[java-idp-oidc] 01/02: Move flow (JWT) security tests into separate package
Codeberg
noreply at shibboleth.net
Thu Jun 25 12:11:15 UTC 2026
This is an automated email from the git hooks/post-receive script.
codeberg pushed a commit to branch main
in repository java-idp-oidc.
View the commit online:
https://codeberg.org/Shibboleth/java-idp-oidc/commit/3fa554f42e387b8c636f764e760425b326d2469f
commit 3fa554f42e387b8c636f764e760425b326d2469f
Author: Henri Mikkonen <henri.mikkonen at iki.fi>
AuthorDate: Thu Jun 25 14:50:06 2026 +0300
Move flow (JWT) security tests into separate package
- net.shibboleth.idp.plugin.oidc.op.profile.flow.security
---
.../AbstractOidcClientAuthenticationFlowTest.java | 6 +-
.../oidc/op/profile/flow/AbstractOidcFlowTest.java | 8 +--
.../oidc/op/profile/flow/AuthorizeFlowTest.java | 43 +--------------
.../oidc/op/profile/flow/EndSessionFlowTest.java | 18 ++----
.../op/profile/flow/LogoutPropagationFlowTest.java | 21 ++-----
.../op/profile/flow/PushedAuthorizeFlowTest.java | 14 +----
.../plugin/oidc/op/profile/flow/TokenFlowTest.java | 33 ++---------
.../plugin/oidc/op/profile/flow/UserInfoTest.java | 16 ------
.../AbstractIssuedJWTSecurityTest.java | 7 ++-
.../flow/security/AuthorizeFlowSecurityTest.java | 64 ++++++++++++++++++++++
.../flow/security/EndSessionFlowSecurityTest.java | 35 ++++++++++++
.../flow/{ => security}/IdTokenHintJWETest.java | 3 +-
.../flow/{ => security}/IdTokenHintJWSTest.java | 3 +-
.../IssueRegistrationAccessTokenFlowTest.java | 3 +-
.../{ => security}/IssuedEncryptedJWTTest.java | 2 +-
.../flow/{ => security}/IssuedSignedJWTTest.java | 2 +-
.../LogoutPropagationFlowSecurityTest.java | 38 +++++++++++++
.../security/PushedAuthorizeFlowSecurityTest.java | 35 ++++++++++++
.../PushedAuthorizeRequestObjectJWETest.java | 4 +-
.../PushedAuthorizeRequestObjectJWSTest.java | 4 +-
.../flow/{ => security}/RequestObjectJWETest.java | 3 +-
.../flow/{ => security}/RequestObjectJWSTest.java | 3 +-
.../flow/security/TokenFlowSecurityTest.java | 48 ++++++++++++++++
.../flow/security/UserInfoFlowSecurityTest.java | 41 ++++++++++++++
24 files changed, 309 insertions(+), 145 deletions(-)
diff --git a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/AbstractOidcClientAuthenticationFlowTest.java b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/AbstractOidcClientAuthenticationFlowTest.java
index ec5a73d9..d65d7826 100644
--- a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/AbstractOidcClientAuthenticationFlowTest.java
+++ b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/AbstractOidcClientAuthenticationFlowTest.java
@@ -1221,7 +1221,7 @@ public abstract class AbstractOidcClientAuthenticationFlowTest extends AbstractO
return buildSecretJwtAuth(id, secret, jwtAud);
}
- protected static ClientSecretJWT buildSecretJwtAuth(final String id, String secret, final String jwtAud)
+ public static ClientSecretJWT buildSecretJwtAuth(final String id, String secret, final String jwtAud)
throws JOSEException, URISyntaxException {
return new ClientSecretJWT(new ClientID(id), new URI(jwtAud),
JWSAlgorithm.HS256, new Secret(secret));
@@ -1232,13 +1232,13 @@ public abstract class AbstractOidcClientAuthenticationFlowTest extends AbstractO
JWSAlgorithm.RS256, (PrivateKey) rsaPrivateKey, null, null);
}
- protected static PrivateKeyJWT buildPrivateKeyJwtAuth(final String id, final PrivateKey privateKey,
+ public static PrivateKeyJWT buildPrivateKeyJwtAuth(final String id, final PrivateKey privateKey,
final String jwtAud) throws JOSEException, URISyntaxException {
return new PrivateKeyJWT(new ClientID(id), new URI(jwtAud),
JWSAlgorithm.RS256, privateKey, null, null);
}
- protected static void populateClientAssertionParams(final Map<String, String> requestParameters,
+ public static void populateClientAssertionParams(final Map<String, String> requestParameters,
final JWTAuthentication clientAuth) {
requestParameters.put("client_assertion", clientAuth.getClientAssertion().serialize());
requestParameters.put("client_assertion_type", "urn:ietf:params:oauth:client-assertion-type:jwt-bearer");
diff --git a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/AbstractOidcFlowTest.java b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/AbstractOidcFlowTest.java
index 9177af6f..1fb40705 100644
--- a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/AbstractOidcFlowTest.java
+++ b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/AbstractOidcFlowTest.java
@@ -125,12 +125,12 @@ public abstract class AbstractOidcFlowTest extends AbstractFlowTest {
@Autowired
@Qualifier("shibboleth.StorageService")
- StorageService storageService;
+ protected StorageService storageService;
- RSAPrivateKey rsaPrivateKey;
- RSAPublicKey rsaPublicKey;
+ protected RSAPrivateKey rsaPrivateKey;
+ protected RSAPublicKey rsaPublicKey;
- ECKey ecKey;
+ protected ECKey ecKey;
protected AbstractOidcFlowTest(final String id) {
this(id, END_STATE_ID);
diff --git a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/AuthorizeFlowTest.java b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/AuthorizeFlowTest.java
index 45fcdd87..a7152061 100644
--- a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/AuthorizeFlowTest.java
+++ b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/AuthorizeFlowTest.java
@@ -39,7 +39,6 @@ import org.springframework.webflow.executor.FlowExecutionResult;
import org.testng.Assert;
import org.testng.annotations.AfterMethod;
import org.testng.annotations.BeforeMethod;
-import org.testng.annotations.Factory;
import org.testng.annotations.Test;
import com.fasterxml.jackson.databind.ObjectMapper;
@@ -2460,45 +2459,7 @@ public class AuthorizeFlowTest extends AbstractOidcFlowTest {
