[java-idp-plugin-oidc-op-oidfed] 03/03: Removed remaining references to Nimbus EntityStatement from the test code
Codeberg
noreply at shibboleth.net
Thu Dec 18 17:55:48 UTC 2025
This is an automated email from the git hooks/post-receive script.
codeberg pushed a commit to branch dev/CACHE-REFACTOR
in repository java-idp-plugin-oidc-op-oidfed.
View the commit online:
https://codeberg.org/Shibboleth/java-idp-plugin-oidc-op-oidfed/commit/e8b450cc8e4cde1812cd18e0c34166c82738d832
commit e8b450cc8e4cde1812cd18e0c34166c82738d832
Author: Henri Mikkonen <henri.mikkonen at iki.fi>
AuthorDate: Thu Dec 18 19:55:22 2025 +0200
Removed remaining references to Nimbus EntityStatement from the test code
---
.../plugin/oidc/op/oidfed/TrustChainTestUtil.java | 41 +++++++++++++---
.../flow/oidfed/AbstractFederationFlowTest.java | 22 ++++-----
.../flow/oidfed/EntityConfigurationFlowTest.java | 57 ++++++++++++++--------
.../profile/flow/oidfed/RegistrationFlowTest.java | 22 ++++-----
4 files changed, 93 insertions(+), 49 deletions(-)
diff --git a/idp-oidfed-op-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/oidfed/TrustChainTestUtil.java b/idp-oidfed-op-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/oidfed/TrustChainTestUtil.java
index 2c3dddc..4d62686 100644
--- a/idp-oidfed-op-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/oidfed/TrustChainTestUtil.java
+++ b/idp-oidfed-op-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/oidfed/TrustChainTestUtil.java
@@ -14,12 +14,18 @@
package net.shibboleth.idp.plugin.oidc.op.oidfed;
+import java.text.ParseException;
import java.time.Instant;
import java.util.Date;
import java.util.List;
+import javax.annotation.Nonnull;
+
import org.testng.Assert;
+import com.fasterxml.jackson.core.JsonProcessingException;
+import com.fasterxml.jackson.databind.ObjectMapper;
+import com.fasterxml.jackson.databind.module.SimpleModule;
import com.nimbusds.jose.JOSEException;
import com.nimbusds.jose.JOSEObjectType;
import com.nimbusds.jose.JWSAlgorithm;
@@ -27,17 +33,23 @@ import com.nimbusds.jose.JWSHeader;
import com.nimbusds.jose.crypto.ECDSASigner;
import com.nimbusds.jose.crypto.RSASSASigner;
import com.nimbusds.jose.jwk.JWK;
+import com.nimbusds.jose.jwk.JWKSet;
import com.nimbusds.jose.jwk.KeyUse;
import com.nimbusds.jose.jwk.RSAKey;
import com.nimbusds.jose.jwk.gen.RSAKeyGenerator;
import com.nimbusds.jwt.JWTClaimsSet;
import com.nimbusds.jwt.SignedJWT;
-import com.nimbusds.oauth2.sdk.ParseException;
-import com.nimbusds.openid.connect.sdk.federation.entities.EntityStatement;
+
+import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.EntityStatement;
+import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.jackson.InstantDeserializer;
+import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.jackson.JWKSetDeserializer;
+import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.policy.FederationMetadataPolicyDeserializer;
+import net.shibboleth.oidc.metadata.policy.MetadataPolicy;
/**
* Various utility methods for testing trust chains.
