[java-plugin-shibd-saml] branch main updated: Add additional response validation to test.

[Scott Cantor]

This is an automated email from the git hooks/post-receive script.

scantor pushed a commit to branch main
in repository java-plugin-shibd-saml.

View the commit online:
http://git.shibboleth.net/view/?p=java-plugin-shibd-saml.git;a=commit;h=95eb1f935b78fbf8f34c4a6814913efdd17fdd83

The following commit(s) were added to refs/heads/main by this push:
     new 95eb1f9  Add additional response validation to test.
95eb1f9 is described below

commit 95eb1f935b78fbf8f34c4a6814913efdd17fdd83
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Tue Oct 8 11:43:52 2024 -0400

    Add additional response validation to test.
---
 .../flows/saml2/SAML2TokenConsumerFlowTest.java    | 53 ++++++++++++++++++++--
 1 file changed, 48 insertions(+), 5 deletions(-)

diff --git a/sp-saml-conf-impl/src/test/java/net/shibboleth/sp/saml/flows/saml2/SAML2TokenConsumerFlowTest.java b/sp-saml-conf-impl/src/test/java/net/shibboleth/sp/saml/flows/saml2/SAML2TokenConsumerFlowTest.java
index 478a940..0de780c 100644
--- a/sp-saml-conf-impl/src/test/java/net/shibboleth/sp/saml/flows/saml2/SAML2TokenConsumerFlowTest.java
+++ b/sp-saml-conf-impl/src/test/java/net/shibboleth/sp/saml/flows/saml2/SAML2TokenConsumerFlowTest.java
@@ -14,20 +14,26 @@
 
 package net.shibboleth.sp.saml.flows.saml2;
 
+import java.io.ByteArrayInputStream;
 import java.io.ByteArrayOutputStream;
 import java.io.IOException;
 import java.nio.charset.StandardCharsets;
 import java.time.Instant;
+import java.util.HashSet;
+import java.util.Set;
 
 import javax.annotation.Nonnull;
 import javax.annotation.Nullable;
 
+import org.opensaml.core.xml.XMLObject;
 import org.opensaml.core.xml.io.MarshallingException;
+import org.opensaml.core.xml.io.UnmarshallingException;
 import org.opensaml.core.xml.util.XMLObjectSupport;
 import org.opensaml.profile.action.EventIds;
 import org.opensaml.profile.context.ProfileRequestContext;
 import org.opensaml.saml.saml2.core.Assertion;
 import org.opensaml.saml.saml2.core.AuthnContext;
+import org.opensaml.saml.saml2.core.AuthnStatement;
 import org.opensaml.saml.saml2.core.Conditions;
 import org.opensaml.saml.saml2.core.Issuer;
 import org.opensaml.saml.saml2.core.NameID;
@@ -60,12 +66,14 @@ import org.testng.annotations.Test;
 import net.shibboleth.idp.authn.AuthnEventIds;
 import net.shibboleth.idp.profile.IdPEventIds;
 import net.shibboleth.shared.codec.Base64Support;
+import net.shibboleth.shared.codec.DecodingException;
 import net.shibboleth.shared.codec.EncodingException;
 import net.shibboleth.shared.collection.CollectionSupport;
 import net.shibboleth.shared.collection.Pair;
 import net.shibboleth.shared.component.ComponentInitializationException;
 import net.shibboleth.shared.net.URISupport;
 import net.shibboleth.shared.security.IdentifierGenerationStrategy;
+import net.shibboleth.shared.xml.XMLParserException;
 import net.shibboleth.sp.context.AgentRequestContext;
 import net.shibboleth.sp.ddf.DDF;
 import net.shibboleth.sp.flows.AbstractSPFlowTest;
@@ -486,18 +494,22 @@ public class SAML2TokenConsumerFlowTest extends AbstractSPFlowTest {
         final DDF output = assertOutputMessageEvent(result, null);
         assert output != null;
         System.out.println("testSuccess output: " + output.toString());
-        validateOutputMessage(result, "/");
+        validateOutputMessage(result, CollectionSupport.singleton("mail"),
+                "/", response.getAssertions().get(0).getAuthnStatements().get(0).getSessionIndex());
     }
 
