[java-oidfed-common] branch main updated: Improve comparison for ResolveEntityRequest
Codeberg
noreply at shibboleth.net
Thu Sep 24 09:49:46 UTC 2026
This is an automated email from the git hooks/post-receive script.
codeberg pushed a commit to branch main
in repository java-oidfed-common.
View the commit online:
https://codeberg.org/Shibboleth/java-oidfed-common/commit/4895ccee15949175b7eb8c22d26e46e45c8d6960
The following commit(s) were added to refs/heads/main by this push:
new 4895cce Improve comparison for ResolveEntityRequest
4895cce is described below
commit 4895ccee15949175b7eb8c22d26e46e45c8d6960
Author: Henri Mikkonen <henri.mikkonen at iki.fi>
AuthorDate: Thu Sep 24 12:49:19 2026 +0300
Improve comparison for ResolveEntityRequest
- Compare client authentication method and client ID
- The process earlier runs the actual authentication
- Included test cases
---
.../messaging/impl/ResolveEntityRequest.java | 16 +-
.../cache/local/ResolveEntityRequestCriterion.java | 1 -
.../messaging/impl/ResolveEntityRequestTest.java | 181 +++++++++++++++++++++
3 files changed, 195 insertions(+), 3 deletions(-)
diff --git a/oidfed-common-impl/src/main/java/net/shibboleth/oidfed/messaging/impl/ResolveEntityRequest.java b/oidfed-common-impl/src/main/java/net/shibboleth/oidfed/messaging/impl/ResolveEntityRequest.java
index 257c65d..d9f8fd4 100644
--- a/oidfed-common-impl/src/main/java/net/shibboleth/oidfed/messaging/impl/ResolveEntityRequest.java
+++ b/oidfed-common-impl/src/main/java/net/shibboleth/oidfed/messaging/impl/ResolveEntityRequest.java
@@ -16,6 +16,8 @@ package net.shibboleth.oidfed.messaging.impl;
import java.net.URI;
import java.util.List;
+import java.util.Objects;
+import java.util.Set;
import javax.annotation.Nonnull;
import javax.annotation.Nullable;
@@ -118,6 +120,14 @@ public class ResolveEntityRequest extends AbstractOptionallyAuthenticatedRequest
.toString();
}
+ /** {@inheritDoc} */
+ @Override
+ public int hashCode() {
+ return Objects.hash(subject, Set.copyOf(trustAnchors), Set.copyOf(entityTypes), getEndpointURI(),
+ getClientAuthentication() != null ? getClientAuthentication().getMethod() : null,
+ getClientAuthentication() != null ? getClientAuthentication().getClientID() : null);
+ }
+
/** {@inheritDoc} */
@Override
public boolean equals(final Object obj) {
@@ -134,7 +144,9 @@ public class ResolveEntityRequest extends AbstractOptionallyAuthenticatedRequest
return getEndpointURI().equals(other.getEndpointURI()) && subject.equals(other.subject) &&
entityTypes.containsAll(other.entityTypes) && other.entityTypes.containsAll(entityTypes) &&
trustAnchors.containsAll(other.trustAnchors) && other.trustAnchors.containsAll(trustAnchors) &&
- getClientAuthentication() == null ? other.getClientAuthentication() == null :
- getClientAuthentication().equals(other.getClientAuthentication());
+ (getClientAuthentication() == null ? other.getClientAuthentication() == null :
+ other.getClientAuthentication() != null &&
+ getClientAuthentication().getMethod().equals(other.getClientAuthentication().getMethod()) &&
+ getClientAuthentication().getClientID().equals(other.getClientAuthentication().getClientID()));
}
}
diff --git a/oidfed-common-impl/src/main/java/net/shibboleth/oidfed/metadata/cache/local/ResolveEntityRequestCriterion.java b/oidfed-common-impl/src/main/java/net/shibboleth/oidfed/metadata/cache/local/ResolveEntityRequestCriterion.java
