResourceParameter(body));
+ httpRequest.setQuery(transformResourceParameter(body));
}
}
diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oauth2/decoding/impl/CustomResourceHttpServletRequestWrapper.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oauth2/decoding/impl/CustomResourceHttpServletRequestWrapper.java
index 65baa75e..f347c317 100644
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oauth2/decoding/impl/CustomResourceHttpServletRequestWrapper.java
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oauth2/decoding/impl/CustomResourceHttpServletRequestWrapper.java
@@ -14,14 +14,18 @@
package net.shibboleth.idp.plugin.oidc.op.oauth2.decoding.impl;
+import java.util.Map;
+import java.util.stream.Collectors;
+
import javax.annotation.Nonnull;
import jakarta.servlet.http.HttpServletRequest;
import jakarta.servlet.http.HttpServletRequestWrapper;
+import net.shibboleth.idp.plugin.oidc.op.profile.context.navigate.DefaultRequestAudienceLookupFunction;
/**
* A custom extension to {@link HttpServletRequestWrapper} overriding the resource parameter with a custom one in the
- * query string.
+ * query string (for GET) and parameter map (for POST).
*/
public class CustomResourceHttpServletRequestWrapper extends HttpServletRequestWrapper {
@@ -40,4 +44,12 @@ public class CustomResourceHttpServletRequestWrapper extends HttpServletRequestW
return BaseOAuth2RequestDecoder.transformResourceParameter(super.getQueryString());
}
+ /** {@inheritDoc} */
+ @Override
+ public Map<String, String[]> getParameterMap() {
+ return super.getParameterMap().entrySet().stream()
+ .collect(Collectors.toMap(entry -> "resource".equals(entry.getKey()) ?
+ DefaultRequestAudienceLookupFunction.CUSTOM_RESOURCE_PARAM_NAME : entry.getKey(),
+ Map.Entry::getValue));
+ }
}
diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oauth2/decoding/impl/OAuth2AuthorizationRequestDecoder.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oauth2/decoding/impl/OAuth2AuthorizationRequestDecoder.java
index 1e852f55..03a45e22 100644
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oauth2/decoding/impl/OAuth2AuthorizationRequestDecoder.java
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oauth2/decoding/impl/OAuth2AuthorizationRequestDecoder.java
@@ -47,12 +47,12 @@ public class OAuth2AuthorizationRequestDecoder extends BaseOAuth2RequestDecoder<
try {
final HttpServletRequest httpServletRequest = getHttpServletRequest();
if (httpServletRequest != null) {
+ getProtocolMessageLogger().trace("Inbound request {}",
+ RequestUtil.toString(JakartaServletUtils.createHTTPRequest(httpServletRequest)));
final HttpServletRequestWrapper httpServletRequestWrapper =
new CustomResourceHttpServletRequestWrapper(httpServletRequest);
final HTTPRequest httpReq = JakartaServletUtils.createHTTPRequest(httpServletRequestWrapper);
- getProtocolMessageLogger().trace("Inbound request {}", RequestUtil.toString(httpReq));
if (httpReq != null) {
- switchIntoCustomResource(httpReq);
return AuthorizationRequest.parse(httpReq);
}
}
diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/AddRemainingClaimsToClientMetadata.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/AddRemainingClaimsToClientMetadata.java
index d27356c1..6aae1444 100644
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/AddRemainingClaimsToClientMetadata.java
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/AddRemainingClaimsToClientMetadata.java
@@ -103,7 +103,10 @@ public class AddRemainingClaimsToClientMetadata extends AbstractOIDCClientMetada
/** {@inheritDoc} */
@Override
protected void doExecute(@Nonnull final ProfileRequestContext profileRequestContext) {
- getOutputMetadata().setDPoPBoundAccessTokens(getInputMetadata().getDPoPBoundAccessTokens());
+ if (getInputMetadata().toJSONObject().containsKey("dpop_bound_access_tokens")) {
+ getOutputMetadata().setCustomField("dpop_bound_access_tokens",
