Package net.shibboleth.idp.plugin.oidc.op.profile.flow

Class TokenFlowTest

java.lang.Object

org.springframework.test.context.testng.AbstractTestNGSpringContextTests

net.shibboleth.idp.test.flows.AbstractFlowTest

net.shibboleth.idp.plugin.oidc.op.profile.flow.AbstractOidcFlowTest

net.shibboleth.idp.plugin.oidc.op.profile.flow.AbstractOidcApiFlowTest

net.shibboleth.idp.plugin.oidc.op.profile.flow.AbstractOidcClientAuthenticationFlowTest

net.shibboleth.idp.plugin.oidc.op.profile.flow.TokenFlowTest

All Implemented Interfaces:

Aware, ApplicationContextAware, IHookable, ITestNGListener

public class TokenFlowTest
extends AbstractOidcClientAuthenticationFlowTest

Unit tests for the token flow.

Field Summary

Fields

Modifier and Type	Field	Description
(package private) String	clientIdCustomTokens
(package private) String	clientIdPkcePlain
(package private) String	clientIdPkcePlainPublic
(package private) String	clientIdPkcePlainUnforced
(package private) String	clientIdPkcePlainUnforcedPublic
(package private) String	clientIdPkceS256
(package private) String	clientIdPkceS256Public
(package private) String	clientIdRefreshTokenRotation
(package private) String	codeVerifier
static String	FLOW_ID
(package private) String	redirectUri
(package private) RevocationCache	revocationCache
(package private) com.nimbusds.oauth2.sdk.Scope	scope
(package private) StorageService	storageService

Fields inherited from class net.shibboleth.idp.plugin.oidc.op.profile.flow.AbstractOidcClientAuthenticationFlowTest

clientId, clientIdSaml, clientSecret, clientSecretSaml, jwtAud, rsaPrivateKey, rsaPublicKey

Fields inherited from class net.shibboleth.idp.plugin.oidc.op.profile.flow.AbstractOidcFlowTest

END_STATE_ID

Fields inherited from class net.shibboleth.idp.test.flows.AbstractFlowTest

builderFactory, certFactoryBean, directoryServer, END_STATE_OUTPUT_ATTR_EXPR, END_STATE_OUTPUT_ATTR_NAME, externalContext, flowExecutor, idGenerator, IDP_ENTITY_ID, idpCredential, IP_ADDRESS_AUTHN_FLOW_ID, IP_ADDRESS_AUTHN_MAP_BEAN_NAME, KEYSTORE_FILE, LDIF_FILE, marshallerFactory, parserPool, request, response, SAML1_TRANSFORM_C14N_BEAN_NAME, SAML2_TRANSFORM_C14N_BEAN_NAME, SP_ACS_URL, SP_ENTITY_ID, SP_RELAY_STATE, spCredential, unmarshallerFactory

Fields inherited from class org.springframework.test.context.testng.AbstractTestNGSpringContextTests

applicationContext, logger

Constructor Summary

Constructors

Constructor	Description
TokenFlowTest()

