[java-idp-oidc] branch main updated: JOIDC-187 - Add metadata-driven naming to attribute transcoders
Henri Mikkonen
henri.mikkonen at iki.fi
Thu Mar 14 10:04:50 UTC 2024
This is an automated email from the git hooks/post-receive script.
hjmikkon pushed a commit to branch main
in repository java-idp-oidc.
View the commit online:
http://git.shibboleth.net/view/?p=java-idp-oidc.git;a=commit;h=f686d2501f194af8753f76ff3abcc90585ccd1f4
The following commit(s) were added to refs/heads/main by this push:
new f686d250 JOIDC-187 - Add metadata-driven naming to attribute transcoders
f686d250 is described below
commit f686d2501f194af8753f76ff3abcc90585ccd1f4
Author: Henri Mikkonen <henri.mikkonen at iki.fi>
AuthorDate: Thu Mar 14 12:04:33 2024 +0200
JOIDC-187 - Add metadata-driven naming to attribute transcoders
https://shibboleth.atlassian.net/browse/JOIDC-187
Added tests to verify the metadata-driven naming implemented by
JCOMOIDC-103.
---
.../op/profile/flow/ClientCredentialsTokenFlowTest.java | 2 +-
.../idp/plugin/oidc/op/profile/flow/TokenFlowTest.java | 4 +++-
.../idp/plugin/oidc/op/profile/flow/UserInfoTest.java | 17 +++++++++++++++++
.../shibboleth/idp/module/conf/attribute-registry.xml | 3 ---
.../shibboleth/idp/module/conf/attribute-resolver.xml | 1 -
.../idp/module/conf/attributes/custom/mail.properties | 4 ++++
.../impl/EntityDescriptor-with-oidcmd-clientsecret.xml | 4 ++++
pom.xml | 2 +-
8 files changed, 30 insertions(+), 7 deletions(-)
diff --git a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/ClientCredentialsTokenFlowTest.java b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/ClientCredentialsTokenFlowTest.java
index 6dd89fc3..44f3ef18 100644
--- a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/ClientCredentialsTokenFlowTest.java
+++ b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/ClientCredentialsTokenFlowTest.java
@@ -331,7 +331,7 @@ public class ClientCredentialsTokenFlowTest extends AbstractOidcClientAuthentica
Assert.assertEquals(response.getTokens().getBearerAccessToken().getLifetime(), 600);
Assert.assertEquals(response.getTokens().getBearerAccessToken().getScope(), scope);
verifyClaims("JWT", response.getTokens().getBearerAccessToken(), clientIdSaml, scope,
- Collections.singletonList(resourceSaml), "email", "eduPersonScopedAffiliation");
+ Collections.singletonList(resourceSaml), "customEmailName", "eduPersonScopedAffiliation");
}
diff --git a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/TokenFlowTest.java b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/TokenFlowTest.java
index 224048e0..60699e62 100644
--- a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/TokenFlowTest.java
+++ b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/TokenFlowTest.java
@@ -665,7 +665,9 @@ public class TokenFlowTest extends AbstractOidcClientAuthenticationFlowTest {
// the email-claim exists in id_token as it's defined to be always included in the SAML metadata
final JWT idToken = response.getOIDCTokens().getIDToken();
Assert.assertNotNull(idToken);
- Assert.assertEquals(idToken.getJWTClaimsSet().getClaim("email"), "jdoe at example.org");
+ Assert.assertNull(idToken.getJWTClaimsSet().getClaim("email"));
+ //The customEmailName for the claim is specified in the SAML metadata
+ Assert.assertEquals(idToken.getJWTClaimsSet().getClaim("customEmailName"), "jdoe at example.org");
Assert.assertNotNull(idToken.getJWTClaimsSet().getClaim("at_hash"));
}
diff --git a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/UserInfoTest.java b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/UserInfoTest.java
index 5e8a830d..21b67e81 100644
--- a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/UserInfoTest.java
+++ b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/UserInfoTest.java
@@ -262,6 +262,23 @@ public class UserInfoTest extends AbstractOidcApiFlowTest {
Assert.assertNull(response.getUserInfoJWT());
}
+ @Test
+ public void testSuccessEmailResolutionSaml() throws URISyntaxException, NoSuchAlgorithmException, DataSealerException,
+ ComponentInitializationException, IOException {
+ final BearerAccessToken token = buildToken(clientIdSaml, subject, new Scope("openid", "email"));
+ request.addHeader("Authorization", token.toAuthorizationHeader());
+ final FlowExecutionResult result = flowExecutor.launchExecution(FLOW_ID, null, externalContext);
+ final UserInfoSuccessResponse response = parseSuccessResponse(result, UserInfoSuccessResponse.class);