+ getInputMetadata().toJSONObject().get("dpop_bound_access_tokens"));
+ }
getOutputMetadata().requiresPushedAuthorizationRequests(
getInputMetadata().requiresPushedAuthorizationRequests());
final JSONObject input = getInputMetadata().toJSONObject();
diff --git a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/token/token-beans.xml b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/token/token-beans.xml
index f62f4b4b..a0704827 100644
--- a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/token/token-beans.xml
+++ b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/token/token-beans.xml
@@ -16,7 +16,7 @@
<bean id="shibboleth.oidc.loggingId" class="java.lang.String" c:_0="%{idp.service.logging.oidctoken:OIDC.Token}" />
<bean id="shibboleth.oidc.MetadataEnforcedDPoP" parent="shibboleth.Conditions.Expression"
- c:expression="#input.ensureInboundMessageContext().getSubcontext(T(net.shibboleth.oidc.metadata.context.OIDCMetadataContext)) != null and #input.ensureInboundMessageContext().getSubcontext(T(net.shibboleth.oidc.metadata.context.OIDCMetadataContext)).getClientInformation() != null and #input.ensureInboundMessageContext().getSubcontext(T(net.shibboleth.oidc.metadata.context.OIDCMetadataContext)).getClientInformation().getMetadata().getDPoPBoundAccessTokens()" />
+ c:expression="#input.ensureInboundMessageContext().getSubcontext(T(net.shibboleth.oidc.metadata.context.OIDCMetadataContext)) != null and #input.ensureInboundMessageContext().getSubcontext(T(net.shibboleth.oidc.metadata.context.OIDCMetadataContext)).getClientInformation() != null and #input.ensureInboundMessageContext().getSubcontext(T(net.shibboleth.oidc.metadata.context.OIDCMetadataContext)).getClientInformation().getMetadata().toJSONObject().get('dpop_bound_access_tokens') != [...]
<util:constant id="shibboleth.metrics.ProfileCounter"
static-field="net.shibboleth.oidc.profile.oauth2.config.impl.DefaultOAuth2TokenConfiguration.PROFILE_COUNTER" />
diff --git a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/decoding/impl/OIDCAuthenticationRequestDecoderTest.java b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/decoding/impl/OIDCAuthenticationRequestDecoderTest.java
index 30de0973..d93b2c23 100644
--- a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/decoding/impl/OIDCAuthenticationRequestDecoderTest.java
+++ b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/decoding/impl/OIDCAuthenticationRequestDecoderTest.java
@@ -15,6 +15,7 @@
package net.shibboleth.idp.plugin.oidc.op.decoding.impl;
import java.net.URISyntaxException;
+import java.util.Map;
import org.opensaml.messaging.context.MessageContext;
import org.opensaml.messaging.decoder.MessageDecodingException;
@@ -23,11 +24,13 @@ import org.testng.Assert;
import org.testng.annotations.BeforeMethod;
import org.testng.annotations.Test;
+import com.nimbusds.common.contenttype.ContentType;
import com.nimbusds.oauth2.sdk.ResponseType;
import com.nimbusds.openid.connect.sdk.AuthenticationRequest;
import jakarta.servlet.http.HttpServletRequest;
import net.shibboleth.idp.plugin.oidc.op.profile.context.navigate.DefaultRequestAudienceLookupFunction;
+import net.shibboleth.shared.collection.CollectionSupport;
import net.shibboleth.shared.primitive.NonnullSupplier;
/**
@@ -136,6 +139,27 @@ public class OIDCAuthenticationRequestDecoderTest {
.contains("mockResourceId"));
}
+ @SuppressWarnings("null")
+ @Test
+ public void testPostRequestDecodingWithNonURIResource() throws MessageDecodingException {
+ httpRequest.setMethod("POST");
+ httpRequest.setContentType(ContentType.APPLICATION_URLENCODED.toString());
+ httpRequest.setParameters(CollectionSupport.copyToMap(Map.of("response_type", "code", "client_id", "s6BhdRkqt3",
+ "redirect_uri", "https://client.example.org/cb", "scope", "openid profile", "resource", "mockResourceId")));
+ decoder.decode();
