Package net.shibboleth.idp.plugin.oidc.op.profile.flow

Class ClientCredentialsTokenFlowTest

java.lang.Object

org.springframework.test.context.testng.AbstractTestNGSpringContextTests

net.shibboleth.idp.test.flows.AbstractFlowTest

net.shibboleth.idp.plugin.oidc.op.profile.flow.AbstractOidcFlowTest

net.shibboleth.idp.plugin.oidc.op.profile.flow.AbstractOidcApiFlowTest

net.shibboleth.idp.plugin.oidc.op.profile.flow.AbstractOidcClientAuthenticationFlowTest

net.shibboleth.idp.plugin.oidc.op.profile.flow.ClientCredentialsTokenFlowTest

All Implemented Interfaces:

Aware, ApplicationContextAware, org.testng.IHookable, org.testng.ITestNGListener

public class ClientCredentialsTokenFlowTest
extends AbstractOidcClientAuthenticationFlowTest

Unit tests for the token flow when using the client_credentials grant type.

Field Summary

Fields

Modifier and Type	Field	Description
static String	FLOW_ID
private String	resource
private String	resourceSaml
private com.nimbusds.oauth2.sdk.Scope	scope
(package private) StorageService	storageService

Fields inherited from class net.shibboleth.idp.plugin.oidc.op.profile.flow.AbstractOidcClientAuthenticationFlowTest

clientId, clientIdSaml, clientSecret, clientSecretSaml, issuer, jwtAud

Fields inherited from class net.shibboleth.idp.plugin.oidc.op.profile.flow.AbstractOidcFlowTest

ecKey, END_STATE_ID, endStateId, flowId, rsaPrivateKey, rsaPublicKey

Fields inherited from class net.shibboleth.idp.test.flows.AbstractFlowTest

builderFactory, certFactoryBean, directoryServer, END_STATE_OUTPUT_ATTR_EXPR, END_STATE_OUTPUT_ATTR_NAME, externalContext, flowExecutor, idGenerator, IDP_ENTITY_ID, idpCredential, IP_ADDRESS_AUTHN_FLOW_ID, IP_ADDRESS_AUTHN_MAP_BEAN_NAME, KEYSTORE_FILE, LDIF_FILE, marshallerFactory, parserPool, request, response, SAML1_TRANSFORM_C14N_BEAN_NAME, SAML2_TRANSFORM_C14N_BEAN_NAME, SP_ACS_URL, SP_ENTITY_ID, SP_RELAY_STATE, spCredential, unmarshallerFactory

Fields inherited from class org.springframework.test.context.testng.AbstractTestNGSpringContextTests

applicationContext, logger

Constructor Summary

Constructors

Constructor	Description
ClientCredentialsTokenFlowTest()	Constructor.

Method Summary

Modifier and Type	Method	Description
private void	addNonNullValue(Map<String,String> map, String key, String value)
protected void	assertSuccessResponse(FlowExecutionResult result)	Verify that the given result is a success response.
protected Map<String,String>	createRequestParameters(String clientId, com.nimbusds.oauth2.sdk.Scope s, String r)
protected Pair<String,String>	getErrorDetaisForJWTValidation()	Get the pair of error code and error description for the error produced via event EventIds.ACCESS_DENIED.
protected FlowExecutionResult	launchWithJwtAuthentication(com.nimbusds.jwt.JWT jwt, com.nimbusds.jose.JWSAlgorithm algorithm, com.nimbusds.oauth2.sdk.auth.ClientAuthenticationMethod method, PublicKey publicKey)	Launch the flow with the JWT client authentication method.
protected FlowExecutionResult	launchWithJwtAuthentication(com.nimbusds.oauth2.sdk.auth.JWTAuthentication authnMethod, com.nimbusds.jose.JWSAlgorithm algorithm)
void	tearDown()
void	testInvalidAudience()
void	testInvalidClientSecret()
void	testInvalidSecretJWTAuthn()
void	testNoScope()
void	testNoScopeUnverifiedClient()
void	testNoScopeUnverifiedClientBadAudience()
void	testRequestedScope()
void	testRequestedScopeJWT()
void	testRequestedScopeJWTEncrypted()
void	testRequestedScopeJWTUnverifiedClient()
void	testRequestedScopeNoAudienceJWT()
void	testRequestedScopeUnverifiedClient()
void	testSaml()
void	testUntrustedClient()
void	testValidSecretJWTAuthn()
private AccessTokenClaimsSet	unwrapAccessToken(com.nimbusds.oauth2.sdk.AccessTokenResponse tokenResponse)
private void	verifyClaims(String type, com.nimbusds.oauth2.sdk.token.AccessToken token, String cid, com.nimbusds.oauth2.sdk.Scope s, Collection<String> audiences, String... customClaims)	Verify access token's claims.

