[java-plugin-shibd-oidc] branch main updated: Switch AuthenticationContextClassRefLookupStrategy to using DefaultAuthenticationMethods
Phil Smart
philip.smart at jisc.ac.uk
Fri Oct 3 16:07:03 UTC 2025
This is an automated email from the git hooks/post-receive script.
philsmart pushed a commit to branch main
in repository java-plugin-shibd-oidc.
View the commit online:
http://git.shibboleth.net/view/?p=java-plugin-shibd-oidc.git;a=commit;h=c0810525ee9aa959c5fa626399e5719e49f9b26a
The following commit(s) were added to refs/heads/main by this push:
new c081052 Switch AuthenticationContextClassRefLookupStrategy to using DefaultAuthenticationMethods
c081052 is described below
commit c0810525ee9aa959c5fa626399e5719e49f9b26a
Author: Phil Smart <philip.smart at jisc.ac.uk>
AuthorDate: Fri Oct 3 17:07:01 2025 +0100
Switch AuthenticationContextClassRefLookupStrategy to using
DefaultAuthenticationMethods
---
...uthenticationContextClassRefLookupStrategy.java | 12 ++-
.../sp/oidc/profile/impl/ScopeLookupStrategy.java | 5 +-
.../profile/request/impl/AddScopesHandler.java | 8 +-
...nticationContextClassRefLookupStrategyTest.java | 110 +++++++++++++++++++++
4 files changed, 124 insertions(+), 11 deletions(-)
diff --git a/sp-oidc-impl/src/main/java/net/shibboleth/sp/oidc/profile/impl/AuthenticationContextClassRefLookupStrategy.java b/sp-oidc-impl/src/main/java/net/shibboleth/sp/oidc/profile/impl/AuthenticationContextClassRefLookupStrategy.java
index e569b4e..9282310 100644
--- a/sp-oidc-impl/src/main/java/net/shibboleth/sp/oidc/profile/impl/AuthenticationContextClassRefLookupStrategy.java
+++ b/sp-oidc-impl/src/main/java/net/shibboleth/sp/oidc/profile/impl/AuthenticationContextClassRefLookupStrategy.java
@@ -14,6 +14,7 @@
package net.shibboleth.sp.oidc.profile.impl;
+import java.security.Principal;
import java.util.List;
import java.util.stream.Collectors;
@@ -66,10 +67,13 @@ public class AuthenticationContextClassRefLookupStrategy
}
if (rpConfig != null && classrefs.isEmpty()) {
- rpConfig.getAuthnContextClassRefs(PRC_LOOKUP.apply(messageCtx));
- }
-
+ final List<Principal> principals = rpConfig.getDefaultAuthenticationMethods(PRC_LOOKUP.apply(messageCtx));
+ if (!principals.isEmpty()) {
+ return principals.stream()
+ .map(p -> new ACR(p.getName())).toList();
+ }
+ classrefs = CollectionSupport.emptyList();
+ }
return classrefs.stream().map(ACR::new).toList();
-
}
}
diff --git a/sp-oidc-impl/src/main/java/net/shibboleth/sp/oidc/profile/impl/ScopeLookupStrategy.java b/sp-oidc-impl/src/main/java/net/shibboleth/sp/oidc/profile/impl/ScopeLookupStrategy.java
index 2e485e5..e24a78a 100644
--- a/sp-oidc-impl/src/main/java/net/shibboleth/sp/oidc/profile/impl/ScopeLookupStrategy.java
+++ b/sp-oidc-impl/src/main/java/net/shibboleth/sp/oidc/profile/impl/ScopeLookupStrategy.java
@@ -14,7 +14,6 @@
package net.shibboleth.sp.oidc.profile.impl;
-import java.util.Arrays;
import java.util.Set;
import java.util.stream.Collectors;
@@ -41,9 +40,9 @@ public class ScopeLookupStrategy extends AbstractAgentAndRelyingPartyContextLook
return null;
}
assert scopeFromDDF != null;
- return Arrays.stream(scopeFromDDF.split("\\s+"))
- .filter(s -> !s.isEmpty())
+ return StringSupport.stringToList(scopeFromDDF,"\\s+").stream().filter(s -> !s.isEmpty())
.collect(Collectors.toUnmodifiableSet());
+
}
}
diff --git a/sp-oidc-impl/src/main/java/net/shibboleth/sp/oidc/profile/request/impl/AddScopesHandler.java b/sp-oidc-impl/src/main/java/net/shibboleth/sp/oidc/profile/request/impl/AddScopesHandler.java
index a59bf40..4a35dc9 100644
--- a/sp-oidc-impl/src/main/java/net/shibboleth/sp/oidc/profile/request/impl/AddScopesHandler.java
+++ b/sp-oidc-impl/src/main/java/net/shibboleth/sp/oidc/profile/request/impl/AddScopesHandler.java
@@ -29,7 +29,10 @@ import net.shibboleth.sp.oidc.profile.impl.AbstractAuthenticationRequestParamete
/**
* A message handler that adds OAuth 2.0 scopes to the authentication request.
