Package net.shibboleth.idp.plugin.authn.oidc.rp.impl

Class OIDCRPFlowTest

    • Field Detail

      • OP_ISSUER_ID_REQUESTOBJECT_TRUE

        protected static final String OP_ISSUER_ID_REQUESTOBJECT_TRUE
        The OP Issuer to use with an override in the config to use the request object authn param.
        See Also:
        Constant Field Values

      • OP_ISSUER_ID_REQUESTOBJECT_TRUE_RSA256_SIG

        protected static final String OP_ISSUER_ID_REQUESTOBJECT_TRUE_RSA256_SIG
        The OP Issuer to use with an override in the config to use the request object authn param signed using RS256.
        See Also:
        Constant Field Values

      • OP_ISSUER_ID_REQUESTOBJECT_TRUE_HS512_SIG

        protected static final String OP_ISSUER_ID_REQUESTOBJECT_TRUE_HS512_SIG
        The OP Issuer to use with an override in the config to use the request object authn param signed using HS512.
        See Also:
        Constant Field Values

      • OP_ISSUER_ID_REQUESTOBJECT_TRUE_ENCRYPT

        protected static final String OP_ISSUER_ID_REQUESTOBJECT_TRUE_ENCRYPT
        The OP Issuer to use with an override in the config to use the request object authn param which is to be encrypted.
        See Also:
        Constant Field Values

      • REMOTE_JWKSET_RESPONSE

        protected static final ClassPathResource REMOTE_JWKSET_RESPONSE
        A JWKSet resource.

      • GOOD_PROVIDER_CONFIGURATION_INFO

        protected static final ClassPathResource GOOD_PROVIDER_CONFIGURATION_INFO
        Example of good provider metadata. Endpoints are localhost to support the mock server that is started.

      • GOOD_PROVIDER_CONFIGURATION_INFO_USE_REQUEST_OBJECT

        protected static final ClassPathResource GOOD_PROVIDER_CONFIGURATION_INFO_USE_REQUEST_OBJECT
        Example of good provider metadata. Endpoints are localhost to support the mock server that is started. This OP supports the use of the request object.

      • GOOD_PROVIDER_CONFIGURATION_INFO_USE_REQUEST_OBJECT_ENCRYPT

        protected static final ClassPathResource GOOD_PROVIDER_CONFIGURATION_INFO_USE_REQUEST_OBJECT_ENCRYPT
        Example of good provider metadata. Endpoints are localhost to support the mock server that is started. This OP supports the use of the request object.

      • GOOD_PROVIDER_CONFIGURATION_INFO_USE_REQUEST_OBJECT_RSA256_SIG

        protected static final ClassPathResource GOOD_PROVIDER_CONFIGURATION_INFO_USE_REQUEST_OBJECT_RSA256_SIG
        Example of good provider metadata. Only supports RS256 signature alg for request object.

      • GOOD_PROVIDER_CONFIGURATION_INFO_USE_REQUEST_OBJECT_HS512_SIG

        protected static final ClassPathResource GOOD_PROVIDER_CONFIGURATION_INFO_USE_REQUEST_OBJECT_HS512_SIG
        Example of good provider metadata. Only supports HS512 signature alg for request object.

      • log

        @Nonnull
private final org.slf4j.Logger log
        Class logger.

      • flowResources

        @Nonnull
@NonnullElements
@Unmodifiable
protected final Map<String,​String> flowResources
        Map of flow resources that support building the flow to test. These are only for parent flows, not subflows.

        Note, these are all local to the RP, as copied from the IdP. These might need updating in the futre.

    • Constructor Detail

      • OIDCRPFlowTest

        public OIDCRPFlowTest()
        Constructor.

    • Method Detail

      • registerMockBeanDefinitions

        protected void registerMockBeanDefinitions​(@Nonnull
                                           MockFlowBuilderContext builderContext)
        Description copied from class: AbstractAuthnXmlFlowExecutionTests
        Register Shibboleth IdP requred mock beans that are not necessary to configure for authentication testing but are required for authentication flows to proceed.

        Project specific tests should override this method, making sure to also call super().

        Overrides:
        registerMockBeanDefinitions in class AbstractAuthnXmlFlowExecutionTests
        Parameters:
        builderContext - the context used to register the beans.

      • createSimpleServer

        protected okhttp3.mockwebserver.MockWebServer createSimpleServer()
                                                          throws UnknownHostException
        Create a running server that mimics responses from an OpenID Connect provider. Creates a new self-signed certificate.
        Returns:
        the simple server.
        Throws:
        UnknownHostException - on error.

      • createPeerContext

        protected net.shibboleth.oidc.profile.messaging.context.OIDCPeerEntityContext createPeerContext()
                                                                                         throws com.nimbusds.oauth2.sdk.ParseException
        Create an OIDCPeerEntityContext.
        Returns:
        the peer entity context.
        Throws:
        com.nimbusds.oauth2.sdk.ParseException - on error.

      • createAuthenticationRequest

        protected net.shibboleth.oidc.profile.core.OIDCAuthenticationRequest createAuthenticationRequest()
        Create an OIDC authentication request.
        Returns:
        the authentication request.