index d6a249f..a1db9d5 100644
--- a/oidfed-common-impl/src/main/java/net/shibboleth/oidfed/metadata/cache/local/ResolveEntityRequestCriterion.java
+++ b/oidfed-common-impl/src/main/java/net/shibboleth/oidfed/metadata/cache/local/ResolveEntityRequestCriterion.java
@@ -73,7 +73,6 @@ public class ResolveEntityRequestCriterion implements Criterion {
return false;
}
final ResolveEntityRequestCriterion other = (ResolveEntityRequestCriterion) obj;
- //TODO: proper equals-check
return request.equals(other.request);
}
diff --git a/oidfed-common-impl/src/test/java/net/shibboleth/oidfed/messaging/impl/ResolveEntityRequestTest.java b/oidfed-common-impl/src/test/java/net/shibboleth/oidfed/messaging/impl/ResolveEntityRequestTest.java
new file mode 100644
index 0000000..c65c0e5
--- /dev/null
+++ b/oidfed-common-impl/src/test/java/net/shibboleth/oidfed/messaging/impl/ResolveEntityRequestTest.java
@@ -0,0 +1,181 @@
+/*
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.oidfed.messaging.impl;
+
+import java.net.URI;
+import java.util.List;
+
+import org.testng.Assert;
+import org.testng.annotations.Test;
+
+import com.nimbusds.oauth2.sdk.auth.ClientAuthentication;
+import com.nimbusds.oauth2.sdk.auth.ClientSecretBasic;
+import com.nimbusds.oauth2.sdk.auth.ClientSecretPost;
+import com.nimbusds.oauth2.sdk.auth.Secret;
+import com.nimbusds.oauth2.sdk.id.ClientID;
+
+/**
+ * Unit tests for {@link ResolveEntityRequest}.
+ */
+public class ResolveEntityRequestTest {
+
+ URI endpoint1 = URI.create("https://op.example.org/resolve");
+ URI endpoint2 = URI.create("https://op2.example.org/resolve");
+
+ String sub = "https://rp.example.org";
+
+ String anchor1 = "https://anchor1.example.org";
+ String anchor2 = "https://anchor2.example.org";
+
+ String client1 = "mockClientId1";
+ String client2 = "mockClientId2";
+
+ @SuppressWarnings("null")
+ private ResolveEntityRequest request(final URI uri, final String subject, final List<String> anchors,
+ final List<String> types, final ClientAuthentication clientAuthentication) {
+ return new ResolveEntityRequest(uri, subject, anchors, types, clientAuthentication);
+ }
+
+ private ResolveEntityRequest defaultRequest(final ClientAuthentication clientAuthentication) {
+ return request(endpoint1, sub, List.of(anchor1, anchor2), List.of("openid_relying_party", "openid_provider"),
+ clientAuthentication);
+ }
+
+ @Test
+ public void testEqualsWithoutAuthentication() {
+ final ResolveEntityRequest request = defaultRequest(null);
+ Assert.assertTrue(request.equals(request));
+ Assert.assertFalse(request.equals(null));
+ Assert.assertTrue(request.equals(defaultRequest(null)));
+ Assert.assertTrue(defaultRequest(null).equals(request));
+ Assert.assertTrue(request.equals(
+ request(endpoint1, sub, List.of(anchor2, anchor1), List.of("openid_provider", "openid_relying_party"),
+ null)));
+ Assert.assertTrue(request(endpoint1, sub, List.of(anchor2, anchor1),
+ List.of("openid_provider", "openid_relying_party"), null).equals(request));
+ Assert.assertFalse(request.equals(
+ request(endpoint1, sub, List.of(anchor2), List.of("openid_provider", "openid_relying_party"), null)));
+ Assert.assertFalse(request(endpoint1, sub, List.of(anchor2),
+ List.of("openid_provider", "openid_relying_party"), null).equals(request));
+ Assert.assertFalse(request.equals(
+ request(endpoint1, sub, List.of(anchor2, anchor1), List.of("openid_relying_party"), null)));
