[java-idp-oidc] 01/02: JOIDC-213 - Make scope nullable in TokenClaimsSet and its subclasses
Henri Mikkonen
henri.mikkonen at iki.fi
Fri Jun 7 06:42:42 UTC 2024
This is an automated email from the git hooks/post-receive script.
hjmikkon pushed a commit to branch main
in repository java-idp-oidc.
View the commit online:
http://git.shibboleth.net/view/?p=java-idp-oidc.git;a=commit;h=fbfa92fbdac91fed6e748ca5cf93473d33669cde
commit fbfa92fbdac91fed6e748ca5cf93473d33669cde
Author: Henri Mikkonen <henri.mikkonen at iki.fi>
AuthorDate: Fri Jun 7 09:40:56 2024 +0300
JOIDC-213 - Make scope nullable in TokenClaimsSet and its subclasses
https://shibboleth.atlassian.net/browse/JOIDC-213
- Switched scope into nullable in claims sets and builders
- Changed authorization code and access token builders to set null instead of empty scope
- BuildAccessToken and SetAuthorizationCodeToResponseContext
- Updated and improved tests accordingly
---
.../op/token/support/AccessTokenClaimsSet.java | 2 +-
.../op/token/support/RefreshTokenClaimsSet.java | 2 +-
.../oidc/op/token/support/TokenClaimsSet.java | 22 +++++++-------
.../op/oauth2/profile/impl/BuildAccessToken.java | 5 ++--
.../SetAuthorizationCodeToResponseContext.java | 2 +-
.../oauth2/profile/impl/BuildAccessTokenTest.java | 34 ++++++++++++++++++++--
.../SetAuthorizationCodeToResponseContextTest.java | 29 +++++++++++++++---
.../flow/ClientCredentialsTokenFlowTest.java | 16 +++++-----
8 files changed, 81 insertions(+), 31 deletions(-)
diff --git a/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/token/support/AccessTokenClaimsSet.java b/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/token/support/AccessTokenClaimsSet.java
index 44d6d15f..a98047b7 100644
--- a/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/token/support/AccessTokenClaimsSet.java
+++ b/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/token/support/AccessTokenClaimsSet.java
@@ -140,7 +140,7 @@ public final class AccessTokenClaimsSet extends TokenClaimsSet {
*
* @since 3.1.0
*/
- public Builder(@Nonnull final TokenClaimsSet existing, @Nonnull final Scope scope,
+ public Builder(@Nonnull final TokenClaimsSet existing, @Nullable final Scope scope,
@Nullable final ClaimsSet dlClaims, @Nullable final ClaimsSet dlClaimsUI, @Nonnull final Instant iat,
@Nonnull final Instant exp) {
this(existing);
diff --git a/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/token/support/RefreshTokenClaimsSet.java b/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/token/support/RefreshTokenClaimsSet.java
index 43b5299a..9ade1ae9 100644
--- a/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/token/support/RefreshTokenClaimsSet.java
+++ b/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/token/support/RefreshTokenClaimsSet.java
@@ -170,7 +170,7 @@ public final class RefreshTokenClaimsSet extends TokenClaimsSet {
"Authentication time cannot be null"));
setNonce(existing.getNonce());
setRedirectURI(Constraint.isNotNull(existing.getRedirectURI(), "Redirect URI cannot be null"));
- setScope(Constraint.isNotNull(existing.getScope(), "Scope cannot be null"));
+ setScope(existing.getScope());
setAudience(existing.getAudience());
setClaimsRequest(existing.getClaimsRequest());
setDlClaims(existing.getDeliveryClaims());
diff --git a/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/token/support/TokenClaimsSet.java b/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/token/support/TokenClaimsSet.java
index c832ece0..b5e5ed1d 100644
--- a/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/token/support/TokenClaimsSet.java
+++ b/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/token/support/TokenClaimsSet.java
@@ -205,8 +205,8 @@ public class TokenClaimsSet {
if (tokenClaimsSet.getDateClaim(KEY_AUTH_TIME) == null) {
throw new ParseException("claim auth_time must exist and not be null", 0);
}
- if (tokenClaimsSet.getStringClaim(KEY_SCOPE) == null) {
- throw new ParseException("claim scope must exist and not be null", 0);
+ if (tokenClaimsSet.getClaims().containsKey(KEY_SCOPE)) {
+ tokenClaimsSet.getStringClaim(KEY_SCOPE);
}
if (tokenClaimsSet.getClaims().containsKey(KEY_ACR)) {
tokenClaimsSet.getStringClaim(KEY_ACR);
@@ -568,12 +568,14 @@ public class TokenClaimsSet {
@Nullable public Scope getScope() {
final JWTClaimsSet tokenClaimsSet = assertedClaimsSet();
try {
- return Scope.parse(tokenClaimsSet.getStringClaim(KEY_SCOPE));
+ if (tokenClaimsSet.getClaims().containsKey(KEY_SCOPE)) {
+ return Scope.parse(tokenClaimsSet.getStringClaim(KEY_SCOPE));
+ }
} catch (final ParseException e) {
log.error("Error parsing scope in request {}", tokenClaimsSet.getClaim(KEY_SCOPE));
// should never happen, programming error.
