[java-idp-plugin-oidc-op-oidfed] branch main updated: Remove the duplicate tests for MetadataCaxhes
Codeberg
noreply at shibboleth.net
Mon Sep 28 12:34:34 UTC 2026
This is an automated email from the git hooks/post-receive script.
codeberg pushed a commit to branch main
in repository java-idp-plugin-oidc-op-oidfed.
View the commit online:
https://codeberg.org/Shibboleth/java-idp-plugin-oidc-op-oidfed/commit/2b3665424e5862262a3cda11a2cb345fd6d45355
The following commit(s) were added to refs/heads/main by this push:
new 2b36654 Remove the duplicate tests for MetadataCaxhes
2b36654 is described below
commit 2b3665424e5862262a3cda11a2cb345fd6d45355
Author: Henri Mikkonen <henri.mikkonen at iki.fi>
AuthorDate: Mon Sep 28 15:33:54 2026 +0300
Remove the duplicate tests for MetadataCaxhes
- Already covered in java-oidfed-conf-impl
---
.../EntityConfigurationMetadataCacheTest.java | 594 ------------------
.../cache/SignedKeysetMetadataCacheTest.java | 242 --------
.../SubordinateStatementMetadataCacheTest.java | 661 ---------------------
.../oidfed/cache/TrustChainMetadataCacheTest.java | 274 ---------
4 files changed, 1771 deletions(-)
diff --git a/idp-oidfed-op-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/oidfed/cache/EntityConfigurationMetadataCacheTest.java b/idp-oidfed-op-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/oidfed/cache/EntityConfigurationMetadataCacheTest.java
deleted file mode 100644
index 96037f3..0000000
--- a/idp-oidfed-op-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/oidfed/cache/EntityConfigurationMetadataCacheTest.java
+++ /dev/null
@@ -1,594 +0,0 @@
-/*
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.plugin.oidc.op.profile.flow.oidfed.cache;
-
-import static org.mockito.ArgumentMatchers.any;
-import static org.mockito.ArgumentMatchers.argThat;
-import static org.mockito.Mockito.when;
-
-import java.io.IOException;
-import java.net.URISyntaxException;
-import java.time.Instant;
-import java.util.Collections;
-import java.util.Date;
-import java.util.HashMap;
-import java.util.List;
-import java.util.Map;
-
-import org.springframework.beans.factory.annotation.Autowired;
-import org.springframework.beans.factory.annotation.Qualifier;
-import org.testng.Assert;
-import org.testng.annotations.Test;
-
-import com.nimbusds.jose.EncryptionMethod;
-import com.nimbusds.jose.JOSEException;
-import com.nimbusds.jose.JOSEObjectType;
-import com.nimbusds.jose.JWEAlgorithm;
-import com.nimbusds.jose.JWEObject;
-import com.nimbusds.jose.JWEHeader;
-import com.nimbusds.jose.JWSAlgorithm;
-import com.nimbusds.jose.JWSHeader;
-import com.nimbusds.jose.Payload;
-import com.nimbusds.jose.crypto.RSAEncrypter;
-import com.nimbusds.jose.jwk.JWKSet;
-import com.nimbusds.jwt.JWTClaimsSet;
-import com.nimbusds.jwt.PlainJWT;
-import com.nimbusds.jwt.SignedJWT;
-
-import net.shibboleth.oidc.metadata.cache.MetadataCache;
-import net.shibboleth.oidc.metadata.cache.MetadataCacheException;
-import net.shibboleth.oidfed.flow.AbstractFederationFlowTest;
-import net.shibboleth.oidfed.flow.EntityConfigurationFlowTest;
-import net.shibboleth.oidfed.flow.support.CustomEntityConfigurationFilterStrategy;
-import net.shibboleth.oidfed.metadata.EntityConfiguration;
-import net.shibboleth.oidfed.metadata.cache.ResponseContainerExpirationCriterion;
-import net.shibboleth.oidfed.metadata.cache.SubjectEntityIDCriterion;
-import net.shibboleth.oidfed.metadata.cache.configuration.EntityConfigurationContainer;
-import net.shibboleth.oidfed.testing.FederationJwtSupport;
-import net.shibboleth.shared.collection.CollectionSupport;
-import net.shibboleth.shared.resolver.CriteriaSet;
-
-/**
- * Unit tests for the default entity configuration metadata cache.
- */
- at SuppressWarnings("null")
-public class EntityConfigurationMetadataCacheTest extends AbstractFederationFlowTest {
-
- protected EntityConfigurationMetadataCacheTest() {
- super(EntityConfigurationFlowTest.FLOW_ID);
- }
-
- @Autowired
- @Qualifier("shibboleth.oidfed.EntityConfigurationMetadataCache")
- MetadataCache<EntityConfigurationContainer> entityConfigurationCache;
-
- @Test
- public void testValidEntityConfiguration()
- throws MetadataCacheException, UnsupportedOperationException, IOException, URISyntaxException {
- final String entityId = uniqueClientId();
- final JWTClaimsSet.Builder builder = new JWTClaimsSet.Builder().issuer(entityId).subject(entityId)
- .issueTime(Date.from(Instant.now()))
- .expirationTime(Date.from(Instant.now().plusSeconds(300)))
- .claim("jwks", new JWKSet(leafKey).toJSONObject(true))
- .claim("metadata", Map.of("federation_entity", Collections.emptyMap()));
- final String entityConfiguration = FederationJwtSupport.signedJwt(
- JWSAlgorithm.RS256, leafKey, "entity-statement+jwt", builder.build()).serialize();
-
- mapResponse(entityConfigurationUrl(entityId), mockResponse(entityConfiguration));
- try {
- final List<EntityConfigurationContainer> result =
- entityConfigurationCache.get(new CriteriaSet(new SubjectEntityIDCriterion(entityId),
- new ResponseContainerExpirationCriterion(Instant.now().plusSeconds(300))));
- Assert.assertNotNull(result);
- Assert.assertEquals(result.size(), 1);
- final EntityConfiguration statement = result.get(0).getStatement();
- Assert.assertNotNull(statement);
- assert statement != null;
- Assert.assertNull(statement.getParsedPayload().getCustomClaims()
- .get(CustomEntityConfigurationFilterStrategy.CUSTOM_CLAIM_NAME));
- } catch (MetadataCacheException e) {
- Assert.fail("Could not resolve entity configuration", e);
- }
- }
-
- @Test
- public void testValidEntityConfiguration_customCriticalClaim()
- throws MetadataCacheException, UnsupportedOperationException, IOException, URISyntaxException {
- final String entityId = uniqueClientId();
- final JWTClaimsSet.Builder builder = new JWTClaimsSet.Builder().issuer(entityId).subject(entityId)
- .issueTime(Date.from(Instant.now()))
- .expirationTime(Date.from(Instant.now().plusSeconds(300)))
- .claim("jwks", new JWKSet(leafKey).toJSONObject(true))
- .claim("crit", List.of("default_crit"))
- .claim("metadata", Map.of("federation_entity", Collections.emptyMap()));
- final String entityConfiguration = FederationJwtSupport.signedJwt(
- JWSAlgorithm.RS256, leafKey, "entity-statement+jwt", builder.build()).serialize();
-
- mapResponse(entityConfigurationUrl(entityId), mockResponse(entityConfiguration));
- try {
- final List<EntityConfigurationContainer> result =
- entityConfigurationCache.get(new CriteriaSet(new SubjectEntityIDCriterion(entityId),
- new ResponseContainerExpirationCriterion(Instant.now().plusSeconds(300))));
- Assert.assertNotNull(result);
- Assert.assertEquals(result.size(), 1);
- final EntityConfiguration statement = result.get(0).getStatement();
- Assert.assertNotNull(statement);
- assert statement != null;
- Assert.assertEquals(statement.getParsedPayload().getCustomClaims()
- .get(CustomEntityConfigurationFilterStrategy.CUSTOM_CLAIM_NAME),
- CustomEntityConfigurationFilterStrategy.CUSTOM_CLAIM_VALUE);
- } catch (MetadataCacheException e) {
- Assert.fail("Could not resolve entity configuration", e);
- }
- }
-
- @Test
- public void testUnsignedEntityConfiguration()
- throws MetadataCacheException, UnsupportedOperationException, IOException, URISyntaxException {
- final String entityId = uniqueClientId();
- final JWTClaimsSet.Builder builder = new JWTClaimsSet.Builder().issuer(entityId).subject(entityId)
- .issueTime(Date.from(Instant.now()))
- .expirationTime(Date.from(Instant.now().plusSeconds(300)))
- .claim("jwks", new JWKSet(leafKey).toJSONObject(true))
- .claim("metadata", Map.of("federation_entity", Collections.emptyMap()));
- final String entityConfiguration = new PlainJWT(builder.build()).serialize();
-
- mapResponse(entityConfigurationUrl(entityId), mockResponse(entityConfiguration));
- assertNoEntityConfiguration(entityId);
- }
-
- @Test
- public void testEncryptedEntityConfiguration()
- throws MetadataCacheException, UnsupportedOperationException, IOException, URISyntaxException {
- final String entityId = uniqueClientId();
- final JWTClaimsSet.Builder builder = new JWTClaimsSet.Builder().issuer(entityId).subject(entityId)
- .issueTime(Date.from(Instant.now()))
- .expirationTime(Date.from(Instant.now().plusSeconds(300)))
- .claim("jwks", new JWKSet(leafKey).toJSONObject(true))
- .claim("metadata", Map.of("federation_entity", Collections.emptyMap()));
- final SignedJWT signedJwt = FederationJwtSupport.signedJwt(
- JWSAlgorithm.RS256, leafKey, "entity-statement+jwt", builder.build());
- final JWEObject jwe = new JWEObject(new JWEHeader.Builder(JWEAlgorithm.RSA_OAEP_256, EncryptionMethod.A256GCM)
- .contentType("JWT")
- .build(),
- new Payload(signedJwt));
- try {
- jwe.encrypt(new RSAEncrypter(leafKey.toRSAKey()));
- } catch (JOSEException e) {
- Assert.fail("Encryption failed", e);
- }
- final String entityConfiguration = jwe.serialize();
-
- mapResponse(entityConfigurationUrl(entityId), mockResponse(entityConfiguration));
- assertNoEntityConfiguration(entityId);
- }
-
- @Test
- public void testWithUnrecognizedCriticalClaim()
- throws MetadataCacheException, UnsupportedOperationException, IOException, URISyntaxException {
- final String entityId = uniqueClientId();
- final JWTClaimsSet.Builder builder = new JWTClaimsSet.Builder().issuer(entityId).subject(entityId)
- .issueTime(Date.from(Instant.now()))
- .expirationTime(Date.from(Instant.now().plusSeconds(300)))
- .claim("jwks", new JWKSet(leafKey).toJSONObject(true))
- .claim("crit", List.of("subordinate_crit"))
- .claim("metadata", Map.of("federation_entity", Collections.emptyMap()));
- final String entityConfiguration = FederationJwtSupport.signedJwt(
- JWSAlgorithm.RS256, leafKey, "entity-statement+jwt", builder.build()).serialize();
-
- mapResponse(entityConfigurationUrl(entityId), mockResponse(entityConfiguration));
- assertNoEntityConfiguration(entityId);
- }
-
- @Test
- public void testWithStandardClaimAsCriticalClaim()
- throws MetadataCacheException, UnsupportedOperationException, IOException, URISyntaxException {
- final String entityId = uniqueClientId();
- final JWTClaimsSet.Builder builder = new JWTClaimsSet.Builder().issuer(entityId).subject(entityId)
- .issueTime(Date.from(Instant.now()))
- .expirationTime(Date.from(Instant.now().plusSeconds(300)))
- .claim("jwks", new JWKSet(leafKey).toJSONObject(true))
- .claim("crit", List.of("jwks"))
- .claim("metadata", Map.of("federation_entity", Collections.emptyMap()));
- final String entityConfiguration = FederationJwtSupport.signedJwt(
- JWSAlgorithm.RS256, leafKey, "entity-statement+jwt", builder.build()).serialize();
-
- mapResponse(entityConfigurationUrl(entityId), mockResponse(entityConfiguration));
- assertNoEntityConfiguration(entityId);