Method Summary

Modifier and Type	Method	Description
private void	addNonNullValue(Map<String,String> map, String key, String value)
protected void	assertSuccessResponse(FlowExecutionResult result)	Verify that the given result is a success response.
protected String	buildAuthorizationCode(String clientId)
protected String	buildAuthorizationCode(String clientId, String verifier)
protected String	buildAuthorizationCode(String clientId, String verifier, net.minidev.json.JSONObject deliveryClaims, net.minidev.json.JSONObject deliveryClaimsIDToken, net.minidev.json.JSONObject deliveryClaimsUserInfo)
protected String	buildLegacyAuthorizationCode(String clientId, String... consentedClaims)
protected String	buildLegacyRefreshToken(String clientId, String... consentedClaims)
protected String	buildRefreshToken(String clientId, String id, String rootId, String... consentedClaims)
protected Map<String,String>	createRequestParameters(String redirectUri, String grantType, String code, String clientId)
protected Map<String,String>	createRequestParameters(String redirectUri, String grantType, String code, String clientId, String codeChallenge, String codeChallengeMethod, String codeVerifier)
protected Pair<String,String>	getErrorDetaisForJWTValidation()	Get the pair of error code and error description for the error produced via event EventIds.ACCESS_DENIED.
protected void	initializeGrantAndRequest(String clientId, Map<String,String> requestParameters)
protected void	initializeGrantAndRequest(String clientId, Map<String,String> requestParameters, boolean doBasicAuth, com.nimbusds.oauth2.sdk.auth.ClientAuthenticationMethod registeredMethod)
protected FlowExecutionResult	launchWithJwtAuthentication(com.nimbusds.jwt.SignedJWT jwt, com.nimbusds.jose.JWSAlgorithm algorithm, com.nimbusds.oauth2.sdk.auth.ClientAuthenticationMethod method)	Launch the flow with the JWT client authentication method.
protected FlowExecutionResult	launchWithJwtAuthentication(com.nimbusds.oauth2.sdk.auth.JWTAuthentication authnMethod, com.nimbusds.jose.JWSAlgorithm algorithm)
protected FlowExecutionResult	launchWithJwtAuthentication(com.nimbusds.oauth2.sdk.auth.JWTAuthentication authnMethod, com.nimbusds.jose.JWSAlgorithm algorithm, String requestedScope)
private String	plainVerifier()
void	removeMetadata()
private String	s256Verifier()
void	testInvalidGrant()
void	testInvalidSecretJWT()
void	testNoClientId()
void	testNoGrantType()
void	testNoScopes()	TODO: This test "fails" now because it's honoring a non-OIDC request by assuming there has to be a requested and allowed audience/resource.
void	testRevokedChainInRefreshTokenGrant()
void	testRevokedChainViaJtiInRefreshTokenGrant()
void	testRevokedRefreshTokenGrantRefreshTokenRotation()
void	testUnauthorizedGrant()
void	testUntrustedClient()
void	testValidGrant()
void	testValidGrantInvalidPlainPKCE()
void	testValidGrantInvalidS256PKCE()
void	testValidGrantInvalidUnforcedPlainPKCE()
void	testValidGrantInvalidUnforcedS256PKCE()
void	testValidGrantNonMatchingRedirectURI()
void	testValidGrantNoRedirectURIMultipleTrusted()
void	testValidGrantNoRedirectURISingleTrusted()
void	testValidGrantNoRedirectURISingleTrustedNotMatchingAuthzCode()
void	testValidGrantRefreshTokensDisabledInSSOProfile()
void	testValidGrantRefreshTokensDisabledInTokenProfile()
void	testValidGrantSaml()
void	testValidGrantValidPlainPKCE()
void	testValidGrantValidPlainPKCE_publicClient()
void	testValidGrantValidRequestMissingPlainPKCE()
void	testValidGrantValidRequestMissingS256PKCE()
void	testValidGrantValidS256PKCE()
void	testValidGrantValidS256PKCE_publicClient()
void	testValidGrantValidUnforcedPlainPKCE()
void	testValidGrantValidUnforcedPlainPKCE_publicClient()
void	testValidGrantValidUnforcedS256PKCE()
void	testValidGrantWithCustomTokens()
void	testValidGrantWithoutAuthentication()
void	testValidGrantWithRequestedScope()
void	testValidGrantWithWrongRegisteredAuthType()
void	testValidGrantWrappedClaims()
void	testValidGrantWrappedClaimsUI()
void	testValidLegacyConsentGrant()
void	testValidLegacyConsentRefreshTokenGrant()
void	testValidLegacyGrant()
void	testValidLegacyRefreshTokenGrant()
void	testValidRefreshTokenGrant()
void	testValidRefreshTokenGrantRefreshTokenRotation()
void	testValidSecretJWT()
void	testValidSecretJWTNoAlg()
private AccessTokenClaimsSet	unwrapAccessToken(com.nimbusds.openid.connect.sdk.OIDCTokenResponse tokenResponse)
protected void	validateConsentFromAccessToken(com.nimbusds.openid.connect.sdk.OIDCTokenResponse response, boolean value)

