Package net.shibboleth.idp.plugin.authn.oidc.rp.impl

Class OIDCRPFlowFromAuthenticationResponseTest

java.lang.Object

junit.framework.Assert

junit.framework.TestCase

org.springframework.webflow.test.execution.AbstractFlowExecutionTests

org.springframework.webflow.test.execution.AbstractExternalizedFlowExecutionTests

net.shibboleth.idp.plugin.authn.test.spring.CustomAbstractXmlFlowExecutionTests

net.shibboleth.idp.plugin.authn.test.flow.AbstractAuthnXmlFlowExecutionTests

net.shibboleth.idp.plugin.authn.oidc.rp.impl.OIDCRPFlowTest

net.shibboleth.idp.plugin.authn.oidc.rp.impl.OIDCRPFlowFromAuthenticationResponseTest

All Implemented Interfaces:

junit.framework.Test

public class OIDCRPFlowFromAuthenticationResponseTest
extends OIDCRPFlowTest

RP flow tests that start after the OpenID Provider redirect back to the RP's callback endpoint. As the initial actions are not run by these tests, most the context setup needs to be mocked.

Field Summary

Fields inherited from class net.shibboleth.idp.plugin.authn.oidc.rp.impl.OIDCRPFlowTest

CLIENT_ID, CLIENT_SECRET, FLOW, flowResources, GOOD_PROVIDER_CONFIGURATION_INFO, GOOD_PROVIDER_CONFIGURATION_INFO_USE_REQUEST_OBJECT, GOOD_PROVIDER_CONFIGURATION_INFO_USE_REQUEST_OBJECT_ENCRYPT, GOOD_PROVIDER_CONFIGURATION_INFO_USE_REQUEST_OBJECT_HS512_SIG, GOOD_PROVIDER_CONFIGURATION_INFO_USE_REQUEST_OBJECT_RSA256_SIG, OP_ISSUER_ID, OP_ISSUER_ID_REQUESTOBJECT_TRUE, OP_ISSUER_ID_REQUESTOBJECT_TRUE_ENCRYPT, OP_ISSUER_ID_REQUESTOBJECT_TRUE_HS512_SIG, OP_ISSUER_ID_REQUESTOBJECT_TRUE_RSA256_SIG, REDIRECT_URI_OVERRIDE, REMOTE_JWKSET_RESPONSE, subflows

Fields inherited from class net.shibboleth.idp.plugin.authn.test.flow.AbstractAuthnXmlFlowExecutionTests

externalContext, mockRequest, mockResponse

Constructor Summary

Constructors

Constructor	Description
OIDCRPFlowFromAuthenticationResponseTest()

Method Summary

Modifier and Type	Method	Description
private void	basicSetup()	Basic setup suitable for all tests.
private void	queueMockServerResponse(okhttp3.mockwebserver.MockWebServer mockOPServer, int code, String body, String contentType)	Queue a mock response.
private ProfileRequestContext	resumeBasicFlow()	Resume a flow using a default prc construction.
void	test_IDTokenHS256_DirA128CBC_HS256_UserInfoES256_RSA_OAEP_256A256GCM()
void	test_IDTokenHS256_InvalidNonce_PlainUserInfo()	Test a suitable error occurs if the id_token does not contain a valid nonce.
void	test_IDTokenHS256_InvalidPlainUserInfo_NoSub()	Test the flow from the external authorization request to the end of the flow.
void	test_IDTokenHS256_InvalidPlainUserInfo_SubDoesNotMatchIdToken()	Test the flow from the external authorization request to the end of the flow.
void	test_IDTokenHS256_NoAudience_PlainUserInfo()	Test a suitable error occurs if the id_token does not contain an audience.
void	test_IDTokenHS256_NoIssuedAt_PlainUserInfo()	Test a suitable error occurs if the id_token does not contain an issued-at time.
void	test_IDTokenHS256_NoIssuer_PlainUserInfo()	Test a suitable error occurs if the id_token does not contain an issuer.
void	test_IDTokenHS256_NoSub_PlainUserInfo()	Test a suitable error occurs if the id_token does not contain a subject.
void	test_IDTokenHS256_PlainJWTUserInfoResponse()	Test a plain UserInfo JWT type.
void	test_IDTokenHS256_PlainUserInfo()	Test the flow from the external authorization request to the end of the flow.
void	test_IDTokenHS256_RSA_OAEP_256_A256GCM_PlainUserInfo()	Uses symmetric MAC and asymmetric encryption.
void	test_IDTokenHS256_UserInfoHS256()
void	test_IDTokenHS256_UserInfoHS256_WithACRAMRTranslation()
void	test_IDTokenHS256_UserInfoJWTNotSigned()
void	testErrorAuthenticationResponse()	Test the flow from the external authorization request to the end of the flow when an error is returned from the downstream OP.
void	testUnsupportedOIDCFlow()	Test the flow terminates correctly when an unsupported flow is used - which is unlikely to get this far.