- }
-
- @Test
- public void testSignatureWithNonMathchingKey()
- throws MetadataCacheException, UnsupportedOperationException, IOException, URISyntaxException {
- final String entityId = uniqueClientId();
- final JWTClaimsSet.Builder builder = new JWTClaimsSet.Builder().issuer(entityId).subject(entityId)
- .issueTime(Date.from(Instant.now()))
- .expirationTime(Date.from(Instant.now().plusSeconds(300)))
- .claim("jwks", new JWKSet(leafKey).toJSONObject(true))
- .claim("metadata", Map.of("federation_entity", Collections.emptyMap()));
- final String entityConfiguration = FederationJwtSupport.signedJwt(
- JWSAlgorithm.RS256, anchorKey, "entity-statement+jwt", builder.build()).serialize();
-
- mapResponse(entityConfigurationUrl(entityId), mockResponse(entityConfiguration));
- assertNoEntityConfiguration(entityId);
- }
-
- @Test
- public void testNonMatchingSubjectVsIssuer()
- throws MetadataCacheException, UnsupportedOperationException, IOException, URISyntaxException {
- final String entityId = uniqueClientId();
- final JWTClaimsSet.Builder builder = new JWTClaimsSet.Builder().issuer(uniqueClientId()).subject(entityId)
- .issueTime(Date.from(Instant.now()))
- .expirationTime(Date.from(Instant.now().plusSeconds(300)))
- .claim("jwks", new JWKSet(leafKey).toJSONObject(true))
- .claim("metadata", Map.of("federation_entity", Collections.emptyMap()));
- final String entityConfiguration = FederationJwtSupport.signedJwt(
- JWSAlgorithm.RS256, leafKey, "entity-statement+jwt", builder.build()).serialize();
-
- mapResponse(entityConfigurationUrl(entityId), mockResponse(entityConfiguration));
- assertNoEntityConfiguration(entityId);
- }
-
- @Test
- public void testValidClaims_nonMatchingSubject()
- throws MetadataCacheException, UnsupportedOperationException, IOException, URISyntaxException {
- final String entityId = uniqueClientId();
- final String claimsEntityId = uniqueClientId();
- final JWTClaimsSet.Builder builder = new JWTClaimsSet.Builder().issuer(claimsEntityId).subject(claimsEntityId)
- .issueTime(Date.from(Instant.now()))
- .expirationTime(Date.from(Instant.now().plusSeconds(300)))
- .claim("jwks", new JWKSet(leafKey).toJSONObject(true))
- .claim("metadata", Map.of("federation_entity", Collections.emptyMap()));
- final String entityConfiguration = FederationJwtSupport.signedJwt(
- JWSAlgorithm.RS256, leafKey, "entity-statement+jwt", builder.build()).serialize();
-
- mapResponse(entityConfigurationUrl(entityId), mockResponse(entityConfiguration));
- assertNoEntityConfiguration(entityId);
- }
-
- @Test
- public void testValidClaims_invalidTypeHeader()
- throws MetadataCacheException, UnsupportedOperationException, IOException, URISyntaxException {
- final String entityId = uniqueClientId();
- final JWTClaimsSet.Builder builder = new JWTClaimsSet.Builder().issuer(entityId).subject(entityId)
- .issueTime(Date.from(Instant.now()))
- .expirationTime(Date.from(Instant.now().plusSeconds(300)))
- .claim("jwks", new JWKSet(leafKey).toJSONObject(true))
- .claim("metadata", Map.of("federation_entity", Collections.emptyMap()));
- final String entityConfiguration = FederationJwtSupport.signedJwt(
- JWSAlgorithm.RS256, leafKey, "jwt", builder.build()).serialize();
-
- mapResponse(entityConfigurationUrl(entityId), mockResponse(entityConfiguration));
- assertNoEntityConfiguration(entityId);
- }
-
- @Test
- public void testIssuedInFuture()
- throws MetadataCacheException, UnsupportedOperationException, IOException, URISyntaxException {
- final String entityId = uniqueClientId();
- final JWTClaimsSet.Builder builder = new JWTClaimsSet.Builder().issuer(entityId).subject(entityId)
- .issueTime(Date.from(Instant.now().plusSeconds(300)))
- .expirationTime(Date.from(Instant.now().plusSeconds(300)))
- .claim("jwks", new JWKSet(leafKey).toJSONObject(true))
- .claim("metadata", Map.of("federation_entity", Collections.emptyMap()));
- final String entityConfiguration = FederationJwtSupport.signedJwt(
- JWSAlgorithm.RS256, leafKey, "entity-statement+jwt", builder.build()).serialize();
-
- mapResponse(entityConfigurationUrl(entityId), mockResponse(entityConfiguration));
- assertNoEntityConfiguration(entityId);
- }
-
- @Test
- public void testMissingSub()
- throws MetadataCacheException, UnsupportedOperationException, IOException, URISyntaxException {
- final String entityId = uniqueClientId();
- final JWTClaimsSet.Builder builder = new JWTClaimsSet.Builder().issuer(entityId)
- .issueTime(Date.from(Instant.now()))
- .expirationTime(Date.from(Instant.now().plusSeconds(300)))
- .claim("jwks", new JWKSet(leafKey).toJSONObject(true))
- .claim("metadata", Map.of("federation_entity", Collections.emptyMap()));
- final String entityConfiguration = FederationJwtSupport.signedJwt(
- JWSAlgorithm.RS256, leafKey, "entity-statement+jwt", builder.build()).serialize();
-
- mapResponse(entityConfigurationUrl(entityId), mockResponse(entityConfiguration));
- assertNoEntityConfiguration(entityId);
- }
-
- @Test
- public void testExpired()
- throws MetadataCacheException, UnsupportedOperationException, IOException, URISyntaxException {
- final String entityId = uniqueClientId();
- final JWTClaimsSet.Builder builder = new JWTClaimsSet.Builder().issuer(entityId).subject(entityId)
- .issueTime(Date.from(Instant.now()))
- .expirationTime(Date.from(Instant.now().minusSeconds(300)))
- .claim("jwks", new JWKSet(leafKey).toJSONObject(true))
- .claim("metadata", Map.of("federation_entity", Collections.emptyMap()));
- final String entityConfiguration = FederationJwtSupport.signedJwt(
- JWSAlgorithm.RS256, leafKey, "entity-statement+jwt", builder.build()).serialize();
-
- mapResponse(entityConfigurationUrl(entityId), mockResponse(entityConfiguration));
- assertNoEntityConfiguration(entityId);
- }
-
- @Test
- public void testMissingJwks()
- throws MetadataCacheException, UnsupportedOperationException, IOException, URISyntaxException {
- final String entityId = uniqueClientId();
- final JWTClaimsSet.Builder builder = new JWTClaimsSet.Builder().issuer(entityId).subject(entityId)
- .issueTime(Date.from(Instant.now()))
- .expirationTime(Date.from(Instant.now().plusSeconds(300)))
- .claim("metadata", Map.of("federation_entity", Collections.emptyMap()));
- final String entityConfiguration = FederationJwtSupport.signedJwt(
- JWSAlgorithm.RS256, leafKey, "entity-statement+jwt", builder.build()).serialize();
-
- mapResponse(entityConfigurationUrl(entityId), mockResponse(entityConfiguration));
- assertNoEntityConfiguration(entityId);
- }
-
- @Test
- public void testInvalidJwksClaim()
- throws MetadataCacheException, UnsupportedOperationException, IOException, URISyntaxException {
- final String entityId = uniqueClientId();
- final JWTClaimsSet.Builder builder = new JWTClaimsSet.Builder().issuer(entityId).subject(entityId)
- .issueTime(Date.from(Instant.now()))
- .expirationTime(Date.from(Instant.now().plusSeconds(300)))
- .claim("jwks", Map.of("federation_entity", Collections.emptyMap()))
- .claim("metadata", Map.of("federation_entity", Collections.emptyMap()));
- final String entityConfiguration = FederationJwtSupport.signedJwt(
- JWSAlgorithm.RS256, leafKey, "entity-statement+jwt", builder.build()).serialize();
-
- mapResponse(entityConfigurationUrl(entityId), mockResponse(entityConfiguration));
- assertNoEntityConfiguration(entityId);
- }
-
- @Test
- public void testValidClaims_forbiddenHeader_trustChain()
- throws MetadataCacheException, UnsupportedOperationException, IOException, URISyntaxException {
- final String entityId = uniqueClientId();
- final JWTClaimsSet.Builder builder = new JWTClaimsSet.Builder().issuer(entityId).subject(entityId)
- .issueTime(Date.from(Instant.now()))
- .expirationTime(Date.from(Instant.now().plusSeconds(300)))
- .claim("jwks", new JWKSet(leafKey).toJSONObject(true))
- .claim("metadata", Map.of("federation_entity", Collections.emptyMap()));
- final JWSHeader header = new JWSHeader.Builder(JWSAlgorithm.RS256)
- .type(new JOSEObjectType("entity-statement+jwt"))
- .keyID(leafKey.getKeyID())
- .customParam("trust_chain", "forbidden")
- .build();
- final String entityConfiguration = FederationJwtSupport.signedJwt(
- JWSAlgorithm.RS256, leafKey, header, builder.build()).serialize();
-
- mapResponse(entityConfigurationUrl(entityId), mockResponse(entityConfiguration));
- assertNoEntityConfiguration(entityId);
- }
-
- @Test
- public void testValidClaims_forbiddenHeader_peerTrustChain()
- throws MetadataCacheException, UnsupportedOperationException, IOException, URISyntaxException {
- final String entityId = uniqueClientId();
- final JWTClaimsSet.Builder builder = new JWTClaimsSet.Builder().issuer(entityId).subject(entityId)
- .issueTime(Date.from(Instant.now()))
- .expirationTime(Date.from(Instant.now().plusSeconds(300)))
- .claim("jwks", new JWKSet(leafKey).toJSONObject(true))
- .claim("metadata", Map.of("federation_entity", Collections.emptyMap()));
- final JWSHeader header = new JWSHeader.Builder(JWSAlgorithm.RS256)
- .type(new JOSEObjectType("entity-statement+jwt"))
- .keyID(leafKey.getKeyID())
- .customParam("peer_trust_chain", "forbidden")
- .build();
- final String entityConfiguration = FederationJwtSupport.signedJwt(
- JWSAlgorithm.RS256, leafKey, header, builder.build()).serialize();
-
- mapResponse(entityConfigurationUrl(entityId), mockResponse(entityConfiguration));
- assertNoEntityConfiguration(entityId);
- }
-
- @Test
- public void testEmptyAuthorityHintsClaim()
- throws MetadataCacheException, UnsupportedOperationException, IOException, URISyntaxException {
- final String entityId = uniqueClientId();
- final JWTClaimsSet.Builder builder = new JWTClaimsSet.Builder().issuer(entityId).subject(entityId)
- .issueTime(Date.from(Instant.now()))
- .expirationTime(Date.from(Instant.now().plusSeconds(300)))
- .claim("jwks", new JWKSet(leafKey).toJSONObject(true))
- .claim("authority_hints", CollectionSupport.emptyList())
- .claim("metadata", Map.of("federation_entity", Collections.emptyMap()));
- final String entityConfiguration = FederationJwtSupport.signedJwt(
- JWSAlgorithm.RS256, leafKey, "entity-statement+jwt", builder.build()).serialize();
-
- mapResponse(entityConfigurationUrl(entityId), mockResponse(entityConfiguration));
- assertNoEntityConfiguration(entityId);
- }
-
- @Test
- public void testEmptyTrustAnchorHintsClaim()
- throws MetadataCacheException, UnsupportedOperationException, IOException, URISyntaxException {
- final String entityId = uniqueClientId();
- final JWTClaimsSet.Builder builder = new JWTClaimsSet.Builder().issuer(entityId).subject(entityId)
- .issueTime(Date.from(Instant.now()))
- .expirationTime(Date.from(Instant.now().plusSeconds(300)))
- .claim("jwks", new JWKSet(leafKey).toJSONObject(true))
- .claim("trust_anchor_hints", CollectionSupport.emptyList())
