[java-idp-oidc] branch main updated: JOIDC-225 - Relocate and improve lookup functions for request message contents
Henri Mikkonen
henri.mikkonen at iki.fi
Mon Oct 7 07:46:56 UTC 2024
This is an automated email from the git hooks/post-receive script.
hjmikkon pushed a commit to branch main
in repository java-idp-oidc.
View the commit online:
http://git.shibboleth.net/view/?p=java-idp-oidc.git;a=commit;h=5a49bdbfc9f0c6f3a6bac867bd03b295434e9b0f
The following commit(s) were added to refs/heads/main by this push:
new 5a49bdbf JOIDC-225 - Relocate and improve lookup functions for request message contents
5a49bdbf is described below
commit 5a49bdbfc9f0c6f3a6bac867bd03b295434e9b0f
Author: Henri Mikkonen <henri.mikkonen at iki.fi>
AuthorDate: Mon Oct 7 10:46:45 2024 +0300
JOIDC-225 - Relocate and improve lookup functions for request message contents
https://shibboleth.atlassian.net/browse/JOIDC-225
Improved wrong type handling and testing with request objects
---
.../DefaultRequestResponseTypeLookupFunction.java | 2 +-
.../DefaultRequestedAcrLookupFunction.java | 2 +-
.../DefaultRequestedPromptLookupFunction.java | 2 +-
.../DefaultRequestedScopeLookupFunction.java | 2 +-
.../DefaultRequestLoginHintLookupFunctionTest.java | 13 ++++++++++++
.../navigate/DefaultRequestMaxAgeFunctionTest.java | 11 ++++++++++
.../DefaultRequestNonceLookupFunctionTest.java | 13 ++++++++++++
...faultRequestResponseModeLookupFunctionTest.java | 13 ++++++++++++
...faultRequestResponseTypeLookupFunctionTest.java | 13 ++++++++++++
.../DefaultRequestStateLookupFunctionTest.java | 13 ++++++++++++
.../DefaultRequestedAcrLookupFunctionTest.java | 13 ++++++++++++
.../DefaultRequestedPromptLookupFunctionTest.java | 12 +++++++++++
.../DefaultRequestedScopeLookupFunctionTest.java | 13 ++++++++++++
.../oidc/op/profile/flow/AuthorizeFlowTest.java | 24 ++++++++++++++++++++++
.../op/profile/flow/PushedAuthorizeFlowTest.java | 20 ++++++++++++++++++
15 files changed, 162 insertions(+), 4 deletions(-)
diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/messaging/context/navigate/DefaultRequestResponseTypeLookupFunction.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/messaging/context/navigate/DefaultRequestResponseTypeLookupFunction.java
index 60aa5f12..08dd7158 100644
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/messaging/context/navigate/DefaultRequestResponseTypeLookupFunction.java
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/messaging/context/navigate/DefaultRequestResponseTypeLookupFunction.java
@@ -50,7 +50,7 @@ public class DefaultRequestResponseTypeLookupFunction
final boolean isRequestObjectFromPar) {
try {
if (requestObject != null && requestObject.getJWTClaimsSet().getClaim("response_type") != null) {
- return ResponseType.parse((String) requestObject.getJWTClaimsSet().getClaim("response_type"));
+ return ResponseType.parse(requestObject.getJWTClaimsSet().getStringClaim("response_type"));
}
} catch (final ParseException | com.nimbusds.oauth2.sdk.ParseException e) {
log.error("Unable to parse response type from request object response_type value {}", e.getMessage());
diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/messaging/context/navigate/DefaultRequestedAcrLookupFunction.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/messaging/context/navigate/DefaultRequestedAcrLookupFunction.java
index f24be19a..e5e95215 100644
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/messaging/context/navigate/DefaultRequestedAcrLookupFunction.java
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/messaging/context/navigate/DefaultRequestedAcrLookupFunction.java
@@ -52,7 +52,7 @@ public class DefaultRequestedAcrLookupFunction extends AbstractAuthenticationReq
try {
if (requestObject != null && requestObject.getJWTClaimsSet().getClaim("acr_values") != null) {