- return null;
}
+ return null;
}
/**
@@ -786,7 +788,7 @@ public class TokenClaimsSet {
@Nonnull protected JWTClaimsSet buildJWTClaimsSet(@Nonnull @NotEmpty final String tokenType) {
if (jwtid == null || rpId == null || iss == null || iat == null || exp == null || authTime == null
- || reqScope == null || sub == null) {
+ || sub == null) {
throw new RuntimeException("Invalid parameters, programming error");
}
assert rpId != null;
@@ -794,8 +796,6 @@ public class TokenClaimsSet {
final ACR ctxRef = acr;
final Nonce nonceValue = nonce;
final URI redirectUri = redirect;
- assert reqScope != null;
- final String scopeValue = reqScope.toString();
final OIDCClaimsRequest requestClaims = reqClaims;
final ClaimsSet deliveryClaims = dlClaims;
final ClaimsSet idTokenClaims = dlClaimsID;
@@ -815,7 +815,6 @@ public class TokenClaimsSet {
.claim(KEY_NONCE, nonceValue == null ? null : nonceValue.getValue())
.claim(KEY_AUTH_TIME, Date.from(authTime))
.claim(KEY_REDIRECT_URI, redirectUri == null ? null : redirectUri.toString())
- .claim(KEY_SCOPE, scopeValue)
.claim(KEY_CLAIMS, requestClaims == null ? null : requestClaims.toJSONObject())
.claim(KEY_DELIVERY_CLAIMS, deliveryClaims == null ? null : deliveryClaims.toJSONObject())
.claim(KEY_DELIVERY_CLAIMS_IDTOKEN, idTokenClaims == null ? null : idTokenClaims.toJSONObject())
@@ -828,6 +827,9 @@ public class TokenClaimsSet {
.claim(KEY_CONFIRMATION, dpopProofJwkThumbprint == null ? null :
CollectionSupport.singletonMap(KEY_DPOP_PROOF_JWK_THUMBPRINT, dpopProofJwkThumbprint));
+ if (reqScope != null) {
+ builder.claim(KEY_SCOPE, reqScope.toString());
+ }
customClaims.forEach((n,v) -> {
if (n != null) {
builder.claim(n, v);
@@ -1003,8 +1005,8 @@ public class TokenClaimsSet {
*
* @since 3.1.0
*/
- public Builder<T> setScope(@Nonnull final Scope s) {
- reqScope = Constraint.isNotNull(s, "Scope cannot be null");
+ public Builder<T> setScope(@Nullable final Scope s) {
+ reqScope = s;
return this;
}
diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oauth2/profile/impl/BuildAccessToken.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oauth2/profile/impl/BuildAccessToken.java
index 3f48cba2..4cf16f6d 100644
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oauth2/profile/impl/BuildAccessToken.java
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oauth2/profile/impl/BuildAccessToken.java
@@ -482,11 +482,10 @@ public class BuildAccessToken extends AbstractOIDCResponseAction {
final OIDCAuthenticationResponseContext responseCtx = getOidcResponseContext();
assert responseCtx != null;
- final Scope scope = responseCtx.getScope() != null ? responseCtx.getScope() : new Scope();
+ final Scope scope = responseCtx.getScope();
log.debug("{} Building access token with scope: {}", getLogPrefix(), scope);
- assert scope != null;
- final boolean oidc = scope.contains("openid");