- .claim("metadata", Map.of("federation_entity", Collections.emptyMap()));
- final String entityConfiguration = FederationJwtSupport.signedJwt(
- JWSAlgorithm.RS256, leafKey, "entity-statement+jwt", builder.build()).serialize();
-
- mapResponse(entityConfigurationUrl(entityId), mockResponse(entityConfiguration));
- assertNoEntityConfiguration(entityId);
- }
-
- @Test
- public void testNullFederationEntityMetadata()
- throws MetadataCacheException, UnsupportedOperationException, IOException, URISyntaxException {
- final String entityId = uniqueClientId();
- final Map<String, Object> metadata = new HashMap<>();
- metadata.put("federation_entity", null);
- final JWTClaimsSet.Builder builder = new JWTClaimsSet.Builder().issuer(entityId).subject(entityId)
- .issueTime(Date.from(Instant.now()))
- .expirationTime(Date.from(Instant.now().plusSeconds(300)))
- .claim("jwks", new JWKSet(leafKey).toJSONObject(true))
- .claim("metadata", metadata);
- final String entityConfiguration = FederationJwtSupport.signedJwt(
- JWSAlgorithm.RS256, leafKey, "entity-statement+jwt", builder.build()).serialize();
-
- mapResponse(entityConfigurationUrl(entityId), mockResponse(entityConfiguration));
- assertNoEntityConfiguration(entityId);
- }
-
- @Test
- public void testNullCustomMetadata()
- throws MetadataCacheException, UnsupportedOperationException, IOException, URISyntaxException {
- final String entityId = uniqueClientId();
- final Map<String, Object> metadata = new HashMap<>();
- metadata.put("federation_entity", Collections.emptyMap());
- metadata.put("custom_type", null);
- final JWTClaimsSet.Builder builder = new JWTClaimsSet.Builder().issuer(entityId).subject(entityId)
- .issueTime(Date.from(Instant.now()))
- .expirationTime(Date.from(Instant.now().plusSeconds(300)))
- .claim("jwks", new JWKSet(leafKey).toJSONObject(true))
- .claim("metadata", metadata);
- final String entityConfiguration = FederationJwtSupport.signedJwt(
- JWSAlgorithm.RS256, leafKey, "entity-statement+jwt", builder.build()).serialize();
-
- mapResponse(entityConfigurationUrl(entityId), mockResponse(entityConfiguration));
- assertNoEntityConfiguration(entityId);
- }
-
- @Test
- public void testNullResponse()
- throws MetadataCacheException, UnsupportedOperationException, IOException, URISyntaxException {
- final String entityId = uniqueClientId();
- mapResponse(entityConfigurationUrl(entityId), null);
- assertNoEntityConfiguration(entityId);
- }
-
- @Test
- public void testExceptionResponse()
- throws MetadataCacheException, UnsupportedOperationException, IOException, URISyntaxException {
- final String entityId = uniqueClientId();
- when(federationHttpClient.executeOpen(any(), argThat(new RequestUriMatcher(entityConfigurationUrl(entityId))),
- any())).thenThrow(IOException.class);
- assertNoEntityConfiguration(entityId);
- }
-
- @Test
- public void testInvalidtTrustMark_nonMatchingType()
- throws MetadataCacheException, UnsupportedOperationException, IOException, URISyntaxException {
- final String entityId = uniqueClientId();
- final String trustMark = FederationJwtSupport.trustMark(JWSAlgorithm.RS256, trustMarkIssuerKey, trustMarkIssuerId,
- entityId, "https://example.org/email-allowing-trust-mark", Instant.now().plusSeconds(300)).serialize();
- final JWTClaimsSet.Builder builder = new JWTClaimsSet.Builder().issuer(entityId).subject(entityId)
- .issueTime(Date.from(Instant.now()))
- .expirationTime(Date.from(Instant.now().plusSeconds(300)))
- .claim("jwks", new JWKSet(leafKey).toJSONObject(true))
- .claim("trust_marks", List.of(Map.of(
- "trust_mark_type", "https://example.org/non-matching-type",
- "trust_mark", trustMark)))
- .claim("metadata", Map.of("federation_entity", Collections.emptyMap()));
- final String entityConfiguration = FederationJwtSupport.signedJwt(
- JWSAlgorithm.RS256, leafKey, "entity-statement+jwt", builder.build()).serialize();
-
- mapResponse(entityConfigurationUrl(entityId), mockResponse(entityConfiguration));
- assertNoEntityConfiguration(entityId);
- }
-
- @Test
- public void testInvalidtTrustMarkIssuers_invalidFormat()
- throws MetadataCacheException, UnsupportedOperationException, IOException, URISyntaxException {
- final String entityId = uniqueClientId();
- final JWTClaimsSet.Builder builder = new JWTClaimsSet.Builder().issuer(entityId).subject(entityId)
- .issueTime(Date.from(Instant.now()))
- .expirationTime(Date.from(Instant.now().plusSeconds(300)))
- .claim("jwks", new JWKSet(leafKey).toJSONObject(true))
- .claim("trust_mark_issuers", List.of(trustMarkIssuerId))
- .claim("metadata", Map.of("federation_entity", Collections.emptyMap()));
- final String entityConfiguration = FederationJwtSupport.signedJwt(
- JWSAlgorithm.RS256, leafKey, "entity-statement+jwt", builder.build()).serialize();
-
- mapResponse(entityConfigurationUrl(entityId), mockResponse(entityConfiguration));
- assertNoEntityConfiguration(entityId);
- }
-
- @Test
- public void testInvalidtTrustMarkOwners_invalidJwks()
- throws MetadataCacheException, UnsupportedOperationException, IOException, URISyntaxException {
- final String entityId = uniqueClientId();
- final Map<String,Object> trustMarkOwner = new HashMap<>();
- trustMarkOwner.put("sub", trustMarkIssuerId);
- trustMarkOwner.put("jwks", Collections.emptyMap());
- final JWTClaimsSet.Builder builder = new JWTClaimsSet.Builder().issuer(entityId).subject(entityId)
- .issueTime(Date.from(Instant.now()))
- .expirationTime(Date.from(Instant.now().plusSeconds(300)))
- .claim("jwks", new JWKSet(leafKey).toJSONObject(true))
- .claim("trust_mark_owners", Map.of("https://example.org/email-allowing-trust-mark", trustMarkOwner))
- .claim("metadata", Map.of("federation_entity", Collections.emptyMap()));
- final String entityConfiguration = FederationJwtSupport.signedJwt(
- JWSAlgorithm.RS256, leafKey, "entity-statement+jwt", builder.build()).serialize();
-
- mapResponse(entityConfigurationUrl(entityId), mockResponse(entityConfiguration));
- assertNoEntityConfiguration(entityId);
- }
-
- @Test
- public void testInvalidtTrustMarkOwners_missingJwks()
- throws MetadataCacheException, UnsupportedOperationException, IOException, URISyntaxException {
- final String entityId = uniqueClientId();
- final Map<String,Object> trustMarkOwner = new HashMap<>();
- trustMarkOwner.put("sub", trustMarkIssuerId);
- final JWTClaimsSet.Builder builder = new JWTClaimsSet.Builder().issuer(entityId).subject(entityId)
- .issueTime(Date.from(Instant.now()))
- .expirationTime(Date.from(Instant.now().plusSeconds(300)))
- .claim("jwks", new JWKSet(leafKey).toJSONObject(true))
- .claim("trust_mark_owners", Map.of("https://example.org/email-allowing-trust-mark", trustMarkOwner))
- .claim("metadata", Map.of("federation_entity", Collections.emptyMap()));
- final String entityConfiguration = FederationJwtSupport.signedJwt(
- JWSAlgorithm.RS256, leafKey, "entity-statement+jwt", builder.build()).serialize();
-
- mapResponse(entityConfigurationUrl(entityId), mockResponse(entityConfiguration));
- assertNoEntityConfiguration(entityId);
- }
-
- @Test
- public void testInvalidtTrustMarkOwners_missingSub()
- throws MetadataCacheException, UnsupportedOperationException, IOException, URISyntaxException {
- final String entityId = uniqueClientId();
- final Map<String,Object> trustMarkOwner = new HashMap<>();
- trustMarkOwner.put("jwks", new JWKSet(leafKey).toJSONObject(true));
- final JWTClaimsSet.Builder builder = new JWTClaimsSet.Builder().issuer(entityId).subject(entityId)
- .issueTime(Date.from(Instant.now()))
- .expirationTime(Date.from(Instant.now().plusSeconds(300)))
- .claim("jwks", new JWKSet(leafKey).toJSONObject(true))
- .claim("trust_mark_owners", Map.of("https://example.org/email-allowing-trust-mark", trustMarkOwner))
- .claim("metadata", Map.of("federation_entity", Collections.emptyMap()));
- final String entityConfiguration = FederationJwtSupport.signedJwt(
- JWSAlgorithm.RS256, leafKey, "entity-statement+jwt", builder.build()).serialize();
-
- mapResponse(entityConfigurationUrl(entityId), mockResponse(entityConfiguration));
- assertNoEntityConfiguration(entityId);
- }
-
- protected void assertNoEntityConfiguration(final String entityId) {
- try {
- final List<EntityConfigurationContainer> result =
- entityConfigurationCache.get(new CriteriaSet(new SubjectEntityIDCriterion(entityId),
- new ResponseContainerExpirationCriterion(Instant.now().plusSeconds(300))));
- Assert.assertNotNull(result);
- Assert.assertTrue(result.size() == 0 || result.get(0).getStatement() == null);
- } catch (MetadataCacheException e) {
- Assert.fail("Could not resolve entity configuration", e);
- }
-
- }
-}
diff --git a/idp-oidfed-op-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/oidfed/cache/SignedKeysetMetadataCacheTest.java b/idp-oidfed-op-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/oidfed/cache/SignedKeysetMetadataCacheTest.java
deleted file mode 100644
index 414643a..0000000
--- a/idp-oidfed-op-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/oidfed/cache/SignedKeysetMetadataCacheTest.java
+++ /dev/null
@@ -1,242 +0,0 @@
-/*
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.plugin.oidc.op.profile.flow.oidfed.cache;
-
-import java.io.IOException;
-import java.net.URI;
-import java.net.URISyntaxException;
-import java.time.Instant;
-import java.util.Date;
-import java.util.List;
-import java.util.Map;
-
-import org.springframework.beans.factory.annotation.Autowired;
-import org.springframework.beans.factory.annotation.Qualifier;
-import org.testng.Assert;
-import org.testng.annotations.Test;
-
-import com.fasterxml.jackson.core.JsonProcessingException;
-import com.fasterxml.jackson.databind.ObjectMapper;
-import com.nimbusds.jose.JWSAlgorithm;
-import com.nimbusds.jose.jwk.JWK;
-import com.nimbusds.jose.jwk.JWKSet;
-import com.nimbusds.jwt.JWTClaimsSet;
-import com.nimbusds.openid.connect.sdk.rp.OIDCClientMetadata;
-
-import net.shibboleth.oidc.metadata.cache.MetadataCache;
-import net.shibboleth.oidc.metadata.cache.MetadataCacheException;
-import net.shibboleth.oidfed.flow.AbstractFederationFlowTest;
-import net.shibboleth.oidfed.flow.EntityConfigurationFlowTest;
-import net.shibboleth.oidfed.metadata.EntityConfiguration;
-import net.shibboleth.oidfed.metadata.SignedKeyset;
-import net.shibboleth.oidfed.metadata.cache.SubjectEntityStatementCriterion;
-import net.shibboleth.oidfed.metadata.cache.keyset.SignedKeysetContainer;
-import net.shibboleth.oidfed.metadata.cache.keyset.SubjectSignedKeysetUriCriterion;
-import net.shibboleth.oidfed.metadata.impl.EntityConfigurationImpl;
-import net.shibboleth.oidfed.testing.FederationJwtSupport;
-import net.shibboleth.shared.resolver.CriteriaSet;
-
-/**
- * Unit tests for the default signed keysetn metadata cache.