final List<ACR> reqObjectAcr = new ArrayList<ACR>();
- final String[] acrs = ((String) requestObject.getJWTClaimsSet().getClaim("acr_values")).split(" ");
+ final String[] acrs = requestObject.getJWTClaimsSet().getStringClaim("acr_values").split(" ");
for (final String acr : acrs) {
reqObjectAcr.add(new ACR(acr));
}
diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/messaging/context/navigate/DefaultRequestedPromptLookupFunction.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/messaging/context/navigate/DefaultRequestedPromptLookupFunction.java
index bba56e46..e5c3ced0 100644
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/messaging/context/navigate/DefaultRequestedPromptLookupFunction.java
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/messaging/context/navigate/DefaultRequestedPromptLookupFunction.java
@@ -49,7 +49,7 @@ public class DefaultRequestedPromptLookupFunction extends AbstractAuthorizationR
final boolean isRequestObjectFromPar) {
try {
if (requestObject != null && requestObject.getJWTClaimsSet().getClaim("prompt") != null) {
- return Prompt.parse((String) requestObject.getJWTClaimsSet().getClaim("prompt"));
+ return Prompt.parse(requestObject.getJWTClaimsSet().getStringClaim("prompt"));
}
} catch (final ParseException | com.nimbusds.oauth2.sdk.ParseException e) {
log.error("Unable to parse prompt from request object prompt value");
diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/messaging/context/navigate/DefaultRequestedScopeLookupFunction.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/messaging/context/navigate/DefaultRequestedScopeLookupFunction.java
index ba8abe43..6462c830 100644
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/messaging/context/navigate/DefaultRequestedScopeLookupFunction.java
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/messaging/context/navigate/DefaultRequestedScopeLookupFunction.java
@@ -49,7 +49,7 @@ public class DefaultRequestedScopeLookupFunction extends AbstractAuthorizationRe
final boolean isRequestObjectFromPar) {
try {
if (requestObject != null && requestObject.getJWTClaimsSet().getClaim("scope") != null) {
- return Scope.parse((String) requestObject.getJWTClaimsSet().getClaim("scope"));
+ return Scope.parse(requestObject.getJWTClaimsSet().getStringClaim("scope"));
}
} catch (final ParseException e) {
log.error("Unable to parse scope from request object scope value");
diff --git a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/messaging/context/navigate/DefaultRequestLoginHintLookupFunctionTest.java b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/messaging/context/navigate/DefaultRequestLoginHintLookupFunctionTest.java
index c6ff155b..36bdbb49 100644
--- a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/messaging/context/navigate/DefaultRequestLoginHintLookupFunctionTest.java
+++ b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/messaging/context/navigate/DefaultRequestLoginHintLookupFunctionTest.java
@@ -15,6 +15,8 @@
package net.shibboleth.idp.plugin.oidc.op.messaging.context.navigate;
import java.net.URI;
+import java.util.List;
+
import org.testng.annotations.BeforeMethod;
import org.testng.annotations.Test;
import com.nimbusds.jwt.JWTClaimsSet;
@@ -57,4 +59,15 @@ public class DefaultRequestLoginHintLookupFunctionTest extends AbstractAuthentic
Assert.assertEquals("therealhint",lookup.apply(prc));
}
+ @Test
+ public void testInvalidReqObject() {
+ JWTClaimsSet ro = new JWTClaimsSet.Builder().claim("login_hint", List.of("1", "2")).build();
+ AuthenticationRequest req = new AuthenticationRequest.Builder(new ResponseType("code"), new Scope("openid"),
+ new ClientID("000123"), URI.create("https://example.com/callback"))
+ .state(new State()).requestObject(new PlainJWT(ro)).build();