*/
+ at SuppressWarnings("null")
public class TrustChainTestUtil {
public static List<EntityStatement> chainWithIntermediate(final EntityStatement leaf, final String anchorId,
@@ -59,13 +71,13 @@ public class TrustChainTestUtil {
.issuer(anchorId)
.build());
final EntityStatement leafSubordinateStatement = entityStatement(JWSAlgorithm.RS256, intermediateKey,
- new JWTClaimsSet.Builder(leaf.getClaimsSet().toJWTClaimsSet())
- .subject(leaf.getEntityID().getValue())
+ new JWTClaimsSet.Builder(leaf.getJwt().getJWTClaimsSet())
+ .subject(leaf.getSubject())
.issueTime(new Date())
.issuer(intermediateId)
.build());
return List.of(leaf, leafSubordinateStatement, intermediateStatement, trustAnchor);
- } catch (final ParseException | JOSEException e) {
+ } catch (final JOSEException | ParseException e) {
Assert.fail("Could not construct trust chain", e);
}
return null;
@@ -82,12 +94,27 @@ public class TrustChainTestUtil {
public static EntityStatement entityStatement(final JWSAlgorithm algorithm, final JWK jwk,
final JWTClaimsSet claimsSet) {
+ return entityStatement(signedJwt(algorithm, jwk, "entity-statement+jwt", claimsSet));
+ }
+
+ public static EntityStatement entityStatement(final SignedJWT jwt) {
try {
- return EntityStatement.parse(signedJwt(algorithm, jwk, "entity-statement+jwt", claimsSet));
- } catch (final ParseException e) {
+ return EntityStatement.parse(jwt, payloadObjectMapper());
+ } catch (JsonProcessingException e) {
Assert.fail("Could not construct entity configuration", e);
}
return null;
+
+ }
+
+ @Nonnull public static ObjectMapper payloadObjectMapper() {
+ final SimpleModule jacksonModule = new SimpleModule();
+ jacksonModule.addDeserializer(MetadataPolicy.class, new FederationMetadataPolicyDeserializer("scope"));
+ jacksonModule.addDeserializer(JWKSet.class, new JWKSetDeserializer());
+ jacksonModule.addDeserializer(Instant.class, new InstantDeserializer());
+ final ObjectMapper objectMapper = new ObjectMapper();
+ objectMapper.registerModule(jacksonModule);
+ return objectMapper;
}
public static SignedJWT trustMark(final JWSAlgorithm algorithm, final JWK jwk, final String iss, final String sub,
diff --git a/idp-oidfed-op-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/oidfed/AbstractFederationFlowTest.java b/idp-oidfed-op-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/oidfed/AbstractFederationFlowTest.java
index 349941d..e550b84 100644
--- a/idp-oidfed-op-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/oidfed/AbstractFederationFlowTest.java
+++ b/idp-oidfed-op-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/oidfed/AbstractFederationFlowTest.java
@@ -71,13 +71,13 @@ import com.nimbusds.oauth2.sdk.ParseException;
import com.nimbusds.oauth2.sdk.Response;
import com.nimbusds.oauth2.sdk.id.Issuer;
import com.nimbusds.openid.connect.sdk.SubjectType;
-import com.nimbusds.openid.connect.sdk.federation.entities.EntityStatement;
import com.nimbusds.openid.connect.sdk.op.OIDCProviderMetadata;
import com.nimbusds.openid.connect.sdk.rp.OIDCClientMetadata;
import net.minidev.json.JSONObject;
import net.shibboleth.idp.plugin.oidc.op.oidfed.TrustChainTestUtil;
import net.shibboleth.idp.plugin.oidc.op.oidfed.messaging.impl.ResolveEntityResponse;
+import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.EntityStatement;
import net.shibboleth.idp.plugin.oidc.op.profile.flow.AbstractOidcFlowTest;
import net.shibboleth.oidc.security.credential.BasicJWKCredential;
import net.shibboleth.shared.logic.Constraint;
@@ -257,7 +257,7 @@ public class AbstractFederationFlowTest extends AbstractOidcFlowTest {