- */
- at SuppressWarnings("null")
-public class SignedKeysetMetadataCacheTest extends AbstractFederationFlowTest {
-
- protected SignedKeysetMetadataCacheTest() {
- super(EntityConfigurationFlowTest.FLOW_ID);
- }
-
- @Autowired
- @Qualifier("shibboleth.oidfed.SignedKeysetMetadataCache")
- MetadataCache<SignedKeysetContainer> signedKeysetCache;
-
- @Test
- public void testValidSignedKeyset()
- throws MetadataCacheException, UnsupportedOperationException, IOException, URISyntaxException {
- final String entityId = uniqueClientId();
- final String signedJwksUri = entityId + "/jwks.jwt";
- final OIDCClientMetadata metadata = new OIDCClientMetadata();
- metadata.setRedirectionURI(new URI(redirectUri));
- metadata.setCustomField("signed_jwks_uri", signedJwksUri);
- final JWTClaimsSet.Builder builder = new JWTClaimsSet.Builder().issuer(entityId).subject(entityId)
- .issueTime(Date.from(Instant.now()))
- .claim("keys", new JWKSet(rpKey).toJSONObject(true).get("keys"));
- final String signedKeyset = FederationJwtSupport.signedJwt(
- JWSAlgorithm.RS256, leafKey, "jwk-set+jwt", builder.build()).serialize();
-
- mapResponse(signedJwksUri, mockResponse(200, "application/jwk-set+jwt", signedKeyset));
- try {
- final List<SignedKeysetContainer> result =
- signedKeysetCache.get(new CriteriaSet(
- new SubjectSignedKeysetUriCriterion(signedJwksUri),
- new SubjectEntityStatementCriterion(buildEntityConfiguration(entityId, metadata))));
- Assert.assertNotNull(result);
- Assert.assertEquals(result.size(), 1);
- final SignedKeyset statement = result.get(0).getStatement();
- Assert.assertNotNull(statement);
- assert statement != null;
- final List<JWK> keys = statement.getParsedPayload().getKeys();
- Assert.assertNotNull(keys);
- Assert.assertEquals(keys.size(), 1);
- Assert.assertEquals(keys.get(0), rpKey.toPublicJWK());
- } catch (MetadataCacheException e) {
- Assert.fail("Could not resolve entity configuration", e);
- }
- }
-
- @Test
- public void testValidSignedKeyset_optionalExpiration()
- throws MetadataCacheException, UnsupportedOperationException, IOException, URISyntaxException {
- final String entityId = uniqueClientId();
- final String signedJwksUri = entityId + "/jwks.jwt";
- final OIDCClientMetadata metadata = new OIDCClientMetadata();
- metadata.setRedirectionURI(new URI(redirectUri));
- metadata.setCustomField("signed_jwks_uri", signedJwksUri);
- final JWTClaimsSet.Builder builder = new JWTClaimsSet.Builder().issuer(entityId).subject(entityId)
- .issueTime(Date.from(Instant.now()))
- .expirationTime(Date.from(Instant.now().plusSeconds(300)))
- .claim("keys", new JWKSet(rpKey).toJSONObject(true).get("keys"));
- final String signedKeyset = FederationJwtSupport.signedJwt(
- JWSAlgorithm.RS256, leafKey, "jwk-set+jwt", builder.build()).serialize();
-
- mapResponse(signedJwksUri, mockResponse(200, "application/jwk-set+jwt", signedKeyset));
- try {
- final List<SignedKeysetContainer> result =
- signedKeysetCache.get(new CriteriaSet(
- new SubjectSignedKeysetUriCriterion(signedJwksUri),
- new SubjectEntityStatementCriterion(buildEntityConfiguration(entityId, metadata))));
- Assert.assertNotNull(result);
- Assert.assertEquals(result.size(), 1);
- final SignedKeyset statement = result.get(0).getStatement();
- Assert.assertNotNull(statement);
- assert statement != null;
- final List<JWK> keys = statement.getParsedPayload().getKeys();
- Assert.assertNotNull(keys);
- Assert.assertEquals(keys.size(), 1);
- Assert.assertEquals(keys.get(0), rpKey.toPublicJWK());
- } catch (MetadataCacheException e) {
- Assert.fail("Could not resolve entity configuration", e);
- }
- }
-
- @Test
- public void testInvalidSignedKeyset_expired()
- throws MetadataCacheException, UnsupportedOperationException, IOException, URISyntaxException {
- final String entityId = uniqueClientId();
- final String signedJwksUri = entityId + "/jwks.jwt";
- final OIDCClientMetadata metadata = new OIDCClientMetadata();
- metadata.setRedirectionURI(new URI(redirectUri));
- metadata.setCustomField("signed_jwks_uri", signedJwksUri);
- final JWTClaimsSet.Builder builder = new JWTClaimsSet.Builder().issuer(entityId).subject(entityId)
- .issueTime(Date.from(Instant.now()))
- .expirationTime(Date.from(Instant.now().minusSeconds(300)))
- .claim("keys", new JWKSet(rpKey).toJSONObject(true).get("keys"));
- final String signedKeyset = FederationJwtSupport.signedJwt(
- JWSAlgorithm.RS256, leafKey, "jwk-set+jwt", builder.build()).serialize();
-
- mapResponse(signedJwksUri, mockResponse(200, "application/jwk-set+jwt", signedKeyset));
- assertNoSignedKeyset(signedJwksUri, buildEntityConfiguration(entityId, metadata));
- }
-
- @Test
- public void testInvalidSignedKeyset_invalidStatementType()
- throws MetadataCacheException, UnsupportedOperationException, IOException, URISyntaxException {
- final String entityId = uniqueClientId();
- final String signedJwksUri = entityId + "/jwks.jwt";
- final OIDCClientMetadata metadata = new OIDCClientMetadata();
- metadata.setRedirectionURI(new URI(redirectUri));
- metadata.setCustomField("signed_jwks_uri", signedJwksUri);
- final JWTClaimsSet.Builder builder = new JWTClaimsSet.Builder().issuer(entityId).subject(entityId)
- .issueTime(Date.from(Instant.now()))
- .expirationTime(Date.from(Instant.now().plusSeconds(300)))
- .claim("keys", new JWKSet(rpKey).toJSONObject(true).get("keys"));
- final String signedKeyset = FederationJwtSupport.signedJwt(
- JWSAlgorithm.RS256, leafKey, "entity-statement+jwt", builder.build()).serialize();
-
- mapResponse(signedJwksUri, mockResponse(200, "application/jwk-set+jwt", signedKeyset));
- assertNoSignedKeyset(signedJwksUri, buildEntityConfiguration(entityId, metadata));
- }
-
- @Test
- public void testInvalidSignedKeyset_invalidResponseContentType()
- throws MetadataCacheException, UnsupportedOperationException, IOException, URISyntaxException {
- final String entityId = uniqueClientId();
- final String signedJwksUri = entityId + "/jwks.jwt";
- final OIDCClientMetadata metadata = new OIDCClientMetadata();
- metadata.setRedirectionURI(new URI(redirectUri));
- metadata.setCustomField("signed_jwks_uri", signedJwksUri);
- final JWTClaimsSet.Builder builder = new JWTClaimsSet.Builder().issuer(entityId).subject(entityId)
- .issueTime(Date.from(Instant.now()))
- .expirationTime(Date.from(Instant.now().plusSeconds(300)))
- .claim("keys", new JWKSet(rpKey).toJSONObject(true).get("keys"));
- final String signedKeyset = FederationJwtSupport.signedJwt(
- JWSAlgorithm.RS256, leafKey, "jwk-set+jwt", builder.build()).serialize();
-
- mapResponse(signedJwksUri, mockResponse(200, "application/entity-statement+jwt", signedKeyset));
- assertNoSignedKeyset(signedJwksUri, buildEntityConfiguration(entityId, metadata));
- }
-
- @Test
- public void testInvalidSignedKeyset_wrongKey()
- throws MetadataCacheException, UnsupportedOperationException, IOException, URISyntaxException {
- final String entityId = uniqueClientId();
- final String signedJwksUri = entityId + "/jwks.jwt";
- final OIDCClientMetadata metadata = new OIDCClientMetadata();
- metadata.setRedirectionURI(new URI(redirectUri));
- metadata.setCustomField("signed_jwks_uri", signedJwksUri);
- final JWTClaimsSet.Builder builder = new JWTClaimsSet.Builder().issuer(entityId).subject(entityId)
- .issueTime(Date.from(Instant.now()))
- .expirationTime(Date.from(Instant.now().minusSeconds(300)))
- .claim("keys", new JWKSet(rpKey).toJSONObject(true).get("keys"));
- final String signedKeyset = FederationJwtSupport.signedJwt(
- JWSAlgorithm.RS256, rpKey, "jwk-set+jwt", builder.build()).serialize();
-
- mapResponse(signedJwksUri, mockResponse(200, "application/jwk-set+jwt", signedKeyset));
- assertNoSignedKeyset(signedJwksUri, buildEntityConfiguration(entityId, metadata));
- }
-
- protected EntityConfiguration buildEntityConfiguration(final String clientId, final OIDCClientMetadata metadata) {
- final JWTClaimsSet.Builder builder = new JWTClaimsSet.Builder().issuer(clientId).subject(clientId)
- .issueTime(Date.from(Instant.now()))
- .expirationTime(Date.from(Instant.now().plusSeconds(300)))
- .claim("jwks", new JWKSet(leafKey).toJSONObject(true))
- .claim("metadata", Map.of("openid_relying_party", metadata.toJSONObject()))
- .claim("authority_hints", new String[] { anchorId });
- final var jwt = FederationJwtSupport.entityStatement(JWSAlgorithm.RS256, leafKey, builder.build());
- final ObjectMapper objectMapper = payloadObjectMapper;
- assert objectMapper != null;
-
- try {
- return EntityConfigurationImpl.parse(jwt, objectMapper);
- } catch (final JsonProcessingException e) {
- Assert.fail("Could not parse entity configuration from the claims set", e);
- }
- return null;
- }
-
- protected void assertNoSignedKeyset(final String signedJwksUri, final EntityConfiguration entityConfiguration) {
- try {
- final List<SignedKeysetContainer> result =
- signedKeysetCache.get(new CriteriaSet(
- new SubjectSignedKeysetUriCriterion(signedJwksUri),
- new SubjectEntityStatementCriterion(entityConfiguration)));
- Assert.assertNotNull(result);
- Assert.assertTrue(result.size() == 0 || result.get(0).getStatement() == null);
- } catch (MetadataCacheException e) {
- Assert.fail("Could not resolve signed keyset", e);
- }
-
- }
-}
diff --git a/idp-oidfed-op-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/oidfed/cache/SubordinateStatementMetadataCacheTest.java b/idp-oidfed-op-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/oidfed/cache/SubordinateStatementMetadataCacheTest.java
deleted file mode 100644
index a26abd0..0000000
--- a/idp-oidfed-op-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/oidfed/cache/SubordinateStatementMetadataCacheTest.java
+++ /dev/null
@@ -1,661 +0,0 @@
-/*
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.plugin.oidc.op.profile.flow.oidfed.cache;
-
-import static org.mockito.ArgumentMatchers.any;
-import static org.mockito.ArgumentMatchers.argThat;
-import static org.mockito.Mockito.when;
-
-import java.io.IOException;
-import java.net.URISyntaxException;
-import java.time.Instant;
-import java.util.Collections;
-import java.util.Date;
-import java.util.HashMap;
-import java.util.List;
-import java.util.Map;
-
-import org.springframework.beans.factory.annotation.Autowired;
-import org.springframework.beans.factory.annotation.Qualifier;
-import org.testng.Assert;
-import org.testng.annotations.Test;
-
-import com.fasterxml.jackson.databind.ObjectMapper;
-import com.nimbusds.jose.EncryptionMethod;
-import com.nimbusds.jose.JOSEException;
-import com.nimbusds.jose.JOSEObjectType;
-import com.nimbusds.jose.JWEAlgorithm;
-import com.nimbusds.jose.JWEHeader;
-import com.nimbusds.jose.JWEObject;
-import com.nimbusds.jose.JWSAlgorithm;
-import com.nimbusds.jose.JWSHeader;
-import com.nimbusds.jose.Payload;
-import com.nimbusds.jose.crypto.RSAEncrypter;
-import com.nimbusds.jose.jwk.JWKSet;
-import com.nimbusds.jwt.JWTClaimsSet;
-import com.nimbusds.jwt.PlainJWT;
-import com.nimbusds.jwt.SignedJWT;
-
-import net.shibboleth.oidc.metadata.cache.MetadataCache;
-import net.shibboleth.oidc.metadata.cache.MetadataCacheException;
-import net.shibboleth.oidfed.flow.AbstractFederationFlowTest;
-import net.shibboleth.oidfed.flow.EntityConfigurationFlowTest;
-import net.shibboleth.oidfed.flow.support.CustomSubordinateStatementFilterStrategy;
-import net.shibboleth.oidfed.metadata.EntityStatement;
-import net.shibboleth.oidfed.metadata.SubordinateStatement;
-import net.shibboleth.oidfed.metadata.cache.IssuerEntityIDCriterion;
-import net.shibboleth.oidfed.metadata.cache.ResponseContainerExpirationCriterion;
-import net.shibboleth.oidfed.metadata.cache.SubjectEntityIDCriterion;
-import net.shibboleth.oidfed.metadata.cache.subordinate.SubordinateStatementContainer;
-import net.shibboleth.oidfed.metadata.impl.EntityConfigurationImpl;
-import net.shibboleth.oidfed.testing.FederationJwtSupport;
-import net.shibboleth.shared.resolver.CriteriaSet;
-
-/**
- * Unit tests for the default entity configuration metadata cache.