Methods inherited from class net.shibboleth.idp.plugin.authn.oidc.rp.impl.OIDCRPFlowTest

addACRAndAMRFunctions, assertEndUserClaimsVerified, assertFlowEndedInErrorConditions, assertFlowEndedInErrorConditions, assertIdTokenSignatureAndClaimsVerified, assertPlainJSONObjectUserInfoToken, assertPreviousEventContextError, assertStandardAuthenticationRedirectFlowSuccessConditions, assertStandardEndFlowSuccessConditions, assertStandardEndUserClaimsSuccessCondition, assertStandardIdTokenClaimsSuccessCondition, assertStandardRequestObjectSuccessConditions, assertUserInfoTokenSignatureVerified, buildProfileRequestContext, createAuthenticationRequest, createAuthenticationResponse, createBasicSecurityConfigAndValidationParams, createOAuth2ClientContext, createPeerContext, createSimpleServer, getRelyingPartyProfileConfig, populateBasicContextTreeFromAuthnResponse, registerMockBeanDefinitions, registerMockPropertySource

Methods inherited from class net.shibboleth.idp.plugin.authn.test.flow.AbstractAuthnXmlFlowExecutionTests

addBeanDefinition, addBeanSingleton, addHttpBasicAuthHeader, configureFlowBuilderContext, getModelResources, getResource, loadBeanDefinitionsFromXmlFile, setFlowModelResources, setFlowPath, setMockProperties, setSubflows, setUp

Methods inherited from class net.shibboleth.idp.plugin.authn.test.spring.CustomAbstractXmlFlowExecutionTests

createFlowBuilder, registerMockFlowBeans

Methods inherited from class org.springframework.webflow.test.execution.AbstractExternalizedFlowExecutionTests

buildFlow, createResourceLoader, getFlow, getFlowDefinition, getFlowDefinitionRegistry, getResourceFactory, isCacheFlowDefinition, setCacheFlowDefinition, setFlowExecutionAttributes, setFlowExecutionListener, setFlowExecutionListeners

Methods inherited from class org.springframework.webflow.test.execution.AbstractFlowExecutionTests

assertActiveFlowEquals, assertCurrentStateEquals, assertFlowExecutionActive, assertFlowExecutionEnded, assertFlowExecutionOutcomeEquals, assertResponseWrittenEquals, createFlowExecutionFactory, getConversationAttribute, getConversationScope, getFlowAttribute, getFlowExecution, getFlowExecutionFactory, getFlowExecutionOutcome, getFlowScope, getRequiredConversationAttribute, getRequiredConversationAttribute, getRequiredFlowAttribute, getRequiredFlowAttribute, getRequiredViewAttribute, getRequiredViewAttribute, getViewAttribute, getViewScope, resumeFlow, setCurrentState, startFlow, startFlow, updateFlowExecution

Methods inherited from class junit.framework.TestCase

assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertFalse, assertFalse, assertNotNull, assertNotNull, assertNotSame, assertNotSame, assertNull, assertNull, assertSame, assertSame, assertTrue, assertTrue, countTestCases, createResult, fail, fail, failNotEquals, failNotSame, failSame, format, getName, run, run, runBare, runTest, setName, tearDown, toString

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, wait, wait, wait

Constructor Detail

OIDCRPFlowFromAuthenticationResponseTest

public OIDCRPFlowFromAuthenticationResponseTest()

Method Detail

basicSetup

private void basicSetup()

Basic setup suitable for all tests.

resumeBasicFlow

private ProfileRequestContext resumeBasicFlow()
                                       throws Exception

Resume a flow using a default prc construction.

Returns:

the prc

Throws:

Exception - on error

queueMockServerResponse

private void queueMockServerResponse(okhttp3.mockwebserver.MockWebServer mockOPServer,
                                     int code,
                                     String body,
                                     String contentType)

Queue a mock response. Simulating a response from the OP.