     /**
      * Decode an encoded response and run sanity checks against it.
      * 
      * @param result flow execution result
+     * @param attributeIds set of attribute IDs to check for
      * @param resource resource URL used in final redirect
+     * @param sessionIndex SessionIndex from assertion
      * 
      * @return the output object
      */
-    @Nonnull private DDF validateOutputMessage(@Nonnull final FlowExecutionResult result, @Nullable final String resource) {
+    @Nonnull private DDF validateOutputMessage(@Nonnull final FlowExecutionResult result,
+            @Nullable final Set<String> attributeIds, @Nullable final String resource, @Nullable final String sessionIndex) {
         final ProfileRequestContext prc = retrieveProfileRequestContext(result);
         assert prc != null;
         final AgentRequestContext arc = prc.ensureSubcontext(AgentRequestContext.class);
@@ -513,6 +525,35 @@ public class SAML2TokenConsumerFlowTest extends AbstractSPFlowTest {
         
         Assert.assertTrue(output.getmember(ConsumerConstants.VALIDATION_ERRORS).isnull());
         
+        final Set<String> mutableIds = new HashSet<>(attributeIds);
+        for (final DDF attr : output.getmember(ConsumerConstants.SESSION_ATTRIBUTES).asList()) {
+            Assert.assertTrue(mutableIds.contains(attr.name()));
+            mutableIds.remove(attr.name());
+            if ("mail".equals(attr.name())) {
+                Assert.assertEquals(attr.asList().stream().map(DDF::string).toList(),
+                        CollectionSupport.singletonList("jdoe at example.org!!https://idp.example.org!!https://testsp.example.org"));
+            }
+        }
+        Assert.assertTrue(mutableIds.isEmpty());
+        
+        try {
+            final String s = output.getmember(ConsumerConstants.SESSION_OPAQUE).string();
+            assert s != null;
+            final byte[] opaque = Base64Support.decodeURLSafe(s);
+            try (final ByteArrayInputStream in = new ByteArrayInputStream(opaque)) {
+                final XMLObject obj = XMLObjectSupport.unmarshallFromInputStream(parserPool, in);
+                if (obj instanceof NameID nameID) {
+                    Assert.assertEquals(nameID.getValue(), "jdoe at example.org");
+                    Assert.assertEquals(nameID.getFormat(), NameIDType.EMAIL);
+                    Assert.assertEquals(nameID.getSPProvidedID(), sessionIndex);
+                } else {
+                    Assert.fail("Session data was not a NameID");
+                }
+            }
+        } catch (final DecodingException|IOException|UnmarshallingException|XMLParserException e) {
+            Assert.fail(e.getMessage());
+        }
+        
         return output;
     }
     
@@ -570,9 +611,11 @@ public class SAML2TokenConsumerFlowTest extends AbstractSPFlowTest {
             
             assertion.setSubject(subject);
             
-            assertion.getAuthnStatements().add(
-                    SAML2ActionTestingSupport.buildAuthnStatement(
-                            Instant.now().minusSeconds(300), "192.168.1.1", AuthnContext.PPT_AUTHN_CTX));
+            final AuthnStatement authn = SAML2ActionTestingSupport.buildAuthnStatement(
+                    Instant.now().minusSeconds(300), "192.168.1.1", AuthnContext.PPT_AUTHN_CTX);
+            authn.setSessionIndex(idGenerator.generateIdentifier(false));
+            
+            assertion.getAuthnStatements().add(authn);
             
             assertion.setConditions(
                     SAML2ActionTestingSupport.buildConditions(Instant.now(), Instant.now().plusSeconds(300), AUDIENCE));

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.