[java-idp-oidc] 01/04: JOIDC-253 - Facilitate extending the default set of request object claim validators

[Henri Mikkonen]

This is an automated email from the git hooks/post-receive script.

hjmikkon pushed a commit to branch main
in repository java-idp-oidc.

View the commit online:
http://git.shibboleth.net/view/?p=java-idp-oidc.git;a=commit;h=9d79c8a393337b6efd4dc52eb46f15f08ae9f6cb

commit 9d79c8a393337b6efd4dc52eb46f15f08ae9f6cb
Author: Henri Mikkonen <henri.mikkonen at iki.fi>
AuthorDate: Mon Sep 8 09:12:06 2025 +0300

    JOIDC-253 - Facilitate extending the default set of request object claim validators
    
    https://shibboleth.atlassian.net/browse/JOIDC-253
    
    Improve tests to cover the PAR flow
---
 .../op/profile/flow/PushedAuthorizeFlowTest.java   | 46 ++++++++++++++++++++++
 .../flow/TestRequestObjectClaimsValidator.java     | 13 +++++-
 2 files changed, 57 insertions(+), 2 deletions(-)

diff --git a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/PushedAuthorizeFlowTest.java b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/PushedAuthorizeFlowTest.java
index ac83b90b..bdd730d9 100644
--- a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/PushedAuthorizeFlowTest.java
+++ b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/PushedAuthorizeFlowTest.java
@@ -852,6 +852,52 @@ public class PushedAuthorizeFlowTest extends AbstractOidcClientAuthenticationFlo
         assertErrorCode(result, OAuth2Error.INVALID_REQUEST_CODE);
     }
 
+    @Test
+    public void testOIDCResponseTypeInROExtraValidatorFailing() throws IOException, NoSuchAlgorithmException,
+            URISyntaxException, DataSealerException, ComponentInitializationException, JOSEException {
+        final String clientId = "clientIdRequireExtraRequestObjectClaim";
+        storeMetadata(storageService, clientId, clientSecret, scope, "https://example.org/cb");
+        setBasicAuth(clientId, clientSecret);
+        final JWTClaimsSet ro = new JWTClaimsSet.Builder()
+                .claim("iss", clientId)
+                .claim("client_id", clientId)
+                .claim("aud", issuer)
+                .claim("response_type", "code")
+                .claim("redirect_uri", "https://example.org/cb")
+                .claim("scope", "openid profile")
+                .build();
+        final SignedJWT requestObject = createSecretJWT(ro, clientSecret);
+        setHttpFormRequest("POST", createRequestParameters(clientId, null, null,
+                requestObject.serialize()));
+        final FlowExecutionResult result = flowExecutor.launchExecution(FLOW_ID, null, externalContext);
+        assertErrorCode(result, OAuth2Error.INVALID_REQUEST_CODE);
+    }
+
+    @Test
+    public void testOIDCResponseTypeInROExtraValidatorSuccess() throws IOException, NoSuchAlgorithmException,
+            URISyntaxException, DataSealerException, ComponentInitializationException, JOSEException {
+        final String clientId = "clientIdRequireExtraRequestObjectClaim";
+        storeMetadata(storageService, clientId, clientSecret, scope, "https://example.org/cb");
+        setBasicAuth(clientId, clientSecret);
+        final JWTClaimsSet ro = new JWTClaimsSet.Builder()
+                .claim("iss", clientId)
+                .claim("client_id", clientId)
+                .claim("aud", issuer)
+                .claim("response_type", "code")
+                .claim("redirect_uri", "https://example.org/cb")
+                .claim("scope", "openid profile")
+                .claim("enforcedClaim", "enforcedValue")
+                .build();
+        final SignedJWT requestObject = createSecretJWT(ro, clientSecret);
+        setHttpFormRequest("POST", createRequestParameters(clientId, null, null,
+                requestObject.serialize()));
+        final FlowExecutionResult result = flowExecutor.launchExecution(FLOW_ID, null, externalContext);
+        assertSuccessResponse(result, clientId);
+        final PushedAuthorizationSuccessResponse response =
+                parseSuccessResponse(result, PushedAuthorizationSuccessResponse.class);
+        verifyAuthorizeEndpoint(clientId, response.getRequestURI().toString());
+    }
+
     @Factory
     public Object[] createRequestObjectSecurityTests() {
         return new Object[] {
diff --git a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/TestRequestObjectClaimsValidator.java b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/TestRequestObjectClaimsValidator.java
index d01a3869..84de97d9 100644
--- a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/TestRequestObjectClaimsValidator.java
+++ b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/TestRequestObjectClaimsValidator.java
@@ -22,6 +22,7 @@ import org.opensaml.profile.context.ProfileRequestContext;
 
 import com.nimbusds.jwt.JWTClaimsSet;
 import com.nimbusds.oauth2.sdk.AuthorizationRequest;
+import com.nimbusds.oauth2.sdk.PushedAuthorizationRequest;
 import com.nimbusds.oauth2.sdk.id.ClientID;
 
 import net.shibboleth.oidc.jwt.claims.AbstractClaimsValidator;
@@ -37,8 +38,7 @@ public class TestRequestObjectClaimsValidator extends AbstractClaimsValidator {
         setActivationCondition((prc, claims) -> {
             return Optional.ofNullable(prc)
                     .map(ctx -> ctx.ensureInboundMessageContext().getMessage())
-                    .filter(AuthorizationRequest.class::isInstance)
-                    .map(AuthorizationRequest.class::cast)
+                    .map(msg -> parseAuthorizationRequest(msg))
                     .map(AuthorizationRequest::getClientID)
                     .map(ClientID::getValue)
                     .map(id -> "clientIdRequireExtraRequestObjectClaim".equals(id))
@@ -47,6 +47,15 @@ public class TestRequestObjectClaimsValidator extends AbstractClaimsValidator {
         });
     }
 
+    protected AuthorizationRequest parseAuthorizationRequest(final Object message) {
+        if (message instanceof AuthorizationRequest authzRequest) {
+            return authzRequest;
+        } else if (message instanceof PushedAuthorizationRequest parRequest) {
+            return parRequest.getAuthorizationRequest();
+        }
+        return null;
+    }
+
     /** {@inheritDoc} */
     @Override
     protected void doValidate(@Nonnull final JWTClaimsSet claims, @Nonnull final ProfileRequestContext context)

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.