+ msgCtx.setMessage(req);
+ oidcCtx.setRequestObject(req.getRequestObject());
+ Assert.assertNull(lookup.apply(prc));
+ }
+
}
\ No newline at end of file
diff --git a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/messaging/context/navigate/DefaultRequestMaxAgeFunctionTest.java b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/messaging/context/navigate/DefaultRequestMaxAgeFunctionTest.java
index bd8bbc8e..5f3a01d7 100644
--- a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/messaging/context/navigate/DefaultRequestMaxAgeFunctionTest.java
+++ b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/messaging/context/navigate/DefaultRequestMaxAgeFunctionTest.java
@@ -67,4 +67,15 @@ public class DefaultRequestMaxAgeFunctionTest extends AbstractAuthenticationRequ
Assert.assertEquals(Duration.ofSeconds(600), lookup.apply(prc));
}
+ @Test
+ public void testInvalidReqObject() {
+ JWTClaimsSet ro = new JWTClaimsSet.Builder().claim("max_age", "string").build();
+ AuthenticationRequest req = new AuthenticationRequest.Builder(new ResponseType("code"), new Scope("openid"),
+ new ClientID("000123"), URI.create("https://example.com/callback"))
+ .state(new State()).requestObject(new PlainJWT(ro)).build();
+ msgCtx.setMessage(req);
+ oidcCtx.setRequestObject(req.getRequestObject());
+ Assert.assertNull(lookup.apply(prc));
+ }
+
}
\ No newline at end of file
diff --git a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/messaging/context/navigate/DefaultRequestNonceLookupFunctionTest.java b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/messaging/context/navigate/DefaultRequestNonceLookupFunctionTest.java
index 335ab622..2cbefcdf 100644
--- a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/messaging/context/navigate/DefaultRequestNonceLookupFunctionTest.java
+++ b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/messaging/context/navigate/DefaultRequestNonceLookupFunctionTest.java
@@ -15,6 +15,8 @@
package net.shibboleth.idp.plugin.oidc.op.messaging.context.navigate;
import java.net.URI;
+import java.util.List;
+
import org.testng.annotations.BeforeMethod;
import org.testng.annotations.Test;
import com.nimbusds.jwt.JWTClaimsSet;
@@ -62,4 +64,15 @@ public class DefaultRequestNonceLookupFunctionTest extends AbstractAuthenticatio
Assert.assertEquals("reqobject", result.getValue());
}
+ @Test
+ public void testInvalidReqObject() {
+ JWTClaimsSet ro = new JWTClaimsSet.Builder().claim("nonce", List.of("string", "another")).build();
+ AuthenticationRequest req = new AuthenticationRequest.Builder(new ResponseType("code"), new Scope("openid"),
+ new ClientID("000123"), URI.create("https://example.com/callback"))
+ .state(new State()).requestObject(new PlainJWT(ro)).build();
+ msgCtx.setMessage(req);
+ oidcCtx.setRequestObject(req.getRequestObject());
+ Assert.assertNull(lookup.apply(prc));
+ }
+
}
\ No newline at end of file
diff --git a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/messaging/context/navigate/DefaultRequestResponseModeLookupFunctionTest.java b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/messaging/context/navigate/DefaultRequestResponseModeLookupFunctionTest.java
index e950e831..0440eec4 100644
--- a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/messaging/context/navigate/DefaultRequestResponseModeLookupFunctionTest.java
+++ b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/messaging/context/navigate/DefaultRequestResponseModeLookupFunctionTest.java
@@ -15,6 +15,8 @@
package net.shibboleth.idp.plugin.oidc.op.messaging.context.navigate;
import java.net.URI;
+import java.util.List;
+
import org.testng.annotations.BeforeMethod;
import org.testng.annotations.Test;
import com.nimbusds.jwt.JWTClaimsSet;
@@ -58,4 +60,15 @@ public class DefaultRequestResponseModeLookupFunctionTest extends AbstractAuthor