      • createOAuth2ClientContext

        protected net.shibboleth.idp.plugin.authn.oidc.rp.context.OAuth2ClientContext createOAuth2ClientContext​(@Nonnull
                                                                                                        String clientId,
                                                                                                        @Nullable
                                                                                                        URI redirectOverride)

      • createBasicSecurityConfigAndValidationParams

        protected net.shibboleth.oidc.profile.config.JSONSecurityConfiguration createBasicSecurityConfigAndValidationParams()
        Create a basic security configuration, which can be overriden per test if required.
        Returns:
        the basic security configuration.

      • createAuthenticationResponse

        protected com.nimbusds.openid.connect.sdk.AuthenticationResponse createAuthenticationResponse()
                                                                                       throws Exception
        Create an authentication response.
        Returns:
        the OIDC authentication response.
        Throws:
        Exception - on error.

      • getRelyingPartyProfileConfig

        protected net.shibboleth.oidc.profile.config.impl.DefaultOIDCAuthorizationConfiguration getRelyingPartyProfileConfig​(ProfileRequestContext prc)
        Return the Profile configuration from the relying party context.
        Parameters:
        prc - the prc
        Returns:
        the relying party configuration

      • assertStandardEndFlowSuccessConditions

        protected ProfileRequestContext assertStandardEndFlowSuccessConditions​(ProfileRequestContext rootPrc)
        Assert the basic set of conditions expected at the end of the entire authentication flow.
        Parameters:
        rootPrc - the profile request context.
        Returns:
        the nested profile request context to perform further checks over.

      • assertStandardAuthenticationRedirectFlowSuccessConditions

        protected ProfileRequestContext assertStandardAuthenticationRedirectFlowSuccessConditions​(ProfileRequestContext rootPrc)
        Assert the basic set of conditions expected when the authentication flow is at the authentication redirect.
        Parameters:
        rootPrc - the root profile request context.
        Returns:
        the nested profile request context to perform further checks over.

      • assertFlowEndedInErrorConditions

        protected void assertFlowEndedInErrorConditions​(@Nonnull
                                                ProfileRequestContext rootPrc,
                                                @Nonnull
                                                String error)
        Assert the conditions expected when the flow has ended in error. No authentication result is produced, and the previous event was an error event with the given value.
        Parameters:
        rootPrc - the root profile request context
        error - the error message to check.

      • assertFlowEndedInErrorConditions

        protected void assertFlowEndedInErrorConditions​(@Nonnull
                                                ProfileRequestContext rootPrc)
        Assert the conditions expected when the flow has ended in error. No authentication result is produced.
        Parameters:
        rootPrc - the root profile request context

      • assertStandardRequestObjectSuccessConditions

        protected void assertStandardRequestObjectSuccessConditions​(com.nimbusds.openid.connect.sdk.claims.ClaimsSet roClaims,
                                                            String audience)
        Assert the claims (belonging to the request object) have the correct set of basic claims.
        Parameters:
        roClaims - the request object claims
        audience - the audience value to check

      • assertPreviousEventContextError

        protected void assertPreviousEventContextError​(@Nonnull
                                               ProfileRequestContext rootPrc,
                                               @Nonnull
                                               String error)
        Assert that a previous event context exists and that the event recorded is a string with the value given.
        Parameters:
        rootPrc - the root profile request context
        error - the error event value to test

      • assertStandardIdTokenClaimsSuccessCondition

        protected void assertStandardIdTokenClaimsSuccessCondition​(com.nimbusds.jwt.JWTClaimsSet claims)
        Assert the standard set of claims exist in the id_token's claimsset.
        Parameters:
        claims - the claims to test.

      • assertStandardEndUserClaimsSuccessCondition

        protected void assertStandardEndUserClaimsSuccessCondition​(com.nimbusds.openid.connect.sdk.claims.ClaimsSet claims)
        Assert the standard set of claims exist in the end-user context claimsset.
        Parameters:
        claims - the claims to test.

      • assertIdTokenSignatureAndClaimsVerified

        protected void assertIdTokenSignatureAndClaimsVerified​(ProfileRequestContext nestedPrc)
                                                throws ParseException
        Assert the id_token exists, has had its signature verified, and the claims contained in the token are accurate.
        Parameters:
        nestedPrc - the nested profile request context
        Throws:
        ParseException - on error

      • assertUserInfoTokenSignatureVerified

        protected void assertUserInfoTokenSignatureVerified​(ProfileRequestContext nestedPrc)
                                             throws ParseException
        Assert the user info response JWT exists, and has had its signature verified.
        Parameters:
        nestedPrc - the nested profile request context
        Throws:
        ParseException - on error

      • assertPlainJSONObjectUserInfoToken

        protected void assertPlainJSONObjectUserInfoToken​(ProfileRequestContext nestedPrc)
                                           throws ParseException
        Assert a plain JSON object user info response.
        Parameters:
        nestedPrc - the nested profile request context
        Throws:
        ParseException - on error

      • assertEndUserClaimsVerified

        protected void assertEndUserClaimsVerified​(ProfileRequestContext nestedPrc)
                                    throws ParseException
        Assert end-user claims exist, and the claims are accurate.
        Parameters:
        nestedPrc - the nested profile request context
        Throws:
        ParseException - on error