}
final EntityStatement rpConfiguration =
TrustChainTestUtil.entityStatement(JWSAlgorithm.RS256, leafKey, builder.build());
- return rpConfiguration.getSignedStatement().serialize();
+ return rpConfiguration.getJwt().serialize();
}
protected String rpEntityConfigurationUnmatchingKey(final String clientId,
@@ -272,7 +272,7 @@ public class AbstractFederationFlowTest extends AbstractOidcFlowTest {
.build();
final EntityStatement rpConfiguration =
TrustChainTestUtil.entityStatement(JWSAlgorithm.RS256, anchorKey, claimsSet);
- return rpConfiguration.getSignedStatement().serialize();
+ return rpConfiguration.getJwt().serialize();
}
protected String trustMarkIssuerConfiguration(final String entityId, final String... authorityHints) {
@@ -287,7 +287,7 @@ public class AbstractFederationFlowTest extends AbstractOidcFlowTest {
.build();
final EntityStatement rpConfiguration =
TrustChainTestUtil.entityStatement(JWSAlgorithm.RS256, trustMarkIssuerKey, claimsSet);
- return rpConfiguration.getSignedStatement().serialize();
+ return rpConfiguration.getJwt().serialize();
}
protected String opEntityConfiguration(final String issuer, final String... authorityHints)
@@ -307,7 +307,7 @@ public class AbstractFederationFlowTest extends AbstractOidcFlowTest {
.build();
final EntityStatement rpConfiguration =
TrustChainTestUtil.entityStatement(JWSAlgorithm.RS256, leafKey, claimsSet);
- return rpConfiguration.getSignedStatement().serialize();
+ return rpConfiguration.getJwt().serialize();
}
protected String entityConfiguration(final String entityId, final Map<String, Object> metadata,
@@ -322,7 +322,7 @@ public class AbstractFederationFlowTest extends AbstractOidcFlowTest {
.build();
final EntityStatement configuration =
TrustChainTestUtil.entityStatement(JWSAlgorithm.RS256, leafKey, claimsSet);
- return configuration.getSignedStatement().serialize();
+ return configuration.getJwt().serialize();
}
protected String trustedAnchorConfiguration() {
@@ -352,7 +352,7 @@ public class AbstractFederationFlowTest extends AbstractOidcFlowTest {
}
final EntityStatement anchorConfiguration =
TrustChainTestUtil.entityStatement(JWSAlgorithm.RS256, trustedAnchorKey, builder.build());
- return anchorConfiguration.getSignedStatement().serialize();
+ return anchorConfiguration.getJwt().serialize();
}
protected String intermediateConfiguration(final String intermediateId) {
@@ -366,7 +366,7 @@ public class AbstractFederationFlowTest extends AbstractOidcFlowTest {
.build();
final EntityStatement anchorConfiguration =
TrustChainTestUtil.entityStatement(JWSAlgorithm.RS256, intermediateKey, claimsSet);
- return anchorConfiguration.getSignedStatement().serialize();
+ return anchorConfiguration.getJwt().serialize();
}
protected String subordinateStatement(final String issuer, final Map<String, Object> metadata) {
@@ -383,7 +383,7 @@ public class AbstractFederationFlowTest extends AbstractOidcFlowTest {
.build();
final EntityStatement rpConfiguration =
TrustChainTestUtil.entityStatement(JWSAlgorithm.RS256, trustedAnchorKey, claimsSet);
- return rpConfiguration.getSignedStatement().serialize();
+ return rpConfiguration.getJwt().serialize();
}
protected String rpSubordinateStatement(final String issuer, final JWK issuerKey, final JWK subjetKey,
@@ -397,7 +397,7 @@ public class AbstractFederationFlowTest extends AbstractOidcFlowTest {
.build();
final EntityStatement rpConfiguration =
TrustChainTestUtil.entityStatement(JWSAlgorithm.RS256, issuerKey, claimsSet);
- return rpConfiguration.getSignedStatement().serialize();
+ return rpConfiguration.getJwt().serialize();