- */
- at SuppressWarnings("null")
-public class SubordinateStatementMetadataCacheTest extends AbstractFederationFlowTest {
-
- protected SubordinateStatementMetadataCacheTest() {
- super(EntityConfigurationFlowTest.FLOW_ID);
- }
-
- @Autowired
- @Qualifier("shibboleth.oidfed.SubordinateEntityStatementMetadataCache")
- MetadataCache<SubordinateStatementContainer> subordinateStatementCache;
-
- @Test
- public void testValidSubordinateStatement()
- throws MetadataCacheException, UnsupportedOperationException, IOException, URISyntaxException {
- final String entityId = uniqueClientId();
- final JWTClaimsSet.Builder builder = new JWTClaimsSet.Builder().issuer(anchorId).subject(entityId)
- .issueTime(Date.from(Instant.now()))
- .expirationTime(Date.from(Instant.now().plusSeconds(300)))
- .claim("jwks", new JWKSet(leafKey).toJSONObject(true))
- .claim("metadata", Map.of("federation_entity", Collections.emptyMap()));
- final String subordinateStatement = FederationJwtSupport.signedJwt(
- JWSAlgorithm.RS256, trustedAnchorKey, "entity-statement+jwt", builder.build()).serialize();
-
- mapResponse(entityConfigurationUrl(anchorId), mockResponse(trustedAnchorConfiguration()));
- mapResponse(subordinateStatementUrl(anchorFetchEndpoint, entityId),
- mockResponse(subordinateStatement));
- try {
- final List<SubordinateStatementContainer> result =
- subordinateStatementCache.get(new CriteriaSet(new SubjectEntityIDCriterion(entityId),
- new ResponseContainerExpirationCriterion(Instant.now().plusSeconds(300)),
- new IssuerEntityIDCriterion(anchorId)));
- Assert.assertNotNull(result);
- Assert.assertEquals(result.size(), 1);
- final SubordinateStatement statement = result.get(0).getStatement();
- Assert.assertNotNull(statement);
- assert statement != null;
- Assert.assertNull(statement.getParsedPayload().getCustomClaims()
- .get(CustomSubordinateStatementFilterStrategy.CUSTOM_CLAIM_NAME));
- } catch (MetadataCacheException e) {
- Assert.fail("Could not resolve entity configuration", e);
- }
- }
-
- @Test
- public void testValidSubordinateStatement_clientAuthentication()
- throws MetadataCacheException, UnsupportedOperationException, IOException, URISyntaxException {
- final String entityId = uniqueClientId();
- final String intermediateId = uniqueIntermediateId();
- final JWTClaimsSet.Builder builder = new JWTClaimsSet.Builder().issuer(intermediateId).subject(entityId)
- .issueTime(Date.from(Instant.now()))
- .expirationTime(Date.from(Instant.now().plusSeconds(300)))
- .claim("jwks", new JWKSet(leafKey).toJSONObject(true))
- .claim("metadata", Map.of("federation_entity", Collections.emptyMap()));
- final String subordinateStatement = FederationJwtSupport.signedJwt(
- JWSAlgorithm.RS256, intermediateKey, "entity-statement+jwt", builder.build()).serialize();
-
- final JWTClaimsSet.Builder ecBuilder = new JWTClaimsSet.Builder().issuer(intermediateId).subject(intermediateId)
- .issueTime(Date.from(Instant.now()))
- .expirationTime(Date.from(Instant.now().plusSeconds(300)))
- .claim("jwks", new JWKSet(intermediateKey).toJSONObject(true))
- .claim("metadata", Map.of("federation_entity", Map.of(
- "federation_fetch_endpoint", intermediateId + "/fetch",
- "federation_fetch_endpoint_auth_methods", List.of("private_key_jwt"),
- "endpoint_auth_signing_alg_values_supported", List.of("ES512"))));
-
- final var jwt = FederationJwtSupport.entityStatement(JWSAlgorithm.RS256, intermediateKey, ecBuilder.build());
- final ObjectMapper objectMapper = payloadObjectMapper;
- assert objectMapper != null;
-
- final EntityStatement<?> intermediateConfiguration = EntityConfigurationImpl.parse(jwt, objectMapper);
-
- mapResponse(entityConfigurationUrl(intermediateId), mockResponse(intermediateConfiguration.getJwt().serialize()));
- // raw anchorFetchEndpoint URL as the request is POST
- mapResponse(intermediateId + "/fetch", mockResponse(subordinateStatement));
-
- try {
- final List<SubordinateStatementContainer> result =
- subordinateStatementCache.get(new CriteriaSet(new SubjectEntityIDCriterion(entityId),
- new ResponseContainerExpirationCriterion(Instant.now().plusSeconds(300)),
- new IssuerEntityIDCriterion(intermediateId)));
- Assert.assertNotNull(result);
- Assert.assertEquals(result.size(), 1);
- final SubordinateStatement statement = result.get(0).getStatement();
- Assert.assertNotNull(statement);
- assert statement != null;
- Assert.assertNull(statement.getParsedPayload().getCustomClaims()
- .get(CustomSubordinateStatementFilterStrategy.CUSTOM_CLAIM_NAME));
- } catch (MetadataCacheException e) {
- Assert.fail("Could not resolve entity configuration", e);
- }
- }
-
- @Test
- public void testValidSubordinateStatement_customCriticalClaim()
- throws MetadataCacheException, UnsupportedOperationException, IOException, URISyntaxException {
- final String entityId = uniqueClientId();
- final JWTClaimsSet.Builder builder = new JWTClaimsSet.Builder().issuer(anchorId).subject(entityId)
- .issueTime(Date.from(Instant.now()))
- .expirationTime(Date.from(Instant.now().plusSeconds(300)))
- .claim("jwks", new JWKSet(leafKey).toJSONObject(true))
- .claim("crit", List.of("subordinate_crit"))
- .claim("metadata", Map.of("federation_entity", Collections.emptyMap()));
- final String subordinateStatement = FederationJwtSupport.signedJwt(
- JWSAlgorithm.RS256, trustedAnchorKey, "entity-statement+jwt", builder.build()).serialize();
-
- mapResponse(entityConfigurationUrl(anchorId), mockResponse(trustedAnchorConfiguration()));
- mapResponse(subordinateStatementUrl(anchorFetchEndpoint, entityId),
- mockResponse(subordinateStatement));
- try {
- final List<SubordinateStatementContainer> result =
- subordinateStatementCache.get(new CriteriaSet(new SubjectEntityIDCriterion(entityId),
- new ResponseContainerExpirationCriterion(Instant.now().plusSeconds(300)),
- new IssuerEntityIDCriterion(anchorId)));
- Assert.assertNotNull(result);
- Assert.assertEquals(result.size(), 1);
- final SubordinateStatement statement = result.get(0).getStatement();
- Assert.assertNotNull(statement);
- assert statement != null;
- Assert.assertEquals(statement.getParsedPayload().getCustomClaims()
- .get(CustomSubordinateStatementFilterStrategy.CUSTOM_CLAIM_NAME),
- CustomSubordinateStatementFilterStrategy.CUSTOM_CLAIM_VALUE);
- } catch (MetadataCacheException e) {
- Assert.fail("Could not resolve entity configuration", e);
- }
- }
-
- @Test
- public void testUnsignedSubordinateStatement()
- throws MetadataCacheException, UnsupportedOperationException, IOException, URISyntaxException {
- final String entityId = uniqueClientId();
- final JWTClaimsSet.Builder builder = new JWTClaimsSet.Builder().issuer(anchorId).subject(entityId)
- .issueTime(Date.from(Instant.now()))
- .expirationTime(Date.from(Instant.now().plusSeconds(300)))
- .claim("jwks", new JWKSet(leafKey).toJSONObject(true))
- .claim("metadata", Map.of("federation_entity", Collections.emptyMap()));
- final String subordinateStatement = new PlainJWT(builder.build()).serialize();
-
- mapResponse(entityConfigurationUrl(anchorId), mockResponse(trustedAnchorConfiguration()));
- mapResponse(subordinateStatementUrl(anchorFetchEndpoint, entityId),
- mockResponse(subordinateStatement));
- assertNoSubordinateStatement(entityId);
- }
-
- @Test
- public void testEncryptedSubordinateStatement()
- throws MetadataCacheException, UnsupportedOperationException, IOException, URISyntaxException {
- final String entityId = uniqueClientId();
- final JWTClaimsSet.Builder builder = new JWTClaimsSet.Builder().issuer(anchorId).subject(entityId)
- .issueTime(Date.from(Instant.now()))
- .expirationTime(Date.from(Instant.now().plusSeconds(300)))
- .claim("jwks", new JWKSet(leafKey).toJSONObject(true))
- .claim("metadata", Map.of("federation_entity", Collections.emptyMap()));
- final SignedJWT signedJwt = FederationJwtSupport.signedJwt(
- JWSAlgorithm.RS256, leafKey, "entity-statement+jwt", builder.build());
- final JWEObject jwe = new JWEObject(new JWEHeader.Builder(JWEAlgorithm.RSA_OAEP_256, EncryptionMethod.A256GCM)
- .contentType("JWT")
- .build(),
- new Payload(signedJwt));
- try {
- jwe.encrypt(new RSAEncrypter(leafKey.toRSAKey()));
- } catch (JOSEException e) {
- Assert.fail("Encryption failed", e);
- }
- final String subordinateStatement = jwe.serialize();
-
- mapResponse(entityConfigurationUrl(anchorId), mockResponse(trustedAnchorConfiguration()));
- mapResponse(subordinateStatementUrl(anchorFetchEndpoint, entityId),
- mockResponse(subordinateStatement));
- assertNoSubordinateStatement(entityId);
- }
-
- @Test
- public void testWithUnrecognizedCriticalClaim()
- throws MetadataCacheException, UnsupportedOperationException, IOException, URISyntaxException {
- final String entityId = uniqueClientId();
- final JWTClaimsSet.Builder builder = new JWTClaimsSet.Builder().issuer(anchorId).subject(entityId)
- .issueTime(Date.from(Instant.now()))
- .expirationTime(Date.from(Instant.now().plusSeconds(300)))
- .claim("jwks", new JWKSet(leafKey).toJSONObject(true))
- .claim("crit", List.of("default_crit"))
- .claim("metadata", Map.of("federation_entity", Collections.emptyMap()));
- final String subordinateStatement = FederationJwtSupport.signedJwt(
- JWSAlgorithm.RS256, trustedAnchorKey, "entity-statement+jwt", builder.build()).serialize();
-
- mapResponse(entityConfigurationUrl(anchorId), mockResponse(trustedAnchorConfiguration()));
- mapResponse(subordinateStatementUrl(anchorFetchEndpoint, entityId),
- mockResponse(subordinateStatement));
- assertNoSubordinateStatement(entityId);
- }
-
- @Test
- public void testWithStandardClaimAsCriticalClaim()
- throws MetadataCacheException, UnsupportedOperationException, IOException, URISyntaxException {
- final String entityId = uniqueClientId();
- final JWTClaimsSet.Builder builder = new JWTClaimsSet.Builder().issuer(anchorId).subject(entityId)
- .issueTime(Date.from(Instant.now()))
- .expirationTime(Date.from(Instant.now().plusSeconds(300)))
- .claim("jwks", new JWKSet(leafKey).toJSONObject(true))
- .claim("crit", List.of("jwks"))
- .claim("metadata", Map.of("federation_entity", Collections.emptyMap()));
- final String subordinateStatement = FederationJwtSupport.signedJwt(
- JWSAlgorithm.RS256, trustedAnchorKey, "entity-statement+jwt", builder.build()).serialize();
-
- mapResponse(entityConfigurationUrl(anchorId), mockResponse(trustedAnchorConfiguration()));
- mapResponse(subordinateStatementUrl(anchorFetchEndpoint, entityId),
- mockResponse(subordinateStatement));
- assertNoSubordinateStatement(entityId);
- }
-
- @Test
- public void testSignatureWithNonMathchingKey()
- throws MetadataCacheException, UnsupportedOperationException, IOException, URISyntaxException {
- final String entityId = uniqueClientId();