Methods inherited from class net.shibboleth.idp.plugin.oidc.op.profile.flow.AbstractOidcClientAuthenticationFlowTest

buildPrivateKeyJwtAuth, buildPrivateKeyJwtAuth, buildSecretJwtAuth, buildSecretJwtAuth, buildSecretJwtAuth, claimsSetExpiredExp, claimsSetIssuedInTheFuture, claimsSetMissingAud, claimsSetMissingExp, claimsSetMissingIss, claimsSetMissingJti, claimsSetMissingSub, launchWithJwtAuthentication, populateClientAssertionParams, populateClientAssertionParams, setupRequestURI, testInvalidPrivateKeyESJWT_invalidSignerKey, testInvalidPrivateKeyESJWT_noTrustedKey, testInvalidPrivateKeyESJWT_wrongKey, testInvalidPrivateKeyJWT_expiredExp, testInvalidPrivateKeyJWT_issuedInTheFuture, testInvalidPrivateKeyJWT_missingAud, testInvalidPrivateKeyJWT_missingExp, testInvalidPrivateKeyJWT_missingIss, testInvalidPrivateKeyJWT_missingJti, testInvalidPrivateKeyJWT_missingSub, testInvalidPrivateKeyJWT_replayJti, testInvalidPrivateKeyJWTES256_algNotMatchingRegistered, testInvalidPrivateKeyJWTES384_algNotMatchingRegistered, testInvalidPrivateKeyJWTES512_algNotMatchingRegistered, testInvalidPrivateKeyJWTRS256_algNotMatchingRegistered, testInvalidPrivateKeyJWTRS384_algNotMatchingRegistered, testInvalidPrivateKeyJWTRS512_algNotMatchingRegistered, testInvalidPrivateKeyRSJWT_invalidSignerKey, testInvalidPrivateKeyRSJWT_noTrustedKey, testInvalidPrivateKeyRSJWT_wrongKey, testInvalidSecretJWT_expiredExp, testInvalidSecretJWT_invalidSecret, testInvalidSecretJWT_issuedInTheFuture, testInvalidSecretJWT_missingAud, testInvalidSecretJWT_missingExp, testInvalidSecretJWT_missingIss, testInvalidSecretJWT_missingJti, testInvalidSecretJWT_missingSub, testInvalidSecretJWT_replayJti, testInvalidSecretJWTHS256_algNotMatchingRegistered, testInvalidSecretJWTHS384_algNotMatchingRegistered, testInvalidSecretJWTHS512_algNotMatchingRegistered, testPlainJWT, testValidPrivateKeyJWTES256_ES256Registered, testValidPrivateKeyJWTES256_noRegisteredAlg, testValidPrivateKeyJWTES384_ES384Registered, testValidPrivateKeyJWTES384_noRegisteredAlg, testValidPrivateKeyJWTES512_ES512Registered, testValidPrivateKeyJWTES512_noRegisteredAlg, testValidPrivateKeyJWTRS256_noRegisteredAlg, testValidPrivateKeyJWTRS256_RS256Registered, testValidPrivateKeyJWTRS384_noRegisteredAlg, testValidPrivateKeyJWTRS384_RS384Registered, testValidPrivateKeyJWTRS512_noRegisteredAlg, testValidPrivateKeyJWTRS512_RS512Registered, testValidSecretJWTH384_noRegisteredAlg, testValidSecretJWTHS256_HS256Registered, testValidSecretJWTHS256_IssuerAudience, testValidSecretJWTHS256_noRegisteredAlg, testValidSecretJWTHS256_TokenEndpointAudience, testValidSecretJWTHS384_HS384Registered, testValidSecretJWTHS512_HS512Registered, testValidSecretJWTHS512_noRegisteredAlg, validClaimsSet, validClaimsSet