Methods inherited from class net.shibboleth.idp.plugin.oidc.op.profile.flow.AbstractOidcClientAuthenticationFlowTest

buildPrivateKeyJwtAuth, buildSecretJwtAuth, claimsSetExpiredExp, claimsSetIssuedInTheFuture, claimsSetMissingAud, claimsSetMissingExp, claimsSetMissingIss, claimsSetMissingJti, claimsSetMissingSub, initKeys, populateClientAssertionParams, populateClientAssertionParams, testInvalidPrivateKeyJWT_expiredExp, testInvalidPrivateKeyJWT_issuedInTheFuture, testInvalidPrivateKeyJWT_missingAud, testInvalidPrivateKeyJWT_missingExp, testInvalidPrivateKeyJWT_missingIss, testInvalidPrivateKeyJWT_missingJti, testInvalidPrivateKeyJWT_missingSub, testInvalidPrivateKeyJWT_replayJti, testInvalidSecretJWT_expiredExp, testInvalidSecretJWT_issuedInTheFuture, testInvalidSecretJWT_missingAud, testInvalidSecretJWT_missingExp, testInvalidSecretJWT_missingIss, testInvalidSecretJWT_missingJti, testInvalidSecretJWT_missingSub, testInvalidSecretJWT_replayJti, testValidPrivateKeyJWT, validClaimsSet

Methods inherited from class net.shibboleth.idp.plugin.oidc.op.profile.flow.AbstractOidcApiFlowTest

buildJWTToken, buildJWTToken, buildLegacyToken, buildLegacyToken, buildRefreshToken, buildToken, buildToken, buildToken

Methods inherited from class net.shibboleth.idp.plugin.oidc.op.profile.flow.AbstractOidcFlowTest

assertErrorCode, assertErrorDescriptionContains, buildJsonForLegacyToken, createPrivateKeyJWT, createSecretJWT, getDataSealer, initializeMocks, initializeThreadLocals, parseErrorResponse, parseResponse, parseSuccessResponse, removeMetadata, setBasicAuth, setHttpFormRequest, setJsonRequest, setRequest, storeConsent, storeMetadata, storeMetadata, storeMetadata, storeMetadata, storeMetadata

Methods inherited from class net.shibboleth.idp.test.flows.AbstractFlowTest

assertFlowExecutionOutcome, assertFlowExecutionOutcome, assertFlowExecutionResult, assertProfileRequestContext, buildSOAP11Envelope, clearThreadLocals, getFlow, initializeFlowExecutor, initializeXMLObjectSupport, overrideEndStateOutput, overrideEndStateOutput, registerFlowsInParentRegistry, retrieveProfileRequestContext, setupDirectoryServer, teardownDirectoryServer

Methods inherited from class org.springframework.test.context.testng.AbstractTestNGSpringContextTests

run, setApplicationContext, springTestContextAfterTestClass, springTestContextAfterTestMethod, springTestContextBeforeTestClass, springTestContextBeforeTestMethod, springTestContextPrepareTestInstance

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Field Detail

FLOW_ID

public static final String FLOW_ID

See Also:

Constant Field Values

redirectUri

String redirectUri

clientIdPkcePlain

String clientIdPkcePlain

clientIdPkcePlainUnforced

String clientIdPkcePlainUnforced

clientIdPkceS256

String clientIdPkceS256

clientIdPkcePlainPublic

String clientIdPkcePlainPublic

clientIdPkcePlainUnforcedPublic

String clientIdPkcePlainUnforcedPublic

clientIdPkceS256Public

String clientIdPkceS256Public

clientIdCustomTokens

String clientIdCustomTokens

clientIdRefreshTokenRotation

String clientIdRefreshTokenRotation

codeVerifier

String codeVerifier

scope

com.nimbusds.oauth2.sdk.Scope scope

storageService

@Autowired
@Qualifier("shibboleth.StorageService")
StorageService storageService

revocationCache

@Autowired
@Qualifier("shibboleth.oidc.RevocationCache")
RevocationCache revocationCache