- final JWTClaimsSet.Builder builder = new JWTClaimsSet.Builder().issuer(anchorId).subject(entityId)
- .issueTime(Date.from(Instant.now()))
- .expirationTime(Date.from(Instant.now().plusSeconds(300)))
- .claim("jwks", new JWKSet(leafKey).toJSONObject(true))
- .claim("metadata", Map.of("federation_entity", Collections.emptyMap()));
- final String subordinateStatement = FederationJwtSupport.signedJwt(
- JWSAlgorithm.RS256, leafKey, "entity-statement+jwt", builder.build()).serialize();
-
- mapResponse(entityConfigurationUrl(anchorId), mockResponse(trustedAnchorConfiguration()));
- mapResponse(subordinateStatementUrl(anchorFetchEndpoint, entityId),
- mockResponse(subordinateStatement));
- assertNoSubordinateStatement(entityId);
- }
-
- @Test
- public void testValidClaims_nonMatchingSubject()
- throws MetadataCacheException, UnsupportedOperationException, IOException, URISyntaxException {
- final String entityId = uniqueClientId();
- final String claimsEntityId = uniqueClientId();
- final JWTClaimsSet.Builder builder = new JWTClaimsSet.Builder().issuer(anchorId).subject(claimsEntityId)
- .issueTime(Date.from(Instant.now()))
- .expirationTime(Date.from(Instant.now().plusSeconds(300)))
- .claim("jwks", new JWKSet(leafKey).toJSONObject(true))
- .claim("metadata", Map.of("federation_entity", Collections.emptyMap()));
- final String subordinateStatement = FederationJwtSupport.signedJwt(
- JWSAlgorithm.RS256, trustedAnchorKey, "entity-statement+jwt", builder.build()).serialize();
-
- mapResponse(entityConfigurationUrl(anchorId), mockResponse(trustedAnchorConfiguration()));
- mapResponse(subordinateStatementUrl(anchorFetchEndpoint, entityId),
- mockResponse(subordinateStatement));
- assertNoSubordinateStatement(entityId);
- }
-
- @Test
- public void testValidClaims_invalidTypeHeader()
- throws MetadataCacheException, UnsupportedOperationException, IOException, URISyntaxException {
- final String entityId = uniqueClientId();
- final JWTClaimsSet.Builder builder = new JWTClaimsSet.Builder().issuer(anchorId).subject(entityId)
- .issueTime(Date.from(Instant.now()))
- .expirationTime(Date.from(Instant.now().plusSeconds(300)))
- .claim("jwks", new JWKSet(leafKey).toJSONObject(true))
- .claim("metadata", Map.of("federation_entity", Collections.emptyMap()));
- final String subordinateStatement = FederationJwtSupport.signedJwt(
- JWSAlgorithm.RS256, trustedAnchorKey, "jwt", builder.build()).serialize();
-
- mapResponse(entityConfigurationUrl(anchorId), mockResponse(trustedAnchorConfiguration()));
- mapResponse(subordinateStatementUrl(anchorFetchEndpoint, entityId),
- mockResponse(subordinateStatement));
-
- assertNoSubordinateStatement(entityId);
- }
-
- @Test
- public void testValidClaims_forbiddenHeader_trustChain()
- throws MetadataCacheException, UnsupportedOperationException, IOException, URISyntaxException {
- final String entityId = uniqueClientId();
- final JWTClaimsSet.Builder builder = new JWTClaimsSet.Builder().issuer(anchorId).subject(entityId)
- .issueTime(Date.from(Instant.now()))
- .expirationTime(Date.from(Instant.now().plusSeconds(300)))
- .claim("jwks", new JWKSet(leafKey).toJSONObject(true))
- .claim("metadata", Map.of("federation_entity", Collections.emptyMap()));
- final JWSHeader header = new JWSHeader.Builder(JWSAlgorithm.RS256)
- .type(new JOSEObjectType("entity-statement+jwt"))
- .keyID(trustedAnchorKey.getKeyID())
- .customParam("trust_chain", "forbidden")
- .build();
- final String subordinateStatement = FederationJwtSupport.signedJwt(
- JWSAlgorithm.RS256, trustedAnchorKey, header, builder.build()).serialize();
-
- mapResponse(entityConfigurationUrl(anchorId), mockResponse(trustedAnchorConfiguration()));
- mapResponse(subordinateStatementUrl(anchorFetchEndpoint, entityId),
- mockResponse(subordinateStatement));
-
- assertNoSubordinateStatement(entityId);
- }
-
- @Test
- public void testValidClaims_forbiddenHeader_peerTrustChain()
- throws MetadataCacheException, UnsupportedOperationException, IOException, URISyntaxException {
- final String entityId = uniqueClientId();
- final JWTClaimsSet.Builder builder = new JWTClaimsSet.Builder().issuer(anchorId).subject(entityId)
- .issueTime(Date.from(Instant.now()))
- .expirationTime(Date.from(Instant.now().plusSeconds(300)))
- .claim("jwks", new JWKSet(leafKey).toJSONObject(true))
- .claim("metadata", Map.of("federation_entity", Collections.emptyMap()));
- final JWSHeader header = new JWSHeader.Builder(JWSAlgorithm.RS256)
- .type(new JOSEObjectType("entity-statement+jwt"))
- .keyID(trustedAnchorKey.getKeyID())
- .customParam("peer_trust_chain", "forbidden")
- .build();
- final String subordinateStatement = FederationJwtSupport.signedJwt(
- JWSAlgorithm.RS256, trustedAnchorKey, header, builder.build()).serialize();
-
- mapResponse(entityConfigurationUrl(anchorId), mockResponse(trustedAnchorConfiguration()));
- mapResponse(subordinateStatementUrl(anchorFetchEndpoint, entityId),
- mockResponse(subordinateStatement));
-
- assertNoSubordinateStatement(entityId);
- }
-
- @Test
- public void testIssuedInFuture()
- throws MetadataCacheException, UnsupportedOperationException, IOException, URISyntaxException {
- final String entityId = uniqueClientId();
- final JWTClaimsSet.Builder builder = new JWTClaimsSet.Builder().issuer(anchorId).subject(entityId)
- .issueTime(Date.from(Instant.now().plusSeconds(300)))
- .expirationTime(Date.from(Instant.now().plusSeconds(300)))
- .claim("jwks", new JWKSet(leafKey).toJSONObject(true))
- .claim("metadata", Map.of("federation_entity", Collections.emptyMap()));
- final String subordinateStatement = FederationJwtSupport.signedJwt(
- JWSAlgorithm.RS256, trustedAnchorKey, "entity-statement+jwt", builder.build()).serialize();
-
- mapResponse(entityConfigurationUrl(anchorId), mockResponse(trustedAnchorConfiguration()));
- mapResponse(subordinateStatementUrl(anchorFetchEndpoint, entityId),
- mockResponse(subordinateStatement));
- assertNoSubordinateStatement(entityId);
- }
-
- @Test
- public void testMissingSub()
- throws MetadataCacheException, UnsupportedOperationException, IOException, URISyntaxException {
- final String entityId = uniqueClientId();
- final JWTClaimsSet.Builder builder = new JWTClaimsSet.Builder().issuer(anchorId)
- .issueTime(Date.from(Instant.now()))
- .expirationTime(Date.from(Instant.now().plusSeconds(300)))
- .claim("jwks", new JWKSet(leafKey).toJSONObject(true))
- .claim("metadata", Map.of("federation_entity", Collections.emptyMap()));
- final String subordinateStatement = FederationJwtSupport.signedJwt(
- JWSAlgorithm.RS256, trustedAnchorKey, "entity-statement+jwt", builder.build()).serialize();
-
- mapResponse(entityConfigurationUrl(anchorId), mockResponse(trustedAnchorConfiguration()));
- mapResponse(subordinateStatementUrl(anchorFetchEndpoint, entityId),
- mockResponse(subordinateStatement));
- assertNoSubordinateStatement(entityId);
- }
-
- @Test
- public void testExpired()
- throws MetadataCacheException, UnsupportedOperationException, IOException, URISyntaxException {
- final String entityId = uniqueClientId();
- final JWTClaimsSet.Builder builder = new JWTClaimsSet.Builder().issuer(anchorId).subject(entityId)
- .issueTime(Date.from(Instant.now()))
- .expirationTime(Date.from(Instant.now().minusSeconds(300)))
- .claim("jwks", new JWKSet(leafKey).toJSONObject(true))
- .claim("metadata", Map.of("federation_entity", Collections.emptyMap()));
- final String subordinateStatement = FederationJwtSupport.signedJwt(
- JWSAlgorithm.RS256, trustedAnchorKey, "entity-statement+jwt", builder.build()).serialize();
-
- mapResponse(entityConfigurationUrl(anchorId), mockResponse(trustedAnchorConfiguration()));
- mapResponse(subordinateStatementUrl(anchorFetchEndpoint, entityId),
- mockResponse(subordinateStatement));
- assertNoSubordinateStatement(entityId);
- }
-
- @Test
- public void testMissingJwks()
- throws MetadataCacheException, UnsupportedOperationException, IOException, URISyntaxException {
- final String entityId = uniqueClientId();
- final JWTClaimsSet.Builder builder = new JWTClaimsSet.Builder().issuer(anchorId).subject(entityId)
- .issueTime(Date.from(Instant.now()))
- .expirationTime(Date.from(Instant.now().plusSeconds(300)))
- .claim("metadata", Map.of("federation_entity", Collections.emptyMap()));
- final String subordinateStatement = FederationJwtSupport.signedJwt(
- JWSAlgorithm.RS256, trustedAnchorKey, "entity-statement+jwt", builder.build()).serialize();
-
- mapResponse(entityConfigurationUrl(anchorId), mockResponse(trustedAnchorConfiguration()));
- mapResponse(subordinateStatementUrl(anchorFetchEndpoint, entityId),
- mockResponse(subordinateStatement));
- assertNoSubordinateStatement(entityId);
- }
-
- @Test
- public void testInvalidConstraints_maxPathLength()
- throws MetadataCacheException, UnsupportedOperationException, IOException, URISyntaxException {
- final String entityId = uniqueClientId();
- final JWTClaimsSet.Builder builder = new JWTClaimsSet.Builder().issuer(anchorId).subject(entityId)
- .issueTime(Date.from(Instant.now()))
- .expirationTime(Date.from(Instant.now().plusSeconds(300)))
- .claim("jwks", new JWKSet(leafKey).toJSONObject(true))
- .claim("constraints", Map.of("max_path_length", "non_integer"))
- .claim("metadata", Map.of("federation_entity", Collections.emptyMap()));
- final String subordinateStatement = FederationJwtSupport.signedJwt(
- JWSAlgorithm.RS256, trustedAnchorKey, "entity-statement+jwt", builder.build()).serialize();
-
- mapResponse(entityConfigurationUrl(anchorId), mockResponse(trustedAnchorConfiguration()));
- mapResponse(subordinateStatementUrl(anchorFetchEndpoint, entityId),
- mockResponse(subordinateStatement));
- assertNoSubordinateStatement(entityId);
- }
-
- @Test
- public void testInvalidConstraints_namingConstraint()
- throws MetadataCacheException, UnsupportedOperationException, IOException, URISyntaxException {
- final String entityId = uniqueClientId();
- final JWTClaimsSet.Builder builder = new JWTClaimsSet.Builder().issuer(anchorId).subject(entityId)
- .issueTime(Date.from(Instant.now()))
- .expirationTime(Date.from(Instant.now().plusSeconds(300)))
- .claim("jwks", new JWKSet(leafKey).toJSONObject(true))
- .claim("constraints", Map.of("naming_constraints", "not_map"))
- .claim("metadata", Map.of("federation_entity", Collections.emptyMap()));
- final String subordinateStatement = FederationJwtSupport.signedJwt(
- JWSAlgorithm.RS256, trustedAnchorKey, "entity-statement+jwt", builder.build()).serialize();
-
- mapResponse(entityConfigurationUrl(anchorId), mockResponse(trustedAnchorConfiguration()));
- mapResponse(subordinateStatementUrl(anchorFetchEndpoint, entityId),
- mockResponse(subordinateStatement));