Assert.assertEquals(ResponseMode.FORM_POST, lookup.apply(prc));
}
+ @Test
+ public void testInvalidReqObject() {
+ JWTClaimsSet ro = new JWTClaimsSet.Builder().claim("response_mode", List.of("string", "another")).build();
+ AuthenticationRequest req = new AuthenticationRequest.Builder(new ResponseType("code"), new Scope("openid"),
+ new ClientID("000123"), URI.create("https://example.com/callback"))
+ .state(new State()).requestObject(new PlainJWT(ro)).build();
+ msgCtx.setMessage(req);
+ oidcCtx.setRequestObject(req.getRequestObject());
+ Assert.assertNull(lookup.apply(prc));
+ }
+
}
\ No newline at end of file
diff --git a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/messaging/context/navigate/DefaultRequestResponseTypeLookupFunctionTest.java b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/messaging/context/navigate/DefaultRequestResponseTypeLookupFunctionTest.java
index f4cd5f35..e2b3bb1d 100644
--- a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/messaging/context/navigate/DefaultRequestResponseTypeLookupFunctionTest.java
+++ b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/messaging/context/navigate/DefaultRequestResponseTypeLookupFunctionTest.java
@@ -15,6 +15,8 @@
package net.shibboleth.idp.plugin.oidc.op.messaging.context.navigate;
import java.net.URI;
+import java.util.List;
+
import org.testng.annotations.BeforeMethod;
import org.testng.annotations.Test;
import com.nimbusds.jwt.JWTClaimsSet;
@@ -64,4 +66,15 @@ public class DefaultRequestResponseTypeLookupFunctionTest extends AbstractAuthor
Assert.assertEquals(3, result.size());
}
+ @Test
+ public void testInvalidReqObject() {
+ JWTClaimsSet ro = new JWTClaimsSet.Builder().claim("response_type", List.of("code", "token")).build();
+ AuthenticationRequest req = new AuthenticationRequest.Builder(new ResponseType("code"), new Scope("openid"),
+ new ClientID("000123"), URI.create("https://example.com/callback"))
+ .state(new State()).requestObject(new PlainJWT(ro)).build();
+ msgCtx.setMessage(req);
+ oidcCtx.setRequestObject(req.getRequestObject());
+ Assert.assertNull(lookup.apply(prc));
+ }
+
}
\ No newline at end of file
diff --git a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/messaging/context/navigate/DefaultRequestStateLookupFunctionTest.java b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/messaging/context/navigate/DefaultRequestStateLookupFunctionTest.java
index 779b2fe2..52a75db4 100644
--- a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/messaging/context/navigate/DefaultRequestStateLookupFunctionTest.java
+++ b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/messaging/context/navigate/DefaultRequestStateLookupFunctionTest.java
@@ -15,6 +15,8 @@
package net.shibboleth.idp.plugin.oidc.op.messaging.context.navigate;
import java.net.URI;
+import java.util.List;
+
import org.testng.annotations.BeforeMethod;
import org.testng.annotations.Test;
import com.nimbusds.jwt.JWTClaimsSet;
@@ -64,4 +66,15 @@ public class DefaultRequestStateLookupFunctionTest extends AbstractAuthorization
Assert.assertEquals(stateReqObj, result.getValue());
}
+ @Test
+ public void testInvalidReqObject() {
+ JWTClaimsSet ro = new JWTClaimsSet.Builder().claim("state", List.of("string", "another")).build();
+ AuthenticationRequest req = new AuthenticationRequest.Builder(new ResponseType("code"), new Scope("openid"),
+ new ClientID("000123"), URI.create("https://example.com/callback"))
+ .state(new State()).requestObject(new PlainJWT(ro)).build();
+ msgCtx.setMessage(req);
+ oidcCtx.setRequestObject(req.getRequestObject());
+ Assert.assertNull(lookup.apply(prc));
+ }
+
}
\ No newline at end of file
diff --git a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/messaging/context/navigate/DefaultRequestedAcrLookupFunctionTest.java b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/messaging/context/navigate/DefaultRequestedAcrLookupFunctionTest.java