Constructor Detail

TokenFlowTest

public TokenFlowTest()

Method Detail

removeMetadata

@AfterMethod
public void removeMetadata()
                    throws IOException

Throws:

IOException

testNoClientId

public void testNoClientId()
                    throws IOException,
                           ParseException

Throws:

IOException

ParseException

testNoGrantType

public void testNoGrantType()
                     throws IOException,
                            ParseException

Throws:

IOException

ParseException

testUntrustedClient

public void testUntrustedClient()
                         throws IOException,
                                ParseException

Throws:

IOException

ParseException

testUnauthorizedGrant

public void testUnauthorizedGrant()
                           throws IOException,
                                  ParseException

Throws:

IOException

ParseException

testInvalidGrant

public void testInvalidGrant()
                      throws ParseException,
                             IOException

Throws:

ParseException

IOException

testNoScopes

public void testNoScopes()
                  throws Exception

TODO: This test "fails" now because it's honoring a non-OIDC request by assuming there has to be a requested and allowed audience/resource. The original success outcome was an anomaly due to the original grant handling not supporting the audience notion.

Throws:

Exception

initializeGrantAndRequest

protected void initializeGrantAndRequest(String clientId,
                                         Map<String,String> requestParameters)
                                  throws IOException

Throws:

IOException

initializeGrantAndRequest

protected void initializeGrantAndRequest(String clientId,
                                         Map<String,String> requestParameters,
                                         boolean doBasicAuth,
                                         com.nimbusds.oauth2.sdk.auth.ClientAuthenticationMethod registeredMethod)
                                  throws IOException

Throws:

IOException

testValidGrant

public void testValidGrant()
                    throws Exception

Throws:

Exception

testValidGrantNonMatchingRedirectURI

public void testValidGrantNonMatchingRedirectURI()
                                          throws Exception

Throws:

Exception

testValidGrantNoRedirectURISingleTrusted

public void testValidGrantNoRedirectURISingleTrusted()
                                              throws Exception

Throws:

Exception

testValidGrantNoRedirectURISingleTrustedNotMatchingAuthzCode

public void testValidGrantNoRedirectURISingleTrustedNotMatchingAuthzCode()
                                                                  throws Exception

Throws:

Exception

testValidGrantNoRedirectURIMultipleTrusted

public void testValidGrantNoRedirectURIMultipleTrusted()
                                                throws Exception

Throws:

Exception

testValidGrantWithCustomTokens

public void testValidGrantWithCustomTokens()
                                    throws Exception

Throws:

Exception

testValidGrantWithWrongRegisteredAuthType

public void testValidGrantWithWrongRegisteredAuthType()
                                               throws Exception

Throws:

Exception

testValidGrantWithoutAuthentication

public void testValidGrantWithoutAuthentication()
                                         throws Exception

Throws:

Exception

testValidGrantRefreshTokensDisabledInSSOProfile

public void testValidGrantRefreshTokensDisabledInSSOProfile()
                                                     throws Exception

Throws:

Exception

testValidGrantRefreshTokensDisabledInTokenProfile

public void testValidGrantRefreshTokensDisabledInTokenProfile()
                                                       throws Exception

Throws:

Exception

testValidGrantWithRequestedScope

public void testValidGrantWithRequestedScope()
                                      throws Exception

Throws:

Exception

testValidLegacyGrant

public void testValidLegacyGrant()
                          throws Exception

Throws:

Exception

testValidLegacyConsentGrant

public void testValidLegacyConsentGrant()
                                 throws Exception

Throws:

Exception

validateConsentFromAccessToken

protected void validateConsentFromAccessToken(com.nimbusds.openid.connect.sdk.OIDCTokenResponse response,
                                              boolean value)
                                       throws Exception

Throws:

Exception

testValidGrantSaml

public void testValidGrantSaml()
                        throws Exception

Throws:

Exception

buildAuthorizationCode

protected String buildAuthorizationCode(String clientId)
                                 throws Exception

Throws:

Exception

buildAuthorizationCode

protected String buildAuthorizationCode(String clientId,
                                        String verifier)
                                 throws Exception

Throws:

Exception

buildAuthorizationCode

protected String buildAuthorizationCode(String clientId,
                                        String verifier,
                                        net.minidev.json.JSONObject deliveryClaims,
                                        net.minidev.json.JSONObject deliveryClaimsIDToken,
                                        net.minidev.json.JSONObject deliveryClaimsUserInfo)
                                 throws Exception

Throws:

Exception

buildLegacyAuthorizationCode

protected String buildLegacyAuthorizationCode(String clientId,
                                              String... consentedClaims)
                                       throws Exception

Throws:

Exception

buildLegacyRefreshToken

protected String buildLegacyRefreshToken(String clientId,
                                         String... consentedClaims)
                                  throws Exception

Throws:

Exception

buildRefreshToken

protected String buildRefreshToken(String clientId,
                                   String id,
                                   String rootId,
                                   String... consentedClaims)
                            throws Exception

Throws:

Exception

testValidSecretJWT

public void testValidSecretJWT()
                        throws Exception

Overrides:

testValidSecretJWT in class AbstractOidcClientAuthenticationFlowTest

Throws:

Exception

testValidSecretJWTNoAlg

public void testValidSecretJWTNoAlg()
                             throws Exception

Throws:

Exception

testValidGrantValidRequestMissingPlainPKCE

public void testValidGrantValidRequestMissingPlainPKCE()
                                                throws Exception

Throws:

Exception

testValidGrantInvalidUnforcedPlainPKCE

public void testValidGrantInvalidUnforcedPlainPKCE()
                                            throws Exception

Throws:

Exception

testValidGrantInvalidPlainPKCE

public void testValidGrantInvalidPlainPKCE()
                                    throws Exception

Throws:

Exception

testValidGrantValidPlainPKCE

public void testValidGrantValidPlainPKCE()
                                  throws Exception

Throws:

Exception

testValidGrantValidPlainPKCE_publicClient

public void testValidGrantValidPlainPKCE_publicClient()
                                               throws Exception

Throws:

Exception

testValidGrantValidUnforcedPlainPKCE

public void testValidGrantValidUnforcedPlainPKCE()
                                          throws Exception

Throws:

Exception

testValidGrantValidUnforcedPlainPKCE_publicClient

public void testValidGrantValidUnforcedPlainPKCE_publicClient()
                                                       throws Exception

Throws:

Exception

testValidGrantValidRequestMissingS256PKCE

public void testValidGrantValidRequestMissingS256PKCE()
                                               throws Exception

Throws:

Exception

testValidGrantInvalidUnforcedS256PKCE

public void testValidGrantInvalidUnforcedS256PKCE()
                                           throws Exception

Throws:

Exception

testValidGrantInvalidS256PKCE

public void testValidGrantInvalidS256PKCE()
                                   throws Exception

Throws:

Exception

testValidGrantValidS256PKCE

public void testValidGrantValidS256PKCE()
                                 throws Exception

Throws:

Exception

testValidGrantValidS256PKCE_publicClient

public void testValidGrantValidS256PKCE_publicClient()
                                              throws Exception

Throws:

Exception

testValidGrantValidUnforcedS256PKCE

public void testValidGrantValidUnforcedS256PKCE()
                                         throws Exception

Throws:

Exception

testInvalidSecretJWT

public void testInvalidSecretJWT()
                          throws Exception

Throws:

Exception

testValidGrantWrappedClaimsUI

public void testValidGrantWrappedClaimsUI()
                                   throws Exception

Throws:

Exception

testValidGrantWrappedClaims

public void testValidGrantWrappedClaims()
                                 throws Exception

Throws:

Exception

testValidLegacyRefreshTokenGrant

public void testValidLegacyRefreshTokenGrant()
                                      throws Exception

