[java-plugin-shibd-oidc] 03/05: Improve logout flow test
Codeberg
noreply at shibboleth.net
Wed Jul 15 08:36:11 UTC 2026
This is an automated email from the git hooks/post-receive script.
codeberg pushed a commit to branch main
in repository java-plugin-shibd-oidc.
View the commit online:
https://codeberg.org/Shibboleth/java-plugin-shibd-oidc/commit/97d7b28dfbf6976fbae4e9d842b1201705efb397
commit 97d7b28dfbf6976fbae4e9d842b1201705efb397
Author: Phil Smart <philip.smart at jisc.ac.uk>
AuthorDate: Mon Jul 13 17:23:57 2026 +0100
Improve logout flow test
- Add check for redirect parameters for RP-Initiated
---
.../shibboleth/sp/oidc/testing/TestConstants.java | 4 +++
.../sp/oidc/flows/OIDCLogoutInitiatorFlowTest.java | 39 +++++++++++++++++++++-
...DCEnvironmentApplicationContextInitializer.java | 2 +-
.../idp/module/conf/sp/oidc-test-agents.xml | 9 ++++-
4 files changed, 51 insertions(+), 3 deletions(-)
diff --git a/sp-oidc-api/src/test/java/net/shibboleth/sp/oidc/testing/TestConstants.java b/sp-oidc-api/src/test/java/net/shibboleth/sp/oidc/testing/TestConstants.java
index 1ec7ffb..9e9c60d 100644
--- a/sp-oidc-api/src/test/java/net/shibboleth/sp/oidc/testing/TestConstants.java
+++ b/sp-oidc-api/src/test/java/net/shibboleth/sp/oidc/testing/TestConstants.java
@@ -52,6 +52,10 @@ public final class TestConstants {
/** Default Application ID that supports all default profiles and no special configuration. */
public static final String APPLICATION_ID = "test-oidc-application-with-default-profile";
+ /** Application ID for an application that supports the post_logout_redirect_uri parameter. */
+ public static final
+ String APPLICATION_ID_POST_LOGOUT_REDIRECT = "test-oidc-application-logout-with-postlogoutredirect";
+
/** Application ID used when private_key_jwt has been configured.*/
public static final String APPLICATION_ID_PRIVATE_KEY_JWT = "test-oidc-application-with-ro-private-key-jwt";
diff --git a/sp-oidc-conf-impl/src/test/java/net/shibboleth/sp/oidc/flows/OIDCLogoutInitiatorFlowTest.java b/sp-oidc-conf-impl/src/test/java/net/shibboleth/sp/oidc/flows/OIDCLogoutInitiatorFlowTest.java
index 301b420..46d39c6 100644
--- a/sp-oidc-conf-impl/src/test/java/net/shibboleth/sp/oidc/flows/OIDCLogoutInitiatorFlowTest.java
+++ b/sp-oidc-conf-impl/src/test/java/net/shibboleth/sp/oidc/flows/OIDCLogoutInitiatorFlowTest.java
@@ -20,6 +20,7 @@ import java.io.IOException;
import java.nio.charset.StandardCharsets;
import java.time.Instant;
import java.util.Date;
+import java.util.Set;
import javax.annotation.Nonnull;
@@ -27,6 +28,7 @@ import org.apache.hc.client5.http.classic.HttpClient;
import org.apache.hc.core5.http.io.HttpClientResponseHandler;
import org.apache.hc.core5.http.protocol.HttpContext;
import org.mockito.Mockito;
+import org.opensaml.profile.context.ProfileRequestContext;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.beans.factory.annotation.Qualifier;
import org.springframework.context.ApplicationContext;
@@ -34,6 +36,7 @@ import org.springframework.core.io.ClassPathResource;
import org.springframework.test.context.ContextConfiguration;
import org.springframework.test.context.web.WebAppConfiguration;
import org.springframework.webflow.executor.FlowExecutionResult;
+import org.testng.Assert;
import org.testng.annotations.BeforeMethod;
import org.testng.annotations.Test;
@@ -46,9 +49,13 @@ import com.nimbusds.openid.connect.sdk.op.OIDCProviderMetadata;
import net.shibboleth.idp.spring.IdPPropertiesApplicationContextInitializer;
import net.shibboleth.idp.test.PreferFileSystemApplicationContextInitializer;
import net.shibboleth.oidc.security.credential.JWKCredential;
+import net.shibboleth.shared.collection.CollectionSupport;
import net.shibboleth.shared.security.DataSealer;
+import net.shibboleth.sp.context.AgentRequestContext;
import net.shibboleth.sp.ddf.DDF;
import net.shibboleth.sp.flows.AbstractSPFlowTest;
+import net.shibboleth.sp.messaging.RemotedHttpServletRequest;
+import net.shibboleth.sp.messaging.RemotedHttpServletResponse;
import net.shibboleth.sp.oidc.profile.impl.PrepareAgentResponse;
import net.shibboleth.sp.oidc.testing.TestConstants;
import net.shibboleth.sp.oidc.testing.TestHelper;
@@ -148,6 +155,9 @@ public class OIDCLogoutInitiatorFlowTest extends AbstractSPFlowTest {
assertFlowExecutionOutcome(result.getOutcome());
final var output = assertOutputMessageSuccess(result);
assert output != null;
+ validateLogoutRedirect(result,
+ CollectionSupport.setOf("id_token_hint", "client_id"),
+ CollectionSupport.setOf("post_logout_redirect_uri"));