index 04ede6d1..bf2ba107 100644
--- a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/messaging/context/navigate/DefaultRequestedAcrLookupFunctionTest.java
+++ b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/messaging/context/navigate/DefaultRequestedAcrLookupFunctionTest.java
@@ -73,4 +73,17 @@ public class DefaultRequestedAcrLookupFunctionTest extends AbstractAuthenticatio
Assert.assertEquals(2, result.size());
}
+ @Test
+ public void testInvalidReqObject() {
+ List<ACR> acrValues = new ArrayList<ACR>();
+ acrValues.add(new ACR("1"));
+ JWTClaimsSet ro = new JWTClaimsSet.Builder().claim("acr_values", List.of("1", "2")).build();
+ AuthenticationRequest req = new AuthenticationRequest.Builder(new ResponseType("code"), new Scope("openid"),
+ new ClientID("000123"), URI.create("https://example.com/callback")).acrValues(acrValues)
+ .state(new State()).requestObject(new PlainJWT(ro)).build();
+ msgCtx.setMessage(req);
+ oidcCtx.setRequestObject(req.getRequestObject());
+ Assert.assertNull(lookup.apply(prc));
+ }
+
}
\ No newline at end of file
diff --git a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/messaging/context/navigate/DefaultRequestedPromptLookupFunctionTest.java b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/messaging/context/navigate/DefaultRequestedPromptLookupFunctionTest.java
index 4ab2efc7..b1bec42c 100644
--- a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/messaging/context/navigate/DefaultRequestedPromptLookupFunctionTest.java
+++ b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/messaging/context/navigate/DefaultRequestedPromptLookupFunctionTest.java
@@ -15,6 +15,7 @@
package net.shibboleth.idp.plugin.oidc.op.messaging.context.navigate;
import java.net.URI;
+import java.util.List;
import org.testng.annotations.BeforeMethod;
import org.testng.annotations.Test;
@@ -72,4 +73,15 @@ public class DefaultRequestedPromptLookupFunctionTest extends AbstractAuthentica
Assert.assertEquals(2, result.size());
}
+ @Test
+ public void testInvalidReqObject() {
+ JWTClaimsSet ro = new JWTClaimsSet.Builder().claim("prompt", List.of("1", "2")).build();
+ AuthenticationRequest req = new AuthenticationRequest.Builder(new ResponseType("code"), new Scope("openid"),
+ new ClientID("000123"), URI.create("https://example.com/callback"))
+ .state(new State()).requestObject(new PlainJWT(ro)).build();
+ msgCtx.setMessage(req);
+ oidcCtx.setRequestObject(req.getRequestObject());
+ Assert.assertNull(lookup.apply(prc));
+ }
+
}
\ No newline at end of file
diff --git a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/messaging/context/navigate/DefaultRequestedScopeLookupFunctionTest.java b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/messaging/context/navigate/DefaultRequestedScopeLookupFunctionTest.java
index 8d44a4e6..3bacb896 100644
--- a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/messaging/context/navigate/DefaultRequestedScopeLookupFunctionTest.java
+++ b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/messaging/context/navigate/DefaultRequestedScopeLookupFunctionTest.java
@@ -15,6 +15,8 @@
package net.shibboleth.idp.plugin.oidc.op.messaging.context.navigate;
import java.net.URI;
+import java.util.List;
+
import org.testng.annotations.BeforeMethod;
import org.testng.annotations.Test;
import com.nimbusds.jwt.JWTClaimsSet;
@@ -112,4 +114,15 @@ public class DefaultRequestedScopeLookupFunctionTest extends AbstractAuthorizati
Assert.assertEquals(result.size(), 0);
}
+ @Test
+ public void testInvalidReqObject() {
+ JWTClaimsSet ro = new JWTClaimsSet.Builder().claim("scope", List.of("openid", "profile")).build();
+ AuthenticationRequest req = new AuthenticationRequest.Builder(new ResponseType("code"), new Scope("openid"),