+ final MessageContext messageContext = decoder.getMessageContext();
+ // We are not testing nimbus itself here, i.e. we are happy to decode
+ // one parameter successfully
+ assert messageContext != null;
+ final AuthenticationRequest request = (AuthenticationRequest) messageContext.getMessage();
+ assert request != null;
+ final ResponseType responseType = request.getResponseType();
+ assert responseType != null;
+ Assert.assertEquals(responseType.toString(), ResponseType.Value.CODE.toString());
+ Assert.assertTrue(request.getCustomParameter(DefaultRequestAudienceLookupFunction.CUSTOM_RESOURCE_PARAM_NAME)
+ .contains("mockResourceId"));
+ }
+
@Test(expectedExceptions = MessageDecodingException.class)
public void testInvalidRequestDecoding() throws MessageDecodingException {
// Mandatory response_type parameter removed, decoding should fail
diff --git a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/decoding/impl/OIDCTokenRequestDecoderTest.java b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/decoding/impl/OIDCTokenRequestDecoderTest.java
index 28515748..6e1bffe9 100644
--- a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/decoding/impl/OIDCTokenRequestDecoderTest.java
+++ b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/decoding/impl/OIDCTokenRequestDecoderTest.java
@@ -178,22 +178,16 @@ public class OIDCTokenRequestDecoderTest {
}
protected void switchIntoCustomClientAssertion(@Nonnull final HTTPRequest httpRequest) {
- final Map<String, List<String>> params;
- try {
- params = httpRequest.getBodyAsFormParameters();
- } catch (ParseException e) {
- Assert.fail("Could not parse form parameters", e);
- return;
- }
+ final Map<String, List<String>> params = httpRequest.getQueryParameters();
if (params != null && !params.isEmpty() && params.get("client_assertion_type") != null) {
final List<String> assertionTypes = params.get("client_assertion_type");
- String body = httpRequest.getBody();
+ String body = httpRequest.getQuery();
for (final String assertionType : assertionTypes) {
if (assertionType.equals("urn:ietf:params:oauth:client-assertion-type:mock-custom")) {
body = body.replace("client_assertion=", "custom_client_assertion=");
}
- httpRequest.setBody(body);
+ httpRequest.setQuery(body);
}
}
}
diff --git a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/oauth2/decoding/impl/OAuth2AuthorizationRequestDecoderTest.java b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/oauth2/decoding/impl/OAuth2AuthorizationRequestDecoderTest.java
index 7b4c9394..c0b9c97d 100644
--- a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/oauth2/decoding/impl/OAuth2AuthorizationRequestDecoderTest.java
+++ b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/oauth2/decoding/impl/OAuth2AuthorizationRequestDecoderTest.java
@@ -15,6 +15,7 @@
package net.shibboleth.idp.plugin.oidc.op.oauth2.decoding.impl;
import java.net.URISyntaxException;
+import java.util.Map;
import org.opensaml.messaging.context.MessageContext;
import org.opensaml.messaging.decoder.MessageDecodingException;
@@ -23,11 +24,13 @@ import org.testng.Assert;
import org.testng.annotations.BeforeMethod;
import org.testng.annotations.Test;
+import com.nimbusds.common.contenttype.ContentType;
import com.nimbusds.oauth2.sdk.AuthorizationRequest;
import com.nimbusds.oauth2.sdk.ResponseType;
import jakarta.servlet.http.HttpServletRequest;
import net.shibboleth.idp.plugin.oidc.op.profile.context.navigate.DefaultRequestAudienceLookupFunction;
+import net.shibboleth.shared.collection.CollectionSupport;
import net.shibboleth.shared.primitive.NonnullSupplier;
/**
@@ -138,6 +141,27 @@ public class OAuth2AuthorizationRequestDecoderTest {
}
}
+ @SuppressWarnings("null")
+ @Test
+ public void testPostRequestDecodingWithNonURIResource() throws MessageDecodingException {
+ httpRequest.setMethod("POST");
+ httpRequest.setContentType(ContentType.APPLICATION_URLENCODED.toString());