+ final boolean oidc = scope != null && scope.contains("openid");
if (oidc) {
responseCtx.getAudience().add(issuer);
diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oauth2/profile/impl/SetAuthorizationCodeToResponseContext.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oauth2/profile/impl/SetAuthorizationCodeToResponseContext.java
index c95047c1..12d8b3db 100644
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oauth2/profile/impl/SetAuthorizationCodeToResponseContext.java
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oauth2/profile/impl/SetAuthorizationCodeToResponseContext.java
@@ -395,7 +395,7 @@ public class SetAuthorizationCodeToResponseContext extends AbstractOAuthAuthoriz
.setExpiresAt(dateExp)
.setAuthenticationTime(authTime)
.setRedirectURI(redirectUri)
- .setScope(scope != null ? scope : new Scope())
+ .setScope(scope)
.setAudience(responseCtx.getAudience())
.setACR(responseCtx.getAcr())
.setNonce(new DefaultRequestNonceLookupFunction().apply(profileRequestContext))
diff --git a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/oauth2/profile/impl/BuildAccessTokenTest.java b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/oauth2/profile/impl/BuildAccessTokenTest.java
index a4bacfa3..277a57f7 100644
--- a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/oauth2/profile/impl/BuildAccessTokenTest.java
+++ b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/oauth2/profile/impl/BuildAccessTokenTest.java
@@ -118,6 +118,20 @@ public class BuildAccessTokenTest extends BaseOIDCResponseActionTest {
CollectionSupport.singletonList("https://rp.example.org"), null);
}
+ @Test
+ public void testOpaqueSuccessNoScope() throws ParseException, DataSealerException,
+ ComponentInitializationException, NoSuchAlgorithmException {
+
+ initAction(null, null);
+
+ respCtx.setScope(null);
+ final Event event = action.execute(requestCtx);
+ ActionTestingSupport.assertProceedEvent(event);
+
+ verifyClaims(respCtx.ensureSubcontext(AccessTokenContext.class), null,
+ CollectionSupport.singletonList("https://rp.example.org"), null);
+ }
+
/**
* Basic success case.
*
@@ -182,6 +196,20 @@ public class BuildAccessTokenTest extends BaseOIDCResponseActionTest {
CollectionSupport.singletonList("https://rp.example.org"), null);
}
+ @Test
+ public void testJWTSuccessNoScope() throws ParseException, ComponentInitializationException,
+ NoSuchAlgorithmException, DataSealerException {
+
+ initAction("JWT", null);
+
+ respCtx.setScope(null);
+ final Event event = action.execute(requestCtx);
+ ActionTestingSupport.assertProceedEvent(event);
+
+ verifyClaims(respCtx.ensureSubcontext(AccessTokenContext.class), null,
+ CollectionSupport.singletonList("https://rp.example.org"), null);
+ }
+
/**
* Basic success case, direct reuse of requested scope/audience.