+ new ClientID("000123"), URI.create("https://example.com/callback"))
+ .state(new State()).requestObject(new PlainJWT(ro)).build();
+ msgCtx.setMessage(req);
+ oidcCtx.setRequestObject(req.getRequestObject());
+ Assert.assertNull(lookup.apply(prc));
+ }
+
}
\ No newline at end of file
diff --git a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/AuthorizeFlowTest.java b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/AuthorizeFlowTest.java
index 8dda7b4b..12a978a8 100644
--- a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/AuthorizeFlowTest.java
+++ b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/AuthorizeFlowTest.java
@@ -2020,6 +2020,30 @@ public class AuthorizeFlowTest extends AbstractOidcFlowTest {
setRequestParameters(List.of(new Pair<>("client_id", "mockClientId"),
new Pair<>("scope", "profile"),
new Pair<>("redirect_uri", redirectUri),
+ new Pair<>("response_type", "code"),
+ new Pair<>("request", requestObject.serialize())));
+ storeMetadata(storageService, clientId, clientSecret, scope, redirectUri);
+
+ initializeThreadLocals();
+
+ final FlowExecutionResult result = flowExecutor.launchExecution(FLOW_ID, null, externalContext);
+ assertErrorCode(result, "unsupported_response_type");
+ }
+
+ @Test
+ public void testWithOAuth2ReqObjectInvalidResponseType() throws IOException, SessionException, JOSEException {
+ final JWTClaimsSet ro = new JWTClaimsSet.Builder()
+ .claim("iss", clientId)
+ .claim("aud", issuer)
+ .claim("redirect_uri", "https://example.org/cb")
+ .claim("response_type", List.of("code", "token"))
+ .build();
+ final SignedJWT requestObject = createSecretJWT(ro, clientSecret);
+ request.setMethod("GET");
+ setRequestParameters(List.of(new Pair<>("client_id", "mockClientId"),
+ new Pair<>("scope", "profile"),
+ new Pair<>("redirect_uri", redirectUri),
+ new Pair<>("response_type", "code"),
new Pair<>("request", requestObject.serialize())));
storeMetadata(storageService, clientId, clientSecret, scope, redirectUri);
diff --git a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/PushedAuthorizeFlowTest.java b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/PushedAuthorizeFlowTest.java
index 0386ef9e..ffb516f2 100644
--- a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/PushedAuthorizeFlowTest.java
+++ b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/PushedAuthorizeFlowTest.java
@@ -380,6 +380,26 @@ public class PushedAuthorizeFlowTest extends AbstractOidcClientAuthenticationFlo
assertErrorCode(result, OAuth2Error.INVALID_REQUEST_CODE);
}
+ @Test
+ public void testOIDCInvalidResponseTypeRO() throws IOException, NoSuchAlgorithmException, URISyntaxException,
+ DataSealerException, ComponentInitializationException, JOSEException {
+ storeMetadata(storageService, clientId, clientSecret, scope, "https://example.org/cb");
+ setBasicAuth(clientId, clientSecret);
+ final JWTClaimsSet ro = new JWTClaimsSet.Builder()
+ .claim("iss", clientId)
+ .claim("client_id", clientId)
+ .claim("aud", issuer)
+ .claim("redirect_uri", "https://example.org/cb")
+ .claim("scope", "openid profile")
+ .claim("response_type", List.of("code", "token"))
+ .build();
+ final SignedJWT requestObject = createSecretJWT(ro, clientSecret);
+ setHttpFormRequest("POST", createRequestParameters(clientId, "openid profile", null,
+ requestObject.serialize()));
+ final FlowExecutionResult result = flowExecutor.launchExecution(FLOW_ID, null, externalContext);
+ assertErrorCode(result, OAuth2Error.INVALID_REQUEST_CODE);
+ }
+
@Test
public void testOIDCResponseTypeInParamsWithRO() throws IOException, NoSuchAlgorithmException, URISyntaxException,
DataSealerException, ComponentInitializationException, JOSEException {
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list