+ Assert.assertFalse(request(endpoint1, sub, List.of(anchor2, anchor1),
+ List.of("openid_relying_party"), null).equals(request));
+ Assert.assertFalse(request.equals(request(endpoint1, sub, List.of(anchor2, anchor1), null, null)));
+ Assert.assertFalse(request(endpoint1, sub, List.of(anchor2, anchor1), null, null).equals(request));
+ Assert.assertFalse(request.equals(
+ request(endpoint2, sub, List.of(anchor2, anchor1), List.of("openid_provider", "openid_relying_party"),
+ null)));
+ Assert.assertFalse(request(endpoint2, sub, List.of(anchor2, anchor1),
+ List.of("openid_provider", "openid_relying_party"), null).equals(request));
+ Assert.assertFalse(request.equals(
+ request(endpoint1, sub + "2", List.of(anchor2, anchor1),
+ List.of("openid_provider", "openid_relying_party"), null)));
+ Assert.assertFalse(request(endpoint1, sub + "2", List.of(anchor2, anchor1),
+ List.of("openid_provider", "openid_relying_party"), null).equals(request));
+ }
+
+ @Test
+ public void testHashWithoutAuthentication() {
+ final ResolveEntityRequest request = defaultRequest(null);
+ Assert.assertEquals(request.hashCode(), request.hashCode());
+ Assert.assertEquals(request.hashCode(), defaultRequest(null).hashCode());
+ Assert.assertEquals(request.hashCode(), request(endpoint1, sub, List.of(anchor2, anchor1),
+ List.of("openid_provider", "openid_relying_party"), null).hashCode());
+ Assert.assertNotEquals(request.hashCode(), request(endpoint2, sub, List.of(anchor2, anchor1),
+ List.of("openid_provider", "openid_relying_party"), null).hashCode());
+ Assert.assertNotEquals(request.hashCode(), request(endpoint1, sub + "2", List.of(anchor2, anchor1),
+ List.of("openid_provider", "openid_relying_party"), null).hashCode());
+ Assert.assertNotEquals(request.hashCode(), request(endpoint1, sub, List.of(anchor1),
+ List.of("openid_provider", "openid_relying_party"), null).hashCode());
+ Assert.assertNotEquals(request.hashCode(), request(endpoint1, sub, List.of(anchor2, anchor1),
+ List.of("openid_provider"), null).hashCode());
+ }
+
+
+ @Test
+ public void testEqualsWithClientSecretAuthentication() {
+ final ClientAuthentication secretAuth =
+ new ClientSecretBasic(new ClientID(client1), new Secret("mockSecret"));
+ final ResolveEntityRequest request = defaultRequest(secretAuth);
+ Assert.assertEquals(request, request);
+ Assert.assertFalse(request.equals(defaultRequest(null)));
+ Assert.assertFalse(defaultRequest(null).equals(request));
+ Assert.assertEquals(request, defaultRequest(secretAuth));
+ Assert.assertEquals(defaultRequest(secretAuth), request);
+ Assert.assertTrue(request(endpoint1, sub, List.of(anchor2, anchor1),
+ List.of("openid_provider", "openid_relying_party"), secretAuth).equals(request));
+ Assert.assertFalse(request.equals(
+ request(endpoint1, sub, List.of(anchor2), List.of("openid_provider", "openid_relying_party"),
+ secretAuth)));
+ Assert.assertFalse(request(endpoint1, sub, List.of(anchor2),
+ List.of("openid_provider", "openid_relying_party"), secretAuth).equals(request));
+ Assert.assertFalse(request.equals(
+ request(endpoint1, sub, List.of(anchor2, anchor1), List.of("openid_relying_party"), secretAuth)));
+ Assert.assertFalse(request(endpoint1, sub, List.of(anchor2, anchor1),
+ List.of("openid_relying_party"), secretAuth).equals(request));
+ Assert.assertFalse(request.equals(request(endpoint1, sub, List.of(anchor2, anchor1), null, secretAuth)));