Assert.assertEquals("ErrorView", result.getOutcome().getId());
}
- @Factory
- public Object[] createIdTokenSecurityTests() {
- return new Object[] {
- new IssuedSignedJWTTest(AbstractIssuedJWTSecurityTest.JWT_FETCHING_TYPE.AUTHORIZE_ID_TOKEN, FLOW_ID),
- new IssuedEncryptedJWTTest(AbstractIssuedJWTSecurityTest.JWT_FETCHING_TYPE.AUTHORIZE_ID_TOKEN, FLOW_ID,
- true, false),
- new IssuedEncryptedJWTTest(AbstractIssuedJWTSecurityTest.JWT_FETCHING_TYPE.AUTHORIZE_ID_TOKEN, FLOW_ID,
- true, true)
- };
- }
-
- @Factory
- public Object[] createAccessTokenSecurityTests() {
- return new Object[] {
- new IssuedSignedJWTTest(AbstractIssuedJWTSecurityTest.JWT_FETCHING_TYPE.AUTHORIZE_ACCESS_TOKEN,
- FLOW_ID),
- new IssuedSignedJWTTest(AbstractIssuedJWTSecurityTest.JWT_FETCHING_TYPE.AUTHORIZE_USER_INFO_ACCESS_TOKEN,
- FLOW_ID),
- new IssuedEncryptedJWTTest(AbstractIssuedJWTSecurityTest.JWT_FETCHING_TYPE.AUTHORIZE_ACCESS_TOKEN,
- FLOW_ID, true, false),
- new IssuedEncryptedJWTTest(AbstractIssuedJWTSecurityTest.JWT_FETCHING_TYPE.AUTHORIZE_ACCESS_TOKEN,
- FLOW_ID, true, true)
- };
- }
-
- @Factory
- public Object[] createRequestObjectSecurityTests() {
- return new Object[] {
- new RequestObjectJWSTest(true),
- new RequestObjectJWSTest(false),
- new RequestObjectJWETest(false, false),
- new RequestObjectJWETest(false, true),
- new RequestObjectJWETest(true, false),
- new RequestObjectJWETest(true, true)
- };
-
- }
-
- protected static String getRequestObjectWithClaimsRequestPayload(final String clientId, final String redirectUri) {
+ public static String getRequestObjectWithClaimsRequestPayload(final String clientId, final String redirectUri) {
return "{\n"
+ " \"iss\": \"" + clientId + "\",\n"
+ " \"response_type\": \"code\",\n"
@@ -2813,7 +2774,7 @@ public class AuthorizeFlowTest extends AbstractOidcFlowTest {
setRequestParameters(request, pairs);
}
- protected static void setRequestParameters(final MockHttpServletRequest request,
+ public static void setRequestParameters(final MockHttpServletRequest request,
final List<Pair<String, String>> pairs) {
final StringBuffer query = new StringBuffer();
for (final Pair<String, String> pair : pairs) {
diff --git a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/EndSessionFlowTest.java b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/EndSessionFlowTest.java
index 15fbaeea..9a02f30a 100644
--- a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/EndSessionFlowTest.java
+++ b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/EndSessionFlowTest.java
@@ -36,7 +36,6 @@ import org.springframework.webflow.test.MockParameterMap;
import org.testng.Assert;
import org.testng.annotations.AfterMethod;
import org.testng.annotations.BeforeMethod;
-import org.testng.annotations.Factory;
import org.testng.annotations.Test;
import com.nimbusds.jose.JOSEException;
@@ -393,15 +392,6 @@ public class EndSessionFlowTest extends AbstractOidcFlowTest {
Assert.assertTrue(result2.isEnded());
}
- @Factory
- public Object[] createRequestObjectSecurityTests() {
- return new Object[] {
- new IdTokenHintJWSTest(),
- new IdTokenHintJWETest(true),
- new IdTokenHintJWETest(false)
- };
- }
-
protected IdPSession buildIdPSessionWithDefaultSP() {
return buildIdPSessionWithSP(clientId);
}
@@ -419,7 +409,7 @@ public class EndSessionFlowTest extends AbstractOidcFlowTest {
.build());
}
- protected static IdPSession buildIdPSession(final StorageBackedSessionManager sessionManager,
+ public static IdPSession buildIdPSession(final StorageBackedSessionManager sessionManager,
final SPSession... sessions) {
try {
final IdPSession idpSession = sessionManager.createSession("mockSessionPrincipal");
@@ -438,7 +428,7 @@ public class EndSessionFlowTest extends AbstractOidcFlowTest {
setRequestParameters(request, pairs);
}
- protected static void setRequestParameters(final MockHttpServletRequest request,
+ public static void setRequestParameters(final MockHttpServletRequest request,
final List<Pair<String, String>> pairs) {
final StringBuffer query = new StringBuffer();
for (final Pair<String, String> pair : pairs) {
@@ -464,7 +454,7 @@ public class EndSessionFlowTest extends AbstractOidcFlowTest {
return isSessionValid(sessionManager, session);
}
- protected static boolean isSessionValid(final StorageBackedSessionManager sessionManager,
+ public static boolean isSessionValid(final StorageBackedSessionManager sessionManager,
final IdPSession session) {
final String id = session.getId();
assert id != null;
@@ -491,7 +481,7 @@ public class EndSessionFlowTest extends AbstractOidcFlowTest {
sessionId);
}
- protected static String getIdTokenHintPayload(final String issuer, final String subject, final String clientId,
+ public static String getIdTokenHintPayload(final String issuer, final String subject, final String clientId,
final Instant exp, final Instant iat, final String sid) {
return "{\n"
+ " \"iss\": \"" + issuer + "\",\n"
diff --git a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/LogoutPropagationFlowTest.java b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/LogoutPropagationFlowTest.java
index 088b02b1..97547b08 100644
--- a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/LogoutPropagationFlowTest.java
+++ b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/LogoutPropagationFlowTest.java
@@ -34,7 +34,6 @@ import org.springframework.webflow.test.MockParameterMap;
import org.testng.Assert;
import org.testng.annotations.AfterMethod;
import org.testng.annotations.BeforeMethod;
-import org.testng.annotations.Factory;
import org.testng.annotations.Test;
import com.nimbusds.jwt.JWT;
@@ -184,18 +183,6 @@ public class LogoutPropagationFlowTest extends AbstractOidcFlowTest {