*/
-public class AddScopesHandler extends AbstractAuthenticationRequestParameterValueMessageHandler<Set<String>> {
+public class AddScopesHandler extends AbstractAuthenticationRequestParameterValueMessageHandler<Set<String>> {
+
+ /** Class logger. */
+ @Nonnull private final Logger log = LoggerFactory.getLogger(AddScopesHandler.class);
/**
* Constructor.
@@ -38,9 +41,6 @@ public class AddScopesHandler extends AbstractAuthenticationRequestParameterValu
protected AddScopesHandler() {
super((Class)Set.class);
}
-
- /** Class logger. */
- @Nonnull private final Logger log = LoggerFactory.getLogger(AddScopesHandler.class);
@Override
protected void doInvoke(@Nonnull final MessageContext messageContext)
diff --git a/sp-oidc-impl/src/test/java/net/shibboleth/sp/oidc/profile/impl/AuthenticationContextClassRefLookupStrategyTest.java b/sp-oidc-impl/src/test/java/net/shibboleth/sp/oidc/profile/impl/AuthenticationContextClassRefLookupStrategyTest.java
new file mode 100644
index 0000000..67b6683
--- /dev/null
+++ b/sp-oidc-impl/src/test/java/net/shibboleth/sp/oidc/profile/impl/AuthenticationContextClassRefLookupStrategyTest.java
@@ -0,0 +1,110 @@
+/*
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.sp.oidc.profile.impl;
+
+import static org.testng.Assert.assertEquals;
+import static org.testng.Assert.assertNotNull;
+
+import java.util.List;
+
+import org.testng.annotations.BeforeMethod;
+import org.testng.annotations.Test;
+
+import com.nimbusds.openid.connect.sdk.claims.ACR;
+
+import net.shibboleth.oidc.authn.principal.AuthenticationContextClassReferencePrincipal;
+import net.shibboleth.oidc.profile.config.OIDCAuthorizationConfiguration;
+import net.shibboleth.shared.collection.CollectionSupport;
+import net.shibboleth.shared.component.ComponentInitializationException;
+import net.shibboleth.sp.ddf.DDF;
+import net.shibboleth.sp.messaging.RemotedHttpServletRequest;
+import net.shibboleth.sp.oidc.profile.OIDCInitiatorConstants;
+import net.shibboleth.sp.profile.InitiatorConstants;
+import net.shibboleth.sp.profile.SPConstants;
+
+/**
+ * Tests for {@link AuthenticationContextClassRefLookupStrategy}.
+ */
+public class AuthenticationContextClassRefLookupStrategyTest extends AbstractAuthenticationLookupStrategyTest {
+
+ /** The strategy to test. */
+ private AuthenticationContextClassRefLookupStrategy strategy;
+
+ /** The DDF to store input parameters. */
+ private DDF ddf;
+
+ @Override
+ @BeforeMethod
+ public void setUp() throws ComponentInitializationException {
+ super.setUp();
+ strategy = new AuthenticationContextClassRefLookupStrategy();
+
+ ddf = new DDF(null).structure();
+ ddf.addmember(RemotedHttpServletRequest.STRUCTURE_NAME).structure();
+ ddf.addmember(InitiatorConstants.RESPONSE_URL).string(RESPONSE_URL);
+ ddf.addmember(SPConstants.TARGET).unsafe_string(RESOURCE_URL);
+ addDDFToAgentRequestContext(ddf);
+
+ }
+
+ @Test
+ public void testReturnsMappedACRsFromInput() {
+ final DDF aclist = ddf.addmember(OIDCInitiatorConstants.AUTHN_CONTEXT_CLASS_REF).list();
+ aclist.add(new DDF(null).string("loa1"));
+ aclist.add(new DDF(null).string("loa2"));
+
+ final List<ACR> result = strategy.apply(mc);
+ assertNotNull(result);
+ assert result != null;
+ assertEquals(result.size(), 2);
+ assertEquals(result.get(0).getValue(), "loa1");
+ assertEquals(result.get(1).getValue(), "loa2");
+ }
+
+ @Test
+ public void testDisallowedFeatureClearsACRs() {
+ final DDF aclist = ddf.addmember(OIDCInitiatorConstants.AUTHN_CONTEXT_CLASS_REF).list();
+ aclist.add(new DDF(null).string("loa1"));
+ aclist.add(new DDF(null).string("loa2"));
+
+ rpConfig.setDisallowedFeatures(OIDCAuthorizationConfiguration.FEATURE_ESSENTIAL_ACR_REQUEST);
+
+ final List<ACR> result = strategy.apply(mc);
+ assert result != null;
+ assertEquals(result.size(), 0);
+
+ }
+
+ @Test
+ public void testFallbackToRpConfigDefaults() {
+ rpConfig.setDefaultAuthenticationMethods(CollectionSupport.listOf(new AuthenticationContextClassReferencePrincipal("loa1")));
+
+ final List<ACR> result = strategy.apply(mc);
+ assertNotNull(result);
+ assert result != null;
+ assertEquals(result.size(), 1);
+ assertEquals(result.get(0).getValue(), "loa1");
+ }
+
+ @Test
+ public void testNoInputNoRpConfig() {
+ prc.removeSubcontext(partyContext);
+ final List<ACR> result = strategy.apply(mc);
+ assertNotNull(result);
+ assert result != null;
+ assertEquals(result.size(), 0);
+ }
+
+}
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list