- assertNoSubordinateStatement(entityId);
- }
-
- @Test
- public void testInvalidConstraints_allowedEntityTypes()
- throws MetadataCacheException, UnsupportedOperationException, IOException, URISyntaxException {
- final String entityId = uniqueClientId();
- final JWTClaimsSet.Builder builder = new JWTClaimsSet.Builder().issuer(anchorId).subject(entityId)
- .issueTime(Date.from(Instant.now()))
- .expirationTime(Date.from(Instant.now().plusSeconds(300)))
- .claim("jwks", new JWKSet(leafKey).toJSONObject(true))
- .claim("constraints", Map.of("allowed_entity_types", "not_list"))
- .claim("metadata", Map.of("federation_entity", Collections.emptyMap()));
- final String subordinateStatement = FederationJwtSupport.signedJwt(
- JWSAlgorithm.RS256, trustedAnchorKey, "entity-statement+jwt", builder.build()).serialize();
-
- mapResponse(entityConfigurationUrl(anchorId), mockResponse(trustedAnchorConfiguration()));
- mapResponse(subordinateStatementUrl(anchorFetchEndpoint, entityId),
- mockResponse(subordinateStatement));
- assertNoSubordinateStatement(entityId);
- }
-
- @Test
- public void testValidConstraints()
- throws MetadataCacheException, UnsupportedOperationException, IOException, URISyntaxException {
- final String entityId = uniqueClientId();
- final Map<String,Object> constraints = new HashMap<>();
- constraints.put("max_path_length", 5);
- constraints.put("allowed_entity_types", List.of("openid_relying_party"));
- constraints.put("naming_constraints", Map.of("permitted", List.of(".example.com")));
- final JWTClaimsSet.Builder builder = new JWTClaimsSet.Builder().issuer(anchorId).subject(entityId)
- .issueTime(Date.from(Instant.now()))
- .expirationTime(Date.from(Instant.now().plusSeconds(300)))
- .claim("jwks", new JWKSet(leafKey).toJSONObject(true))
- .claim("constraints", constraints)
- .claim("metadata", Map.of("federation_entity", Collections.emptyMap()));
- final String subordinateStatement = FederationJwtSupport.signedJwt(
- JWSAlgorithm.RS256, trustedAnchorKey, "entity-statement+jwt", builder.build()).serialize();
-
- mapResponse(entityConfigurationUrl(anchorId), mockResponse(trustedAnchorConfiguration()));
- mapResponse(subordinateStatementUrl(anchorFetchEndpoint, entityId),
- mockResponse(subordinateStatement));
- try {
- final List<SubordinateStatementContainer> result =
- subordinateStatementCache.get(new CriteriaSet(new SubjectEntityIDCriterion(entityId),
- new ResponseContainerExpirationCriterion(Instant.now().plusSeconds(300)),
- new IssuerEntityIDCriterion(anchorId)));
- Assert.assertNotNull(result);
- Assert.assertEquals(result.size(), 1);
- final SubordinateStatement statement = result.get(0).getStatement();
- Assert.assertNotNull(statement);
- assert statement != null;
- Assert.assertNull(statement.getParsedPayload().getCustomClaims()
- .get(CustomSubordinateStatementFilterStrategy.CUSTOM_CLAIM_NAME));
- } catch (MetadataCacheException e) {
- Assert.fail("Could not resolve entity configuration", e);
- }
- }
-
- @Test
- public void testForbiddenClaim_trustMark()
- throws MetadataCacheException, UnsupportedOperationException, IOException, URISyntaxException {
- final String entityId = uniqueClientId();
- final String trustMark = FederationJwtSupport.trustMark(JWSAlgorithm.RS256, trustMarkIssuerKey, trustMarkIssuerId,
- entityId, "https://example.org/email-allowing-trust-mark", Instant.now().plusSeconds(300)).serialize();
- final JWTClaimsSet.Builder builder = new JWTClaimsSet.Builder().issuer(anchorId).subject(entityId)
- .issueTime(Date.from(Instant.now()))
- .expirationTime(Date.from(Instant.now().plusSeconds(300)))
- .claim("jwks", new JWKSet(leafKey).toJSONObject(true))
- .claim("trust_marks", List.of(Map.of(
- "trust_mark_type", "https://example.org/email-allowing-trust-mark",
- "trust_mark", trustMark)))
- .claim("metadata", Map.of("federation_entity", Collections.emptyMap()));
- final String subordinateStatement = FederationJwtSupport.signedJwt(
- JWSAlgorithm.RS256, trustedAnchorKey, "entity-statement+jwt", builder.build()).serialize();
-
- mapResponse(entityConfigurationUrl(anchorId), mockResponse(trustedAnchorConfiguration()));
- mapResponse(subordinateStatementUrl(anchorFetchEndpoint, entityId),
- mockResponse(subordinateStatement));
- assertNoSubordinateStatement(entityId);
- }
-
- @Test
- public void testForbiddenClaim_trustMarkIssuers()
- throws MetadataCacheException, UnsupportedOperationException, IOException, URISyntaxException {
- final String entityId = uniqueClientId();
- final JWTClaimsSet.Builder builder = new JWTClaimsSet.Builder().issuer(anchorId).subject(entityId)
- .issueTime(Date.from(Instant.now()))
- .expirationTime(Date.from(Instant.now().plusSeconds(300)))
- .claim("jwks", new JWKSet(leafKey).toJSONObject(true))
- .claim("trust_mark_issuers", List.of(trustMarkIssuerId))
- .claim("metadata", Map.of("federation_entity", Collections.emptyMap()));
- final String subordinateStatement = FederationJwtSupport.signedJwt(
- JWSAlgorithm.RS256, trustedAnchorKey, "entity-statement+jwt", builder.build()).serialize();
-
- mapResponse(entityConfigurationUrl(anchorId), mockResponse(trustedAnchorConfiguration()));
- mapResponse(subordinateStatementUrl(anchorFetchEndpoint, entityId),
- mockResponse(subordinateStatement));
- assertNoSubordinateStatement(entityId);
- }
-
- @Test
- public void testForbiddenClaim_trustMarkOwners()
- throws MetadataCacheException, UnsupportedOperationException, IOException, URISyntaxException {
- final String entityId = uniqueClientId();
- final Map<String,Object> trustMarkOwner = new HashMap<>();
- trustMarkOwner.put("sub", trustMarkIssuerId);
- trustMarkOwner.put("jwks", new JWKSet(leafKey).toJSONObject(true));
- final JWTClaimsSet.Builder builder = new JWTClaimsSet.Builder().issuer(anchorId).subject(entityId)
- .issueTime(Date.from(Instant.now()))
- .expirationTime(Date.from(Instant.now().plusSeconds(300)))
- .claim("jwks", new JWKSet(leafKey).toJSONObject(true))
- .claim("trust_mark_owners", Map.of("https://example.org/email-allowing-trust-mark", trustMarkOwner))
- .claim("metadata", Map.of("federation_entity", Collections.emptyMap()));
- final String subordinateStatement = FederationJwtSupport.signedJwt(
- JWSAlgorithm.RS256, trustedAnchorKey, "entity-statement+jwt", builder.build()).serialize();
-
- mapResponse(entityConfigurationUrl(anchorId), mockResponse(trustedAnchorConfiguration()));
- mapResponse(subordinateStatementUrl(anchorFetchEndpoint, entityId),
- mockResponse(subordinateStatement));
- assertNoSubordinateStatement(entityId);
- }
-
- @Test
- public void testInvalidJwksClaim()
- throws MetadataCacheException, UnsupportedOperationException, IOException, URISyntaxException {
- final String entityId = uniqueClientId();
- final JWTClaimsSet.Builder builder = new JWTClaimsSet.Builder().issuer(anchorId).subject(entityId)
- .issueTime(Date.from(Instant.now()))
- .expirationTime(Date.from(Instant.now().plusSeconds(300)))
- .claim("jwks", Map.of("federation_entity", Collections.emptyMap()))
- .claim("metadata", Map.of("federation_entity", Collections.emptyMap()));
- final String subordinateStatement = FederationJwtSupport.signedJwt(
- JWSAlgorithm.RS256, trustedAnchorKey, "entity-statement+jwt", builder.build()).serialize();
-
- mapResponse(entityConfigurationUrl(anchorId), mockResponse(trustedAnchorConfiguration()));
- mapResponse(subordinateStatementUrl(anchorFetchEndpoint, entityId),
- mockResponse(subordinateStatement));
- assertNoSubordinateStatement(entityId);
- }
-
- @Test
- public void testNullResponse()
- throws MetadataCacheException, UnsupportedOperationException, IOException, URISyntaxException {
- final String entityId = uniqueClientId();
- mapResponse(entityConfigurationUrl(anchorId), mockResponse(trustedAnchorConfiguration()));
- assertNoSubordinateStatement(entityId);
- }
-
- @Test
- public void testExceptionResponse()
- throws MetadataCacheException, UnsupportedOperationException, IOException, URISyntaxException {
- final String entityId = uniqueClientId();
- mapResponse(entityConfigurationUrl(anchorId), mockResponse(trustedAnchorConfiguration()));
- when(federationHttpClient.executeOpen(any(),
- argThat(new RequestUriMatcher(subordinateStatementUrl(anchorFetchEndpoint, entityId))),
- any())).thenThrow(IOException.class);
- assertNoSubordinateStatement(entityId);
- }
-
- protected void assertNoSubordinateStatement(final String entityId) {
- try {
- final List<SubordinateStatementContainer> result =
- subordinateStatementCache.get(new CriteriaSet(new SubjectEntityIDCriterion(entityId),
- new ResponseContainerExpirationCriterion(Instant.now().plusSeconds(300)),
- new IssuerEntityIDCriterion(anchorId)));
- Assert.assertNotNull(result);
- Assert.assertTrue(result.size() == 0 || result.get(0).getStatement() == null);
- } catch (MetadataCacheException e) {
- Assert.fail("Could not resolve entity configuration", e);
- }
-
- }
-}
diff --git a/idp-oidfed-op-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/oidfed/cache/TrustChainMetadataCacheTest.java b/idp-oidfed-op-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/oidfed/cache/TrustChainMetadataCacheTest.java
deleted file mode 100644
index 19b38f4..0000000
--- a/idp-oidfed-op-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/oidfed/cache/TrustChainMetadataCacheTest.java
+++ /dev/null
@@ -1,274 +0,0 @@
-/*
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.plugin.oidc.op.profile.flow.oidfed.cache;
-
-import java.io.IOException;
-import java.net.URISyntaxException;
-import java.time.Instant;
-import java.util.Collections;
-import java.util.Date;
-import java.util.List;
-import java.util.Map;
-
-import org.springframework.beans.factory.annotation.Autowired;
-import org.springframework.beans.factory.annotation.Qualifier;
-import org.testng.Assert;
-import org.testng.annotations.Test;
-
-import com.nimbusds.jose.JWSAlgorithm;
-import com.nimbusds.jose.jwk.JWKSet;
-import com.nimbusds.jwt.JWTClaimsSet;
-
-import net.shibboleth.oidc.metadata.cache.MetadataCache;
-import net.shibboleth.oidc.metadata.cache.MetadataCacheException;
-import net.shibboleth.oidfed.flow.AbstractFederationFlowTest;
-import net.shibboleth.oidfed.flow.EntityConfigurationFlowTest;
-import net.shibboleth.oidfed.metadata.cache.IssuerEntityIDCriterion;
-import net.shibboleth.oidfed.metadata.cache.ResponseContainerExpirationCriterion;
-import net.shibboleth.oidfed.metadata.cache.SubjectEntityIDCriterion;
-import net.shibboleth.oidfed.metadata.cache.trustchain.TrustChainsContainer;
-import net.shibboleth.oidfed.testing.FederationJwtSupport;
-import net.shibboleth.shared.resolver.CriteriaSet;
-
-/**
- * Unit tests for the default entity configuration metadata cache.