Assert.assertTrue(logoutToken instanceof SignedJWT);
}
- @Factory
- public Object[] createLogoutTokenSecurityTests() {
- return new Object[] {
- new IssuedSignedJWTTest(AbstractIssuedJWTSecurityTest.JWT_FETCHING_TYPE.LOGOUT_TOKEN, FLOW_ID,
- "LogoutPropagateView"),
- new IssuedEncryptedJWTTest(AbstractIssuedJWTSecurityTest.JWT_FETCHING_TYPE.LOGOUT_TOKEN, FLOW_ID,
- "LogoutPropagateView", true, false),
- new IssuedEncryptedJWTTest(AbstractIssuedJWTSecurityTest.JWT_FETCHING_TYPE.LOGOUT_TOKEN, FLOW_ID,
- "LogoutPropagateView", true, true)
- };
- }
-
protected ProfileRequestContext retrievePrcViaRequest() {
final ProfileRequestContext prc = (ProfileRequestContext)request.getAttribute(ProfileRequestContext.BINDING_KEY);
Assert.assertNotNull(prc);
@@ -213,7 +200,7 @@ public class LogoutPropagationFlowTest extends AbstractOidcFlowTest {
}
@SuppressWarnings("null")
- protected static IdPSession buildIdPSessionWithDefaultSP(final StorageBackedSessionManager sessionManager,
+ public static IdPSession buildIdPSessionWithDefaultSP(final StorageBackedSessionManager sessionManager,
final String clientId, final String issuer, final String sessionId, final String subject) {
return buildIdPSession(sessionManager, new OIDCRPSession.Builder()
.serviceId(clientId)
@@ -227,7 +214,7 @@ public class LogoutPropagationFlowTest extends AbstractOidcFlowTest {
.build());
}
- protected static IdPSession buildIdPSession(final StorageBackedSessionManager sessionManager,
+ public static IdPSession buildIdPSession(final StorageBackedSessionManager sessionManager,
final SPSession... sessions) {
try {
final IdPSession idpSession = sessionManager.createSession("mockSessionPrincipal");
@@ -246,7 +233,7 @@ public class LogoutPropagationFlowTest extends AbstractOidcFlowTest {
setRequestParameters(request, pairs);
}
- protected static void setRequestParameters(final MockHttpServletRequest request,
+ public static void setRequestParameters(final MockHttpServletRequest request,
final List<Pair<String, String>> pairs) {
final StringBuffer query = new StringBuffer();
for (final Pair<String, String> pair : pairs) {
@@ -271,7 +258,7 @@ public class LogoutPropagationFlowTest extends AbstractOidcFlowTest {
return isSessionValid(sessionManager, session);
}
- protected static boolean isSessionValid(final StorageBackedSessionManager sessionManager,
+ public static boolean isSessionValid(final StorageBackedSessionManager sessionManager,
final IdPSession session) {
final String id = session.getId();
assert id != null;
diff --git a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/PushedAuthorizeFlowTest.java b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/PushedAuthorizeFlowTest.java
index 3856f46f..4c7211f8 100644
--- a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/PushedAuthorizeFlowTest.java
+++ b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/PushedAuthorizeFlowTest.java
@@ -34,7 +34,6 @@ import org.springframework.webflow.executor.FlowExecutionResult;
import org.testng.Assert;
import org.testng.annotations.AfterMethod;
import org.testng.annotations.BeforeMethod;
-import org.testng.annotations.Factory;
import org.testng.annotations.Test;
import com.fasterxml.jackson.databind.ObjectMapper;
@@ -943,15 +942,6 @@ public class PushedAuthorizeFlowTest extends AbstractOidcClientAuthenticationFlo
assertErrorCode(result, "custom_par_error");
}
- @Factory
- public Object[] createRequestObjectSecurityTests() {
- return new Object[] {
- new PushedAuthorizeRequestObjectJWSTest(false),
- new PushedAuthorizeRequestObjectJWETest(false),
- new PushedAuthorizeRequestObjectJWETest(true)
- };
- }
-
protected Pair<String, String> getErrorDetaisForJWTValidation() {
return new Pair<>("invalid_client", "Client authentication failed");
}
@@ -1017,11 +1007,11 @@ public class PushedAuthorizeFlowTest extends AbstractOidcClientAuthenticationFlo
initializeThreadLocals();
}
- protected static Map<String,String> createRequestParameters(final String id) {
+ public static Map<String,String> createRequestParameters(final String id) {
return createRequestParameters(id, "openid profile", "code", null);
}
- protected static Map<String,String> createRequestParameters(final String id, final String scope,
+ public static Map<String,String> createRequestParameters(final String id, final String scope,
final String responseType, final String requestObject) {
final Map<String,String> result = new HashMap<>();
result.put("client_id", id);
diff --git a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/TokenFlowTest.java b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/TokenFlowTest.java
index 2d2bbc8d..5a608a12 100644
--- a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/TokenFlowTest.java
+++ b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/TokenFlowTest.java
@@ -39,7 +39,6 @@ import org.springframework.webflow.executor.FlowExecutionResult;
import org.springframework.webflow.executor.FlowExecutor;
import org.testng.Assert;
import org.testng.annotations.AfterMethod;
-import org.testng.annotations.Factory;
import org.testng.annotations.Test;
import com.nimbusds.jose.EncryptionMethod;
@@ -2021,28 +2020,6 @@ public class TokenFlowTest extends AbstractOidcClientAuthenticationFlowTest {
assertErrorCode(result, "custom_token_error");
}
- @Factory
- public Object[] createIdTokenSecurityTests() {
- return new Object[] {
- new IssuedSignedJWTTest(AbstractIssuedJWTSecurityTest.JWT_FETCHING_TYPE.TOKEN_ID_TOKEN, FLOW_ID),
- new IssuedEncryptedJWTTest(AbstractIssuedJWTSecurityTest.JWT_FETCHING_TYPE.TOKEN_ID_TOKEN, FLOW_ID,
- true, false),
- new IssuedEncryptedJWTTest(AbstractIssuedJWTSecurityTest.JWT_FETCHING_TYPE.TOKEN_ID_TOKEN, FLOW_ID,