}
protected String subordinateStatement(final String issuer, final JWK issuerKey, final JWK subjetKey,
@@ -412,7 +412,7 @@ public class AbstractFederationFlowTest extends AbstractOidcFlowTest {
.build();
final EntityStatement rpConfiguration =
TrustChainTestUtil.entityStatement(JWSAlgorithm.RS256, issuerKey, claimsSet);
- return rpConfiguration.getSignedStatement().serialize();
+ return rpConfiguration.getJwt().serialize();
}
protected String rpResolveEntityResponse(final String clientId, final Map<String, Object> metadata) {
diff --git a/idp-oidfed-op-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/oidfed/EntityConfigurationFlowTest.java b/idp-oidfed-op-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/oidfed/EntityConfigurationFlowTest.java
index a4278d2..e2d1245 100644
--- a/idp-oidfed-op-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/oidfed/EntityConfigurationFlowTest.java
+++ b/idp-oidfed-op-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/oidfed/EntityConfigurationFlowTest.java
@@ -26,35 +26,45 @@ import java.util.Collection;
import java.util.List;
import java.util.Map;
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.beans.factory.annotation.Qualifier;
import org.springframework.webflow.executor.FlowExecutionResult;
import org.testng.Assert;
import org.testng.annotations.Test;
+import com.fasterxml.jackson.core.JsonProcessingException;
+import com.fasterxml.jackson.databind.ObjectMapper;
import com.nimbusds.jose.Algorithm;
import com.nimbusds.jose.JWSAlgorithm;
+import com.nimbusds.jwt.SignedJWT;
import com.nimbusds.oauth2.sdk.ParseException;
import com.nimbusds.oauth2.sdk.Response;
import com.nimbusds.oauth2.sdk.id.Issuer;
-import com.nimbusds.openid.connect.sdk.federation.entities.EntityID;
-import com.nimbusds.openid.connect.sdk.federation.entities.EntityStatement;
-import com.nimbusds.openid.connect.sdk.federation.entities.FederationEntityMetadata;
import com.nimbusds.openid.connect.sdk.federation.registration.ClientRegistrationType;
import com.nimbusds.openid.connect.sdk.op.OIDCProviderMetadata;
+import net.minidev.json.JSONObject;
import net.shibboleth.idp.plugin.oidc.op.oidfed.TrustChainTestUtil;
+import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.EntityConfiguration;
+import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.EntityConfigurationPayload;
import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.remote.trustmark.DefaultTrustMarkFetchingStrategy;
import net.shibboleth.shared.collection.CollectionSupport;
/**
* Unit test for the entity configuration flow.
*/
+ at SuppressWarnings("null")
public class EntityConfigurationFlowTest extends AbstractFederationFlowTest {
public static final String FLOW_ID = "oidfed/entity-configuration";
final String dynamicTrustMarkIssuerId = "https://dyn-trust-mark-issuer.federation.local";
final String dynamicTrustMarkType = dynamicTrustMarkIssuerId + "/example";
-
+
+ @Autowired
+ @Qualifier("shibboleth.oidfed.JWTPayloadJSONObjectMapper")
+ ObjectMapper payloadObjectMapper;
+
protected EntityConfigurationFlowTest() {
super(FLOW_ID);
}
@@ -99,8 +109,16 @@ public class EntityConfigurationFlowTest extends AbstractFederationFlowTest {
}
protected void assertEntityStatement(final Response response) throws ParseException {
- final EntityStatement entityStatement = EntityStatement.parse(response.toHTTPResponse().getContent());
- final OIDCProviderMetadata metadata = entityStatement.getClaimsSet().getOPMetadata();
+ final EntityConfiguration entityStatement;
+ try {
+ entityStatement = EntityConfiguration.parse(