+ Assert.assertFalse(request(endpoint1, sub, List.of(anchor2, anchor1), null, secretAuth).equals(request));
+ Assert.assertFalse(request.equals(
+ request(endpoint2, sub, List.of(anchor2, anchor1), List.of("openid_provider", "openid_relying_party"),
+ secretAuth)));
+ Assert.assertFalse(request(endpoint2, sub, List.of(anchor2, anchor1),
+ List.of("openid_provider", "openid_relying_party"), secretAuth).equals(request));
+ Assert.assertFalse(request.equals(
+ request(endpoint1, sub + "2", List.of(anchor2, anchor1),
+ List.of("openid_provider", "openid_relying_party"), secretAuth)));
+ Assert.assertFalse(request(endpoint1, sub + "2", List.of(anchor2, anchor1),
+ List.of("openid_provider", "openid_relying_party"), secretAuth).equals(request));
+ Assert.assertFalse(request(endpoint1, sub, List.of(anchor2, anchor1),
+ List.of("openid_provider", "openid_relying_party"), new ClientSecretBasic(new ClientID(client2),
+ new Secret("mockSecret"))).equals(request));
+ Assert.assertFalse(request(endpoint1, sub, List.of(anchor2, anchor1),
+ List.of("openid_provider", "openid_relying_party"), new ClientSecretPost(new ClientID(client1),
+ new Secret("mockSecret"))).equals(request));
+ // secret is checked by the authentication earlier in the process
+ Assert.assertTrue(request(endpoint1, sub, List.of(anchor2, anchor1),
+ List.of("openid_provider", "openid_relying_party"), new ClientSecretBasic(new ClientID(client1),
+ new Secret("wrongSecret"))).equals(request));
+ }
+
+ @Test
+ public void testHashWithClientSecretAuthentication() {
+ final ClientAuthentication secretAuth =
+ new ClientSecretBasic(new ClientID(client1), new Secret("mockSecret"));
+ final ResolveEntityRequest request = defaultRequest(secretAuth);
+ Assert.assertEquals(request.hashCode(), request.hashCode());
+ Assert.assertEquals(request.hashCode(), defaultRequest(secretAuth).hashCode());
+ Assert.assertEquals(request.hashCode(), request(endpoint1, sub, List.of(anchor2, anchor1),
+ List.of("openid_provider", "openid_relying_party"), secretAuth).hashCode());
+ Assert.assertNotEquals(request.hashCode(), request(endpoint2, sub, List.of(anchor2, anchor1),
+ List.of("openid_provider", "openid_relying_party"), secretAuth).hashCode());
+ Assert.assertNotEquals(request.hashCode(), request(endpoint1, sub + "2", List.of(anchor2, anchor1),
+ List.of("openid_provider", "openid_relying_party"), secretAuth).hashCode());
+ Assert.assertNotEquals(request.hashCode(), request(endpoint1, sub, List.of(anchor1),
+ List.of("openid_provider", "openid_relying_party"), secretAuth).hashCode());
+ Assert.assertNotEquals(request.hashCode(), request(endpoint1, sub, List.of(anchor2, anchor1),
+ List.of("openid_provider"), secretAuth).hashCode());
+ Assert.assertNotEquals(request.hashCode(), defaultRequest(new ClientSecretBasic(new ClientID(client2),
+ new Secret("mockSecret"))).hashCode());
+ Assert.assertNotEquals(request.hashCode(), defaultRequest(new ClientSecretPost(new ClientID(client1),
+ new Secret("mockSecret"))).hashCode());
+ // secret is checked by the authentication earlier in the process
+ Assert.assertEquals(request.hashCode(), defaultRequest(new ClientSecretBasic(new ClientID(client1),
+ new Secret("wrongSecret"))).hashCode());
+ Assert.assertNotEquals(defaultRequest(null).hashCode(), defaultRequest(new ClientSecretBasic(
+ new ClientID(client2), new Secret("mockSecret"))).hashCode());
+ }
+
+}
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list