- true, true)
- };
- }
-
- @Factory
- public Object[] createAccessTokenSecurityTests() {
- return new Object[] {
- new IssuedSignedJWTTest(AbstractIssuedJWTSecurityTest.JWT_FETCHING_TYPE.TOKEN_ACCESS_TOKEN, FLOW_ID),
- new IssuedEncryptedJWTTest(AbstractIssuedJWTSecurityTest.JWT_FETCHING_TYPE.TOKEN_ACCESS_TOKEN, FLOW_ID,
- true, false),
- new IssuedEncryptedJWTTest(AbstractIssuedJWTSecurityTest.JWT_FETCHING_TYPE.TOKEN_ACCESS_TOKEN, FLOW_ID,
- true, true)
- };
- }
-
@Nonnull private AccessTokenClaimsSet unwrapAccessToken(final AccessTokenResponse tokenResponse) throws Exception {
final AccessToken accessToken = tokenResponse.getTokens().getAccessToken();
Assert.assertNotNull(accessToken);
@@ -2070,7 +2047,7 @@ public class TokenFlowTest extends AbstractOidcClientAuthenticationFlowTest {
return launchWithJwtAuthentication(authnMethod, algorithm, null);
}
- protected static String buildAuthorizationCode(final String clientId, final String issuer,
+ public static String buildAuthorizationCode(final String clientId, final String issuer,
final String userPrincipal, final String sub, final String callbackUrl, final String scope,
final Collection<String> aud) throws Exception {
final Instant now = Instant.now();
@@ -2123,7 +2100,7 @@ public class TokenFlowTest extends AbstractOidcClientAuthenticationFlowTest {
scope.toString(), metadata, clientSecret, storageService);
}
- protected static FlowExecutionResult launchWithJwtAuthentication(final FlowExecutor flowExecutor,
+ public static FlowExecutionResult launchWithJwtAuthentication(final FlowExecutor flowExecutor,
final JWTAuthentication authnMethod, final ExternalContext externalContext,
final MockHttpServletRequest request, final String redirectUri, final String scope,
final OIDCClientMetadata metadata, final String clientSecret, final StorageService storageService)
@@ -2159,12 +2136,12 @@ public class TokenFlowTest extends AbstractOidcClientAuthenticationFlowTest {
return flowExecutor.launchExecution(FLOW_ID, null, externalContext);
}
- protected static Map<String, String> createRequestParameters(final String redirectUri, final String grantType,
+ public static Map<String, String> createRequestParameters(final String redirectUri, final String grantType,
final String code, final String clientId) {
return createRequestParameters(redirectUri, grantType, code, clientId, null);
}
- protected static Map<String, String> createRequestParameters(final String redirectUri, final String grantType,
+ public static Map<String, String> createRequestParameters(final String redirectUri, final String grantType,
final String code, final String clientId, final String clientSecret) {
final Map<String, String> parameters = new HashMap<>();
addNonNullValue(parameters, "redirect_uri", redirectUri);
@@ -2179,7 +2156,7 @@ public class TokenFlowTest extends AbstractOidcClientAuthenticationFlowTest {
return parameters;
}
- protected static Map<String, String> createRequestParameters(final String redirectUri, final String grantType,
+ public static Map<String, String> createRequestParameters(final String redirectUri, final String grantType,
final String code, final String clientId, final String codeChallenge, final String codeChallengeMethod,
final String codeVerifier) {
final Map<String, String> parameters = createRequestParameters(redirectUri, grantType, code, clientId);
diff --git a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/UserInfoTest.java b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/UserInfoTest.java
index 03b8fc1b..b188726e 100644
--- a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/UserInfoTest.java
+++ b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/UserInfoTest.java
@@ -29,7 +29,6 @@ import org.springframework.webflow.executor.FlowExecutionResult;
import org.testng.Assert;
import org.testng.annotations.AfterMethod;
import org.testng.annotations.BeforeMethod;
-import org.testng.annotations.Factory;
import org.testng.annotations.Test;
import com.nimbusds.common.contenttype.ContentType;
@@ -856,21 +855,6 @@ public class UserInfoTest extends AbstractOidcApiFlowTest {
assertErrorCode(result, "custom_userinfo_error");
}
- @Factory
- public Object[] createUserInfoAsJwtSecurityTests() {
- return new Object[] {
- new IssuedSignedJWTTest(AbstractIssuedJWTSecurityTest.JWT_FETCHING_TYPE.USERINFO, FLOW_ID),
- new IssuedEncryptedJWTTest(AbstractIssuedJWTSecurityTest.JWT_FETCHING_TYPE.USERINFO, FLOW_ID, false,
- false),
- new IssuedEncryptedJWTTest(AbstractIssuedJWTSecurityTest.JWT_FETCHING_TYPE.USERINFO, FLOW_ID, false,
- true),
- new IssuedEncryptedJWTTest(AbstractIssuedJWTSecurityTest.JWT_FETCHING_TYPE.USERINFO, FLOW_ID, true,
- false),
- new IssuedEncryptedJWTTest(AbstractIssuedJWTSecurityTest.JWT_FETCHING_TYPE.USERINFO, FLOW_ID, true,
- true)
- };
- }
-
@Nonnull private static String getTokenHeaderValue(final AccessToken token) {
final String value = token.toAuthorizationHeader();
assert value != null;
diff --git a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/AbstractIssuedJWTSecurityTest.java b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/security/AbstractIssuedJWTSecurityTest.java
similarity index 98%
rename from idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/AbstractIssuedJWTSecurityTest.java
rename to idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/security/AbstractIssuedJWTSecurityTest.java
index 23d570ba..8331a485 100644
--- a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/AbstractIssuedJWTSecurityTest.java
+++ b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/security/AbstractIssuedJWTSecurityTest.java
@@ -12,7 +12,7 @@
* limitations under the License.