+ httpRequest.setParameters(CollectionSupport.copyToMap(Map.of("response_type", "code", "client_id", "s6BhdRkqt3",
+ "redirect_uri", "https://client.example.org/cb", "scope", "profile", "resource", "mockResourceId")));
+ decoder.decode();
+ final MessageContext messageContext = decoder.getMessageContext();
+ // We are not testing nimbus itself here, i.e. we are happy to decode
+ // one parameter successfully
+ assert messageContext != null;
+ final AuthorizationRequest request = (AuthorizationRequest) messageContext.getMessage();
+ assert request != null;
+ final ResponseType responseType = request.getResponseType();
+ assert responseType != null;
+ Assert.assertEquals(responseType.toString(), ResponseType.Value.CODE.toString());
+ Assert.assertTrue(request.getCustomParameter(DefaultRequestAudienceLookupFunction.CUSTOM_RESOURCE_PARAM_NAME)
+ .contains("mockResourceId"));
+ }
+
@Test(expectedExceptions = MessageDecodingException.class)
public void testInvalidRequestDecoding() throws MessageDecodingException {
// Mandatory response_type parameter removed, decoding should fail
diff --git a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/ConfigurationFlowTest.java b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/ConfigurationFlowTest.java
index 454c8769..7cba0665 100644
--- a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/ConfigurationFlowTest.java
+++ b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/ConfigurationFlowTest.java
@@ -60,7 +60,7 @@ public class ConfigurationFlowTest extends AbstractOidcFlowTest {
Assert.assertNull(originalMetadata.getUserInfoJWEAlgs());
Assert.assertNull(originalMetadata.getUserInfoJWEEncs());
Assert.assertNull(originalMetadata.getUserInfoJWSAlgs());
- final OIDCProviderMetadata metadata = OIDCProviderMetadata.parse(response.toHTTPResponse().getBody());
+ final OIDCProviderMetadata metadata = OIDCProviderMetadata.parse(response.toHTTPResponse().getContent());
Assert.assertEquals(metadata.getIssuer(), new Issuer("https://op.example.org"));;
// all but RSA-OAEP-384 as it's excluded in test relying-party.xml
final List<String> jweAlgs = Arrays.asList("RSA1_5", "RSA-OAEP", "RSA-OAEP-256", "RSA-OAEP-512",
diff --git a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/KeySetFlowTest.java b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/KeySetFlowTest.java
index b2c4ef20..8da234b9 100644
--- a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/KeySetFlowTest.java
+++ b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/KeySetFlowTest.java
@@ -53,7 +53,7 @@ public class KeySetFlowTest extends AbstractOidcFlowTest {
final FlowExecutionResult result = flowExecutor.launchExecution(FLOW_ID, null, externalContext);
final Response response = parseResponse(result);
Assert.assertTrue(response.indicatesSuccess());
- final JWKSet jwkSet = JWKSet.parse(response.toHTTPResponse().getBody());
+ final JWKSet jwkSet = JWKSet.parse(response.toHTTPResponse().getContent());
final List<JWK> keys = jwkSet.getKeys();
Assert.assertNotNull(keys);
Assert.assertEquals(keys.size(), 6);
diff --git a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/RegistrationFlowTest.java b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/RegistrationFlowTest.java
index 1de268fa..18006b13 100644
--- a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/RegistrationFlowTest.java
+++ b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/RegistrationFlowTest.java
@@ -197,7 +197,7 @@ public class RegistrationFlowTest extends AbstractOidcFlowTest {
Assert.assertEquals(storedInfo.getOIDCMetadata().getRedirectionURIStrings(), metadata.getRedirectionURIStrings());
Assert.assertEquals(storedInfo.getOIDCMetadata().getRequestObjectURIs(), Set.of(new URI(requestUri)));
Assert.assertTrue(metadata.getRedirectionURIStrings().contains(redirectUri));
- Assert.assertTrue(metadata.getDPoPBoundAccessTokens());