*
@@ -261,7 +289,7 @@ public class BuildAccessTokenTest extends BaseOIDCResponseActionTest {
* @throws ParseException
* @throws NoSuchAlgorithmException
*/
- private void verifyClaims(@Nonnull final AccessTokenContext ctx, @Nonnull final Scope scope,
+ private void verifyClaims(@Nonnull final AccessTokenContext ctx, @Nullable final Scope scope,
@Nonnull @NonnullElements final Collection<String> audiences, final Map<String, Object> customClaims)
throws NoSuchAlgorithmException, ParseException, DataSealerException, ComponentInitializationException {
verifyClaims(ctx, scope, audiences, customClaims, null);
@@ -281,7 +309,7 @@ public class BuildAccessTokenTest extends BaseOIDCResponseActionTest {
* @throws ParseException
* @throws NoSuchAlgorithmException
*/
- private void verifyClaims(@Nonnull final AccessTokenContext ctx, @Nonnull final Scope scope,
+ private void verifyClaims(@Nonnull final AccessTokenContext ctx, @Nullable final Scope scope,
@Nonnull @NonnullElements final Collection<String> audiences, final Map<String, Object> customClaims,
@Nullable final String sid)
throws NoSuchAlgorithmException, ParseException, DataSealerException, ComponentInitializationException {
@@ -323,7 +351,7 @@ public class BuildAccessTokenTest extends BaseOIDCResponseActionTest {
assertEquals(claims.getExpirationTime().toInstant(), claims.getIssueTime().toInstant().plusSeconds(600));
assertEquals(claims.getIssuer(), ActionTestingSupport.OUTBOUND_MSG_ISSUER);
assertTrue(claims.getIssueTime().toInstant().isBefore(Instant.now()));
- assertEquals(claims.getStringClaim(TokenClaimsSet.KEY_SCOPE), scope.toString());
+ assertEquals(claims.getStringClaim(TokenClaimsSet.KEY_SCOPE), scope != null ? scope.toString() : null);
assertEquals(claims.getSubject(), clientId);
final JWTClaimsSet unsealedClaims =
JWTClaimsSet.parse(getDataSealer().unwrap(claims.getStringClaim(TokenClaimsSet.KEY_SEALED_FOR_OP)));
diff --git a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/oauth2/profile/impl/SetAuthorizationCodeToResponseContextTest.java b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/oauth2/profile/impl/SetAuthorizationCodeToResponseContextTest.java
index 4d6cd965..0e938c2f 100644
--- a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/oauth2/profile/impl/SetAuthorizationCodeToResponseContextTest.java
+++ b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/oauth2/profile/impl/SetAuthorizationCodeToResponseContextTest.java
@@ -59,12 +59,13 @@ public class SetAuthorizationCodeToResponseContextTest extends BaseOIDCResponseA
private SetAuthorizationCodeToResponseContext action;
private void init() throws ComponentInitializationException, NoSuchAlgorithmException, URISyntaxException {
- init(null);
+ init(null, new Scope());
}
private void init(final Function<ProfileRequestContext,
- BiFunction<ProfileRequestContext,Map<String,Object>,Map<String,Object>>> manipulationStrategy) throws ComponentInitializationException, NoSuchAlgorithmException, URISyntaxException {
- respCtx.setScope(new Scope());
+ BiFunction<ProfileRequestContext,Map<String,Object>,Map<String,Object>>> manipulationStrategy,
+ final Scope scope) throws ComponentInitializationException, NoSuchAlgorithmException, URISyntaxException {
+ respCtx.setScope(scope);
respCtx.setSubject("subject");
respCtx.setAuthTime(Instant.now());
respCtx.setAcr("0");
@@ -100,6 +101,20 @@ public class SetAuthorizationCodeToResponseContextTest extends BaseOIDCResponseA
final AuthorizeCodeClaimsSet ac = parseAuthorizeCodeClaimsSet(respCtx.getAuthorizationCode());
Assert.assertNotNull(ac);
Assert.assertNull(ac.getSessionIdentifier());
+ Assert.assertNotNull(ac.getScope());
+ }
+
+ @Test
+ public void testSuccessNoScope() throws ComponentInitializationException, NoSuchAlgorithmException,
+ URISyntaxException, ParseException, DataSealerException {
+ init(null, null);
+ final Event event = action.execute(requestCtx);
+ ActionTestingSupport.assertProceedEvent(event);