*/
-package net.shibboleth.idp.plugin.oidc.op.profile.flow;
+package net.shibboleth.idp.plugin.oidc.op.profile.flow.security;
import java.io.IOException;
import java.net.URI;
@@ -68,6 +68,11 @@ import com.nimbusds.openid.connect.sdk.UserInfoSuccessResponse;
import com.nimbusds.openid.connect.sdk.rp.OIDCClientMetadata;
import net.shibboleth.idp.plugin.oidc.op.messaging.context.OIDCAuthenticationResponseContext;
+import net.shibboleth.idp.plugin.oidc.op.profile.flow.AbstractOidcFlowTest;
+import net.shibboleth.idp.plugin.oidc.op.profile.flow.AuthorizeFlowTest;
+import net.shibboleth.idp.plugin.oidc.op.profile.flow.LogoutPropagationFlowTest;
+import net.shibboleth.idp.plugin.oidc.op.profile.flow.PrependTestEnvironmentApplicationContextInitializer;
+import net.shibboleth.idp.plugin.oidc.op.profile.flow.TokenFlowTest;
import net.shibboleth.idp.session.IdPSession;
import net.shibboleth.idp.session.impl.StorageBackedSessionManager;
import net.shibboleth.oidc.security.credential.JWKCredential;
diff --git a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/security/AuthorizeFlowSecurityTest.java b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/security/AuthorizeFlowSecurityTest.java
new file mode 100644
index 00000000..9056a3d0
--- /dev/null
+++ b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/security/AuthorizeFlowSecurityTest.java
@@ -0,0 +1,64 @@
+/*
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.idp.plugin.oidc.op.profile.flow.security;
+
+import org.testng.annotations.Factory;
+
+import net.shibboleth.idp.plugin.oidc.op.profile.flow.AuthorizeFlowTest;
+
+/**
+ * Security tests for the JWTs handled by the authorize flow.
+ */
+public class AuthorizeFlowSecurityTest extends AuthorizeFlowTest {
+
+ @Factory
+ public Object[] createIdTokenSecurityTests() {
+ return new Object[] {
+ new IssuedSignedJWTTest(AbstractIssuedJWTSecurityTest.JWT_FETCHING_TYPE.AUTHORIZE_ID_TOKEN, FLOW_ID),
+ new IssuedEncryptedJWTTest(AbstractIssuedJWTSecurityTest.JWT_FETCHING_TYPE.AUTHORIZE_ID_TOKEN, FLOW_ID,
+ true, false),
+ new IssuedEncryptedJWTTest(AbstractIssuedJWTSecurityTest.JWT_FETCHING_TYPE.AUTHORIZE_ID_TOKEN, FLOW_ID,
+ true, true)
+ };
+ }
+
+ @Factory
+ public Object[] createAccessTokenSecurityTests() {
+ return new Object[] {
+ new IssuedSignedJWTTest(AbstractIssuedJWTSecurityTest.JWT_FETCHING_TYPE.AUTHORIZE_ACCESS_TOKEN,
+ FLOW_ID),
+ new IssuedSignedJWTTest(AbstractIssuedJWTSecurityTest.JWT_FETCHING_TYPE.AUTHORIZE_USER_INFO_ACCESS_TOKEN,
+ FLOW_ID),
+ new IssuedEncryptedJWTTest(AbstractIssuedJWTSecurityTest.JWT_FETCHING_TYPE.AUTHORIZE_ACCESS_TOKEN,
+ FLOW_ID, true, false),
+ new IssuedEncryptedJWTTest(AbstractIssuedJWTSecurityTest.JWT_FETCHING_TYPE.AUTHORIZE_ACCESS_TOKEN,
+ FLOW_ID, true, true)
+ };
+ }
+
+ @Factory
+ public Object[] createRequestObjectSecurityTests() {
+ return new Object[] {
+ new RequestObjectJWSTest(true),
+ new RequestObjectJWSTest(false),
+ new RequestObjectJWETest(false, false),
+ new RequestObjectJWETest(false, true),
+ new RequestObjectJWETest(true, false),
+ new RequestObjectJWETest(true, true)
+ };
+
+ }
+
+}
diff --git a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/security/EndSessionFlowSecurityTest.java b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/security/EndSessionFlowSecurityTest.java
new file mode 100644
index 00000000..dae31a3d
--- /dev/null
+++ b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/security/EndSessionFlowSecurityTest.java
@@ -0,0 +1,35 @@
+/*
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.idp.plugin.oidc.op.profile.flow.security;
+
+import org.testng.annotations.Factory;
+
+import net.shibboleth.idp.plugin.oidc.op.profile.flow.EndSessionFlowTest;
+
+/**
+ * Security tests for the id_token_hints received by the end session flow.
