[java-plugin-shibd-saml] branch main updated: Add attribute testing.
Scott Cantor
cantor.2 at osu.edu
Tue Oct 8 21:34:56 UTC 2024
This is an automated email from the git hooks/post-receive script.
scantor pushed a commit to branch main
in repository java-plugin-shibd-saml.
View the commit online:
http://git.shibboleth.net/view/?p=java-plugin-shibd-saml.git;a=commit;h=5faef683a8b993f5d640492a0b96c7f725b00973
The following commit(s) were added to refs/heads/main by this push:
new 5faef68 Add attribute testing.
5faef68 is described below
commit 5faef683a8b993f5d640492a0b96c7f725b00973
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Tue Oct 8 17:34:53 2024 -0400
Add attribute testing.
---
.../flows/saml2/SAML2TokenConsumerFlowTest.java | 69 +++++++++++++++-------
.../idp/module/conf/attribute-filter.xml | 4 ++
.../idp/module/conf/metadata-providers.xml | 4 ++
3 files changed, 55 insertions(+), 22 deletions(-)
diff --git a/sp-saml-conf-impl/src/test/java/net/shibboleth/sp/saml/flows/saml2/SAML2TokenConsumerFlowTest.java b/sp-saml-conf-impl/src/test/java/net/shibboleth/sp/saml/flows/saml2/SAML2TokenConsumerFlowTest.java
index 0de780c..ac06e99 100644
--- a/sp-saml-conf-impl/src/test/java/net/shibboleth/sp/saml/flows/saml2/SAML2TokenConsumerFlowTest.java
+++ b/sp-saml-conf-impl/src/test/java/net/shibboleth/sp/saml/flows/saml2/SAML2TokenConsumerFlowTest.java
@@ -32,6 +32,8 @@ import org.opensaml.core.xml.util.XMLObjectSupport;
import org.opensaml.profile.action.EventIds;
import org.opensaml.profile.context.ProfileRequestContext;
import org.opensaml.saml.saml2.core.Assertion;
+import org.opensaml.saml.saml2.core.Attribute;
+import org.opensaml.saml.saml2.core.AttributeStatement;
import org.opensaml.saml.saml2.core.AuthnContext;
import org.opensaml.saml.saml2.core.AuthnStatement;
import org.opensaml.saml.saml2.core.Conditions;
@@ -77,6 +79,7 @@ import net.shibboleth.shared.xml.XMLParserException;
import net.shibboleth.sp.context.AgentRequestContext;
import net.shibboleth.sp.ddf.DDF;
import net.shibboleth.sp.flows.AbstractSPFlowTest;
+import net.shibboleth.sp.impl.PassthroughStateTokenManager;
import net.shibboleth.sp.impl.StorageServiceStateTokenManager;
import net.shibboleth.sp.messaging.RemotedHttpServletRequest;
import net.shibboleth.sp.messaging.RemotedHttpServletResponse;
@@ -107,17 +110,13 @@ public class SAML2TokenConsumerFlowTest extends AbstractSPFlowTest {
/** ACS URL. */
@Nonnull public static final String RESPONSE_URL = "https://sp.example.org/Shibboleth.sso/SAML2/POST";
- @Autowired
- @Qualifier("shibboleth.StorageService")
- protected StorageService storageService;
-
+ /** ACS URL. */
+ @Nonnull public static final String RESOURCE_URL = "https://sp.example.org/secure";
+
@Autowired
@Qualifier("shibboleth.SessionIDGenerator")
protected IdentifierGenerationStrategy idGenerator;
- /** Relay state manager. */
- private StorageServiceStateTokenManager stateManager;
-
/** Dummy signing key. */
@Autowired @Qualifier("dummy.idp.Credential") protected Credential idpCredential;
@@ -125,19 +124,6 @@ public class SAML2TokenConsumerFlowTest extends AbstractSPFlowTest {
public SAML2TokenConsumerFlowTest() {
super(FLOW_ID);
}
-
- /**
- * Global state setup.
- *
- * @throws ComponentInitializationException
- */
- @BeforeClass
- public void beforeClass() throws ComponentInitializationException {
- stateManager = new StorageServiceStateTokenManager();
- stateManager.setId("test");
- stateManager.setStorageService(storageService);
- stateManager.initialize();
- }
/** Pre-test work. */
@BeforeMethod
@@ -477,7 +463,7 @@ public class SAML2TokenConsumerFlowTest extends AbstractSPFlowTest {
}
/**
- * Test successful flow.
+ * Test successful flow.
*
* @throws IOException
*/
@@ -495,7 +481,37 @@ public class SAML2TokenConsumerFlowTest extends AbstractSPFlowTest {
assert output != null;
System.out.println("testSuccess output: " + output.toString());
validateOutputMessage(result, CollectionSupport.singleton("mail"),
- "/", response.getAssertions().get(0).getAuthnStatements().get(0).getSessionIndex());
+ RESOURCE_URL, response.getAssertions().get(0).getAuthnStatements().get(0).getSessionIndex());
+ }
+
+ /**
+ * Test successful flow with attributes.