Throws:

Exception

testValidLegacyConsentRefreshTokenGrant

public void testValidLegacyConsentRefreshTokenGrant()
                                             throws Exception

Throws:

Exception

testValidRefreshTokenGrant

public void testValidRefreshTokenGrant()
                                throws Exception

Throws:

Exception

testValidRefreshTokenGrantRefreshTokenRotation

public void testValidRefreshTokenGrantRefreshTokenRotation()
                                                    throws Exception

Throws:

Exception

testRevokedRefreshTokenGrantRefreshTokenRotation

public void testRevokedRefreshTokenGrantRefreshTokenRotation()
                                                      throws Exception

Throws:

Exception

testRevokedChainInRefreshTokenGrant

public void testRevokedChainInRefreshTokenGrant()
                                         throws Exception

Throws:

Exception

testRevokedChainViaJtiInRefreshTokenGrant

public void testRevokedChainViaJtiInRefreshTokenGrant()
                                               throws Exception

Throws:

Exception

unwrapAccessToken

private AccessTokenClaimsSet unwrapAccessToken(com.nimbusds.openid.connect.sdk.OIDCTokenResponse tokenResponse)

plainVerifier

private String plainVerifier()

s256Verifier

private String s256Verifier()

launchWithJwtAuthentication

protected FlowExecutionResult launchWithJwtAuthentication(com.nimbusds.oauth2.sdk.auth.JWTAuthentication authnMethod,
                                                          com.nimbusds.jose.JWSAlgorithm algorithm)
                                                   throws Exception

Throws:

Exception

launchWithJwtAuthentication

protected FlowExecutionResult launchWithJwtAuthentication(com.nimbusds.oauth2.sdk.auth.JWTAuthentication authnMethod,
                                                          com.nimbusds.jose.JWSAlgorithm algorithm,
                                                          String requestedScope)
                                                   throws Exception

Throws:

Exception

launchWithJwtAuthentication

protected FlowExecutionResult launchWithJwtAuthentication(com.nimbusds.jwt.SignedJWT jwt,
                                                          com.nimbusds.jose.JWSAlgorithm algorithm,
                                                          com.nimbusds.oauth2.sdk.auth.ClientAuthenticationMethod method)
                                                   throws Exception

Description copied from class: AbstractOidcClientAuthenticationFlowTest

Launch the flow with the JWT client authentication method.

Specified by:

launchWithJwtAuthentication in class AbstractOidcClientAuthenticationFlowTest

Parameters:

jwt - The JWT to be used for client authentication.

algorithm - The algorithm to be used in the client authentication.

method - The client authentication method.

Returns:

The flow execution result.

Throws:

Exception

createRequestParameters

protected Map<String,String> createRequestParameters(String redirectUri,
                                                           String grantType,
                                                           String code,
                                                           String clientId)

createRequestParameters

protected Map<String,String> createRequestParameters(String redirectUri,
                                                           String grantType,
                                                           String code,
                                                           String clientId,
                                                           String codeChallenge,
                                                           String codeChallengeMethod,
                                                           String codeVerifier)

addNonNullValue

private void addNonNullValue(Map<String,String> map,
                             String key,
                             String value)

getErrorDetaisForJWTValidation

protected Pair<String,String> getErrorDetaisForJWTValidation()

Description copied from class: AbstractOidcClientAuthenticationFlowTest

Get the pair of error code and error description for the error produced via event EventIds.ACCESS_DENIED. This is abstract due to the fact that each endpoint may have its own mappings.

Specified by:

getErrorDetaisForJWTValidation in class AbstractOidcClientAuthenticationFlowTest

Returns:

The pair of error code and error description.

assertSuccessResponse

protected void assertSuccessResponse(FlowExecutionResult result)

Description copied from class: AbstractOidcClientAuthenticationFlowTest

Verify that the given result is a success response.

Specified by:

assertSuccessResponse in class AbstractOidcClientAuthenticationFlowTest

Parameters:

result - The flow execution result to be verified.