+ Assert.assertEquals(response.getUserInfo().getSubject().getValue(), subject);
+ final UserInfo userInfo = response.getUserInfo();
+ Assert.assertNotNull(userInfo);
+ Assert.assertNull(userInfo.getEmailAddress());
+ //The customEmailName for the claim is specified in the SAML metadata
+ Assert.assertEquals(userInfo.getClaim("customEmailName"), "jdoe at example.org");
+ Assert.assertNull(userInfo.getNickname());
+ Assert.assertNull(response.getUserInfoJWT());
+ }
+
@Test
public void testSuccessEmailResolution() throws URISyntaxException, NoSuchAlgorithmException, DataSealerException,
ComponentInitializationException, IOException {
diff --git a/idp-oidc-extension-impl/src/test/resources/net/shibboleth/idp/module/conf/attribute-registry.xml b/idp-oidc-extension-impl/src/test/resources/net/shibboleth/idp/module/conf/attribute-registry.xml
index 1c8c6a9f..2733f860 100644
--- a/idp-oidc-extension-impl/src/test/resources/net/shibboleth/idp/module/conf/attribute-registry.xml
+++ b/idp-oidc-extension-impl/src/test/resources/net/shibboleth/idp/module/conf/attribute-registry.xml
@@ -22,10 +22,7 @@
-->
<!-- Default directory for custom mappings. -->
- <!--
- This doesn't load when idp.home is classpath:
<bean parent="shibboleth.TranscodingRuleLoader"
c:dir="%{idp.home}/conf/attributes/custom"
c:extensions="#{{'.txt', '.props', '.properties', '.rule'}}" />
- -->
</beans>
diff --git a/idp-oidc-extension-impl/src/test/resources/net/shibboleth/idp/module/conf/attribute-resolver.xml b/idp-oidc-extension-impl/src/test/resources/net/shibboleth/idp/module/conf/attribute-resolver.xml
index 4853ed0c..5d88aeef 100644
--- a/idp-oidc-extension-impl/src/test/resources/net/shibboleth/idp/module/conf/attribute-resolver.xml
+++ b/idp-oidc-extension-impl/src/test/resources/net/shibboleth/idp/module/conf/attribute-resolver.xml
@@ -51,7 +51,6 @@
-->
<AttributeDefinition id="mail" xsi:type="Template">
<InputAttributeDefinition ref="uid" />
- <AttributeEncoder xsi:type="oidc:OIDCString" name="email" />
<Template>
<![CDATA[
${uid}@example.org
diff --git a/idp-oidc-extension-impl/src/test/resources/net/shibboleth/idp/module/conf/attributes/custom/mail.properties b/idp-oidc-extension-impl/src/test/resources/net/shibboleth/idp/module/conf/attributes/custom/mail.properties
new file mode 100644
index 00000000..ab79bf62
--- /dev/null
+++ b/idp-oidc-extension-impl/src/test/resources/net/shibboleth/idp/module/conf/attributes/custom/mail.properties
@@ -0,0 +1,4 @@
+id=mail
+transcoder=OIDCStringTranscoder
+oidc.name=email
+oidc.nameFromSamlMetadata=true
\ No newline at end of file
diff --git a/idp-oidc-extension-impl/src/test/resources/net/shibboleth/idp/oidc/metadata/impl/EntityDescriptor-with-oidcmd-clientsecret.xml b/idp-oidc-extension-impl/src/test/resources/net/shibboleth/idp/oidc/metadata/impl/EntityDescriptor-with-oidcmd-clientsecret.xml
index f67ccdfc..23396549 100644
--- a/idp-oidc-extension-impl/src/test/resources/net/shibboleth/idp/oidc/metadata/impl/EntityDescriptor-with-oidcmd-clientsecret.xml
+++ b/idp-oidc-extension-impl/src/test/resources/net/shibboleth/idp/oidc/metadata/impl/EntityDescriptor-with-oidcmd-clientsecret.xml
@@ -6,6 +6,10 @@
NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">
<saml:AttributeValue>mail</saml:AttributeValue>
</saml:Attribute>
+ <saml:Attribute Name="http://shibboleth.net/ns/attributes/naming/oidc"
+ NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">
+ <saml:AttributeValue>mail customEmailName</saml:AttributeValue>
+ </saml:Attribute>
</mdattr:EntityAttributes>
</md:Extensions>
<md:SPSSODescriptor xmlns:oidcmd="urn:mace:shibboleth:metadata:oidc:1.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" protocolSupportEnumeration="http://openid.net/specs/openid-connect-core-1_0.html">
diff --git a/pom.xml b/pom.xml
index b041bcdf..2e732c9f 100644
--- a/pom.xml
+++ b/pom.xml
@@ -36,7 +36,7 @@
<accessors.smart.version>1.2</accessors.smart.version>
<nimbus.lang.tag.version>1.7</nimbus.lang.tag.version>
<nimbus.content.type.version>2.2</nimbus.content.type.version>
- <oidc.config.version>2.0.0</oidc.config.version>
+ <oidc.config.version>2.1.0-SNAPSHOT</oidc.config.version>
<commons.io.version>2.6</commons.io.version>
<checkstyle.configLocation>${project.basedir}/resources/checkstyle.xml</checkstyle.configLocation>
</properties>
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list