+ Assert.assertNotNull(respCtx.getAuthorizationCode());
+ final AuthorizeCodeClaimsSet ac = parseAuthorizeCodeClaimsSet(respCtx.getAuthorizationCode());
+ Assert.assertNotNull(ac);
+ Assert.assertNull(ac.getSessionIdentifier());
+ Assert.assertNull(ac.getScope());
}
/**
@@ -122,12 +137,13 @@ public class SetAuthorizationCodeToResponseContextTest extends BaseOIDCResponseA
final AuthorizeCodeClaimsSet ac = parseAuthorizeCodeClaimsSet(respCtx.getAuthorizationCode());
Assert.assertNotNull(ac);
Assert.assertEquals(ac.getSessionIdentifier(), "mockSid");
+ Assert.assertNotNull(ac.getScope());
}
@Test
public void testSuccessWithCustomClaim() throws ComponentInitializationException, NoSuchAlgorithmException, URISyntaxException,
ParseException, DataSealerException {
- init(prc -> ((prc2, map) -> addEntryToMap(map, "custom_claim", "custom_value")));
+ init(prc -> ((prc2, map) -> addEntryToMap(map, "custom_claim", "custom_value")), new Scope());
final Event event = action.execute(requestCtx);
ActionTestingSupport.assertProceedEvent(event);
Assert.assertNotNull(respCtx.getAuthorizationCode());
@@ -137,6 +153,7 @@ public class SetAuthorizationCodeToResponseContextTest extends BaseOIDCResponseA
assert claimsSet != null;
Assert.assertNotNull(claimsSet.getClaim("custom_claim"));
Assert.assertEquals(claimsSet.getStringClaim("custom_claim"), "custom_value");
+ Assert.assertNotNull(ac.getScope());
}
/**
@@ -161,6 +178,7 @@ public class SetAuthorizationCodeToResponseContextTest extends BaseOIDCResponseA
final AuthorizeCodeClaimsSet ac = parseAuthorizeCodeClaimsSet(respCtx.getAuthorizationCode());
Assert.assertNotNull(ac);
Assert.assertEquals(ac.getConsentedClaims(), consCtx.getConsentedAttributes());
+ Assert.assertNotNull(ac.getScope());
}
/**
@@ -196,6 +214,7 @@ public class SetAuthorizationCodeToResponseContextTest extends BaseOIDCResponseA
final ClaimsSet userInfoDeliveryClaims = ac.getUserinfoDeliveryClaims();
assert userInfoDeliveryClaims != null;
Assert.assertNotNull(userInfoDeliveryClaims.getClaim("3"));
+ Assert.assertNotNull(ac.getScope());
}
/**
@@ -221,6 +240,7 @@ public class SetAuthorizationCodeToResponseContextTest extends BaseOIDCResponseA
final AuthorizeCodeClaimsSet ac = parseAuthorizeCodeClaimsSet(respCtx.getAuthorizationCode());
Assert.assertNotNull(ac);
Assert.assertEquals(ac.getCodeChallenge(), "S256123456");
+ Assert.assertNotNull(ac.getScope());
}
/**
@@ -246,6 +266,7 @@ public class SetAuthorizationCodeToResponseContextTest extends BaseOIDCResponseA
final AuthorizeCodeClaimsSet ac = parseAuthorizeCodeClaimsSet(respCtx.getAuthorizationCode());
Assert.assertNotNull(ac);
Assert.assertEquals(ac.getCodeChallenge(), "plain123456");
+ Assert.assertNotNull(ac.getScope());
}
@Nonnull private AuthorizeCodeClaimsSet parseAuthorizeCodeClaimsSet(@Nullable final AuthorizationCode code)
diff --git a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/ClientCredentialsTokenFlowTest.java b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/ClientCredentialsTokenFlowTest.java
index af74f631..cb32a14e 100644
--- a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/ClientCredentialsTokenFlowTest.java
+++ b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/ClientCredentialsTokenFlowTest.java
@@ -134,7 +134,7 @@ public class ClientCredentialsTokenFlowTest extends AbstractOidcClientAuthentica
Assert.assertNotNull(response.getTokens().getBearerAccessToken());
Assert.assertEquals(response.getTokens().getBearerAccessToken().getLifetime(), 600);
Assert.assertNull(response.getTokens().getBearerAccessToken().getScope());
- verifyClaims(null, response.getTokens().getBearerAccessToken(), clientId, new Scope(),
+ verifyClaims(null, response.getTokens().getBearerAccessToken(), clientId, null,
Collections.singletonList(resource), "eduPersonScopedAffiliation");
}
@@ -148,7 +148,7 @@ public class ClientCredentialsTokenFlowTest extends AbstractOidcClientAuthentica