+ */
+public class EndSessionFlowSecurityTest extends EndSessionFlowTest {
+
+ @Factory
+ public Object[] createRequestObjectSecurityTests() {
+ return new Object[] {
+ new IdTokenHintJWSTest(),
+ new IdTokenHintJWETest(true),
+ new IdTokenHintJWETest(false)
+ };
+ }
+
+}
diff --git a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/IdTokenHintJWETest.java b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/security/IdTokenHintJWETest.java
similarity index 99%
rename from idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/IdTokenHintJWETest.java
rename to idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/security/IdTokenHintJWETest.java
index 0a113850..965aec68 100644
--- a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/IdTokenHintJWETest.java
+++ b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/security/IdTokenHintJWETest.java
@@ -12,7 +12,7 @@
* limitations under the License.
*/
-package net.shibboleth.idp.plugin.oidc.op.profile.flow;
+package net.shibboleth.idp.plugin.oidc.op.profile.flow.security;
import java.io.IOException;
import java.security.PrivateKey;
@@ -41,6 +41,7 @@ import com.nimbusds.jwt.JWTClaimsSet;
import com.nimbusds.oauth2.sdk.Scope;
import com.nimbusds.openid.connect.sdk.rp.OIDCClientMetadata;
+import net.shibboleth.idp.plugin.oidc.op.profile.flow.EndSessionFlowTest;
import net.shibboleth.idp.plugin.oidc.op.session.OIDCRPSession;
import net.shibboleth.idp.session.IdPSession;
import net.shibboleth.idp.session.impl.StorageBackedSessionManager;
diff --git a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/IdTokenHintJWSTest.java b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/security/IdTokenHintJWSTest.java
similarity index 98%
rename from idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/IdTokenHintJWSTest.java
rename to idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/security/IdTokenHintJWSTest.java
index 77971b60..aa14333b 100644
--- a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/IdTokenHintJWSTest.java
+++ b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/security/IdTokenHintJWSTest.java
@@ -12,7 +12,7 @@
* limitations under the License.
*/
-package net.shibboleth.idp.plugin.oidc.op.profile.flow;
+package net.shibboleth.idp.plugin.oidc.op.profile.flow.security;
import java.io.IOException;
import java.net.URI;
@@ -42,6 +42,7 @@ import com.nimbusds.jwt.JWTClaimsSet;
import com.nimbusds.oauth2.sdk.Scope;
import com.nimbusds.openid.connect.sdk.rp.OIDCClientMetadata;
+import net.shibboleth.idp.plugin.oidc.op.profile.flow.EndSessionFlowTest;
import net.shibboleth.idp.plugin.oidc.op.session.OIDCRPSession;
import net.shibboleth.idp.session.IdPSession;
import net.shibboleth.idp.session.impl.StorageBackedSessionManager;
diff --git a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/IssueRegistrationAccessTokenFlowTest.java b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/security/IssueRegistrationAccessTokenFlowTest.java
similarity index 98%
rename from idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/IssueRegistrationAccessTokenFlowTest.java
rename to idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/security/IssueRegistrationAccessTokenFlowTest.java
index 3e009673..636d52df 100644
--- a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/IssueRegistrationAccessTokenFlowTest.java
+++ b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/security/IssueRegistrationAccessTokenFlowTest.java
@@ -12,7 +12,7 @@
* limitations under the License.
*/
-package net.shibboleth.idp.plugin.oidc.op.profile.flow;
+package net.shibboleth.idp.plugin.oidc.op.profile.flow.security;
import static org.testng.Assert.assertEquals;
@@ -38,6 +38,7 @@ import com.nimbusds.oauth2.sdk.AccessTokenResponse;
import com.nimbusds.oauth2.sdk.token.BearerAccessToken;
import net.shibboleth.idp.plugin.oidc.op.cli.IssueRegistrationAccessTokenArguments;
+import net.shibboleth.idp.plugin.oidc.op.profile.flow.AbstractOidcFlowTest;
import net.shibboleth.idp.plugin.oidc.op.profile.impl.BaseOIDCResponseActionTest;
import net.shibboleth.idp.plugin.oidc.op.token.support.RegistrationClaimsSet;
import net.shibboleth.oidc.metadata.policy.MetadataPolicy;
diff --git a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/IssuedEncryptedJWTTest.java b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/security/IssuedEncryptedJWTTest.java
similarity index 99%
rename from idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/IssuedEncryptedJWTTest.java
rename to idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/security/IssuedEncryptedJWTTest.java
index 197f8766..f1981e73 100644
--- a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/IssuedEncryptedJWTTest.java
+++ b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/security/IssuedEncryptedJWTTest.java
@@ -12,7 +12,7 @@
* limitations under the License.
*/
-package net.shibboleth.idp.plugin.oidc.op.profile.flow;
+package net.shibboleth.idp.plugin.oidc.op.profile.flow.security;
import java.security.PrivateKey;
import java.security.PublicKey;
diff --git a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/IssuedSignedJWTTest.java b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/security/IssuedSignedJWTTest.java
similarity index 99%
rename from idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/IssuedSignedJWTTest.java
rename to idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/security/IssuedSignedJWTTest.java
index c7f96792..e3a68490 100644
--- a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/IssuedSignedJWTTest.java
+++ b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/security/IssuedSignedJWTTest.java
@@ -12,7 +12,7 @@
* limitations under the License.