Methods inherited from class net.shibboleth.idp.plugin.oidc.op.profile.flow.AbstractOidcApiFlowTest

buildJWTToken, buildJWTToken, buildLegacyToken, buildLegacyToken, buildRefreshToken, buildRefreshToken

Methods inherited from class net.shibboleth.idp.plugin.oidc.op.profile.flow.AbstractOidcFlowTest

assertErrorCode, assertErrorDescriptionContains, buildJsonForLegacyToken, buildJWKSet, buildMetadataSkeleton, buildToken, buildToken, buildToken, createEncryptedJWT, createEncryptedJWT, createEncryptedJWT, createPrivateKeyJWT, createPrivateKeyJWT, createPrivateKeyJWT, createSecretJWT, createSecretJWT, generateNewKeyPair, generateNewKeyPair, getDataSealer, initializeECKey, initializeMocks, initializeThreadLocals, initKeys, loadCredential, loadEncryptionCredential, loadES384SigningCredential, loadES512SigningCredential, loadESSigningCredential, loadRSSigningCredential, parseErrorResponse, parseResponse, parseSuccessResponse, removeMetadata, setBasicAuth, setHttpFormRequest, setHttpFormRequest, setJsonRequest, setRequest, setRequest, storeConsent, storeMetadata, storeMetadata, storeMetadata, storeMetadata, storeMetadata, storeMetadata, storeMetadata, storeMetadata, storeMetadata, storeMetadata, storeMetadata, storeMetadataObject

Methods inherited from class net.shibboleth.idp.test.flows.AbstractFlowTest

assertFlowExecutionOutcome, assertFlowExecutionOutcome, assertFlowExecutionResult, assertProfileRequestContext, buildSOAP11Envelope, clearThreadLocals, getFlow, initializeFlowExecutor, initializeXMLObjectSupport, overrideEndStateOutput, overrideEndStateOutput, registerFlowsInParentRegistry, retrieveProfileRequestContext, setupDirectoryServer, teardownDirectoryServer

Methods inherited from class org.springframework.test.context.testng.AbstractTestNGSpringContextTests

run, setApplicationContext, springTestContextAfterTestClass, springTestContextAfterTestMethod, springTestContextBeforeTestClass, springTestContextBeforeTestMethod, springTestContextPrepareTestInstance

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Field Detail

FLOW_ID

public static final String FLOW_ID

See Also:

Constant Field Values

scope

private final com.nimbusds.oauth2.sdk.Scope scope

resource

private final String resource

See Also:

Constant Field Values

resourceSaml

private final String resourceSaml

See Also:

Constant Field Values

storageService

@Autowired
@Qualifier("shibboleth.StorageService")
StorageService storageService

Constructor Detail

ClientCredentialsTokenFlowTest

public ClientCredentialsTokenFlowTest()

Constructor.

Method Detail

tearDown

@AfterMethod
public void tearDown()
              throws IOException

Throws:

IOException

testUntrustedClient

public void testUntrustedClient()
                         throws IOException,
                                ParseException

Throws:

IOException

ParseException

testInvalidClientSecret

public void testInvalidClientSecret()
                             throws ParseException,
                                    IOException

Throws:

ParseException

IOException

testInvalidAudience

public void testInvalidAudience()
                         throws ParseException,
                                IOException

Throws:

ParseException

IOException

testNoScope

public void testNoScope()
                 throws Exception

Throws:

Exception

testNoScopeUnverifiedClient

public void testNoScopeUnverifiedClient()
                                 throws Exception

Throws:

Exception

testNoScopeUnverifiedClientBadAudience

public void testNoScopeUnverifiedClientBadAudience()
                                            throws Exception

Throws:

Exception

testRequestedScope

public void testRequestedScope()
                        throws Exception

Throws:

Exception

testRequestedScopeUnverifiedClient

public void testRequestedScopeUnverifiedClient()
                                        throws Exception

Throws:

Exception

testRequestedScopeNoAudienceJWT

public void testRequestedScopeNoAudienceJWT()
                                     throws Exception

Throws:

Exception

testRequestedScopeJWT

public void testRequestedScopeJWT()
                           throws Exception

Throws:

Exception

testRequestedScopeJWTUnverifiedClient

public void testRequestedScopeJWTUnverifiedClient()
                                           throws Exception

Throws:

Exception

testRequestedScopeJWTEncrypted

public void testRequestedScopeJWTEncrypted()
                                    throws Exception

Throws:

Exception

testInvalidSecretJWTAuthn

public void testInvalidSecretJWTAuthn()
                               throws Exception

Throws:

Exception

testValidSecretJWTAuthn

public void testValidSecretJWTAuthn()
                             throws Exception

Throws:

Exception

testSaml

public void testSaml()
              throws Exception

Throws:

Exception

unwrapAccessToken

private AccessTokenClaimsSet unwrapAccessToken(com.nimbusds.oauth2.sdk.AccessTokenResponse tokenResponse)

launchWithJwtAuthentication

protected FlowExecutionResult launchWithJwtAuthentication(com.nimbusds.oauth2.sdk.auth.JWTAuthentication authnMethod,
                                                          com.nimbusds.jose.JWSAlgorithm algorithm)
                                                   throws Exception

Throws:

Exception

launchWithJwtAuthentication

protected FlowExecutionResult launchWithJwtAuthentication(com.nimbusds.jwt.JWT jwt,
                                                          com.nimbusds.jose.JWSAlgorithm algorithm,
                                                          com.nimbusds.oauth2.sdk.auth.ClientAuthenticationMethod method,
                                                          PublicKey publicKey)
                                                   throws Exception

Description copied from class: AbstractOidcClientAuthenticationFlowTest

Launch the flow with the JWT client authentication method.

Specified by:

launchWithJwtAuthentication in class AbstractOidcClientAuthenticationFlowTest

Parameters:

jwt - The JWT to be used for client authentication.

algorithm - The algorithm to be used in the client authentication.

method - The client authentication method.

publicKey - The public key to store into the trusted metadata.

Returns:

The flow execution result.

Throws:

Exception

createRequestParameters

protected Map<String,String> createRequestParameters(String clientId,
                                                           com.nimbusds.oauth2.sdk.Scope s,
                                                           String r)

addNonNullValue

private void addNonNullValue(Map<String,String> map,
                             String key,
                             String value)

getErrorDetaisForJWTValidation

protected Pair<String,String> getErrorDetaisForJWTValidation()

Description copied from class: AbstractOidcClientAuthenticationFlowTest

Get the pair of error code and error description for the error produced via event EventIds.ACCESS_DENIED. This is abstract due to the fact that each endpoint may have its own mappings.

Specified by:

getErrorDetaisForJWTValidation in class AbstractOidcClientAuthenticationFlowTest

Returns:

The pair of error code and error description.

verifyClaims

private void verifyClaims(@Nullable
                          String type,
                          @Nonnull
                          com.nimbusds.oauth2.sdk.token.AccessToken token,
                          @Nonnull
                          String cid,
                          @Nonnull
                          com.nimbusds.oauth2.sdk.Scope s,
                          @Nonnull @NonnullElements
                          Collection<String> audiences,
                          @Nullable
                          String... customClaims)
                   throws ParseException,
                          DataSealerException,
                          com.nimbusds.jose.JOSEException

Verify access token's claims.

Parameters:

type - token type/format

token - access token

cid - client ID

s - scope to check for

audiences - audiences to check for

customClaims - custom claim names to check for

Throws:

DataSealerException

ParseException

com.nimbusds.jose.JOSEException

assertSuccessResponse

protected void assertSuccessResponse(FlowExecutionResult result)

Description copied from class: AbstractOidcClientAuthenticationFlowTest

Verify that the given result is a success response.

Specified by:

assertSuccessResponse in class AbstractOidcClientAuthenticationFlowTest

Parameters:

result - The flow execution result to be verified.