+ *
+ * @throws IOException
+ */
+ @Test
+ public void testSuccessAttributes() throws IOException {
+ final Response response = buildSAMLResponse(ISSUER, StatusCode.SUCCESS);
+ final AttributeStatement statement = SAML2ActionTestingSupport.buildAttributeStatement();
+ statement.getAttributes().add(
+ SAML2ActionTestingSupport.buildAttribute("urn:oid:2.16.840.1.113730.3.1.241", Attribute.URI_REFERENCE,
+ CollectionSupport.singletonList("John Doe")));
+ statement.getAttributes().add(
+ SAML2ActionTestingSupport.buildAttribute("urn:oid:1.3.6.1.4.1.5923.1.1.1.9", Attribute.URI_REFERENCE,
+ CollectionSupport.listOf("staff at example.org", "employee at example.org")));
+ response.getAssertions().get(0).getAttributeStatements().add(statement);
+ sign(response);
+ final DDF input = buildRemotedPOSTResponse(response);
+ setApplicationRequest(APPLICATION_ID, input);
+
+ final FlowExecutionResult result = flowExecutor.launchExecution(FLOW_ID, null, externalContext);
+ assertFlowExecutionResult(result, FLOW_ID);
+ assertFlowExecutionOutcome(result.getOutcome());
+ final DDF output = assertOutputMessageEvent(result, null);
+ assert output != null;
+ System.out.println("testSuccessAttributes output: " + output.toString());
+ validateOutputMessage(result, CollectionSupport.setOf("mail", "displayName", "eduPersonScopedAffiliation"),
+ RESOURCE_URL, response.getAssertions().get(0).getAuthnStatements().get(0).getSessionIndex());
}
/**
@@ -532,6 +548,14 @@ public class SAML2TokenConsumerFlowTest extends AbstractSPFlowTest {
if ("mail".equals(attr.name())) {
Assert.assertEquals(attr.asList().stream().map(DDF::string).toList(),
CollectionSupport.singletonList("jdoe at example.org!!https://idp.example.org!!https://testsp.example.org"));
+ } else if ("displayName".equals(attr.name())) {
+ Assert.assertEquals(attr.asList().stream().map(DDF::string).toList(),
+ CollectionSupport.singletonList("John Doe"));
+ } else if ("eduPersonScopedAffiliation".equals(attr.name())) {
+ Assert.assertEquals(attr.asList().stream().map(ddf -> {return ddf.getmember("value").string();}).toList(),
+ CollectionSupport.listOf("staff", "employee"));
+ Assert.assertEquals(attr.asList().stream().map(ddf -> {return ddf.getmember("scope").string();}).toList(),
+ CollectionSupport.listOf("example.org", "example.org"));
}
}
Assert.assertTrue(mutableIds.isEmpty());
@@ -641,6 +665,7 @@ public class SAML2TokenConsumerFlowTest extends AbstractSPFlowTest {
XMLObjectSupport.marshallToOutputStream(response, sink);
final String base64 = Base64Support.encode(sink.toByteArray(), true);
final DDF obj = new DDF(null).structure();
+ obj.addmember(ConsumerConstants.BASE_URL).unsafe_string(RESOURCE_URL.getBytes(StandardCharsets.UTF_8));
final DDF http = obj.addmember(RemotedHttpServletRequest.STRUCTURE_NAME).structure();
http.addmember(RemotedHttpServletRequest.METHOD).string("POST");
diff --git a/sp-saml-conf-impl/src/test/resources/net/shibboleth/idp/module/conf/attribute-filter.xml b/sp-saml-conf-impl/src/test/resources/net/shibboleth/idp/module/conf/attribute-filter.xml
index b83e023..55bdee2 100644
--- a/sp-saml-conf-impl/src/test/resources/net/shibboleth/idp/module/conf/attribute-filter.xml
+++ b/sp-saml-conf-impl/src/test/resources/net/shibboleth/idp/module/conf/attribute-filter.xml
@@ -21,6 +21,10 @@
<PolicyRequirementRule xsi:type="Issuer" value="https://idp.example.org" />
<AttributeRule attributeID="mail" permitAny="true" />
+ <AttributeRule attributeID="displayName" permitAny="true" />
+ <AttributeRule attributeID="eduPersonScopedAffiliation">
+ <PermitValueRule xsi:type="ScopeMatchesShibMDScope" />
+ </AttributeRule>
</AttributeFilterPolicy>
</AttributeFilterPolicyGroup>
diff --git a/sp-saml-conf-impl/src/test/resources/net/shibboleth/idp/module/conf/metadata-providers.xml b/sp-saml-conf-impl/src/test/resources/net/shibboleth/idp/module/conf/metadata-providers.xml
index ba3bf0f..b78c87a 100644
--- a/sp-saml-conf-impl/src/test/resources/net/shibboleth/idp/module/conf/metadata-providers.xml
+++ b/sp-saml-conf-impl/src/test/resources/net/shibboleth/idp/module/conf/metadata-providers.xml
@@ -1,6 +1,7 @@
<?xml version="1.0" encoding="UTF-8"?>
<MetadataProvider id="ShibbolethMetadata" xsi:type="ChainingMetadataProvider"
xmlns="urn:mace:shibboleth:2.0:metadata"
+ xmlns:shibmd="urn:mace:shibboleth:metadata:1.0"
xmlns:security="urn:mace:shibboleth:2.0:security"
xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"
xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata"
@@ -30,6 +31,9 @@
<md:EntitiesDescriptor Name="tests">
<md:EntityDescriptor entityID="https://idp.example.org">
<md:IDPSSODescriptor protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol">
+ <md:Extensions>
+ <shibmd:Scope regexp="false">example.org</shibmd:Scope>
+ </md:Extensions>
<md:KeyDescriptor>
<ds:KeyInfo>
<ds:X509Data>
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list