+ Assert.assertTrue(Boolean.valueOf("" + metadata.getCustomField("dpop_bound_access_tokens")));
Assert.assertFalse(metadata.requiresPushedAuthorizationRequests());
}
@@ -227,7 +227,7 @@ public class RegistrationFlowTest extends AbstractOidcFlowTest {
Assert.assertEquals(storedInfo.getOIDCMetadata().getRequestObjectURIs(), Set.of(new URI(requestUri)));
Assert.assertTrue(metadata.getRedirectionURIStrings().contains(redirectUri));
Assert.assertTrue(metadata.requiresPushedAuthorizationRequests());
- Assert.assertFalse(metadata.getDPoPBoundAccessTokens());
+ Assert.assertFalse(Boolean.valueOf("" + metadata.getCustomField("dpop_bound_access_tokens")));
}
@Test
diff --git a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/TokenFlowTest.java b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/TokenFlowTest.java
index dd17561f..82a43ee5 100644
--- a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/TokenFlowTest.java
+++ b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/TokenFlowTest.java
@@ -986,7 +986,7 @@ public class TokenFlowTest extends AbstractOidcClientAuthenticationFlowTest {
final OIDCClientMetadata metadata = buildMetadataSkeleton();
metadata.setRedirectionURIs(Set.of(new URI(redirectUri)));
metadata.setScope(scope);
- metadata.setDPoPBoundAccessTokens(true);
+ metadata.setCustomField("dpop_bound_access_tokens", true);
storeMetadataObject(storageService, clientId, clientSecret, metadata);
storeConsent(storageService, "jdoe", clientId, "mail");
final FlowExecutionResult result = flowExecutor.launchExecution(FLOW_ID, null, externalContext);
diff --git a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/FormOutboundDiscoveryResponseTest.java b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/FormOutboundDiscoveryResponseTest.java
index a452e2fa..ea4932bf 100644
--- a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/FormOutboundDiscoveryResponseTest.java
+++ b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/FormOutboundDiscoveryResponseTest.java
@@ -114,7 +114,7 @@ public class FormOutboundDiscoveryResponseTest {
(JSONSuccessResponse) profileRequestCtx.ensureOutboundMessageContext().getMessage();
assert resp != null;
Assert.assertTrue(resp.indicatesSuccess());
- final OIDCProviderMetadata metadata = OIDCProviderMetadata.parse(resp.toHTTPResponse().getBody());
+ final OIDCProviderMetadata metadata = OIDCProviderMetadata.parse(resp.toHTTPResponse().getContent());
assertFileContents(metadata);
Assert.assertNull(metadata.getCustomParameter(dynamicClaim));
}
@@ -129,7 +129,7 @@ public class FormOutboundDiscoveryResponseTest {
final JSONSuccessResponse resp =
(JSONSuccessResponse) profileRequestCtx.ensureOutboundMessageContext().getMessage();
assert resp != null;
- final OIDCProviderMetadata metadata = OIDCProviderMetadata.parse(resp.toHTTPResponse().getBody());
+ final OIDCProviderMetadata metadata = OIDCProviderMetadata.parse(resp.toHTTPResponse().getContent());
assertFileContents(metadata);
Assert.assertNotNull(metadata.getCustomParameter(dynamicClaim));
Assert.assertEquals(metadata.getCustomParameter(dynamicClaim), dynamicClaimValue);
diff --git a/pom.xml b/pom.xml
index c6d70397..b2f46918 100644
--- a/pom.xml
+++ b/pom.xml
@@ -34,8 +34,8 @@
<commons.io.version>2.6</commons.io.version>
<checkstyle.configLocation>${project.basedir}/resources/checkstyle.xml</checkstyle.configLocation>
<!-- Dependency management in oidc-common-bom, but versions needed here for javadoc links -->
- <nimbus-jose-jwt.version>9.39.1</nimbus-jose-jwt.version>
- <oauth2-oidc-sdk.version>11.11</oauth2-oidc-sdk.version>
+ <nimbus-jose-jwt.version>9.40</nimbus-jose-jwt.version>
+ <oauth2-oidc-sdk.version>10.15</oauth2-oidc-sdk.version>
<json.smart.version>2.5.1</json.smart.version>
<accessors.smart.version>1.2</accessors.smart.version>
<nimbus.lang.tag.version>1.7</nimbus.lang.tag.version>
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list