*/
-package net.shibboleth.idp.plugin.oidc.op.profile.flow;
+package net.shibboleth.idp.plugin.oidc.op.profile.flow.security;
import java.io.IOException;
import java.security.PublicKey;
diff --git a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/security/LogoutPropagationFlowSecurityTest.java b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/security/LogoutPropagationFlowSecurityTest.java
new file mode 100644
index 00000000..f81fae32
--- /dev/null
+++ b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/security/LogoutPropagationFlowSecurityTest.java
@@ -0,0 +1,38 @@
+/*
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.idp.plugin.oidc.op.profile.flow.security;
+
+import org.testng.annotations.Factory;
+
+import net.shibboleth.idp.plugin.oidc.op.profile.flow.LogoutPropagationFlowTest;
+
+/**
+ * Security tests for the logout tokens used within back-channel propagation.
+ */
+public class LogoutPropagationFlowSecurityTest extends LogoutPropagationFlowTest {
+
+ @Factory
+ public Object[] createLogoutTokenSecurityTests() {
+ return new Object[] {
+ new IssuedSignedJWTTest(AbstractIssuedJWTSecurityTest.JWT_FETCHING_TYPE.LOGOUT_TOKEN, FLOW_ID,
+ "LogoutPropagateView"),
+ new IssuedEncryptedJWTTest(AbstractIssuedJWTSecurityTest.JWT_FETCHING_TYPE.LOGOUT_TOKEN, FLOW_ID,
+ "LogoutPropagateView", true, false),
+ new IssuedEncryptedJWTTest(AbstractIssuedJWTSecurityTest.JWT_FETCHING_TYPE.LOGOUT_TOKEN, FLOW_ID,
+ "LogoutPropagateView", true, true)
+ };
+ }
+
+}
diff --git a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/security/PushedAuthorizeFlowSecurityTest.java b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/security/PushedAuthorizeFlowSecurityTest.java
new file mode 100644
index 00000000..8b352928
--- /dev/null
+++ b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/security/PushedAuthorizeFlowSecurityTest.java
@@ -0,0 +1,35 @@
+/*
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.idp.plugin.oidc.op.profile.flow.security;
+
+import org.testng.annotations.Factory;
+
+import net.shibboleth.idp.plugin.oidc.op.profile.flow.PushedAuthorizeFlowTest;
+
+/**
+ * Security tests for the request objects used with the PAR flow.
+ */
+public class PushedAuthorizeFlowSecurityTest extends PushedAuthorizeFlowTest {
+
+ @Factory
+ public Object[] createRequestObjectSecurityTests() {
+ return new Object[] {
+ new PushedAuthorizeRequestObjectJWSTest(false),
+ new PushedAuthorizeRequestObjectJWETest(false),
+ new PushedAuthorizeRequestObjectJWETest(true)
+ };
+ }
+
+}
diff --git a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/PushedAuthorizeRequestObjectJWETest.java b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/security/PushedAuthorizeRequestObjectJWETest.java
similarity index 98%
rename from idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/PushedAuthorizeRequestObjectJWETest.java
rename to idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/security/PushedAuthorizeRequestObjectJWETest.java
index e780f379..0922bb53 100644
--- a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/PushedAuthorizeRequestObjectJWETest.java
+++ b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/security/PushedAuthorizeRequestObjectJWETest.java
@@ -12,7 +12,7 @@
* limitations under the License.
*/
-package net.shibboleth.idp.plugin.oidc.op.profile.flow;
+package net.shibboleth.idp.plugin.oidc.op.profile.flow.security;
import java.io.IOException;
import java.net.URI;
@@ -43,6 +43,8 @@ import com.nimbusds.oauth2.sdk.Scope;
import com.nimbusds.oauth2.sdk.auth.ClientAuthenticationMethod;
import com.nimbusds.openid.connect.sdk.rp.OIDCClientMetadata;
+import net.shibboleth.idp.plugin.oidc.op.profile.flow.AuthorizeFlowTest;
+import net.shibboleth.idp.plugin.oidc.op.profile.flow.PushedAuthorizeFlowTest;
import net.shibboleth.oidc.security.credential.BasicJWKCredential;
public class PushedAuthorizeRequestObjectJWETest extends IssuedEncryptedJWTTest {
diff --git a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/PushedAuthorizeRequestObjectJWSTest.java b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/security/PushedAuthorizeRequestObjectJWSTest.java
similarity index 97%
rename from idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/PushedAuthorizeRequestObjectJWSTest.java
rename to idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/security/PushedAuthorizeRequestObjectJWSTest.java
index 1af07e74..cd937542 100644
--- a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/PushedAuthorizeRequestObjectJWSTest.java
+++ b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/security/PushedAuthorizeRequestObjectJWSTest.java
@@ -12,7 +12,7 @@
* limitations under the License.
*/
-package net.shibboleth.idp.plugin.oidc.op.profile.flow;
+package net.shibboleth.idp.plugin.oidc.op.profile.flow.security;
import java.io.IOException;
import java.net.URI;
@@ -41,6 +41,8 @@ import com.nimbusds.oauth2.sdk.Scope;
import com.nimbusds.oauth2.sdk.auth.ClientAuthenticationMethod;
import com.nimbusds.openid.connect.sdk.rp.OIDCClientMetadata;
+import net.shibboleth.idp.plugin.oidc.op.profile.flow.AuthorizeFlowTest;
+import net.shibboleth.idp.plugin.oidc.op.profile.flow.PushedAuthorizeFlowTest;
import net.shibboleth.shared.security.DataSealerException;
public class PushedAuthorizeRequestObjectJWSTest extends IssuedSignedJWTTest {
diff --git a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/RequestObjectJWETest.java b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/security/RequestObjectJWETest.java
similarity index 99%
rename from idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/RequestObjectJWETest.java
rename to idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/security/RequestObjectJWETest.java
index 61b8e375..fb29f624 100644
--- a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/RequestObjectJWETest.java
+++ b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/security/RequestObjectJWETest.java
@@ -12,7 +12,7 @@
* limitations under the License.