+ SignedJWT.parse(response.toHTTPResponse().getContent()), payloadObjectMapper);
+ } catch (JsonProcessingException | java.text.ParseException e) {
+ Assert.fail();
+ return;
+ }
+ final OIDCProviderMetadata metadata = OIDCProviderMetadata.parse(
+ new JSONObject(entityStatement.getParsedPayload().getMetadata().getOpenidProviderMetadata()));
Assert.assertEquals(metadata.getIssuer(), new Issuer("https://op.example.org"));;
// all but RSA-OAEP-384 as it's excluded in test relying-party.xml
final List<String> jweAlgs = Arrays.asList("RSA1_5", "RSA-OAEP", "RSA-OAEP-256", "RSA-OAEP-512",
@@ -126,25 +144,26 @@ public class EntityConfigurationFlowTest extends AbstractFederationFlowTest {
Assert.assertNotNull(metadata.getCustomParameter("STATIC_CONF_ATTRIBUTE"));
Assert.assertEquals(metadata.getCustomParameter("STATIC_CONF_ATTRIBUTE"), "TestAttributeValue");
Assert.assertTrue(metadata.getClientRegistrationTypes().containsAll(
- List.of(ClientRegistrationType.AUTOMATIC, ClientRegistrationType.EXPLICIT)));
+ List.of(new ClientRegistrationType("automatic"), new ClientRegistrationType("explicit"))));
try {
Assert.assertEquals(metadata.getFederationRegistrationEndpointURI(),
new URI("http://localhost/idp/profile/oidfed/register"));
} catch (URISyntaxException e) {
Assert.fail("Could not build URI", e);
}
- final FederationEntityMetadata entityMetadata = entityStatement.getClaimsSet().getFederationEntityMetadata();
- Assert.assertEquals(entityMetadata.getOrganizationName(), "Example organization");
- Assert.assertEquals(entityMetadata.getContacts(), List.of("contact at example.org"));
- Assert.assertEquals(entityStatement.getClaimsSet().getAuthorityHints(),
- List.of(new EntityID("https://anchor1.example.org"), new EntityID("https://anchor2.example.org")));
- final List<String> trustAnchorHints = entityStatement.getClaimsSet().getStringListClaim("trust_anchor_hints");
- Assert.assertEquals(trustAnchorHints, List.of(anchorId));
- final List<Object> trustMarks = entityStatement.getClaimsSet().getJSONArrayClaim("trust_marks");
- Assert.assertNotNull(trustMarks);
- @SuppressWarnings("unchecked")
- final List<Map<String,Object>> trustMarkMap = trustMarks.stream().filter(Map.class::isInstance)
- .map(object -> (Map<String,Object>) object).toList();
+ final Map<String,Object> entityMetadata =
+ entityStatement.getParsedPayload().getMetadata().getFederationEntityMetadata();
+ Assert.assertNotNull(entityMetadata);
+ assert entityMetadata != null;
+ Assert.assertEquals(entityMetadata.get("organization_name"), "Example organization");
+ Assert.assertEquals(entityMetadata.get("contacts"), List.of("contact at example.org"));
+ final EntityConfigurationPayload payload = (EntityConfigurationPayload) entityStatement.getParsedPayload();
+ Assert.assertEquals(payload.getAuthorityHints(),
+ List.of("https://anchor1.example.org","https://anchor2.example.org"));
+ Assert.assertEquals(payload.getTrustAnchorHints(), List.of(anchorId));
+ final List<Map<String,String>> trustMarkMap = payload.getTrustMarks();
+ Assert.assertNotNull(trustMarkMap);
+ assert trustMarkMap != null;
Assert.assertEquals(trustMarkMap.size(), 2);
Assert.assertNotNull(trustMarkMap.stream()
.filter(map -> map.entrySet().stream()
diff --git a/idp-oidfed-op-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/oidfed/RegistrationFlowTest.java b/idp-oidfed-op-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/oidfed/RegistrationFlowTest.java
index 6200d8a..9504a84 100644
--- a/idp-oidfed-op-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/oidfed/RegistrationFlowTest.java