Assert.assertNotNull(response.getTokens().getBearerAccessToken());
Assert.assertEquals(response.getTokens().getBearerAccessToken().getLifetime(), 600);
Assert.assertNull(response.getTokens().getBearerAccessToken().getScope());
- verifyClaims(null, response.getTokens().getBearerAccessToken(), clientId, new Scope(),
+ verifyClaims(null, response.getTokens().getBearerAccessToken(), clientId, null,
Collections.singletonList(resource), "eduPersonScopedAffiliation");
}
@@ -162,7 +162,7 @@ public class ClientCredentialsTokenFlowTest extends AbstractOidcClientAuthentica
Assert.assertNotNull(response.getTokens().getBearerAccessToken());
Assert.assertEquals(response.getTokens().getBearerAccessToken().getLifetime(), 600);
Assert.assertNull(response.getTokens().getBearerAccessToken().getScope());
- verifyClaims(null, response.getTokens().getBearerAccessToken(), clientId, new Scope(),
+ verifyClaims(null, response.getTokens().getBearerAccessToken(), clientId, null,
Collections.singletonList(resource), "eduPersonScopedAffiliation");
}
@@ -176,7 +176,7 @@ public class ClientCredentialsTokenFlowTest extends AbstractOidcClientAuthentica
Assert.assertNotNull(response.getTokens().getBearerAccessToken());
Assert.assertEquals(response.getTokens().getBearerAccessToken().getLifetime(), 600);
Assert.assertNull(response.getTokens().getBearerAccessToken().getScope());
- verifyClaims(null, response.getTokens().getBearerAccessToken(), clientId, new Scope(),
+ verifyClaims(null, response.getTokens().getBearerAccessToken(), clientId, null,
Collections.singletonList(resource), "eduPersonScopedAffiliation");
}
@@ -234,7 +234,7 @@ public class ClientCredentialsTokenFlowTest extends AbstractOidcClientAuthentica
Assert.assertNotNull(response.getTokens().getBearerAccessToken());
Assert.assertEquals(response.getTokens().getBearerAccessToken().getLifetime(), 600);
Assert.assertNull(response.getTokens().getBearerAccessToken().getScope());
- verifyClaims(null, response.getTokens().getBearerAccessToken(), clientId, new Scope(),
+ verifyClaims(null, response.getTokens().getBearerAccessToken(), clientId, null,
Collections.singletonList(resource), "email", "eduPersonScopedAffiliation");
}
@@ -279,7 +279,7 @@ public class ClientCredentialsTokenFlowTest extends AbstractOidcClientAuthentica
Assert.assertNotNull(response.getTokens().getBearerAccessToken());
Assert.assertEquals(response.getTokens().getBearerAccessToken().getLifetime(), 600);
Assert.assertNull(response.getTokens().getBearerAccessToken().getScope());
- verifyClaims("JWT", response.getTokens().getBearerAccessToken(), clientId, new Scope(),
+ verifyClaims("JWT", response.getTokens().getBearerAccessToken(), clientId, null,
Collections.singletonList(resource), "eduPersonScopedAffiliation");
}
@@ -401,7 +401,7 @@ public class ClientCredentialsTokenFlowTest extends AbstractOidcClientAuthentica
* @throws JOSEException
*/
private void verifyClaims(@Nullable final String type, @Nonnull final AccessToken token, @Nonnull final String cid,
- @Nonnull final Scope s, @Nonnull @NonnullElements final Collection<String> audiences,
+ @Nullable final Scope s, @Nonnull @NonnullElements final Collection<String> audiences,
@Nullable final String...customClaims)
throws ParseException, DataSealerException, JOSEException {
@@ -453,7 +453,7 @@ public class ClientCredentialsTokenFlowTest extends AbstractOidcClientAuthentica
assertEquals(claims.getExpirationTime().toInstant(), claims.getIssueTime().toInstant().plusSeconds(600));
assertEquals(claims.getIssuer(), "https://op.example.org");
assertTrue(claims.getIssueTime().toInstant().isBefore(Instant.now()));
- assertEquals(claims.getStringClaim(TokenClaimsSet.KEY_SCOPE), s.toString());
+ assertEquals(claims.getStringClaim(TokenClaimsSet.KEY_SCOPE), s == null ? null : s.toString());
assertEquals(claims.getSubject(), cid);
if (customClaims != null) {
for (final String c : customClaims) {
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list