System.out.println("test output: " + output.toString());
}
@@ -160,7 +170,7 @@ public class OIDCLogoutInitiatorFlowTest extends AbstractSPFlowTest {
TestHelper.buildLogoutInitiatorDDFInput(sealedIdToken, PrepareAgentResponse.ID_TOKEN_PARAM);
// Add target
input.addmember(SPConstants.TARGET).unsafe_string("https://sp.example.org/logout-end".getBytes(StandardCharsets.UTF_8));
- setApplicationRequest(TestConstants.APPLICATION_ID, input);
+ setApplicationRequest(TestConstants.APPLICATION_ID_POST_LOGOUT_REDIRECT, input);
@@ -169,7 +179,12 @@ public class OIDCLogoutInitiatorFlowTest extends AbstractSPFlowTest {
assertFlowExecutionOutcome(result.getOutcome());
final var output = assertOutputMessageSuccess(result);
assert output != null;
+ validateLogoutRedirect(result,
+ CollectionSupport.setOf("id_token_hint", "post_logout_redirect_uri","client_id"),
+ CollectionSupport.setOf());
+
System.out.println("test output: " + output.toString());
+
}
/**
@@ -191,5 +206,27 @@ public class OIDCLogoutInitiatorFlowTest extends AbstractSPFlowTest {
.thenReturn(metadata);
}
+
+ protected void validateLogoutRedirect(@Nonnull final FlowExecutionResult result,
+ @Nonnull final Set<String> containedParams, @Nonnull final Set<String> doesNotContainParams) {
+
+ final ProfileRequestContext prc = retrieveProfileRequestContext(result);
+ assert prc != null;
+ final AgentRequestContext arc = prc.ensureSubcontext(AgentRequestContext.class);
+ final DDF output = arc.getOutput();
+
+ assert output != null;
+ Assert.assertTrue(output.isstruct());
+ final DDF http = output.getmember(RemotedHttpServletRequest.STRUCTURE_NAME);
+ Assert.assertTrue(http.isstruct());
+
+ final byte[] redirect = http.getmember(RemotedHttpServletResponse.REDIRECT).unsafe_string();
+ final String redirectString = new String(redirect, StandardCharsets.UTF_8);
+
+ // Check all the params are contained
+ assertTrue(containedParams.stream().allMatch(redirectString::contains));
+ assertTrue(doesNotContainParams.stream().noneMatch(redirectString::contains));
+
+ }
}
diff --git a/sp-oidc-conf-impl/src/test/java/net/shibboleth/sp/oidc/flows/TestSPOIDCEnvironmentApplicationContextInitializer.java b/sp-oidc-conf-impl/src/test/java/net/shibboleth/sp/oidc/flows/TestSPOIDCEnvironmentApplicationContextInitializer.java
index 6633acc..0faa3dc 100644
--- a/sp-oidc-conf-impl/src/test/java/net/shibboleth/sp/oidc/flows/TestSPOIDCEnvironmentApplicationContextInitializer.java
+++ b/sp-oidc-conf-impl/src/test/java/net/shibboleth/sp/oidc/flows/TestSPOIDCEnvironmentApplicationContextInitializer.java
@@ -51,7 +51,7 @@ public class TestSPOIDCEnvironmentApplicationContextInitializer extends TestSPEn
// Ensure ACR checks are performed
mock.setProperty("sp.oidc.idtoken.validateAcrValue", "true");
// Turn off the sealing state data for testing
- mock.setProperty("sp.stateToken.sealed", "false");;
+ mock.setProperty("sp.stateToken.sealed", "false");
// Create a basic default client secret
mock.setProperty("sp.oidc.defaultClientSecret", "secret");
// Turn on the replay cache for testing
diff --git a/sp-oidc-conf-impl/src/test/resources/net/shibboleth/idp/module/conf/sp/oidc-test-agents.xml b/sp-oidc-conf-impl/src/test/resources/net/shibboleth/idp/module/conf/sp/oidc-test-agents.xml
index 583c1bb..579df9f 100644
--- a/sp-oidc-conf-impl/src/test/resources/net/shibboleth/idp/module/conf/sp/oidc-test-agents.xml
+++ b/sp-oidc-conf-impl/src/test/resources/net/shibboleth/idp/module/conf/sp/oidc-test-agents.xml
@@ -31,7 +31,10 @@
p:profileConfigurations-ref="test.WithPKCE"/>
<bean p:id="test-oidc-application-with-post-responsemode" parent="shibboleth.sp.Application"
- p:profileConfigurations-ref="test.WithPostResponseMode"/>
+ p:profileConfigurations-ref="test.WithPostResponseMode"/>
+
+ <bean p:id="test-oidc-application-logout-with-postlogoutredirect" parent="shibboleth.sp.Application"
+ p:profileConfigurations-ref="test.logout.WithPostLogoutRedirectURI"/>
<!-- Test using a profile that requires a request object, also override the authenticatingAuthority just to check that -->
<bean p:id="test-oidc-application-with-ro" parent="shibboleth.sp.Application"
@@ -62,6 +65,10 @@
</bean>
</util:list>
+ <util:list id="test.logout.WithPostLogoutRedirectURI">
+ <bean parent="OIDC.Logout" p:includePostLogoutRedirectUri="true"/>
+ </util:list>
+
<util:list id="test.WithPKCE">
<bean parent="OIDC.SSO" p:securityConfiguration-ref="testSecConfig" p:forcePKCE="true">
<property name="clientCredential">
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list