+++ b/idp-oidfed-op-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/oidfed/RegistrationFlowTest.java
@@ -42,15 +42,14 @@ import com.nimbusds.jose.jwk.JWKSet;
import com.nimbusds.jwt.SignedJWT;
import com.nimbusds.oauth2.sdk.ParseException;
import com.nimbusds.oauth2.sdk.Scope;
-import com.nimbusds.openid.connect.sdk.federation.entities.EntityID;
-import com.nimbusds.openid.connect.sdk.federation.entities.EntityStatement;
-import com.nimbusds.openid.connect.sdk.federation.entities.EntityStatementClaimsSet;
import com.nimbusds.openid.connect.sdk.rp.OIDCClientInformation;
import com.nimbusds.openid.connect.sdk.rp.OIDCClientMetadata;
import net.minidev.json.JSONObject;
import net.minidev.json.parser.JSONParser;
+import net.shibboleth.idp.plugin.oidc.op.oidfed.TrustChainTestUtil;
import net.shibboleth.idp.plugin.oidc.op.oidfed.messaging.impl.ExplicitClientRegistrationResponse;
+import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.EntityStatement;
import net.shibboleth.oidc.metadata.impl.BaseStorageServiceClientInformationComponent;
import net.shibboleth.shared.collection.Pair;
@@ -457,19 +456,19 @@ public class RegistrationFlowTest extends AbstractFederationFlowTest {
final String expectedClientId) throws IOException, ParseException, net.minidev.json.parser.ParseException {
Assert.assertEquals(response.getHeader("Content-Type"),
ExplicitClientRegistrationResponse.HTTP_RESPONSE_CONTENT_TYPE.toString());
- final EntityStatement entityStatement = EntityStatement.parse(regResponse.getJWT());
- final EntityStatementClaimsSet statementClaims = entityStatement.getClaimsSet();
- Assert.assertNotNull(statementClaims.getIssuer());
- Assert.assertEquals(statementClaims.getIssuer().getValue(), issuer);
- Assert.assertEquals(statementClaims.getAuthorityHints().stream().map(id -> id.getValue()).toList(),
+ final EntityStatement entityStatement =
+ TrustChainTestUtil.entityStatement(regResponse.getJWT());
+ Assert.assertEquals(entityStatement.getIssuer(), issuer);
+ Assert.assertEquals(entityStatement.getParsedPayload().getCustomClaims().get("authority_hints"),
List.of(anchorId));
- Assert.assertEquals(statementClaims.getClaim("trust_anchor"), anchorId);
- final OIDCClientInformation clientInfo = entityStatement.getClaimsSet().getRPInformation();
+ Assert.assertEquals(entityStatement.getParsedPayload().getCustomClaims().get("trust_anchor"), anchorId);
+ final OIDCClientInformation clientInfo = OIDCClientInformation.parse(
+ new JSONObject(entityStatement.getParsedPayload().getMetadata().getOpenidRelyingPartyMetadata()));
final OIDCClientMetadata metadata = clientInfo.getOIDCMetadata();
final String providedClientId = clientInfo.getID().getValue();
assert providedClientId != null;
Assert.assertEquals(providedClientId, expectedClientId);
- Assert.assertEquals(entityStatement.getClaimsSet().getSubject().getValue(), expectedClientId);
+ Assert.assertEquals(entityStatement.getSubject(), expectedClientId);
assert storageService != null;
final StorageRecord<String> storageRecord =
storageService.read(BaseStorageServiceClientInformationComponent.CONTEXT_NAME, providedClientId);
@@ -484,7 +483,6 @@ public class RegistrationFlowTest extends AbstractFederationFlowTest {
Assert.assertEquals(storedInfo.getOIDCMetadata().getRedirectionURIStrings(),
metadata.getRedirectionURIStrings());
Assert.assertTrue(metadata.getRedirectionURIStrings().contains(redirectUri));
- Assert.assertEquals(entityStatement.getClaimsSet().getAuthorityHints(), List.of(new EntityID(anchorId)));
return storedInfo;
}
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list