Parameters:

mockOPServer - the mock server

code - the response HTTP code

body - the response body

contentType - the content type header

test_IDTokenHS256_PlainUserInfo

public void test_IDTokenHS256_PlainUserInfo()
                                     throws Exception

Test the flow from the external authorization request to the end of the flow. Using a MAC-signed id_token and plain UserInfo JSON Response.

Throws:

Exception - on error.

test_IDTokenHS256_UserInfoHS256

public void test_IDTokenHS256_UserInfoHS256()
                                     throws Exception

Throws:

Exception

test_IDTokenHS256_UserInfoJWTNotSigned

public void test_IDTokenHS256_UserInfoJWTNotSigned()
                                            throws Exception

Throws:

Exception

test_IDTokenHS256_DirA128CBC_HS256_UserInfoES256_RSA_OAEP_256A256GCM

public void test_IDTokenHS256_DirA128CBC_HS256_UserInfoES256_RSA_OAEP_256A256GCM()
                                                                          throws Exception

Throws:

Exception

test_IDTokenHS256_RSA_OAEP_256_A256GCM_PlainUserInfo

public void test_IDTokenHS256_RSA_OAEP_256_A256GCM_PlainUserInfo()
                                                          throws Exception

Uses symmetric MAC and asymmetric encryption. Plain UserInfo response.

Throws:

Exception - on error.

test_IDTokenHS256_PlainJWTUserInfoResponse

public void test_IDTokenHS256_PlainJWTUserInfoResponse()
                                                throws Exception

Test a plain UserInfo JWT type. This can not happen, and should trigger an error on signature validation.

Throws:

Exception - on error.

test_IDTokenHS256_UserInfoHS256_WithACRAMRTranslation

public void test_IDTokenHS256_UserInfoHS256_WithACRAMRTranslation()
                                                           throws Exception

Throws:

Exception

testUnsupportedOIDCFlow

public void testUnsupportedOIDCFlow()
                             throws Exception

Test the flow terminates correctly when an unsupported flow is used - which is unlikely to get this far.

Throws:

Exception - on error.

testErrorAuthenticationResponse

public void testErrorAuthenticationResponse()
                                     throws Exception

Test the flow from the external authorization request to the end of the flow when an error is returned from the downstream OP.

Throws:

Exception - on error.

test_IDTokenHS256_NoIssuer_PlainUserInfo

public void test_IDTokenHS256_NoIssuer_PlainUserInfo()
                                              throws Exception

Test a suitable error occurs if the id_token does not contain an issuer.

Throws:

Exception - on error.

test_IDTokenHS256_NoSub_PlainUserInfo

public void test_IDTokenHS256_NoSub_PlainUserInfo()
                                           throws Exception

Test a suitable error occurs if the id_token does not contain a subject.

Throws:

Exception - on error.

test_IDTokenHS256_NoAudience_PlainUserInfo

public void test_IDTokenHS256_NoAudience_PlainUserInfo()
                                                throws Exception

Test a suitable error occurs if the id_token does not contain an audience.

Throws:

Exception - on error.

test_IDTokenHS256_NoIssuedAt_PlainUserInfo

public void test_IDTokenHS256_NoIssuedAt_PlainUserInfo()
                                                throws Exception

Test a suitable error occurs if the id_token does not contain an issued-at time.

Throws:

Exception - on error.

test_IDTokenHS256_InvalidNonce_PlainUserInfo

public void test_IDTokenHS256_InvalidNonce_PlainUserInfo()
                                                  throws Exception

Test a suitable error occurs if the id_token does not contain a valid nonce.

Throws:

Exception - on error.

test_IDTokenHS256_InvalidPlainUserInfo_NoSub

public void test_IDTokenHS256_InvalidPlainUserInfo_NoSub()
                                                  throws Exception

Test the flow from the external authorization request to the end of the flow. Using a MAC signed id_token and an invalid UserInfo JSON Response - it has no subject.

Throws:

Exception - on error.

test_IDTokenHS256_InvalidPlainUserInfo_SubDoesNotMatchIdToken

public void test_IDTokenHS256_InvalidPlainUserInfo_SubDoesNotMatchIdToken()
                                                                   throws Exception

Test the flow from the external authorization request to the end of the flow. Using a MAC signed id_token and an invalid UserInfo JSON Response - it has no subject.

Throws:

Exception - on error.