*/
-package net.shibboleth.idp.plugin.oidc.op.profile.flow;
+package net.shibboleth.idp.plugin.oidc.op.profile.flow.security;
import java.io.IOException;
import java.net.URI;
@@ -45,6 +45,7 @@ import com.nimbusds.openid.connect.sdk.claims.ClaimRequirement;
import com.nimbusds.openid.connect.sdk.claims.ClaimsSetRequest;
import com.nimbusds.openid.connect.sdk.rp.OIDCClientMetadata;
+import net.shibboleth.idp.plugin.oidc.op.profile.flow.AuthorizeFlowTest;
import net.shibboleth.idp.plugin.oidc.op.token.support.AuthorizeCodeClaimsSet;
import net.shibboleth.oidc.security.credential.BasicJWKCredential;
import net.shibboleth.shared.collection.Pair;
diff --git a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/RequestObjectJWSTest.java b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/security/RequestObjectJWSTest.java
similarity index 98%
rename from idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/RequestObjectJWSTest.java
rename to idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/security/RequestObjectJWSTest.java
index 06218911..ab15b56d 100644
--- a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/RequestObjectJWSTest.java
+++ b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/security/RequestObjectJWSTest.java
@@ -12,7 +12,7 @@
* limitations under the License.
*/
-package net.shibboleth.idp.plugin.oidc.op.profile.flow;
+package net.shibboleth.idp.plugin.oidc.op.profile.flow.security;
import java.io.IOException;
import java.net.URI;
@@ -43,6 +43,7 @@ import com.nimbusds.openid.connect.sdk.claims.ClaimRequirement;
import com.nimbusds.openid.connect.sdk.claims.ClaimsSetRequest;
import com.nimbusds.openid.connect.sdk.rp.OIDCClientMetadata;
+import net.shibboleth.idp.plugin.oidc.op.profile.flow.AuthorizeFlowTest;
import net.shibboleth.idp.plugin.oidc.op.token.support.AuthorizeCodeClaimsSet;
import net.shibboleth.shared.collection.Pair;
import net.shibboleth.shared.primitive.StringSupport;
diff --git a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/security/TokenFlowSecurityTest.java b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/security/TokenFlowSecurityTest.java
new file mode 100644
index 00000000..d44c4a37
--- /dev/null
+++ b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/security/TokenFlowSecurityTest.java
@@ -0,0 +1,48 @@
+/*
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.idp.plugin.oidc.op.profile.flow.security;
+
+import org.testng.annotations.Factory;
+
+import net.shibboleth.idp.plugin.oidc.op.profile.flow.TokenFlowTest;
+
+/**
+ * Security tests for the JWTs issued by the token flow.
+ */
+public class TokenFlowSecurityTest extends TokenFlowTest {
+
+ @Factory
+ public Object[] createIdTokenSecurityTests() {
+ return new Object[] {
+ new IssuedSignedJWTTest(AbstractIssuedJWTSecurityTest.JWT_FETCHING_TYPE.TOKEN_ID_TOKEN, FLOW_ID),
+ new IssuedEncryptedJWTTest(AbstractIssuedJWTSecurityTest.JWT_FETCHING_TYPE.TOKEN_ID_TOKEN, FLOW_ID,
+ true, false),
+ new IssuedEncryptedJWTTest(AbstractIssuedJWTSecurityTest.JWT_FETCHING_TYPE.TOKEN_ID_TOKEN, FLOW_ID,
+ true, true)
+ };
+ }
+
+ @Factory
+ public Object[] createAccessTokenSecurityTests() {
+ return new Object[] {
+ new IssuedSignedJWTTest(AbstractIssuedJWTSecurityTest.JWT_FETCHING_TYPE.TOKEN_ACCESS_TOKEN, FLOW_ID),
+ new IssuedEncryptedJWTTest(AbstractIssuedJWTSecurityTest.JWT_FETCHING_TYPE.TOKEN_ACCESS_TOKEN, FLOW_ID,
+ true, false),
+ new IssuedEncryptedJWTTest(AbstractIssuedJWTSecurityTest.JWT_FETCHING_TYPE.TOKEN_ACCESS_TOKEN, FLOW_ID,
+ true, true)
+ };
+ }
+
+}
diff --git a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/security/UserInfoFlowSecurityTest.java b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/security/UserInfoFlowSecurityTest.java
new file mode 100644
index 00000000..9d846ad1
--- /dev/null
+++ b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/security/UserInfoFlowSecurityTest.java
@@ -0,0 +1,41 @@
+/*
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.idp.plugin.oidc.op.profile.flow.security;
+
+import org.testng.annotations.Factory;
+
+import net.shibboleth.idp.plugin.oidc.op.profile.flow.UserInfoTest;
+
+/**
+ * Security tests for the JWTs issued by the user info flow.
+ */
+public class UserInfoFlowSecurityTest extends UserInfoTest {
+
+ @Factory
+ public Object[] createUserInfoAsJwtSecurityTests() {
+ return new Object[] {
+ new IssuedSignedJWTTest(AbstractIssuedJWTSecurityTest.JWT_FETCHING_TYPE.USERINFO, FLOW_ID),
+ new IssuedEncryptedJWTTest(AbstractIssuedJWTSecurityTest.JWT_FETCHING_TYPE.USERINFO, FLOW_ID, false,
+ false),
+ new IssuedEncryptedJWTTest(AbstractIssuedJWTSecurityTest.JWT_FETCHING_TYPE.USERINFO, FLOW_ID, false,
+ true),
+ new IssuedEncryptedJWTTest(AbstractIssuedJWTSecurityTest.JWT_FETCHING_TYPE.USERINFO, FLOW_ID, true,
+ false),
+ new IssuedEncryptedJWTTest(AbstractIssuedJWTSecurityTest.JWT_FETCHING_TYPE.USERINFO, FLOW_ID, true,
+ true)
+ };
+ }
+
+}
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list