- */
- at SuppressWarnings("null")
-public class TrustChainMetadataCacheTest extends AbstractFederationFlowTest {
-
- protected TrustChainMetadataCacheTest() {
- super(EntityConfigurationFlowTest.FLOW_ID);
- }
-
- @Autowired
- @Qualifier("shibboleth.oidfed.TrustChainMetadataCache")
- MetadataCache<TrustChainsContainer> trustChainCache;
-
- @Test
- public void testValidTrustChainResolved()
- throws MetadataCacheException, UnsupportedOperationException, IOException, URISyntaxException {
- final String entityId = uniqueClientId();
-
- final JWTClaimsSet.Builder builder = new JWTClaimsSet.Builder().issuer(entityId).subject(entityId)
- .issueTime(Date.from(Instant.now()))
- .expirationTime(Date.from(Instant.now().plusSeconds(300)))
- .claim("jwks", new JWKSet(leafKey).toJSONObject(true))
- .claim("metadata", Map.of("federation_entity", Collections.emptyMap()))
- .claim("authority_hints", List.of(anchorId));
- final String entityConfiguration = FederationJwtSupport.signedJwt(
- JWSAlgorithm.RS256, leafKey, "entity-statement+jwt", builder.build()).serialize();
-
- mapResponse(entityConfigurationUrl(entityId), mockResponse(entityConfiguration));
-
- final JWTClaimsSet.Builder builder2 = new JWTClaimsSet.Builder().issuer(anchorId).subject(entityId)
- .issueTime(Date.from(Instant.now()))
- .expirationTime(Date.from(Instant.now().plusSeconds(300)))
- .claim("jwks", new JWKSet(leafKey).toJSONObject(true))
- .claim("metadata", Map.of("federation_entity", Collections.emptyMap()));
- final String subordinateStatement = FederationJwtSupport.signedJwt(
- JWSAlgorithm.RS256, trustedAnchorKey, "entity-statement+jwt", builder2.build()).serialize();
-
- mapResponse(entityConfigurationUrl(anchorId), mockResponse(trustedAnchorConfiguration()));
- mapResponse(subordinateStatementUrl(anchorFetchEndpoint, entityId),
- mockResponse(subordinateStatement));
- try {
- final List<TrustChainsContainer> result =
- trustChainCache.get(new CriteriaSet(new SubjectEntityIDCriterion(entityId),
- new ResponseContainerExpirationCriterion(Instant.now().plusSeconds(300)),
- new IssuerEntityIDCriterion(anchorId)));
- Assert.assertNotNull(result);
- Assert.assertEquals(result.size(), 1);
- Assert.assertNotNull(result.get(0).getTrustChains());
- Assert.assertEquals(result.get(0).getTrustChains().size(), 1);
- } catch (MetadataCacheException e) {
- Assert.fail("Could not resolve entity configuration", e);
- }
- }
-
- @Test(enabled = false)
- //TODO: enable once the entity configuration cache can be cleaned before/after the test
- //otherwise the non-compatible trust anchor configuration may be in the cache
- public void testTrustAnchorConfigurationSignatureWithUntrustedKey()
- throws MetadataCacheException, UnsupportedOperationException, IOException, URISyntaxException {
- final String entityId = uniqueClientId();
-
- final JWTClaimsSet.Builder builder = new JWTClaimsSet.Builder().issuer(entityId).subject(entityId)
- .issueTime(Date.from(Instant.now()))
- .expirationTime(Date.from(Instant.now().plusSeconds(300)))
- .claim("jwks", new JWKSet(leafKey).toJSONObject(true))
- .claim("metadata", Map.of("federation_entity", Collections.emptyMap()))
- .claim("authority_hints", List.of(anchorId));
- final String entityConfiguration = FederationJwtSupport.signedJwt(
- JWSAlgorithm.RS256, leafKey, "entity-statement+jwt", builder.build()).serialize();
-
- mapResponse(entityConfigurationUrl(entityId), mockResponse(entityConfiguration));
-
- final JWTClaimsSet.Builder builder2 = new JWTClaimsSet.Builder().issuer(anchorId).subject(entityId)
- .issueTime(Date.from(Instant.now()))
- .expirationTime(Date.from(Instant.now().plusSeconds(300)))
- .claim("jwks", new JWKSet(leafKey).toJSONObject(true))
- .claim("metadata", Map.of("federation_entity", Collections.emptyMap()));
- final String subordinateStatement = FederationJwtSupport.signedJwt(
- JWSAlgorithm.RS256, trustedAnchorKey, "entity-statement+jwt", builder2.build()).serialize();
-
- mapResponse(entityConfigurationUrl(anchorId),
- mockResponse(trustedAnchorConfiguration(null, null, anchorKey, new JWKSet(anchorKey))));
- mapResponse(subordinateStatementUrl(anchorFetchEndpoint, entityId),
- mockResponse(subordinateStatement));
- try {
- final List<TrustChainsContainer> result =
- trustChainCache.get(new CriteriaSet(new SubjectEntityIDCriterion(entityId),
- new ResponseContainerExpirationCriterion(Instant.now().plusSeconds(300)),
- new IssuerEntityIDCriterion(anchorId)));
- Assert.assertNotNull(result);
- Assert.assertEquals(result.size(), 1);
- Assert.assertNotNull(result.get(0).getTrustChains());
- Assert.assertEquals(result.get(0).getTrustChains().size(), 0);
- } catch (MetadataCacheException e) {
- Assert.fail("Could not resolve entity configuration", e);
- }
- }
-
- @Test(enabled = false)
- //TODO: enable once the trust anchor cache can be cleaned before/after the test
- //otherwise the non-compatible trust anchor configuration may be in the cache
- public void testTrustAnchorSubordinateSignatureWithUntrustedKey()
- throws MetadataCacheException, UnsupportedOperationException, IOException, URISyntaxException {
- final String entityId = uniqueClientId();
-
- final JWTClaimsSet.Builder builder = new JWTClaimsSet.Builder().issuer(entityId).subject(entityId)
- .issueTime(Date.from(Instant.now()))
- .expirationTime(Date.from(Instant.now().plusSeconds(300)))
- .claim("jwks", new JWKSet(leafKey).toJSONObject(true))
- .claim("metadata", Map.of("federation_entity", Collections.emptyMap()))
- .claim("authority_hints", List.of(anchorId));
- final String entityConfiguration = FederationJwtSupport.signedJwt(
- JWSAlgorithm.RS256, leafKey, "entity-statement+jwt", builder.build()).serialize();
-
- mapResponse(entityConfigurationUrl(entityId), mockResponse(entityConfiguration));
-
- final JWTClaimsSet.Builder builder2 = new JWTClaimsSet.Builder().issuer(anchorId).subject(entityId)
- .issueTime(Date.from(Instant.now()))
- .expirationTime(Date.from(Instant.now().plusSeconds(300)))
- .claim("jwks", new JWKSet(leafKey).toJSONObject(true))
- .claim("metadata", Map.of("federation_entity", Collections.emptyMap()));
- final String subordinateStatement = FederationJwtSupport.signedJwt(
- JWSAlgorithm.RS256, anchorKey, "entity-statement+jwt", builder2.build()).serialize();
-
- mapResponse(entityConfigurationUrl(anchorId),
- mockResponse(trustedAnchorConfiguration(null, null, trustedAnchorKey,
- new JWKSet(List.of(trustedAnchorKey, anchorKey)))));
- mapResponse(subordinateStatementUrl(anchorFetchEndpoint, entityId),
- mockResponse(subordinateStatement));
- try {
- final List<TrustChainsContainer> result =
- trustChainCache.get(new CriteriaSet(new SubjectEntityIDCriterion(entityId),
- new ResponseContainerExpirationCriterion(Instant.now().plusSeconds(300)),
- new IssuerEntityIDCriterion(anchorId)));
- Assert.assertNotNull(result);
- Assert.assertEquals(result.size(), 1);
- Assert.assertNotNull(result.get(0).getTrustChains());
- Assert.assertEquals(result.get(0).getTrustChains().size(), 0);
- } catch (MetadataCacheException e) {
- Assert.fail("Could not resolve entity configuration", e);
- }
- }
-
- @Test
- public void testValidTrustChainResolved_intermediateWithBrokenAuthorityHint()
- throws MetadataCacheException, UnsupportedOperationException, IOException, URISyntaxException {
- final String entityId = uniqueClientId();
-
- final JWTClaimsSet.Builder builder = new JWTClaimsSet.Builder().issuer(entityId).subject(entityId)
- .issueTime(Date.from(Instant.now()))
- .expirationTime(Date.from(Instant.now().plusSeconds(300)))
- .claim("jwks", new JWKSet(leafKey).toJSONObject(true))
- .claim("metadata", Map.of("federation_entity", Collections.emptyMap()))
- .claim("authority_hints", List.of(trustedIntermediateId));
- final String entityConfiguration = FederationJwtSupport.signedJwt(
- JWSAlgorithm.RS256, leafKey, "entity-statement+jwt", builder.build()).serialize();
-
- mapResponse(entityConfigurationUrl(entityId), mockResponse(entityConfiguration));
- mapResponse(entityConfigurationUrl(trustedIntermediateId),
- mockResponse(intermediateConfiguration(trustedIntermediateId,
- new JWKSet(List.of(intermediateKey, trustedIntermediateKey)), trustedIntermediateKey)));
-
- final JWTClaimsSet.Builder builder2 = new JWTClaimsSet.Builder().issuer(trustedIntermediateId)
- .subject(entityId)
- .issueTime(Date.from(Instant.now()))
- .expirationTime(Date.from(Instant.now().plusSeconds(300)))
- .claim("jwks", new JWKSet(leafKey).toJSONObject(true))
- .claim("metadata", Map.of("federation_entity", Collections.emptyMap()));
- final String subordinateStatement = FederationJwtSupport.signedJwt(
- JWSAlgorithm.RS256, trustedIntermediateKey, "entity-statement+jwt", builder2.build()).serialize();
-
- mapResponse(subordinateStatementUrl(trustedIntermediateId + "/fetch", entityId),
- mockResponse(subordinateStatement));
-
- mapResponse(entityConfigurationUrl(anchorId), mockResponse(trustedAnchorConfiguration()));
-
- try {
- final List<TrustChainsContainer> result =
- trustChainCache.get(new CriteriaSet(new SubjectEntityIDCriterion(entityId)));
- Assert.assertNotNull(result);
- Assert.assertEquals(result.size(), 1);
- Assert.assertNotNull(result.get(0).getTrustChains());
- Assert.assertEquals(result.get(0).getTrustChains().size(), 1);
- } catch (MetadataCacheException e) {
- Assert.fail("Could not resolve entity configuration", e);
- }
- }
-
- @Test
- public void testValidTrustChainResolved_customFilterReturnsNull()
- throws MetadataCacheException, UnsupportedOperationException, IOException, URISyntaxException {
- final String entityId = uniqueClientId();
-
- final JWTClaimsSet.Builder builder = new JWTClaimsSet.Builder().issuer(entityId).subject(entityId)
- .issueTime(Date.from(Instant.now()))
- .expirationTime(Date.from(Instant.now().plusSeconds(300)))
- .claim("jwks", new JWKSet(leafKey).toJSONObject(true))
- .claim("metadata", Map.of("federation_entity", Collections.emptyMap()))
- .claim("crit", List.of("default_crit"))
- .claim("authority_hints", List.of(anchorId));
- final String entityConfiguration = FederationJwtSupport.signedJwt(
- JWSAlgorithm.RS256, leafKey, "entity-statement+jwt", builder.build()).serialize();
-
- mapResponse(entityConfigurationUrl(entityId), mockResponse(entityConfiguration));
-
- final JWTClaimsSet.Builder builder2 = new JWTClaimsSet.Builder().issuer(anchorId).subject(entityId)
- .issueTime(Date.from(Instant.now()))
- .expirationTime(Date.from(Instant.now().plusSeconds(300)))
- .claim("jwks", new JWKSet(leafKey).toJSONObject(true))
- .claim("metadata", Map.of("federation_entity", Collections.emptyMap()));
- final String subordinateStatement = FederationJwtSupport.signedJwt(
- JWSAlgorithm.RS256, trustedAnchorKey, "entity-statement+jwt", builder2.build()).serialize();
-
- mapResponse(entityConfigurationUrl(anchorId), mockResponse(trustedAnchorConfiguration()));
- mapResponse(subordinateStatementUrl(anchorFetchEndpoint, entityId),
- mockResponse(subordinateStatement));
- try {
- final List<TrustChainsContainer> result =
- trustChainCache.get(new CriteriaSet(new SubjectEntityIDCriterion(entityId),
- new ResponseContainerExpirationCriterion(Instant.now().plusSeconds(300)),
- new IssuerEntityIDCriterion(anchorId)));
- Assert.assertNotNull(result);
- Assert.assertEquals(result.size(), 0);
- } catch (MetadataCacheException e) {
- Assert.fail("Could not resolve entity configuration", e);
- }
- }
-
-}
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list